1 5 4 1 0 0x8000000000000000 3230 Microsoft-Windows-Sysmon/Operational EC2AMAZ-J5R8T5M - 2024-05-16 16:00:18.061 AF7BBE47-2D92-6646-4405-00000000C702 1608 C:\Windows\System32\cmd.exe 10.0.17763.1697 (WinBuild.160101.0800) Windows Command Processor Microsoft® Windows® Operating System Microsoft Corporation Cmd.Exe C:\Windows\system32\cmd.exe /c start cmd.exe C:\Windows\system32\ NT AUTHORITY\SYSTEM AF7BBE47-2D2F-6646-E703-000000000000 0x3e7 2 System MD5=911D039E71583A07320B32BDE22F8E22,SHA256=BC866CFCDDA37E24DC2634DC282C7A0E6F55209DA17A8FA105B07414C0E7C527,IMPHASH=272245E2988E1E430500B852C4FB5E18 AF7BBE47-2D8C-6646-4305-00000000C702 788 C:\Windows\System32\consent.exe consent.exe 2792 288 0000016A8C9E1EF0 NT AUTHORITY\SYSTEM