11241100x8000000000000000535773Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:30:42.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a20d310153300d042021-12-21 11:30:42.193root 11241100x8000000000000000535774Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:30:42.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6c3ef391f4a672362021-12-21 11:30:42.193root 11241100x8000000000000000535775Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:30:42.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.97fdb6dce5cc41c12021-12-21 11:30:42.193root 11241100x8000000000000000535776Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:30:42.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.92c45c1546a9340d2021-12-21 11:30:42.193root 11241100x8000000000000000535777Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:30:42.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d2485e8a14595aaf2021-12-21 11:30:42.193root 11241100x8000000000000000535778Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:30:42.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5abac2523d6d84bb2021-12-21 11:30:42.193root 11241100x8000000000000000535779Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:30:42.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1a75b43448ba05402021-12-21 11:30:42.193root 11241100x8000000000000000535780Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:30:42.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.069369dccb4114152021-12-21 11:30:42.194root 11241100x8000000000000000535781Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:30:42.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.75e7aa08e02162de2021-12-21 11:30:42.194root 11241100x8000000000000000535782Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:30:42.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d481b413486408562021-12-21 11:30:42.194root 11241100x8000000000000000535783Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:30:42.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.98b793eeff16c3232021-12-21 11:30:42.194root 11241100x8000000000000000535784Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:30:42.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b5bc3d44e62219a62021-12-21 11:30:42.194root 11241100x8000000000000000535785Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:30:42.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.029f94edbf7c9a2b2021-12-21 11:30:42.194root 11241100x8000000000000000535786Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:30:42.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.475064335e9fa70a2021-12-21 11:30:42.194root 11241100x8000000000000000535787Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:30:42.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e568b01916cffa412021-12-21 11:30:42.194root 11241100x8000000000000000535788Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:30:42.692{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6506a510a91e26142021-12-21 11:30:42.692root 11241100x8000000000000000535789Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:30:42.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.83e5d42fa6af206d2021-12-21 11:30:42.693root 11241100x8000000000000000535790Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:30:42.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4a66be46db73859f2021-12-21 11:30:42.693root 11241100x8000000000000000535791Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:30:42.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.eb6cb9e42bdcd5492021-12-21 11:30:42.693root 11241100x8000000000000000535792Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:30:42.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.eb10744afeddb6462021-12-21 11:30:42.693root 11241100x8000000000000000535793Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:30:42.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7da4b7d76b6db5cc2021-12-21 11:30:42.693root 11241100x8000000000000000535794Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:30:42.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.38049f97a8988bfd2021-12-21 11:30:42.693root 11241100x8000000000000000535795Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:30:42.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c804c6c273e9de0c2021-12-21 11:30:42.693root 11241100x8000000000000000535796Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:30:42.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.704aaca675facf3a2021-12-21 11:30:42.693root 11241100x8000000000000000535797Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:30:42.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.34c6e730b5e637f62021-12-21 11:30:42.693root 11241100x8000000000000000535798Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:30:42.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7f0ce52ee6bfed442021-12-21 11:30:42.693root 11241100x8000000000000000535799Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:30:42.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b43cba078b2eeba12021-12-21 11:30:42.693root 11241100x8000000000000000535800Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:30:42.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.03830159951d79bd2021-12-21 11:30:42.693root 11241100x8000000000000000535801Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:30:42.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e6b40458d7b397ce2021-12-21 11:30:42.694root 11241100x8000000000000000535802Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:30:42.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2c112d5bcb877c2e2021-12-21 11:30:42.694root 354300x8000000000000000535803Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:30:43.100{ec2b6afe-95d9-61c1-5175-3a0400000000}5346/opt/splunkforwarder/etc/apps/Splunk_TA_stream/linux_x86_64/bin/streamfwdroottcptruefalse10.0.1.25-48644-false10.0.1.12-8000- 11241100x8000000000000000535804Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:30:43.100{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1cd993cd85a5d48a2021-12-21 11:30:43.100root 11241100x8000000000000000535805Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:30:43.100{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f508c8185a906d372021-12-21 11:30:43.100root 11241100x8000000000000000535806Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:30:43.100{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c929565aba4594872021-12-21 11:30:43.100root 11241100x8000000000000000535807Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:30:43.101{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4add36f1d0adf0a82021-12-21 11:30:43.101root 11241100x8000000000000000535808Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:30:43.101{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a1a15937f8a0ffca2021-12-21 11:30:43.101root 11241100x8000000000000000535809Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:30:43.101{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.06274b089d0b4e892021-12-21 11:30:43.101root 11241100x8000000000000000535810Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:30:43.101{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c84037dde90b89052021-12-21 11:30:43.101root 11241100x8000000000000000535811Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:30:43.101{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a77b10ff9101997f2021-12-21 11:30:43.101root 11241100x8000000000000000535812Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:30:43.101{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.956edbc050514d352021-12-21 11:30:43.101root 11241100x8000000000000000535813Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:30:43.101{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0abe18c6cd66f4ff2021-12-21 11:30:43.101root 11241100x8000000000000000535814Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:30:43.101{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0bd5e195f2eef4802021-12-21 11:30:43.101root 11241100x8000000000000000535815Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:30:43.101{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.eecc467ba6fc8e682021-12-21 11:30:43.101root 11241100x8000000000000000535816Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:30:43.101{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3c74ab01ba7154472021-12-21 11:30:43.101root 11241100x8000000000000000535817Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:30:43.101{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4cddc0c34b984dbc2021-12-21 11:30:43.101root 11241100x8000000000000000535818Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:30:43.101{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ce8ad8fdb6dc40282021-12-21 11:30:43.101root 11241100x8000000000000000535819Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:30:43.102{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b95572194ccfeb1f2021-12-21 11:30:43.102root 11241100x8000000000000000535820Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:30:43.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1fb0d0ed8b19a42f2021-12-21 11:30:43.443root 11241100x8000000000000000535821Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:30:43.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9938feec42d70c9c2021-12-21 11:30:43.443root 11241100x8000000000000000535822Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:30:43.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.612118a60263c6992021-12-21 11:30:43.443root 11241100x8000000000000000535823Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:30:43.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8fa7c090cd2217392021-12-21 11:30:43.443root 11241100x8000000000000000535824Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:30:43.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ceb231bd61b6c7602021-12-21 11:30:43.443root 11241100x8000000000000000535825Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:30:43.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.38a19d5881a804502021-12-21 11:30:43.443root 11241100x8000000000000000535826Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:30:43.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a74d0a0748a30a812021-12-21 11:30:43.443root 11241100x8000000000000000535827Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:30:43.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.536bccc7c8738bff2021-12-21 11:30:43.444root 11241100x8000000000000000535828Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:30:43.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6617a39175cc3d942021-12-21 11:30:43.444root 11241100x8000000000000000535829Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:30:43.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.cc030858335a6ece2021-12-21 11:30:43.444root 11241100x8000000000000000535830Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:30:43.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.54c5af6a3da8df0e2021-12-21 11:30:43.444root 11241100x8000000000000000535831Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:30:43.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b1478c4c5691bb402021-12-21 11:30:43.444root 11241100x8000000000000000535832Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:30:43.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7121e49320e75b002021-12-21 11:30:43.444root 11241100x8000000000000000535833Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:30:43.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4cbcb854188b18e02021-12-21 11:30:43.444root 11241100x8000000000000000535834Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:30:43.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7a54b43cedff009b2021-12-21 11:30:43.444root 11241100x8000000000000000535835Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:30:43.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e2d03ff522d3fe182021-12-21 11:30:43.444root 11241100x8000000000000000535836Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:30:43.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8ff939420735aa9a2021-12-21 11:30:43.943root 11241100x8000000000000000535837Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:30:43.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8459f60ec79779b82021-12-21 11:30:43.943root 11241100x8000000000000000535838Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:30:43.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a9addc8e588ee3982021-12-21 11:30:43.943root 11241100x8000000000000000535839Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:30:43.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1e8e8199e300b6462021-12-21 11:30:43.943root 11241100x8000000000000000535840Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:30:43.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.06bf64e49f8639c42021-12-21 11:30:43.943root 11241100x8000000000000000535841Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:30:43.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9ed80ba8248e570b2021-12-21 11:30:43.943root 11241100x8000000000000000535842Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:30:43.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2151100df4a5bcc42021-12-21 11:30:43.943root 11241100x8000000000000000535843Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:30:43.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.fdbbf0e57b1aea2c2021-12-21 11:30:43.943root 11241100x8000000000000000535844Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:30:43.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.22205c9ea5ed97e02021-12-21 11:30:43.943root 11241100x8000000000000000535845Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:30:43.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4cd7a80c18df47162021-12-21 11:30:43.943root 11241100x8000000000000000535846Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:30:43.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.15e52713d9d4d4262021-12-21 11:30:43.943root 11241100x8000000000000000535847Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:30:43.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3fd8752d72353b3d2021-12-21 11:30:43.943root 11241100x8000000000000000535848Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:30:43.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.04bbf2955ae3ee762021-12-21 11:30:43.943root 11241100x8000000000000000535849Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:30:43.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.28b807d8d97e90d82021-12-21 11:30:43.944root 11241100x8000000000000000535850Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:30:43.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c42c313c286317b42021-12-21 11:30:43.944root 11241100x8000000000000000535851Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:30:43.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9ce510e89c6754722021-12-21 11:30:43.944root 11241100x8000000000000000535852Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:30:44.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.19238af40220a8ad2021-12-21 11:30:44.443root 11241100x8000000000000000535853Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:30:44.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.70f6388095dd89452021-12-21 11:30:44.443root 11241100x8000000000000000535854Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:30:44.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.85ece56e8b1060752021-12-21 11:30:44.444root 11241100x8000000000000000535855Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:30:44.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1d467927ed99e4e92021-12-21 11:30:44.444root 11241100x8000000000000000535856Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:30:44.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b97102fa589a7dbb2021-12-21 11:30:44.444root 11241100x8000000000000000535857Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:30:44.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.59da4b110ba8e1782021-12-21 11:30:44.444root 11241100x8000000000000000535858Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:30:44.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.eec0a034a86303fd2021-12-21 11:30:44.444root 11241100x8000000000000000535859Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:30:44.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1ad3bc3fde9ccbd02021-12-21 11:30:44.444root 11241100x8000000000000000535860Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:30:44.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2c8f6214ba62fb6c2021-12-21 11:30:44.444root 11241100x8000000000000000535861Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:30:44.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b899ffc67e4ff1562021-12-21 11:30:44.444root 11241100x8000000000000000535862Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:30:44.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.85e1093665e5310f2021-12-21 11:30:44.445root 11241100x8000000000000000535863Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:30:44.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6ffb982d40f2e57d2021-12-21 11:30:44.445root 11241100x8000000000000000535864Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:30:44.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7176b7c1e441537e2021-12-21 11:30:44.445root 11241100x8000000000000000535865Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:30:44.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.123bd68ec61f3d6c2021-12-21 11:30:44.445root 11241100x8000000000000000535866Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:30:44.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.41574815fe145a942021-12-21 11:30:44.445root 11241100x8000000000000000535867Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:30:44.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3709185c3c8377622021-12-21 11:30:44.445root 11241100x8000000000000000535868Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:30:44.942{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3f970775ce4de2902021-12-21 11:30:44.942root 11241100x8000000000000000535869Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:30:44.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6fd2be26ebaf69792021-12-21 11:30:44.943root 11241100x8000000000000000535870Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:30:44.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d4d6186645fa94102021-12-21 11:30:44.943root 11241100x8000000000000000535871Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:30:44.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a4dde062219941a92021-12-21 11:30:44.943root 11241100x8000000000000000535872Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:30:44.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1e19ea25ad135aad2021-12-21 11:30:44.943root 11241100x8000000000000000535873Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:30:44.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9ab8ce0e9941e7f42021-12-21 11:30:44.943root 11241100x8000000000000000535874Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:30:44.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.361cc718b1fb2c892021-12-21 11:30:44.943root 11241100x8000000000000000535875Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:30:44.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.786915f332030d4c2021-12-21 11:30:44.943root 11241100x8000000000000000535876Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:30:44.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.14a030aea0fb88512021-12-21 11:30:44.943root 11241100x8000000000000000535877Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:30:44.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2be82f7173e008302021-12-21 11:30:44.943root 11241100x8000000000000000535878Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:30:44.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c4c8bb9f9618811d2021-12-21 11:30:44.943root 11241100x8000000000000000535879Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:30:44.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d10fc8088c3933cb2021-12-21 11:30:44.944root 11241100x8000000000000000535880Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:30:44.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.de84f8e2f04058fa2021-12-21 11:30:44.944root 11241100x8000000000000000535881Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:30:44.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7ba27a80fad7934c2021-12-21 11:30:44.944root 11241100x8000000000000000535882Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:30:44.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c616f5e85824172b2021-12-21 11:30:44.944root 11241100x8000000000000000535883Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:30:44.