704504000x8080000000000000168145Systemar-win-dc.attackrange.localKrbSCMpowershell.exe -WindowStyle Hiddenestno' rofile -Command Write-Host 'This is a test'user mode servicedemand startLocalSystem 704504000x8080000000000000168102Systemar-win-dc.attackrange.localKrbSCMcmd.exeuser mode serviceauto startLocalSystem 704504000x8080000000000000168100Systemar-win-dc.attackrange.localKrbSCMC:\Temp\mockService.exeuser mode serviceauto startLocalSystem