4688201331200x80200000000000001414933Securityar-win.nas.domainNAS\AdministratorAdministratorNAS0xbae2c0x3e94C:\Program Files\Cisco\AMP\8.4.2.30317\sfc.exe%%19360x60csfc.exe -uNULL SID--0x0C:\Windows\System32\cmd.exeMandatory Label\High Mandatory Level 154100x800000000000000016073394Microsoft-Windows-Sysmon/Operationalar-win.nas.domain-2025-01-08 10:48:37.055{38b9f94a-5805-677e-86aa-000000003603}16020C:\Program Files\Cisco\AMP\8.4.2.30317\sfc.exe8, 4, 2, 30317Cisco Secure EndpointCisco Secure EndpointCisco Systems, Inc.sfc.exesfc.exe -uC:\Program Files\Cisco\AMP\8.4.2.30317\NAS\Administrator{38b9f94a-2501-6778-2cae-0b0000000000}0xbae2c2HighSHA1=6FE270541617EAECB4E3E4BA2D6AA34A222B18C7,MD5=7A68877B57365DE7A8D7939EA0A7077B,SHA256=BF5424561245A5A8DADF20B9E87BAA2EB440BE65CBA6D628F6C2A5E59E2632A7,IMPHASH=F54DD220C1AEDC672D8433446FCACC74{38b9f94a-2563-6778-4a01-000000003603}1548C:\Windows\System32\cmd.exe"C:\Windows\system32\cmd.exe" NAS\Administrator 4688201331200x80200000000000001415316Securityar-win.nas.domainNAS\AdministratorAdministratorNAS0xbae2c0x5a4C:\Program Files\Cisco\AMP\8.4.2.30317\sfc.exe%%19360x60csfc.exe -unblock 507e8666c239397561c58609f7ea569c9c49ddbb900cd260e7e42b02d03cfd87NULL SID--0x0C:\Windows\System32\cmd.exeMandatory Label\High Mandatory Level 154100x800000000000000016109716Microsoft-Windows-Sysmon/Operationalar-win.nas.domain-2025-01-08 11:07:21.542{38b9f94a-5c69-677e-02ab-000000003603}1444C:\Program Files\Cisco\AMP\8.4.2.30317\sfc.exe8, 4, 2, 30317Cisco Secure EndpointCisco Secure EndpointCisco Systems, Inc.sfc.exesfc.exe -unblock 507e8666c239397561c58609f7ea569c9c49ddbb900cd260e7e42b02d03cfd87C:\Program Files\Cisco\AMP\8.4.2.30317\NAS\Administrator{38b9f94a-2501-6778-2cae-0b0000000000}0xbae2c2HighSHA1=6FE270541617EAECB4E3E4BA2D6AA34A222B18C7,MD5=7A68877B57365DE7A8D7939EA0A7077B,SHA256=BF5424561245A5A8DADF20B9E87BAA2EB440BE65CBA6D628F6C2A5E59E2632A7,IMPHASH=F54DD220C1AEDC672D8433446FCACC74{38b9f94a-2563-6778-4a01-000000003603}1548C:\Windows\System32\cmd.exe"C:\Windows\system32\cmd.exe" NAS\Administrator 4688201331200x80200000000000001415423Securityar-win.nas.domainNAS\AdministratorAdministratorNAS0xbae2c0x4784C:\Program Files\Cisco\AMP\8.4.2.30317\sfc.exe%%19360x60csfc.exe -kNULL SID--0x0C:\Windows\System32\cmd.exeMandatory Label\High Mandatory Level 154100x800000000000000016127774Microsoft-Windows-Sysmon/Operationalar-win.nas.domain-2025-01-08 11:16:36.406{38b9f94a-5e94-677e-43ab-000000003603}18308C:\Program Files\Cisco\AMP\8.4.2.30317\sfc.exe8, 4, 2, 30317Cisco Secure EndpointCisco Secure EndpointCisco Systems, Inc.sfc.exesfc.exe -kC:\Program Files\Cisco\AMP\8.4.2.30317\NAS\Administrator{38b9f94a-2501-6778-2cae-0b0000000000}0xbae2c2HighSHA1=6FE270541617EAECB4E3E4BA2D6AA34A222B18C7,MD5=7A68877B57365DE7A8D7939EA0A7077B,SHA256=BF5424561245A5A8DADF20B9E87BAA2EB440BE65CBA6D628F6C2A5E59E2632A7,IMPHASH=F54DD220C1AEDC672D8433446FCACC74{38b9f94a-2563-6778-4a01-000000003603}1548C:\Windows\System32\cmd.exe"C:\Windows\system32\cmd.exe" NAS\Administrator 4688201331200x80200000000000001414930Securityar-win.nas.domainNAS\AdministratorAdministratorNAS0xbae2c0x4464C:\Program Files\Cisco\AMP\8.4.2.30317\sfc.exe%%19360x60csfc.exe -k qwqeNULL SID--0x0C:\Windows\System32\cmd.exeMandatory Label\High Mandatory Level 154100x800000000000000016072735Microsoft-Windows-Sysmon/Operationalar-win.nas.domain-2025-01-08 10:48:15.101{38b9f94a-57ef-677e-85aa-000000003603}17508C:\Program Files\Cisco\AMP\8.4.2.30317\sfc.exe8, 4, 2, 30317Cisco Secure EndpointCisco Secure EndpointCisco Systems, Inc.sfc.exesfc.exe -k qwqeC:\Program Files\Cisco\AMP\8.4.2.30317\NAS\Administrator{38b9f94a-2501-6778-2cae-0b0000000000}0xbae2c2HighSHA1=6FE270541617EAECB4E3E4BA2D6AA34A222B18C7,MD5=7A68877B57365DE7A8D7939EA0A7077B,SHA256=BF5424561245A5A8DADF20B9E87BAA2EB440BE65CBA6D628F6C2A5E59E2632A7,IMPHASH=F54DD220C1AEDC672D8433446FCACC74{38b9f94a-2563-6778-4a01-000000003603}1548C:\Windows\System32\cmd.exe"C:\Windows\system32\cmd.exe" NAS\Administrator 4688201331200x80200000000000001414913Securityar-win.nas.domainNAS\AdministratorAdministratorNAS0xbae2c0x4644C:\Program Files\Cisco\AMP\8.4.2.30317\sfc.exe%%19360x60csfc.exe -kNULL SID--0x0C:\Windows\System32\cmd.exeMandatory Label\High Mandatory Level 154100x800000000000000016070561Microsoft-Windows-Sysmon/Operationalar-win.nas.domain-2025-01-08 10:47:16.578{38b9f94a-57b4-677e-7baa-000000003603}17988C:\Program Files\Cisco\AMP\8.4.2.30317\sfc.exe8, 4, 2, 30317Cisco Secure EndpointCisco Secure EndpointCisco Systems, Inc.sfc.exesfc.exe -kC:\Program Files\Cisco\AMP\8.4.2.30317\NAS\Administrator{38b9f94a-2501-6778-2cae-0b0000000000}0xbae2c2HighSHA1=6FE270541617EAECB4E3E4BA2D6AA34A222B18C7,MD5=7A68877B57365DE7A8D7939EA0A7077B,SHA256=BF5424561245A5A8DADF20B9E87BAA2EB440BE65CBA6D628F6C2A5E59E2632A7,IMPHASH=F54DD220C1AEDC672D8433446FCACC74{38b9f94a-2563-6778-4a01-000000003603}1548C:\Windows\System32\cmd.exe"C:\Windows\system32\cmd.exe" NAS\Administrator