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.05ebbf8ade4477f72021-12-21 11:30:44.944root 11241100x8000000000000000535884Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:30:45.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a629fe7093b0eec92021-12-21 11:30:45.443root 11241100x8000000000000000535885Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:30:45.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.47a979c423b440792021-12-21 11:30:45.443root 11241100x8000000000000000535886Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:30:45.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5072a05ec608d36c2021-12-21 11:30:45.443root 11241100x8000000000000000535887Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:30:45.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6ae166297d9ef6612021-12-21 11:30:45.443root 11241100x8000000000000000535888Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:30:45.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2eab753555d3ab4c2021-12-21 11:30:45.443root 11241100x8000000000000000535889Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:30:45.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.59ea17c0998715f12021-12-21 11:30:45.443root 11241100x8000000000000000535890Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:30:45.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a79e628e5599c04f2021-12-21 11:30:45.443root 11241100x8000000000000000535891Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:30:45.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e39a6c696d8b585b2021-12-21 11:30:45.444root 11241100x8000000000000000535892Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:30:45.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0af58a386a2f70ce2021-12-21 11:30:45.444root 11241100x8000000000000000535893Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:30:45.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4540ea465eba72cb2021-12-21 11:30:45.444root 11241100x8000000000000000535894Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:30:45.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.589f23ba143159602021-12-21 11:30:45.444root 11241100x8000000000000000535895Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:30:45.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a081abfcf4bca72a2021-12-21 11:30:45.444root 11241100x8000000000000000535896Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:30:45.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.01a287aed2c804942021-12-21 11:30:45.444root 11241100x8000000000000000535897Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:30:45.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1531614a7454b0b12021-12-21 11:30:45.444root 11241100x8000000000000000535898Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:30:45.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.269661e6b8518bb22021-12-21 11:30:45.444root 11241100x8000000000000000535899Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:30:45.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.cf7a1635711007342021-12-21 11:30:45.444root 11241100x8000000000000000535900Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:30:45.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8f041873f5d850942021-12-21 11:30:45.943root 11241100x8000000000000000535901Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:30:45.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.aaec047ac4eec9a82021-12-21 11:30:45.943root 11241100x8000000000000000535902Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:30:45.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f63512f75574658a2021-12-21 11:30:45.943root 11241100x8000000000000000535903Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:30:45.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.020f4b0e76c323fd2021-12-21 11:30:45.943root 11241100x8000000000000000535904Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:30:45.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.69905534631c4c052021-12-21 11:30:45.943root 11241100x8000000000000000535905Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:30:45.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3b2af966883415742021-12-21 11:30:45.943root 11241100x8000000000000000535906Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:30:45.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c0040e3902bfa7002021-12-21 11:30:45.944root 11241100x8000000000000000535907Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:30:45.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.71808b3540bad7a32021-12-21 11:30:45.944root 11241100x8000000000000000535908Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:30:45.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b18ca03396cf6aa52021-12-21 11:30:45.944root 11241100x8000000000000000535909Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:30:45.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.14353cb0f5f83c202021-12-21 11:30:45.944root 11241100x8000000000000000535910Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:30:45.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b0d290a5f99d96c52021-12-21 11:30:45.944root 11241100x8000000000000000535911Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:30:45.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d816ffb40b29690e2021-12-21 11:30:45.944root 11241100x8000000000000000535912Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:30:45.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0cbd177ab46bcf9e2021-12-21 11:30:45.944root 11241100x8000000000000000535913Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:30:45.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9de7a185f9f71d212021-12-21 11:30:45.944root 11241100x8000000000000000535914Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:30:45.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e5bfebcc51eba8ca2021-12-21 11:30:45.944root 11241100x8000000000000000535915Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:30:45.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a8b4b5dba041cdef2021-12-21 11:30:45.944root 11241100x8000000000000000535916Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:30:46.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.91c9cdae84c42be32021-12-21 11:30:46.443root 11241100x8000000000000000535917Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:30:46.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3c54da7df4c7cb082021-12-21 11:30:46.443root 11241100x8000000000000000535918Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:30:46.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.910be03e6351ecf32021-12-21 11:30:46.443root 11241100x8000000000000000535919Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:30:46.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c72e30d31e38ce762021-12-21 11:30:46.443root 11241100x8000000000000000535920Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:30:46.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.838069dbdaeecd7c2021-12-21 11:30:46.443root 11241100x8000000000000000535921Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:30:46.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.12f9ebd5cc4802ba2021-12-21 11:30:46.443root 11241100x8000000000000000535922Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:30:46.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.de691b8a6579df5c2021-12-21 11:30:46.444root 11241100x8000000000000000535923Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:30:46.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b928412ed3d8cdb82021-12-21 11:30:46.444root 11241100x8000000000000000535924Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:30:46.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d41a26f09b3db4472021-12-21 11:30:46.444root 11241100x8000000000000000535925Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:30:46.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.dfd0560dd50519c52021-12-21 11:30:46.444root 11241100x8000000000000000535926Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:30:46.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a0cfefd505a46d192021-12-21 11:30:46.444root 11241100x8000000000000000535927Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:30:46.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5f34374f7f5d47952021-12-21 11:30:46.444root 11241100x8000000000000000535928Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:30:46.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.cd71090f3775589a2021-12-21 11:30:46.444root 11241100x8000000000000000535929Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:30:46.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d24519dfdf52e7922021-12-21 11:30:46.444root 11241100x8000000000000000535930Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:30:46.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.61ea15ad95ebebff2021-12-21 11:30:46.444root 11241100x8000000000000000535931Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:30:46.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6d89f66d86db1fd32021-12-21 11:30:46.444root 11241100x8000000000000000535932Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:30:46.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.28dd6dc63694b0bb2021-12-21 11:30:46.943root 11241100x8000000000000000535933Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:30:46.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4b5ea9c4a36ddf842021-12-21 11:30:46.943root 11241100x8000000000000000535934Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:30:46.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.366f17b544572a222021-12-21 11:30:46.943root 11241100x8000000000000000535935Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:30:46.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8c316a6ab067257c2021-12-21 11:30:46.943root 11241100x8000000000000000535936Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:30:46.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.58cf7f28f917e8132021-12-21 11:30:46.943root 11241100x8000000000000000535937Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:30:46.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6175a7bc06730e9b2021-12-21 11:30:46.943root 11241100x8000000000000000535938Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:30:46.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4bdc3765535ef0b52021-12-21 11:30:46.944root 11241100x8000000000000000535939Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:30:46.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1e263635e0ff01792021-12-21 11:30:46.944root 11241100x8000000000000000535940Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:30:46.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f80b735d588071002021-12-21 11:30:46.944root 11241100x8000000000000000535941Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:30:46.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ae13378c91ff49662021-12-21 11:30:46.944root 11241100x8000000000000000535942Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:30:46.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.cdd6fa55d74bd3862021-12-21 11:30:46.944root 11241100x8000000000000000535943Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:30:46.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1b8279a0fdfd56d32021-12-21 11:30:46.944root 11241100x8000000000000000535944Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:30:46.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.bcf97c95a1f1d8992021-12-21 11:30:46.944root 11241100x8000000000000000535945Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:30:46.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a1ca512923d9d9ef2021-12-21 11:30:46.944root 11241100x8000000000000000535946Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:30:46.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4dfb11729f83705a2021-12-21 11:30:46.944root 11241100x8000000000000000535947Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:30:46.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a108f99a1483d7492021-12-21 11:30:46.944root 11241100x8000000000000000535948Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:30:47.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.428b1b152a1e43fb2021-12-21 11:30:47.443root 11241100x8000000000000000535949Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:30:47.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d99e4b6ceb7f573f2021-12-21 11:30:47.443root 11241100x8000000000000000535950Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:30:47.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.61567370540fa0122021-12-21 11:30:47.443root 11241100x8000000000000000535951Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:30:47.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.619038db35f9eefc2021-12-21 11:30:47.443root 11241100x8000000000000000535952Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:30:47.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.380e87906bc76f3b2021-12-21 11:30:47.443root 11241100x8000000000000000535953Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:30:47.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.28490d0a5b37b3472021-12-21 11:30:47.443root 11241100x8000000000000000535954Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:30:47.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d77ce0625e58f2b32021-12-21 11:30:47.444root 11241100x8000000000000000535955Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:30:47.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5be8fcc77f2060072021-12-21 11:30:47.444root 11241100x8000000000000000535956Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:30:47.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.572242e84d4edac92021-12-21 11:30:47.444root 11241100x8000000000000000535957Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:30:47.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d547e26cc1a6b27b2021-12-21 11:30:47.444root 11241100x8000000000000000535958Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:30:47.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8619911341eb10662021-12-21 11:30:47.444root 11241100x8000000000000000535959Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:30:47.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a17ffe0fb87e8a3d2021-12-21 11:30:47.444root 11241100x8000000000000000535960Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:30:47.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5c80c0f18cbbac752021-12-21 11:30:47.444root 11241100x8000000000000000535961Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:30:47.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.27240c2bb6968b992021-12-21 11:30:47.444root 11241100x8000000000000000535962Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:30:47.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.eb1ebac1d399e96c2021-12-21 11:30:47.444root 11241100x8000000000000000535963Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:30:47.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3451a2c738b3f66c2021-12-21 11:30:47.444root 11241100x8000000000000000535964Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:30:47.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b1eada5b6a96693c2021-12-21 11:30:47.944root 11241100x8000000000000000535965Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:30:47.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0082d05d0a1fdc262021-12-21 11:30:47.944root 11241100x8000000000000000535966Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:30:47.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9d353fa8033078522021-12-21 11:30:47.944root 11241100x8000000000000000535967Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:30:47.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.cfa7af6359e40f652021-12-21 11:30:47.944root 11241100x8000000000000000535968Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:30:47.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ddf422e890e756f62021-12-21 11:30:47.944root 11241100x8000000000000000535969Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:30:47.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1a36e247fa4cae0a2021-12-21 11:30:47.944root 11241100x8000000000000000535970Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:30:47.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.dbe84fcfd44a00852021-12-21 11:30:47.944root 11241100x8000000000000000535971Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:30:47.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.49426202e7da719f2021-12-21 11:30:47.944root 11241100x8000000000000000535972Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:30:47.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b35fa8d4034e99db2021-12-21 11:30:47.944root 11241100x8000000000000000535973Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:30:47.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.724592c659e4e8162021-12-21 11:30:47.945root 11241100x8000000000000000535974Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:30:47.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2460dff2234fd01c2021-12-21 11:30:47.945root 11241100x8000000000000000535975Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:30:47.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c633db05125dcdbf2021-12-21 11:30:47.945root 11241100x8000000000000000535976Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:30:47.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d7506110c8be4b3b2021-12-21 11:30:47.945root 11241100x8000000000000000535977Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:30:47.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b97ee550fb66a39f2021-12-21 11:30:47.945root 11241100x8000000000000000535978Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:30:47.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9e65b6e656dcccd52021-12-21 11:30:47.945root 11241100x8000000000000000535979Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:30:47.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.88bb0874c66686ab2021-12-21 11:30:47.945root 11241100x8000000000000000535980Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:30:48.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.869d676e42e15f592021-12-21 11:30:48.443root 11241100x8000000000000000535981Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:30:48.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9a1db8e398085edb2021-12-21 11:30:48.443root 11241100x8000000000000000535982Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:30:48.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f7edd6e0e88693462021-12-21 11:30:48.443root 11241100x8000000000000000535983Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:30:48.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.93fde869a77c7d5b2021-12-21 11:30:48.443root 11241100x8000000000000000535984Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:30:48.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ff8fe96d0bc3b3b42021-12-21 11:30:48.443root 11241100x8000000000000000535985Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:30:48.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4ea8ed4465e8b06e2021-12-21 11:30:48.444root 11241100x8000000000000000535986Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:30:48.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.46926696ed2e4b692021-12-21 11:30:48.444root 11241100x8000000000000000535987Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:30:48.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.80b64bb0c10432f92021-12-21 11:30:48.444root 11241100x8000000000000000535988Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:30:48.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.317d425ab7ba7f622021-12-21 11:30:48.444root 11241100x8000000000000000535989Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:30:48.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7bb29df325aac1e52021-12-21 11:30:48.444root 11241100x8000000000000000535990Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:30:48.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a396d09a2750eef12021-12-21 11:30:48.444root 11241100x8000000000000000535991Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:30:48.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.79a4b39b458f7df62021-12-21 11:30:48.444root 11241100x8000000000000000535992Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:30:48.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8ad86b536a5386392021-12-21 11:30:48.444root 11241100x8000000000000000535993Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:30:48.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.bb66bc757147ff6a2021-12-21 11:30:48.444root 11241100x8000000000000000535994Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:30:48.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8d19229fb4d7adb42021-12-21 11:30:48.444root 11241100x8000000000000000535995Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:30:48.