154100x800000000000000013208447Microsoft-Windows-Sysmon/Operationalwin-host-mhaag-attack-range-979-2022-06-30 16:10:34.631{7CF983DC-CAFA-62BD-0D36-020000006202}5052C:\Windows\System32\cmd.exe10.0.14393.0 (rs1_release.160715-1616)Windows Command ProcessorMicrosoft® Windows® Operating SystemMicrosoft CorporationCmd.Execmd.exe /c whoamiC:\WindowsWIN-HOST-MHAAG-\Administrator{7CF983DC-EE99-62A8-FF22-070000000000}0x722ff2HighMD5=D752C96401E2540A443C599154FC6FA9,SHA256=046F7A1B4DE67562547ED9A180A72F481FC41E803DE49A96D7D7C731964D53A0{7CF983DC-CAFA-62BD-0C36-020000006202}292C:\Program Files\CrushFTP10\crushftpservice.execrushftpservice.exeWIN-HOST-MHAAG-\Administrator