Windows_cmd

sc query | find /c /i "running"

explorer.exe

control desk.cpl,,0

taskmgr.exe

calc.exe

net user

net share

netstat -ano | more

eventvwr.msc

net accounts

secpol.msc

wmic process get caption, processid

wmic service where (state="running") get caption ,processid

wmic /namespace:\root\securitycenter2 path antivirusproduct get displayName,pathToSignedProductExe