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5975e0e913a933a72021-12-21 11:30:48.444root 11241100x8000000000000000535996Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:30:48.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9621fd6d0ed160b92021-12-21 11:30:48.943root 11241100x8000000000000000535997Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:30:48.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c9f526150fdb6d7d2021-12-21 11:30:48.943root 11241100x8000000000000000535998Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:30:48.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.509c745219971cf12021-12-21 11:30:48.943root 11241100x8000000000000000535999Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:30:48.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f8dca9762c8878612021-12-21 11:30:48.943root 11241100x8000000000000000536000Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:30:48.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a35063ffeba12d832021-12-21 11:30:48.943root 11241100x8000000000000000536001Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:30:48.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b9aea8f9bd087ca12021-12-21 11:30:48.943root 11241100x8000000000000000536002Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:30:48.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.08645d500b4b85ec2021-12-21 11:30:48.944root 11241100x8000000000000000536003Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:30:48.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.24e72d1f4cc9b3012021-12-21 11:30:48.944root 11241100x8000000000000000536004Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:30:48.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e9ca1b49b9b6f1b92021-12-21 11:30:48.944root 11241100x8000000000000000536005Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:30:48.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7be73a56f0a067642021-12-21 11:30:48.944root 11241100x8000000000000000536006Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:30:48.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9d0c2d5a11bf5c152021-12-21 11:30:48.944root 11241100x8000000000000000536007Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:30:48.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.20c342f952c9bee52021-12-21 11:30:48.944root 11241100x8000000000000000536008Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:30:48.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6eca7a0f81fc8ac32021-12-21 11:30:48.944root 11241100x8000000000000000536009Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:30:48.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d684727cd640752c2021-12-21 11:30:48.944root 11241100x8000000000000000536010Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:30:48.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3006dd528187adeb2021-12-21 11:30:48.944root 11241100x8000000000000000536011Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:30:48.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.099d6767ec28517a2021-12-21 11:30:48.944root 354300x8000000000000000536012Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:30:49.014{ec2b6afe-95d9-61c1-5175-3a0400000000}5346/opt/splunkforwarder/etc/apps/Splunk_TA_stream/linux_x86_64/bin/streamfwdroottcptruefalse10.0.1.25-48646-false10.0.1.12-8000- 11241100x8000000000000000536013Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:30:49.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b64d38a2d09c7cf02021-12-21 11:30:49.443root 11241100x8000000000000000536014Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:30:49.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4fbcbc7de6b42b6e2021-12-21 11:30:49.443root 11241100x8000000000000000536015Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:30:49.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c4b461e3481cbae22021-12-21 11:30:49.443root 11241100x8000000000000000536016Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:30:49.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a780f6960748e50e2021-12-21 11:30:49.443root 11241100x8000000000000000536017Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:30:49.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4023444288a151632021-12-21 11:30:49.443root 11241100x8000000000000000536018Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:30:49.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.04da81619ebe04e32021-12-21 11:30:49.444root 11241100x8000000000000000536019Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:30:49.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.81bc7de2d88970732021-12-21 11:30:49.444root 11241100x8000000000000000536020Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:30:49.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.bb4f0dd99200201e2021-12-21 11:30:49.444root 11241100x8000000000000000536021Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:30:49.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a3299b156c85250a2021-12-21 11:30:49.444root 11241100x8000000000000000536022Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:30:49.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.272e2963547b05ee2021-12-21 11:30:49.444root 11241100x8000000000000000536023Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:30:49.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b6d941880acf3e142021-12-21 11:30:49.444root 11241100x8000000000000000536024Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:30:49.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2910a0f983a3565a2021-12-21 11:30:49.444root 11241100x8000000000000000536025Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:30:49.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.40ff1bf88b08aa612021-12-21 11:30:49.444root 11241100x8000000000000000536026Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:30:49.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c81d898ae2afde392021-12-21 11:30:49.444root 11241100x8000000000000000536027Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:30:49.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6d2fff18729c9beb2021-12-21 11:30:49.444root 11241100x8000000000000000536028Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:30:49.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0ff7d5516b6c69632021-12-21 11:30:49.444root 11241100x8000000000000000536029Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:30:49.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8ef14fc76762df462021-12-21 11:30:49.444root 11241100x8000000000000000536030Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:30:49.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.da8e6845695475c72021-12-21 11:30:49.943root 11241100x8000000000000000536031Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:30:49.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.395380622cd7a4a32021-12-21 11:30:49.943root 11241100x8000000000000000536032Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:30:49.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.502239a45f62b2d82021-12-21 11:30:49.943root 11241100x8000000000000000536033Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:30:49.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1cdcbe0f61bd78b52021-12-21 11:30:49.943root 11241100x8000000000000000536034Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:30:49.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.42d9b04a98be4f7c2021-12-21 11:30:49.943root 11241100x8000000000000000536035Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:30:49.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.52ea93dae814b2ec2021-12-21 11:30:49.944root 11241100x8000000000000000536036Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:30:49.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4765679aac8410502021-12-21 11:30:49.944root 11241100x8000000000000000536037Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:30:49.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.62a36fc663b7da092021-12-21 11:30:49.944root 11241100x8000000000000000536038Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:30:49.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7f15f7576f0b8dff2021-12-21 11:30:49.944root 11241100x8000000000000000536039Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:30:49.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a008a1cbd27b6cf32021-12-21 11:30:49.944root 11241100x8000000000000000536040Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:30:49.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3710d6b9742561242021-12-21 11:30:49.944root 11241100x8000000000000000536041Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:30:49.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8523bb3fa27c8d5d2021-12-21 11:30:49.944root 11241100x8000000000000000536042Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:30:49.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ef070c072c1d14172021-12-21 11:30:49.944root 11241100x8000000000000000536043Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:30:49.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0d12d227da4e97402021-12-21 11:30:49.944root 11241100x8000000000000000536044Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:30:49.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.70d97566fafee0402021-12-21 11:30:49.944root 11241100x8000000000000000536045Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:30:49.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8bede1550851c5212021-12-21 11:30:49.944root 11241100x8000000000000000536046Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:30:49.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.29cba7396038152b2021-12-21 11:30:49.944root 11241100x8000000000000000536047Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:30:50.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e6480353b2776ebc2021-12-21 11:30:50.443root 11241100x8000000000000000536048Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:30:50.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c5a4f6a96726fcec2021-12-21 11:30:50.443root 11241100x8000000000000000536049Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:30:50.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.dedd17086ce546612021-12-21 11:30:50.443root 11241100x8000000000000000536050Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:30:50.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.da2cc925397161bf2021-12-21 11:30:50.443root 11241100x8000000000000000536051Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:30:50.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.fe71afa7f475ce642021-12-21 11:30:50.444root 11241100x8000000000000000536052Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:30:50.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5544776db698e26b2021-12-21 11:30:50.444root 11241100x8000000000000000536053Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:30:50.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.00c90856125f578e2021-12-21 11:30:50.444root 11241100x8000000000000000536054Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:30:50.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.50f44f28755a21d32021-12-21 11:30:50.444root 11241100x8000000000000000536055Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:30:50.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ab50905c82867c122021-12-21 11:30:50.444root 11241100x8000000000000000536056Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:30:50.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e7ff764af9e8c99a2021-12-21 11:30:50.444root 11241100x8000000000000000536057Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:30:50.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d6cb6efeb28926372021-12-21 11:30:50.444root 11241100x8000000000000000536058Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:30:50.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.47a8d4d4865ed1e82021-12-21 11:30:50.444root 11241100x8000000000000000536059Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:30:50.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.bbbbaf48ab68f32d2021-12-21 11:30:50.444root 11241100x8000000000000000536060Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:30:50.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0d112347b17235162021-12-21 11:30:50.444root 11241100x8000000000000000536061Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:30:50.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2cd33e882356ed592021-12-21 11:30:50.444root 11241100x8000000000000000536062Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:30:50.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5752fc81dd4b62252021-12-21 11:30:50.445root 11241100x8000000000000000536063Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:30:50.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4b03e4ca01b8eefe2021-12-21 11:30:50.445root 11241100x8000000000000000536064Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:30:50.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.14a21bb86c81f69f2021-12-21 11:30:50.943root 11241100x8000000000000000536065Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:30:50.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c555cd7a467adc7e2021-12-21 11:30:50.943root 11241100x8000000000000000536066Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:30:50.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c262c863357fd5c62021-12-21 11:30:50.943root 11241100x8000000000000000536067Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:30:50.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a009de2639b355172021-12-21 11:30:50.943root 11241100x8000000000000000536068Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:30:50.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.08ec3ca7c9b04dc02021-12-21 11:30:50.944root 11241100x8000000000000000536069Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:30:50.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b88c97a59fab16a22021-12-21 11:30:50.944root 11241100x8000000000000000536070Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:30:50.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.38794693b10f71a92021-12-21 11:30:50.944root 11241100x8000000000000000536071Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:30:50.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.427d1b5becce5b492021-12-21 11:30:50.944root 11241100x8000000000000000536072Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:30:50.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.fd437a744679517e2021-12-21 11:30:50.944root 11241100x8000000000000000536073Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:30:50.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d3cd7903ed7189a72021-12-21 11:30:50.944root 11241100x8000000000000000536074Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:30:50.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7414227575b202642021-12-21 11:30:50.944root 11241100x8000000000000000536075Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:30:50.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d1f469645b2624a82021-12-21 11:30:50.944root 11241100x8000000000000000536076Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:30:50.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3c909d1421e484ec2021-12-21 11:30:50.944root 11241100x8000000000000000536077Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:30:50.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.53f9ce48bd056a432021-12-21 11:30:50.944root 11241100x8000000000000000536078Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:30:50.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1cdbb42831be49792021-12-21 11:30:50.944root 11241100x8000000000000000536079Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:30:50.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6086231d8177eb3d2021-12-21 11:30:50.944root 11241100x8000000000000000536080Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:30:50.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.14af8eb4b272d7d72021-12-21 11:30:50.944root 11241100x8000000000000000536081Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:30:51.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.af5a9ac7a55ab0c72021-12-21 11:30:51.443root 11241100x8000000000000000536082Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:30:51.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d3905e7efcc2ef782021-12-21 11:30:51.443root 11241100x8000000000000000536083Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:30:51.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c212008c7d84ca542021-12-21 11:30:51.443root 11241100x8000000000000000536084Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:30:51.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5915925b0b1be3882021-12-21 11:30:51.443root 11241100x8000000000000000536085Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:30:51.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f6e26c6294cefc912021-12-21 11:30:51.444root 11241100x8000000000000000536086Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:30:51.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ef1befb29ab9b54f2021-12-21 11:30:51.444root 11241100x8000000000000000536087Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:30:51.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.587a6c99343694182021-12-21 11:30:51.444root 11241100x8000000000000000536088Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:30:51.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.704f8bf11538ed2d2021-12-21 11:30:51.444root 11241100x8000000000000000536089Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:30:51.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8dd6415446a37b302021-12-21 11:30:51.444root 11241100x8000000000000000536090Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:30:51.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.312111e93bdefcde2021-12-21 11:30:51.444root 11241100x8000000000000000536091Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:30:51.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5089904c1da3bc5d2021-12-21 11:30:51.444root 11241100x8000000000000000536092Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:30:51.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f425fc0a556300e92021-12-21 11:30:51.444root 11241100x8000000000000000536093Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:30:51.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.78543ec57fcad57a2021-12-21 11:30:51.444root 11241100x8000000000000000536094Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:30:51.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.30b5d2c30ec919d82021-12-21 11:30:51.444root 11241100x8000000000000000536095Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:30:51.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b73169544d8cbd0d2021-12-21 11:30:51.444root 11241100x8000000000000000536096Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:30:51.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c163347e51a857992021-12-21 11:30:51.445root 11241100x8000000000000000536097Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:30:51.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e2aa4cccb7fb037c2021-12-21 11:30:51.445root 11241100x8000000000000000536098Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:30:51.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8fd2907cfd7f37b02021-12-21 11:30:51.943root 11241100x8000000000000000536099Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:30:51.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c5ef964d75bc7fdc2021-12-21 11:30:51.943root 11241100x8000000000000000536100Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:30:51.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.61ecf55b264fa6bc2021-12-21 11:30:51.943root 11241100x8000000000000000536101Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:30:51.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b2a0af390355d60c2021-12-21 11:30:51.943root 11241100x8000000000000000536102Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:30:51.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2abd66b867fb082d2021-12-21 11:30:51.943root 11241100x8000000000000000536103Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:30:51.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.65567ddb0fe2443d2021-12-21 11:30:51.944root 11241100x8000000000000000536104Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:30:51.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.05867b820302086a2021-12-21 11:30:51.944root 11241100x8000000000000000536105Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:30:51.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.13c06dc00ef60d1b2021-12-21 11:30:51.944root 11241100x8000000000000000536106Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:30:51.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b6b469df0ab3f3022021-12-21 11:30:51.944root 11241100x8000000000000000536107Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:30:51.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7cf22aca28ead6622021-12-21 11:30:51.944root 11241100x8000000000000000536108Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:30:51.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1782d5fe38ab9fd42021-12-21 11:30:51.944root 11241100x8000000000000000536109Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:30:51.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7ed7a3089add310a2021-12-21 11:30:51.944root 11241100x8000000000000000536110Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:30:51.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.24fff2c4744622b62021-12-21 11:30:51.944root 11241100x8000000000000000536111Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:30:51.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4a6f5cc5adc2dadd2021-12-21 11:30:51.944root 11241100x8000000000000000536112Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:30:51.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ae2d6fd52ae0a7692021-12-21 11:30:51.944root 11241100x8000000000000000536113Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:30:51.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.14e7dbf7f7e847722021-12-21 11:30:51.944root 11241100x8000000000000000536114Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:30:51.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b8e8c4d94124b2412021-12-21 11:30:51.944root 11241100x8000000000000000536115Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:30:52.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c267927ae673ac192021-12-21 11:30:52.443root 11241100x8000000000000000536116Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:30:52.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.01843d113c2c20642021-12-21 11:30:52.443root 11241100x8000000000000000536117Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:30:52.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b1b6425953ded1f02021-12-21 11:30:52.443root 11241100x8000000000000000536118Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:30:52.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.83c235b6b7689f8e2021-12-21 11:30:52.443root 11241100x8000000000000000536119Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:30:52.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5114e9239d6da84e2021-12-21 11:30:52.443root 11241100x8000000000000000536120Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:30:52.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0e32370648bca48b2021-12-21 11:30:52.443root 11241100x8000000000000000536121Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:30:52.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2ad2a7c0aacf89aa2021-12-21 11:30:52.444root 11241100x8000000000000000536122Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:30:52.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.af07a7784283df302021-12-21 11:30:52.444root 11241100x8000000000000000536123Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:30:52.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5a124982d121edb02021-12-21 11:30:52.444root 11241100x8000000000000000536124Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:30:52.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1b5ad19e6b2df6902021-12-21 11:30:52.444root 11241100x8000000000000000536125Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:30:52.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e7edf3e17ad8579f2021-12-21 11:30:52.444root 11241100x8000000000000000536126Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:30:52.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.dbf0a3f79e8f91052021-12-21 11:30:52.444root 11241100x8000000000000000536127Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:30:52.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.581ae821ecdc522d2021-12-21 11:30:52.444root 11241100x8000000000000000536128Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:30:52.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e1655a4fe8f199112021-12-21 11:30:52.444root 11241100x8000000000000000536129Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:30:52.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a1f19370571807d92021-12-21 11:30:52.444root 11241100x8000000000000000536130Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:30:52.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c5736bfdba9271d22021-12-21 11:30:52.444root 11241100x8000000000000000536131Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:30:52.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d168b3e8da44c56b2021-12-21 11:30:52.444root 11241100x8000000000000000536132Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:30:52.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.55a4e5780159b2e32021-12-21 11:30:52.943root 11241100x8000000000000000536133Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:30:52.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9301d51071d31a752021-12-21 11:30:52.943root 11241100x8000000000000000536134Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:30:52.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c52d445e804926432021-12-21 11:30:52.943root 11241100x8000000000000000536135Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:30:52.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.50a9b5cd53f51fb52021-12-21 11:30:52.943root 11241100x8000000000000000536136Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:30:52.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c029b56d87b031682021-12-21 11:30:52.944root 11241100x8000000000000000536137Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:30:52.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e89bd4da89ab9ffb2021-12-21 11:30:52.944root 11241100x8000000000000000536138Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:30:52.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.dbdcbd59fbfa7da82021-12-21 11:30:52.944root 11241100x8000000000000000536139Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:30:52.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.315728c0773ffbcb2021-12-21 11:30:52.944root 11241100x8000000000000000536140Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:30:52.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7ecf708882660a742021-12-21 11:30:52.944root 11241100x8000000000000000536141Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:30:52.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d148451eace50e7c2021-12-21 11:30:52.944root 11241100x8000000000000000536142Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:30:52.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0459b19159768d592021-12-21 11:30:52.944root 11241100x8000000000000000536143Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:30:52.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.bfd96ad4c6bde8332021-12-21 11:30:52.944root 11241100x8000000000000000536144Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:30:52.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.75b94d39bb828d792021-12-21 11:30:52.944root 11241100x8000000000000000536145Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:30:52.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.dfb259f6a0a2ed8b2021-12-21 11:30:52.944root 11241100x8000000000000000536146Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:30:52.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ae6b17007e17e5282021-12-21 11:30:52.944root 11241100x8000000000000000536147Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:30:52.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.010485996e69fa722021-12-21 11:30:52.944root 11241100x8000000000000000536148Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:30:52.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0f76730dccb1d1b22021-12-21 11:30:52.944root 11241100x8000000000000000536149Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:30:53.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e8daa30c40af94f62021-12-21 11:30:53.443root 11241100x8000000000000000536150Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:30:53.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b8e915cc7b13dfa92021-12-21 11:30:53.443root 11241100x8000000000000000536151Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:30:53.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ddbb3834a1b548072021-12-21 11:30:53.443root 11241100x8000000000000000536152Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:30:53.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d5493c3f51f7b56c2021-12-21 11:30:53.443root 11241100x8000000000000000536153Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:30:53.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.399bbc23722a7b402021-12-21 11:30:53.443root 11241100x8000000000000000536154Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:30:53.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e70866804f6602402021-12-21 11:30:53.443root 11241100x8000000000000000536155Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:30:53.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d6059d4abd0a483c2021-12-21 11:30:53.444root 11241100x8000000000000000536156Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:30:53.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4e67f08faf14152b2021-12-21 11:30:53.444root 11241100x8000000000000000536157Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:30:53.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.90100ba286a83efb2021-12-21 11:30:53.444root 11241100x8000000000000000536158Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:30:53.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c71cc037cf98cde42021-12-21 11:30:53.444root 11241100x8000000000000000536159Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:30:53.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f3b0fea271d13fa42021-12-21 11:30:53.444root 11241100x8000000000000000536160Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:30:53.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.15172a41500b14922021-12-21 11:30:53.444root 11241100x8000000000000000536161Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:30:53.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1244269f74e4b3fe2021-12-21 11:30:53.444root 11241100x8000000000000000536162Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:30:53.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0d09df4f2fa1c0172021-12-21 11:30:53.444root 11241100x8000000000000000536163Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:30:53.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0f523f800a875e862021-12-21 11:30:53.444root 11241100x8000000000000000536164Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:30:53.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.704d827827ce05852021-12-21 11:30:53.444root 11241100x8000000000000000536165Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:30:53.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8595f47ac77783922021-12-21 11:30:53.444root 11241100x8000000000000000536166Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:30:53.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9bcdd4510d90be8f2021-12-21 11:30:53.943root 11241100x8000000000000000536167Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:30:53.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d24e41d71ced5b3d2021-12-21 11:30:53.943root 11241100x8000000000000000536168Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:30:53.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.fb210c9791ee6e402021-12-21 11:30:53.943root 11241100x8000000000000000536169Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:30:53.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a13e94c5a6cb56412021-12-21 11:30:53.943root 11241100x8000000000000000536170Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:30:53.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2d467a903cf849302021-12-21 11:30:53.943root 11241100x8000000000000000536171Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:30:53.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4a750b3de228e7b42021-12-21 11:30:53.943root 11241100x8000000000000000536172Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:30:53.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.fbe421c10e6c04a82021-12-21 11:30:53.944root 11241100x8000000000000000536173Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:30:53.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4652386663f1239c2021-12-21 11:30:53.944root 11241100x8000000000000000536174Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:30:53.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c2bc2c57b15103852021-12-21 11:30:53.944root 11241100x8000000000000000536175Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:30:53.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e9962bcd2b37f5802021-12-21 11:30:53.944root 11241100x8000000000000000536176Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:30:53.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4e96690df9d0ed302021-12-21 11:30:53.944root 11241100x8000000000000000536177Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:30:53.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f71da2086fea875e2021-12-21 11:30:53.944root 11241100x8000000000000000536178Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:30:53.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c4a0f6ed5214951c2021-12-21 11:30:53.944root 11241100x8000000000000000536179Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:30:53.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c439060296306b052021-12-21 11:30:53.944root 11241100x8000000000000000536180Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:30:53.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.431662f5f6eb44272021-12-21 11:30:53.944root 11241100x8000000000000000536181Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:30:53.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3f880431e9fcb7a92021-12-21 11:30:53.944root 11241100x8000000000000000536182Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:30:53.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c0db48a1c40ae86e2021-12-21 11:30:53.944root 354300x8000000000000000536183Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:30:54.093{ec2b6afe-95d9-61c1-5175-3a0400000000}5346/opt/splunkforwarder/etc/apps/Splunk_TA_stream/linux_x86_64/bin/streamfwdroottcptruefalse10.0.1.25-48648-false10.0.1.12-8000- 11241100x8000000000000000536184Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:30:54.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.af8cf6cb01944c8f2021-12-21 11:30:54.443root 11241100x8000000000000000536185Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:30:54.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4cc439fe8a2647d62021-12-21 11:30:54.443root 11241100x8000000000000000536186Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:30:54.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.714a9f5ea70702632021-12-21 11:30:54.443root 11241100x8000000000000000536187Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:30:54.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3107516e823dbf972021-12-21 11:30:54.443root 11241100x8000000000000000536188Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:30:54.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.285c2c49c43b29882021-12-21 11:30:54.444root 11241100x8000000000000000536189Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:30:54.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ad1019674a50a7c22021-12-21 11:30:54.444root 11241100x8000000000000000536190Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:30:54.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.41637f20a3bb79c62021-12-21 11:30:54.444root 11241100x8000000000000000536191Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:30:54.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e4602f5e14ba89682021-12-21 11:30:54.444root 11241100x8000000000000000536192Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:30:54.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c5edb1748a8a82c82021-12-21 11:30:54.444root 11241100x8000000000000000536193Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:30:54.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f46d9a59a66f302b2021-12-21 11:30:54.444root 11241100x8000000000000000536194Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:30:54.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.392e9cdc6dc6e36f2021-12-21 11:30:54.444root 11241100x8000000000000000536195Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:30:54.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4f9836b9b13948ab2021-12-21 11:30:54.444root 11241100x8000000000000000536196Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:30:54.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d6ea1f692a853cd32021-12-21 11:30:54.444root 11241100x8000000000000000536197Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:30:54.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b13d513cdeaac0152021-12-21 11:30:54.444root 11241100x8000000000000000536198Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:30:54.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.083bd8010b02927f2021-12-21 11:30:54.444root 11241100x8000000000000000536199Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:30:54.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.fa118dee37a019222021-12-21 11:30:54.444root 11241100x8000000000000000536200Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:30:54.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8a20361762b1bd8f2021-12-21 11:30:54.444root 11241100x8000000000000000536201Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:30:54.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5a1ca4446f1215002021-12-21 11:30:54.444root 11241100x8000000000000000536202Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:30:54.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ed1fc472617f11102021-12-21 11:30:54.943root 11241100x8000000000000000536203Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:30:54.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.253663ea67ee98dc2021-12-21 11:30:54.943root 11241100x8000000000000000536204Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:30:54.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f7c7b51e4344202b2021-12-21 11:30:54.943root 11241100x8000000000000000536205Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:30:54.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.525c8c840aaa64e92021-12-21 11:30:54.943root 11241100x8000000000000000536206Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:30:54.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4abcd8b51a1457ee2021-12-21 11:30:54.943root 11241100x8000000000000000536207Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:30:54.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.951908ce206b3e832021-12-21 11:30:54.944root 11241100x8000000000000000536208Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:30:54.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.721d802072411f2b2021-12-21 11:30:54.944root 11241100x8000000000000000536209Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:30:54.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.bebc7fba3adc53252021-12-21 11:30:54.944root 11241100x8000000000000000536210Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:30:54.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.05e122c574d157112021-12-21 11:30:54.944root 11241100x8000000000000000536211Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:30:54.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.767512e7d02ba23c2021-12-21 11:30:54.944root 11241100x8000000000000000536212Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:30:54.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.fd5bfebe6eba69092021-12-21 11:30:54.944root 11241100x8000000000000000536213Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:30:54.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ed5ebeabd4bd5cc82021-12-21 11:30:54.944root 11241100x8000000000000000536214Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:30:54.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9c7c50c82716eda52021-12-21 11:30:54.944root 11241100x8000000000000000536215Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:30:54.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f8db6ebf53464aae2021-12-21 11:30:54.944root 11241100x8000000000000000536216Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:30:54.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ff508aa66ca5946e2021-12-21 11:30:54.944root 11241100x8000000000000000536217Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:30:54.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4dafc05a6296bae22021-12-21 11:30:54.944root 11241100x8000000000000000536218Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:30:54.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.770c0fa533b2bad32021-12-21 11:30:54.944root 11241100x8000000000000000536219Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:30:54.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a1a807220c35e71b2021-12-21 11:30:54.944root 11241100x8000000000000000536220Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:30:55.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4ef174aaccc119f22021-12-21 11:30:55.443root 11241100x8000000000000000536221Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:30:55.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a589aee0b86f806c2021-12-21 11:30:55.443root 11241100x8000000000000000536222Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:30:55.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0d7bd0173d3f08e22021-12-21 11:30:55.444root 11241100x8000000000000000536223Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:30:55.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.840d7deadee5b2e12021-12-21 11:30:55.444root 11241100x8000000000000000536224Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:30:55.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d5c3ad12b4a70d2d2021-12-21 11:30:55.444root 11241100x8000000000000000536225Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:30:55.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2914a0f3b8b4ffa42021-12-21 11:30:55.444root 11241100x8000000000000000536226Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:30:55.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2d8abfcb1f1c00dd2021-12-21 11:30:55.444root 11241100x8000000000000000536227Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:30:55.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.811d90306b3a921c2021-12-21 11:30:55.444root 11241100x8000000000000000536228Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:30:55.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7587fbc9b12cb5012021-12-21 11:30:55.444root 11241100x8000000000000000536229Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:30:55.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f1a83829280e0e912021-12-21 11:30:55.444root 11241100x8000000000000000536230Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:30:55.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.94289908358c4ebf2021-12-21 11:30:55.444root 11241100x8000000000000000536231Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:30:55.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f54a1e2d0a69a7b02021-12-21 11:30:55.444root 11241100x8000000000000000536232Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:30:55.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3d279f86c555c0dc2021-12-21 11:30:55.444root 11241100x8000000000000000536233Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:30:55.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.fb64515c97640a822021-12-21 11:30:55.444root 11241100x8000000000000000536234Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:30:55.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4f15ae01cd6429f92021-12-21 11:30:55.444root 11241100x8000000000000000536235Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:30:55.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c18b80c507bb34512021-12-21 11:30:55.444root 11241100x8000000000000000536236Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:30:55.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f609a762cb60fcdf2021-12-21 11:30:55.444root 11241100x8000000000000000536237Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:30:55.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.64b2637f1ae032422021-12-21 11:30:55.445root 11241100x8000000000000000536238Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:30:55.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c76b21839f8ed0192021-12-21 11:30:55.943root 11241100x8000000000000000536239Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:30:55.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4fa2aa3169f7dfa32021-12-21 11:30:55.943root 11241100x8000000000000000536240Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:30:55.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.59c60de8dd9074552021-12-21 11:30:55.943root 11241100x8000000000000000536241Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:30:55.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ff942c8fc8e4eba02021-12-21 11:30:55.943root 11241100x8000000000000000536242Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:30:55.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.49a47cd4b364e4e22021-12-21 11:30:55.943root 11241100x8000000000000000536243Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:30:55.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.96a19d701fa8e9712021-12-21 11:30:55.944root 11241100x8000000000000000536244Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:30:55.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ab60eacb4960d12e2021-12-21 11:30:55.944root 11241100x8000000000000000536245Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:30:55.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.90a3d434978f86c42021-12-21 11:30:55.944root 11241100x8000000000000000536246Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:30:55.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.060ec4dd5b3303592021-12-21 11:30:55.944root 11241100x8000000000000000536247Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:30:55.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6f3b30137fc31f232021-12-21 11:30:55.944root 11241100x8000000000000000536248Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:30:55.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e533dc745b83a4bb2021-12-21 11:30:55.944root 11241100x8000000000000000536249Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:30:55.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.26fd957e4ac4c7cd2021-12-21 11:30:55.944root 11241100x8000000000000000536250Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:30:55.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.28562361ab3e40a72021-12-21 11:30:55.944root 11241100x8000000000000000536251Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:30:55.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1becc68eec066cfe2021-12-21 11:30:55.944root 11241100x8000000000000000536252Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:30:55.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2a3b98ce0e9849bb2021-12-21 11:30:55.944root 11241100x8000000000000000536253Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:30:55.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9e984fecb69539b02021-12-21 11:30:55.944root 11241100x8000000000000000536254Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:30:55.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0723b480bcf0a4082021-12-21 11:30:55.944root 11241100x8000000000000000536255Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:30:55.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.def21e8d597c4a492021-12-21 11:30:55.944root 11241100x8000000000000000536256Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:30:56.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b9c5d31105d117ca2021-12-21 11:30:56.443root 11241100x8000000000000000536257Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:30:56.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2cc7a55799f941a62021-12-21 11:30:56.443root 11241100x8000000000000000536258Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:30:56.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.00e208df6f1037f62021-12-21 11:30:56.443root 11241100x8000000000000000536259Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:30:56.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.534004217f17126a2021-12-21 11:30:56.443root 11241100x8000000000000000536260Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:30:56.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a4ae7f22446bd5252021-12-21 11:30:56.443root 11241100x8000000000000000536261Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:30:56.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d0031477867cd6d92021-12-21 11:30:56.444root 11241100x8000000000000000536262Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:30:56.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.64bcec6593a1ff602021-12-21 11:30:56.444root 11241100x8000000000000000536263Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:30:56.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.fb863f8c71e6632b2021-12-21 11:30:56.444root 11241100x8000000000000000536264Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:30:56.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7004e58d658cbd152021-12-21 11:30:56.444root 11241100x8000000000000000536265Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:30:56.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0232658a08653a5a2021-12-21 11:30:56.444root 11241100x8000000000000000536266Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:30:56.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.664de0ff7dab873f2021-12-21 11:30:56.444root 11241100x8000000000000000536267Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:30:56.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9ca17947b42930762021-12-21 11:30:56.444root 11241100x8000000000000000536268Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:30:56.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4b39c2c0bd39114e2021-12-21 11:30:56.444root 11241100x8000000000000000536269Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:30:56.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4885a606072ae35b2021-12-21 11:30:56.444root 11241100x8000000000000000536270Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:30:56.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.27a16118c68bef142021-12-21 11:30:56.444root 11241100x8000000000000000536271Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:30:56.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a8ac385a1b10caa52021-12-21 11:30:56.444root 11241100x8000000000000000536272Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:30:56.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e523ddfb7eefeff02021-12-21 11:30:56.444root 11241100x8000000000000000536273Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:30:56.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.880d6ce3fc9eb1872021-12-21 11:30:56.444root 11241100x8000000000000000536274Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:30:56.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.165e08326aebc6b22021-12-21 11:30:56.943root 11241100x8000000000000000536275Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:30:56.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.dc6647f61a8610f12021-12-21 11:30:56.943root 11241100x8000000000000000536276Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:30:56.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1864f1fd239087ff2021-12-21 11:30:56.943root 11241100x8000000000000000536277Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:30:56.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c2aabb056e4f9a822021-12-21 11:30:56.943root 11241100x8000000000000000536278Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:30:56.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.59c042ecedc8b1da2021-12-21 11:30:56.943root 11241100x8000000000000000536279Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:30:56.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9e97b05c95b4bbff2021-12-21 11:30:56.944root 11241100x8000000000000000536280Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:30:56.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8f80b5a1547785f42021-12-21 11:30:56.944root 11241100x8000000000000000536281Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:30:56.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.11880df01b0b44db2021-12-21 11:30:56.944root 11241100x8000000000000000536282Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:30:56.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3c1193ad2fcd88aa2021-12-21 11:30:56.944root 11241100x8000000000000000536283Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:30:56.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2345fa65d85007722021-12-21 11:30:56.944root 11241100x8000000000000000536284Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:30:56.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.bb07b67d307403d62021-12-21 11:30:56.944root 11241100x8000000000000000536285Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:30:56.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5768c1b0123e24c42021-12-21 11:30:56.944root 11241100x8000000000000000536286Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:30:56.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.12b358e75ead6b842021-12-21 11:30:56.944root 11241100x8000000000000000536287Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:30:56.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6c6848c56463a0262021-12-21 11:30:56.944root 11241100x8000000000000000536288Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:30:56.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ccbf65261867827f2021-12-21 11:30:56.944root 11241100x8000000000000000536289Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:30:56.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.bf88fe245ab03f272021-12-21 11:30:56.944root 11241100x8000000000000000536290Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:30:56.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d290dd93d188ee6a2021-12-21 11:30:56.944root 11241100x8000000000000000536291Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:30:56.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c58133d68ea8d70f2021-12-21 11:30:56.944root 11241100x8000000000000000536292Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:30:57.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9ebf69c3558bc4712021-12-21 11:30:57.443root 11241100x8000000000000000536293Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:30:57.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2429ca4d9e5d26912021-12-21 11:30:57.443root 11241100x8000000000000000536294Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:30:57.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7e4bd3dc0887baf22021-12-21 11:30:57.443root 11241100x8000000000000000536295Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:30:57.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.cb15c0a1834839c62021-12-21 11:30:57.443root 11241100x8000000000000000536296Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:30:57.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1df18a868a9285e62021-12-21 11:30:57.443root 11241100x8000000000000000536297Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:30:57.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9b3619c7e9c3969b2021-12-21 11:30:57.444root 11241100x8000000000000000536298Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:30:57.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.107547535ef0d4062021-12-21 11:30:57.444root 11241100x8000000000000000536299Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:30:57.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b66f4f6185b38dcd2021-12-21 11:30:57.444root 11241100x8000000000000000536300Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:30:57.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.fd063272d570fc6d2021-12-21 11:30:57.444root 11241100x8000000000000000536301Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:30:57.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b622d3c567c0827e2021-12-21 11:30:57.444root 11241100x8000000000000000536302Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:30:57.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.cd3b7eb9266609312021-12-21 11:30:57.444root 11241100x8000000000000000536303Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:30:57.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b245cb7994e8ec642021-12-21 11:30:57.444root 11241100x8000000000000000536304Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:30:57.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.dc06a9623a6a3f452021-12-21 11:30:57.444root 11241100x8000000000000000536305Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:30:57.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.95fb4c5747b8aa392021-12-21 11:30:57.444root 11241100x8000000000000000536306Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:30:57.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ff57ed2a10a778da2021-12-21 11:30:57.444root 11241100x8000000000000000536307Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:30:57.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c8858d3faf7deb0b2021-12-21 11:30:57.444root 11241100x8000000000000000536308Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:30:57.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.26a1a967c5515cff2021-12-21 11:30:57.444root 11241100x8000000000000000536309Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:30:57.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ec70f113b68988992021-12-21 11:30:57.444root 11241100x8000000000000000536310Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:30:57.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.fee00298a7d6e5ef2021-12-21 11:30:57.943root 11241100x8000000000000000536311Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:30:57.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f59e82541d4b253f2021-12-21 11:30:57.943root 11241100x8000000000000000536312Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:30:57.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.104951ac57b8b9302021-12-21 11:30:57.944root 11241100x8000000000000000536313Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:30:57.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d9cf61cd05ebdb962021-12-21 11:30:57.944root 11241100x8000000000000000536314Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:30:57.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.147442624a4f796a2021-12-21 11:30:57.944root 11241100x8000000000000000536315Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:30:57.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2e73eebfefec685b2021-12-21 11:30:57.944root 11241100x8000000000000000536316Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:30:57.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9189101eebb6ea8e2021-12-21 11:30:57.944root 11241100x8000000000000000536317Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:30:57.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.da68a54c8b8654602021-12-21 11:30:57.944root 11241100x8000000000000000536318Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:30:57.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.cf5a77a2c953b5552021-12-21 11:30:57.944root 11241100x8000000000000000536319Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:30:57.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.41eca22d9fda16922021-12-21 11:30:57.944root 11241100x8000000000000000536320Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:30:57.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f53d146a61630e4f2021-12-21 11:30:57.944root 11241100x8000000000000000536321Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:30:57.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.dd7e9a8a799924712021-12-21 11:30:57.944root 11241100x8000000000000000536322Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:30:57.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.95fef695c9253a362021-12-21 11:30:57.944root 11241100x8000000000000000536323Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:30:57.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.866120c1dd0dd6012021-12-21 11:30:57.944root 11241100x8000000000000000536324Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:30:57.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ae004ca53e5ec6c22021-12-21 11:30:57.944root 11241100x8000000000000000536325Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:30:57.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.15684961c4f237102021-12-21 11:30:57.944root 11241100x8000000000000000536326Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:30:57.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.faa9405abee7b7662021-12-21 11:30:57.944root 11241100x8000000000000000536327Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:30:57.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3fb87c3a73f5f7812021-12-21 11:30:57.944root 11241100x8000000000000000536328Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:30:58.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2d61bfd78e587b1b2021-12-21 11:30:58.443root 11241100x8000000000000000536329Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:30:58.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ec1e29e4ef16d1df2021-12-21 11:30:58.443root 11241100x8000000000000000536330Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:30:58.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d6a29be4c38ef07f2021-12-21 11:30:58.443root 11241100x8000000000000000536331Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:30:58.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8cf0212ef6bd68ff2021-12-21 11:30:58.443root 11241100x8000000000000000536332Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:30:58.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b5bad4eab88e67732021-12-21 11:30:58.443root 11241100x8000000000000000536333Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:30:58.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2a647193202b7abf2021-12-21 11:30:58.444root 11241100x8000000000000000536334Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:30:58.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2c0067eb1f55f8022021-12-21 11:30:58.444root 11241100x8000000000000000536335Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:30:58.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c936b73a1267602e2021-12-21 11:30:58.444root 11241100x8000000000000000536336Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:30:58.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a48a62a53a553ee52021-12-21 11:30:58.444root 11241100x8000000000000000536337Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:30:58.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.de85de0ff14005c72021-12-21 11:30:58.444root 11241100x8000000000000000536338Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:30:58.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d31a0e38e24ca43e2021-12-21 11:30:58.444root 11241100x8000000000000000536339Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:30:58.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.76193bc7ec24a4c42021-12-21 11:30:58.444root 11241100x8000000000000000536340Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:30:58.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.691b21d6db36cfed2021-12-21 11:30:58.444root 11241100x8000000000000000536341Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:30:58.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e0e5dc54b96896a22021-12-21 11:30:58.444root 11241100x8000000000000000536342Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:30:58.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4c3470ea471f70092021-12-21 11:30:58.444root 11241100x8000000000000000536343Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:30:58.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3ac614a037f618f72021-12-21 11:30:58.444root 11241100x8000000000000000536344Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:30:58.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0fc2d7ad1b7095012021-12-21 11:30:58.444root 11241100x8000000000000000536345Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:30:58.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b6e47ebe9765cc332021-12-21 11:30:58.444root 11241100x8000000000000000536346Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:30:58.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c3aa3cbcab1580e52021-12-21 11:30:58.943root 11241100x8000000000000000536347Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:30:58.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5528b5f7089dbe372021-12-21 11:30:58.943root 11241100x8000000000000000536348Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:30:58.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.812f25a3046916422021-12-21 11:30:58.943root 11241100x8000000000000000536349Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:30:58.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.575add82d915d9b22021-12-21 11:30:58.943root 11241100x8000000000000000536350Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:30:58.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.200121d83929d4fd2021-12-21 11:30:58.943root 11241100x8000000000000000536351Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:30:58.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ee89387e5bf3d1c62021-12-21 11:30:58.944root 11241100x8000000000000000536352Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:30:58.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.29e6a52c016853d82021-12-21 11:30:58.944root 11241100x8000000000000000536353Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:30:58.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2668bfb58086be152021-12-21 11:30:58.944root 11241100x8000000000000000536354Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:30:58.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.bbd02efb9f0208cf2021-12-21 11:30:58.944root 11241100x8000000000000000536355Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:30:58.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2d988d79472ffb212021-12-21 11:30:58.944root 11241100x8000000000000000536356Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:30:58.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6c7fb397dc12b3242021-12-21 11:30:58.944root 11241100x8000000000000000536357Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:30:58.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.88b412fa1a6179132021-12-21 11:30:58.944root 11241100x8000000000000000536358Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:30:58.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.48731e58d78afd482021-12-21 11:30:58.944root 11241100x8000000000000000536359Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:30:58.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.96b54ff949d7edf52021-12-21 11:30:58.944root 11241100x8000000000000000536360Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:30:58.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.bf73648e99fe4fdb2021-12-21 11:30:58.944root 11241100x8000000000000000536361Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:30:58.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b4c5e821c5adde922021-12-21 11:30:58.944root 11241100x8000000000000000536362Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:30:58.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1852ee6f139d01af2021-12-21 11:30:58.944root 11241100x8000000000000000536363Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:30:58.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.73483562835ada7a2021-12-21 11:30:58.944root 11241100x8000000000000000536364Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:30:59.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a1dca7db36dccea02021-12-21 11:30:59.443root 11241100x8000000000000000536365Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:30:59.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.74ed0366fd1b98352021-12-21 11:30:59.443root 11241100x8000000000000000536366Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:30:59.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1489423e615ed1c52021-12-21 11:30:59.443root 11241100x8000000000000000536367Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:30:59.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d44ae2f6f11ab6452021-12-21 11:30:59.443root 11241100x8000000000000000536368Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:30:59.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.943eb9bba253a80b2021-12-21 11:30:59.444root 11241100x8000000000000000536369Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:30:59.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5d915926e85835be2021-12-21 11:30:59.444root 11241100x8000000000000000536370Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:30:59.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6eabcefc19504ebc2021-12-21 11:30:59.444root 11241100x8000000000000000536371Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:30:59.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.31f01751c5a43ba42021-12-21 11:30:59.444root 11241100x8000000000000000536372Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:30:59.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.afce23e7171bef812021-12-21 11:30:59.444root 11241100x8000000000000000536373Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:30:59.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8787f981a09ea1b62021-12-21 11:30:59.444root 11241100x8000000000000000536374Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:30:59.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.cb7b964685aab7f02021-12-21 11:30:59.444root 11241100x8000000000000000536375Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:30:59.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2215065c33867ee42021-12-21 11:30:59.444root 11241100x8000000000000000536376Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:30:59.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.930872a04fe187712021-12-21 11:30:59.444root 11241100x8000000000000000536377Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:30:59.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.df0ef5b4b17c181d2021-12-21 11:30:59.444root 11241100x8000000000000000536378Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:30:59.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c12063a86a8455942021-12-21 11:30:59.444root 11241100x8000000000000000536379Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:30:59.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ff72b65d6adb678f2021-12-21 11:30:59.444root 11241100x8000000000000000536380Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:30:59.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.da8d326ccb22b4442021-12-21 11:30:59.444root 11241100x8000000000000000536381Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:30:59.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.19786d9ab13047092021-12-21 11:30:59.444root 11241100x8000000000000000536382Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:30:59.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6f5d3bd4e19a1d3c2021-12-21 11:30:59.943root 11241100x8000000000000000536383Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:30:59.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.723c62a9f26984142021-12-21 11:30:59.943root 11241100x8000000000000000536384Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:30:59.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f068f826d9c9311a2021-12-21 11:30:59.943root 11241100x8000000000000000536385Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:30:59.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ee8c46ce2fcca7212021-12-21 11:30:59.943root 11241100x8000000000000000536386Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:30:59.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.78b53f3d09576a532021-12-21 11:30:59.943root 11241100x8000000000000000536387Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:30:59.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c65a8351483788c62021-12-21 11:30:59.944root 11241100x8000000000000000536388Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:30:59.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4ef74d42b66b4fc62021-12-21 11:30:59.944root 11241100x8000000000000000536389Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:30:59.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2493245add2ae9f12021-12-21 11:30:59.944root 11241100x8000000000000000536390Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:30:59.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e7b0629f219ed79f2021-12-21 11:30:59.944root 11241100x8000000000000000536391Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:30:59.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4c790be9f4d3340f2021-12-21 11:30:59.944root 11241100x8000000000000000536392Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:30:59.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ec0b2693550125412021-12-21 11:30:59.944root 11241100x8000000000000000536393Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:30:59.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0e3f3b9b207051992021-12-21 11:30:59.944root 11241100x8000000000000000536394Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:30:59.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.dda85cc4daf697a42021-12-21 11:30:59.944root 11241100x8000000000000000536395Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:30:59.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c2dd4bf444c1e4f42021-12-21 11:30:59.944root 11241100x8000000000000000536396Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:30:59.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.dea0e9431d3a93c62021-12-21 11:30:59.944root 11241100x8000000000000000536397Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:30:59.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f405fc51bf94292a2021-12-21 11:30:59.944root 11241100x8000000000000000536398Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:30:59.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7be1a16c065958ce2021-12-21 11:30:59.944root 11241100x8000000000000000536399Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:30:59.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c1e9aa377b6ab6062021-12-21 11:30:59.944root 354300x8000000000000000536400Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:00.079{ec2b6afe-95d9-61c1-5175-3a0400000000}5346/opt/splunkforwarder/etc/apps/Splunk_TA_stream/linux_x86_64/bin/streamfwdroottcptruefalse10.0.1.25-48650-false10.0.1.12-8000- 11241100x8000000000000000536401Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:00.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.99345b66f1350d342021-12-21 11:31:00.443root 11241100x8000000000000000536402Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:00.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.bc6d09356900259c2021-12-21 11:31:00.443root 11241100x8000000000000000536403Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:00.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b60bde5d1b44133d2021-12-21 11:31:00.443root 11241100x8000000000000000536404Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:00.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3808b5f06a6180842021-12-21 11:31:00.444root 11241100x8000000000000000536405Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:00.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.50ecf6ce8ef4cfbb2021-12-21 11:31:00.444root 11241100x8000000000000000536406Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:00.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5d38bf4d48d37b492021-12-21 11:31:00.444root 11241100x8000000000000000536407Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:00.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e78b12292471161e2021-12-21 11:31:00.444root 11241100x8000000000000000536408Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:00.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1cf7bc2853493d1a2021-12-21 11:31:00.444root 11241100x8000000000000000536409Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:00.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d0095364fa63300c2021-12-21 11:31:00.444root 11241100x8000000000000000536410Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:00.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.af9992c0e0b5a4212021-12-21 11:31:00.444root 11241100x8000000000000000536411Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:00.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b53976e00e7520fd2021-12-21 11:31:00.444root 11241100x8000000000000000536412Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:00.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.40592e521b48a4c12021-12-21 11:31:00.444root 11241100x8000000000000000536413Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:00.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2f34eb6fe99227fc2021-12-21 11:31:00.444root 11241100x8000000000000000536414Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:00.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.18b87e11a064cfe22021-12-21 11:31:00.444root 11241100x8000000000000000536415Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:00.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2489f39f4e73af962021-12-21 11:31:00.444root 11241100x8000000000000000536416Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:00.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7cdd134b164b14722021-12-21 11:31:00.444root 11241100x8000000000000000536417Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:00.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b02e719758ec14e02021-12-21 11:31:00.444root 11241100x8000000000000000536418Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:00.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.880fe057a56836382021-12-21 11:31:00.444root 11241100x8000000000000000536419Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:00.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1c274a148dc872292021-12-21 11:31:00.445root 11241100x8000000000000000536420Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:00.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.89fe0895417f03f92021-12-21 11:31:00.943root 11241100x8000000000000000536421Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:00.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.196b3a54963cbdd12021-12-21 11:31:00.943root 11241100x8000000000000000536422Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:00.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2b8d3bf334c2194d2021-12-21 11:31:00.943root 11241100x8000000000000000536423Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:00.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f4d4c2008124bc9b2021-12-21 11:31:00.943root 11241100x8000000000000000536424Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:00.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7320695a6a0639e52021-12-21 11:31:00.944root 11241100x8000000000000000536425Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:00.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.87c057cb1a48a4102021-12-21 11:31:00.944root 11241100x8000000000000000536426Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:00.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b37e9d38e6bbe3bb2021-12-21 11:31:00.944root 11241100x8000000000000000536427Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:00.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.36a7f791e81fed982021-12-21 11:31:00.944root 11241100x8000000000000000536428Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:00.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.fb8dcbf0e192818a2021-12-21 11:31:00.944root 11241100x8000000000000000536429Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:00.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6308207f4d06085f2021-12-21 11:31:00.944root 11241100x8000000000000000536430Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:00.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.96f880dd36fe63072021-12-21 11:31:00.944root 11241100x8000000000000000536431Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:00.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c75f5efe2ff7d1912021-12-21 11:31:00.944root 11241100x8000000000000000536432Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:00.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.57fe22e681909fa22021-12-21 11:31:00.944root 11241100x8000000000000000536433Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:00.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.cd391c772ee875bf2021-12-21 11:31:00.944root 11241100x8000000000000000536434Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:00.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.79c516abed53b3f32021-12-21 11:31:00.944root 11241100x8000000000000000536435Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:00.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a242f36ec40a9c212021-12-21 11:31:00.945root 11241100x8000000000000000536436Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:00.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e35a583674ffe1162021-12-21 11:31:00.945root 11241100x8000000000000000536437Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:00.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3ff1cd07d5b1016b2021-12-21 11:31:00.945root 11241100x8000000000000000536438Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:00.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.53b21ebc7d8fa46d2021-12-21 11:31:00.945root 11241100x8000000000000000536439Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:01.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c7b88c85b9e433d82021-12-21 11:31:01.443root 11241100x8000000000000000536440Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:01.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.12ada3bc50a14e992021-12-21 11:31:01.443root 11241100x8000000000000000536441Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:01.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e256b5a2347441642021-12-21 11:31:01.443root 11241100x8000000000000000536442Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:01.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.78ab94ac22ed3fb32021-12-21 11:31:01.443root 11241100x8000000000000000536443Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:01.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c076d1d6213a4a8e2021-12-21 11:31:01.444root 11241100x8000000000000000536444Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:01.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e2f887c730367ff22021-12-21 11:31:01.444root 11241100x8000000000000000536445Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:01.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.000d8d75814924502021-12-21 11:31:01.444root 11241100x8000000000000000536446Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:01.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0f642118880c1df32021-12-21 11:31:01.444root 11241100x8000000000000000536447Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:01.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.45bedea40568a29c2021-12-21 11:31:01.444root 11241100x8000000000000000536448Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:01.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b1a1d72a0f21d8782021-12-21 11:31:01.444root 11241100x8000000000000000536449Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:01.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d48516c2665ffcb52021-12-21 11:31:01.444root 11241100x8000000000000000536450Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:01.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.86e2cad4411794e42021-12-21 11:31:01.444root 11241100x8000000000000000536451Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:01.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2089c45f7fb8ac662021-12-21 11:31:01.444root 11241100x8000000000000000536452Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:01.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.53c6cf019c19eda32021-12-21 11:31:01.444root 11241100x8000000000000000536453Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:01.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.916e2aad23b43ee12021-12-21 11:31:01.444root 11241100x8000000000000000536454Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:01.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.95fabf336b5d2b852021-12-21 11:31:01.444root 11241100x8000000000000000536455Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:01.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7cb16afb587cb0e12021-12-21 11:31:01.444root 11241100x8000000000000000536456Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:01.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4b51f281fe0de3cb2021-12-21 11:31:01.444root 11241100x8000000000000000536457Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:01.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.872947131eb921262021-12-21 11:31:01.444root 11241100x8000000000000000536458Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:01.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ef002fd54fbb3f2a2021-12-21 11:31:01.943root 11241100x8000000000000000536459Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:01.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.54948aca0414f9ab2021-12-21 11:31:01.943root 11241100x8000000000000000536460Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:01.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f7c6f958ca115c2b2021-12-21 11:31:01.943root 11241100x8000000000000000536461Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:01.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5f1cf4f0da5953622021-12-21 11:31:01.943root 11241100x8000000000000000536462Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:01.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c8c838efb33f517e2021-12-21 11:31:01.944root 11241100x8000000000000000536463Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:01.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8ecce9f39acf17722021-12-21 11:31:01.944root 11241100x8000000000000000536464Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:01.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.78aa2a0fcb74d5752021-12-21 11:31:01.944root 11241100x8000000000000000536465Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:01.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c53125b971063a172021-12-21 11:31:01.944root 11241100x8000000000000000536466Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:01.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ca652ff71ff295562021-12-21 11:31:01.944root 11241100x8000000000000000536467Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:01.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e32c91e6c69973642021-12-21 11:31:01.944root 11241100x8000000000000000536468Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:01.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.07a137b6efe48a1e2021-12-21 11:31:01.944root 11241100x8000000000000000536469Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:01.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7ab0cf83387a79f82021-12-21 11:31:01.944root 11241100x8000000000000000536470Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:01.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9af38be8f629c1962021-12-21 11:31:01.944root 11241100x8000000000000000536471Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:01.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.cf03259b9f94a2892021-12-21 11:31:01.944root 11241100x8000000000000000536472Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:01.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d459f1cf01147ac92021-12-21 11:31:01.944root 11241100x8000000000000000536473Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:01.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.23a3e8baea3d00cc2021-12-21 11:31:01.944root 11241100x8000000000000000536474Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:01.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.10576443ddef30e12021-12-21 11:31:01.944root 11241100x8000000000000000536475Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:01.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.649eb4161541074a2021-12-21 11:31:01.944root 11241100x8000000000000000536476Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:01.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3a8fb1368cb588b72021-12-21 11:31:01.944root 11241100x8000000000000000536477Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:02.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e580408fffd8be152021-12-21 11:31:02.443root 11241100x8000000000000000536478Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:02.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c17dcde5791702982021-12-21 11:31:02.443root 11241100x8000000000000000536479Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:02.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0ccc4cc6d7e4d8e82021-12-21 11:31:02.443root 11241100x8000000000000000536480Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:02.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4fb1f6f486226f0c2021-12-21 11:31:02.443root 11241100x8000000000000000536481Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:02.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.cc1fea2b4e18d76d2021-12-21 11:31:02.443root 11241100x8000000000000000536482Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:02.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a437ab74b0eae5072021-12-21 11:31:02.444root 11241100x8000000000000000536483Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:02.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8bf9d169c3c987f72021-12-21 11:31:02.444root 11241100x8000000000000000536484Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:02.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2a12ea2e2d8ffa342021-12-21 11:31:02.444root 11241100x8000000000000000536485Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:02.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1ed81041b341ac032021-12-21 11:31:02.444root 11241100x8000000000000000536486Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:02.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3dde57f83e0f0f182021-12-21 11:31:02.444root 11241100x8000000000000000536487Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:02.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.dab5d829dc587fed2021-12-21 11:31:02.444root 11241100x8000000000000000536488Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:02.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1cc196b1218a537b2021-12-21 11:31:02.444root 11241100x8000000000000000536489Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:02.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5b6398651717c13d2021-12-21 11:31:02.444root 11241100x8000000000000000536490Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:02.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1e8c2fbd6bbc61742021-12-21 11:31:02.444root 11241100x8000000000000000536491Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:02.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2d706e0436f465582021-12-21 11:31:02.444root 11241100x8000000000000000536492Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:02.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f7d083ae9b09954d2021-12-21 11:31:02.444root 11241100x8000000000000000536493Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:02.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c372d59150e61ebf2021-12-21 11:31:02.444root 11241100x8000000000000000536494Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:02.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.24c6e8089cd85af12021-12-21 11:31:02.444root 11241100x8000000000000000536495Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:02.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.fefbd6210c6553ea2021-12-21 11:31:02.444root 11241100x8000000000000000536496Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:02.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6b3c79a51ced1d4c2021-12-21 11:31:02.943root 11241100x8000000000000000536497Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:02.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.afaca544b62334d82021-12-21 11:31:02.943root 11241100x8000000000000000536498Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:02.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8cfacde60d38d91c2021-12-21 11:31:02.943root 11241100x8000000000000000536499Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:02.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6c22dffa879f49ca2021-12-21 11:31:02.943root 11241100x8000000000000000536500Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:02.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c695df4d857f08322021-12-21 11:31:02.944root 11241100x8000000000000000536501Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:02.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.77ee6e04b15dcfed2021-12-21 11:31:02.944root 11241100x8000000000000000536502Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:02.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1ed59d80abd743612021-12-21 11:31:02.944root 11241100x8000000000000000536503Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:02.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.432be53141cb99e22021-12-21 11:31:02.944root 11241100x8000000000000000536504Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:02.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ce3a22f4b48d29172021-12-21 11:31:02.944root 11241100x8000000000000000536505Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:02.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9541f21294a5b60e2021-12-21 11:31:02.944root 11241100x8000000000000000536506Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:02.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2f2da83015d2e00e2021-12-21 11:31:02.944root 11241100x8000000000000000536507Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:02.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e4c9244d32b9ba9f2021-12-21 11:31:02.944root 11241100x8000000000000000536508Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:02.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2303f2680220413d2021-12-21 11:31:02.944root 11241100x8000000000000000536509Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:02.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.133222af40d04bdc2021-12-21 11:31:02.944root 11241100x8000000000000000536510Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:02.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b94b609d06aec1212021-12-21 11:31:02.944root 11241100x8000000000000000536511Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:02.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3a12b3db3c2e8b692021-12-21 11:31:02.944root 11241100x8000000000000000536512Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:02.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.592c26ae6ee40e6e2021-12-21 11:31:02.944root 11241100x8000000000000000536513Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:02.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ef98518a7c76e2a82021-12-21 11:31:02.944root 11241100x8000000000000000536514Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:02.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.601ae32bfe8bfb4d2021-12-21 11:31:02.944root 11241100x8000000000000000536515Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:03.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2385fbcc6f0012b12021-12-21 11:31:03.443root 11241100x8000000000000000536516Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:03.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e6d57e187bd7b90d2021-12-21 11:31:03.443root 11241100x8000000000000000536517Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:03.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e8d4e2824d3e583c2021-12-21 11:31:03.443root 11241100x8000000000000000536518Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:03.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ce25672639379f512021-12-21 11:31:03.443root 11241100x8000000000000000536519Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:03.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.18bcb8aefa4cf70b2021-12-21 11:31:03.444root 11241100x8000000000000000536520Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:03.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.fec48f5d29f348da2021-12-21 11:31:03.444root 11241100x8000000000000000536521Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:03.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f8f832c7b7c5cbac2021-12-21 11:31:03.444root 11241100x8000000000000000536522Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:03.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.908955e53bcd3ab42021-12-21 11:31:03.444root 11241100x8000000000000000536523Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:03.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a48bdf2d20e321112021-12-21 11:31:03.444root 11241100x8000000000000000536524Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:03.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d2f3efc464cc80472021-12-21 11:31:03.444root 11241100x8000000000000000536525Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:03.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.631f7d7eaf19af752021-12-21 11:31:03.444root 11241100x8000000000000000536526Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:03.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.82418fcbedaee65a2021-12-21 11:31:03.444root 11241100x8000000000000000536527Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:03.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b9c84584656ecf412021-12-21 11:31:03.444root 11241100x8000000000000000536528Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:03.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ede0abd8d8d022fa2021-12-21 11:31:03.444root 11241100x8000000000000000536529Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:03.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.252ea145efd613792021-12-21 11:31:03.444root 11241100x8000000000000000536530Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:03.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4f23c2d77761c4912021-12-21 11:31:03.444root 11241100x8000000000000000536531Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:03.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.50d570be47ff5c302021-12-21 11:31:03.444root 11241100x8000000000000000536532Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:03.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7d68dd68d3ebd5762021-12-21 11:31:03.444root 11241100x8000000000000000536533Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:03.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9d704211a7502d872021-12-21 11:31:03.444root 11241100x8000000000000000536534Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:03.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1d286302f7ff35482021-12-21 11:31:03.943root 11241100x8000000000000000536535Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:03.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d947ecfac19b2b452021-12-21 11:31:03.943root 11241100x8000000000000000536536Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:03.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.54a302952f07a57d2021-12-21 11:31:03.943root 11241100x8000000000000000536537Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:03.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.23f3f6edd5ca1e192021-12-21 11:31:03.943root 11241100x8000000000000000536538Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:03.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.bbab8e16de69ab0b2021-12-21 11:31:03.944root 11241100x8000000000000000536539Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:03.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f75fc9acbd29bdfa2021-12-21 11:31:03.944root 11241100x8000000000000000536540Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:03.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.fadcc27b711008e72021-12-21 11:31:03.944root 11241100x8000000000000000536541Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:03.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0588776f75722e2e2021-12-21 11:31:03.944root 11241100x8000000000000000536542Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:03.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e0905d7318b42ee72021-12-21 11:31:03.944root 11241100x8000000000000000536543Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:03.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1e4cb1d04f7859692021-12-21 11:31:03.944root 11241100x8000000000000000536544Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:03.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.02c5668565467f3c2021-12-21 11:31:03.944root 11241100x8000000000000000536545Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:03.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.fc24bb2d554b38972021-12-21 11:31:03.944root 11241100x8000000000000000536546Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:03.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5fc178d28ada04bc2021-12-21 11:31:03.944root 11241100x8000000000000000536547Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:03.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9fac8c38a48db8242021-12-21 11:31:03.944root 11241100x8000000000000000536548Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:03.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ba77947ef24ed6582021-12-21 11:31:03.944root 11241100x8000000000000000536549Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:03.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.189b231a3181f2ec2021-12-21 11:31:03.944root 11241100x8000000000000000536550Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:03.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.fcf8fada689007fa2021-12-21 11:31:03.944root 11241100x8000000000000000536551Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:03.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d6729a09d713f7dc2021-12-21 11:31:03.944root 11241100x8000000000000000536552Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:03.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ce4a8e67b10908592021-12-21 11:31:03.944root 11241100x8000000000000000536553Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:04.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e8555ee4ea1ffb9e2021-12-21 11:31:04.443root 11241100x8000000000000000536554Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:04.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6a768305f2c960e52021-12-21 11:31:04.443root 11241100x8000000000000000536555Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:04.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.626acb87902b80ff2021-12-21 11:31:04.443root 11241100x8000000000000000536556Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:04.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.76acaccfaf5f87ab2021-12-21 11:31:04.443root 11241100x8000000000000000536557Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:04.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.26617470060da7182021-12-21 11:31:04.444root 11241100x8000000000000000536558Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:04.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1c9381fc14c737552021-12-21 11:31:04.444root 11241100x8000000000000000536559Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:04.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c643fec422e05c3d2021-12-21 11:31:04.444root 11241100x8000000000000000536560Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:04.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b334bcde3951f1fc2021-12-21 11:31:04.444root 11241100x8000000000000000536561Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:04.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b729033e9b4db9aa2021-12-21 11:31:04.444root 11241100x8000000000000000536562Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:04.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c10c95ef2e27ddd52021-12-21 11:31:04.444root 11241100x8000000000000000536563Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:04.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.abf895de928521412021-12-21 11:31:04.444root 11241100x8000000000000000536564Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:04.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9478f8bf0fd3db5e2021-12-21 11:31:04.444root 11241100x8000000000000000536565Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:04.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2581dc8e97bd70732021-12-21 11:31:04.444root 11241100x8000000000000000536566Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:04.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f8aab46f2afd60512021-12-21 11:31:04.444root 11241100x8000000000000000536567Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:04.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.cc675cb748fb08982021-12-21 11:31:04.444root 11241100x8000000000000000536568Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:04.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.61a4f395f95805692021-12-21 11:31:04.444root 11241100x8000000000000000536569Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:04.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0166b8fcc448188f2021-12-21 11:31:04.444root 11241100x8000000000000000536570Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:04.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2e7917a5577783c22021-12-21 11:31:04.444root 11241100x8000000000000000536571Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:04.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a22afe07e068493b2021-12-21 11:31:04.444root 11241100x8000000000000000536572Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:04.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.14eca463a699e47b2021-12-21 11:31:04.943root 11241100x8000000000000000536573Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:04.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b65ac0825c678f082021-12-21 11:31:04.943root 11241100x8000000000000000536574Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:04.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2b8df7717a3ea5b22021-12-21 11:31:04.943root 11241100x8000000000000000536575Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:04.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ab8b3052b3865afd2021-12-21 11:31:04.944root 11241100x8000000000000000536576Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:04.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a40501f0885b5f312021-12-21 11:31:04.944root 11241100x8000000000000000536577Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:04.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.189b315c22777a582021-12-21 11:31:04.944root 11241100x8000000000000000536578Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:04.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b2a52fbeda54edbf2021-12-21 11:31:04.944root 11241100x8000000000000000536579Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:04.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9bf4f972e668807e2021-12-21 11:31:04.944root 11241100x8000000000000000536580Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:04.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b087a3ec29dba99f2021-12-21 11:31:04.944root 11241100x8000000000000000536581Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:04.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.88c01bc86ae575f72021-12-21 11:31:04.944root 11241100x8000000000000000536582Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:04.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.10f9a4eff87e8e152021-12-21 11:31:04.944root 11241100x8000000000000000536583Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:04.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.79d91a4b30aac3a72021-12-21 11:31:04.944root 11241100x8000000000000000536584Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:04.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ede8c8084168fa212021-12-21 11:31:04.944root 11241100x8000000000000000536585Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:04.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a427ce82cf517e1a2021-12-21 11:31:04.944root 11241100x8000000000000000536586Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:04.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.58c8aee1b4c2bd122021-12-21 11:31:04.944root 11241100x8000000000000000536587Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:04.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.41642654ed7089f42021-12-21 11:31:04.944root 11241100x8000000000000000536588Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:04.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1e1396b105973d1d2021-12-21 11:31:04.944root 11241100x8000000000000000536589Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:04.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.df9ceec29e171bee2021-12-21 11:31:04.944root 11241100x8000000000000000536590Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:04.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6273d7d9f230c5962021-12-21 11:31:04.944root 354300x8000000000000000536591Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:05.104{ec2b6afe-95d9-61c1-5175-3a0400000000}5346/opt/splunkforwarder/etc/apps/Splunk_TA_stream/linux_x86_64/bin/streamfwdroottcptruefalse10.0.1.25-48652-false10.0.1.12-8000- 11241100x8000000000000000536592Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:05.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.97f2a0480993fa3e2021-12-21 11:31:05.443root 11241100x8000000000000000536593Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:05.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.34db09c3928583ce2021-12-21 11:31:05.444root 11241100x8000000000000000536594Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:05.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4bbd32eca5223b842021-12-21 11:31:05.444root 11241100x8000000000000000536595Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:05.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0457d2acc07ffee52021-12-21 11:31:05.444root 11241100x8000000000000000536596Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:05.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7659472af34dd5a92021-12-21 11:31:05.444root 11241100x8000000000000000536597Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:05.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3acede31408408c32021-12-21 11:31:05.444root 11241100x8000000000000000536598Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:05.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6ab0e4abff9833ae2021-12-21 11:31:05.444root 11241100x8000000000000000536599Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:05.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0c3cba48ca0aaf022021-12-21 11:31:05.444root 11241100x8000000000000000536600Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:05.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b39d078b7462a1f62021-12-21 11:31:05.444root 11241100x8000000000000000536601Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:05.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.25f59bd3449799492021-12-21 11:31:05.444root 11241100x8000000000000000536602Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:05.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5ea41db41e3fd90c2021-12-21 11:31:05.444root 11241100x8000000000000000536603Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:05.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9b2b83e994042fe52021-12-21 11:31:05.444root 11241100x8000000000000000536604Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:05.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.69c2265d264a75e02021-12-21 11:31:05.444root 11241100x8000000000000000536605Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:05.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1cf5dadb9a1975902021-12-21 11:31:05.444root 11241100x8000000000000000536606Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:05.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e2f055dad9713dfe2021-12-21 11:31:05.444root 11241100x8000000000000000536607Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:05.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6f8929a7e940099e2021-12-21 11:31:05.444root 11241100x8000000000000000536608Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:05.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e7b7ebfb3a139b642021-12-21 11:31:05.445root 11241100x8000000000000000536609Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:05.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5ec52edc6083b0f32021-12-21 11:31:05.445root 11241100x8000000000000000536610Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:05.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.873a12b004c007242021-12-21 11:31:05.445root 11241100x8000000000000000536611Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:05.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1174bf7c7ee134132021-12-21 11:31:05.445root 11241100x8000000000000000536612Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:05.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.912ae323ef7234a42021-12-21 11:31:05.943root 11241100x8000000000000000536613Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:05.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b42769f31603711c2021-12-21 11:31:05.944root 11241100x8000000000000000536614Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:05.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c30a9a373eed41052021-12-21 11:31:05.944root 11241100x8000000000000000536615Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:05.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b3bab93dac8f76672021-12-21 11:31:05.944root 11241100x8000000000000000536616Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:05.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.031321a1893248fc2021-12-21 11:31:05.944root 11241100x8000000000000000536617Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:05.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.cf62c6a8301b07bc2021-12-21 11:31:05.944root 11241100x8000000000000000536618Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:05.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ea0f5bd4ffe6852e2021-12-21 11:31:05.944root 11241100x8000000000000000536619Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:05.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1526ab5f1abec8892021-12-21 11:31:05.944root 11241100x8000000000000000536620Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:05.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3e2e2541599411ba2021-12-21 11:31:05.945root 11241100x8000000000000000536621Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:05.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.651da9ca23e70cb32021-12-21 11:31:05.945root 11241100x8000000000000000536622Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:05.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a6f8b29e2f93dd632021-12-21 11:31:05.945root 11241100x8000000000000000536623Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:05.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a213fa685a2c0fbd2021-12-21 11:31:05.945root 11241100x8000000000000000536624Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:05.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d9a5aed7f43de3332021-12-21 11:31:05.945root 11241100x8000000000000000536625Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:05.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.007f6e3b2dc454ab2021-12-21 11:31:05.945root 11241100x8000000000000000536626Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:05.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2b926545935b84dc2021-12-21 11:31:05.945root 11241100x8000000000000000536627Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:05.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.95b0a7dfc742f60f2021-12-21 11:31:05.945root 11241100x8000000000000000536628Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:05.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4a50b138bc0505e62021-12-21 11:31:05.945root 11241100x8000000000000000536629Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:05.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d51f21fcc66b5b7d2021-12-21 11:31:05.945root 11241100x8000000000000000536630Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:05.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b9f9049a0c897ed32021-12-21 11:31:05.945root 11241100x8000000000000000536631Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:05.946{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9ebe709438b8695a2021-12-21 11:31:05.946root 11241100x8000000000000000536632Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:06.326{ec2b6afe-95d2-61c1-3038-b84203560000}5272/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/spool/splunk/tracker.log2021-12-21 11:31:06.326root 11241100x8000000000000000536633Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:06.327{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.729ea9ab7480ed812021-12-21 11:31:06.327root 11241100x8000000000000000536634Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:06.327{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6f3f3d9929ca97752021-12-21 11:31:06.327root 11241100x8000000000000000536635Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:06.328{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.99c840d9f706c3912021-12-21 11:31:06.328root 11241100x8000000000000000536636Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:06.328{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.dde6ec37a24afdc42021-12-21 11:31:06.328root 11241100x8000000000000000536637Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:06.328{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.81a5447dd60c61342021-12-21 11:31:06.328root 11241100x8000000000000000536638Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:06.328{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.31ef363de304082a2021-12-21 11:31:06.328root 11241100x8000000000000000536639Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:06.329{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f8bcab1da30e7bcb2021-12-21 11:31:06.329root 11241100x8000000000000000536640Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:06.329{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7d86ebe56a2a8d352021-12-21 11:31:06.329root 11241100x8000000000000000536641Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:06.329{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e795b63a1c4142b02021-12-21 11:31:06.329root 11241100x8000000000000000536642Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:06.329{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.252263ae63bdb91a2021-12-21 11:31:06.329root 11241100x8000000000000000536643Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:06.329{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.560b10811063e4292021-12-21 11:31:06.329root 11241100x8000000000000000536644Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:06.329{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7e40d17becf35c952021-12-21 11:31:06.329root 11241100x8000000000000000536645Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:06.329{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e096b2c3e92c15cd2021-12-21 11:31:06.329root 11241100x8000000000000000536646Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:06.329{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.442bcca0d927aa822021-12-21 11:31:06.329root 11241100x8000000000000000536647Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:06.329{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.fae337f6ea323da92021-12-21 11:31:06.329root 11241100x8000000000000000536648Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:06.329{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.71a0451032f9f11b2021-12-21 11:31:06.329root 11241100x8000000000000000536649Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:06.329{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e7f02e03559a56782021-12-21 11:31:06.329root 11241100x8000000000000000536650Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:06.329{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f0a0635b92e816852021-12-21 11:31:06.329root 11241100x8000000000000000536651Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:06.330{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6f3b322ef9df12a72021-12-21 11:31:06.330root 11241100x8000000000000000536652Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:06.330{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.21753e13baf7bfa02021-12-21 11:31:06.330root 11241100x8000000000000000536653Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:06.330{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.cd0e73873dc8c3802021-12-21 11:31:06.330root 11241100x8000000000000000536654Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:06.330{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f83a71304ad3e4bf2021-12-21 11:31:06.330root 11241100x8000000000000000536655Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:06.330{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.41d550b879f9602b2021-12-21 11:31:06.330root 11241100x8000000000000000536656Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:06.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d967f57471b6a7802021-12-21 11:31:06.693root 11241100x8000000000000000536657Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:06.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.676f10ce317ab1462021-12-21 11:31:06.693root 11241100x8000000000000000536658Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:06.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.53e5d5bf142e1d222021-12-21 11:31:06.693root 11241100x8000000000000000536659Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:06.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.59e00db15ad934bd2021-12-21 11:31:06.693root 11241100x8000000000000000536660Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:06.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ce181c7315c982392021-12-21 11:31:06.693root 11241100x8000000000000000536661Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:06.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a83fd816900eb1072021-12-21 11:31:06.693root 11241100x8000000000000000536662Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:06.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7639bd6134afeb332021-12-21 11:31:06.693root 11241100x8000000000000000536663Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:06.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.77ceceb7d006026e2021-12-21 11:31:06.693root 11241100x8000000000000000536664Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:06.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ba83fd083a8a90362021-12-21 11:31:06.694root 11241100x8000000000000000536665Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:06.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.87be02848eba8e4c2021-12-21 11:31:06.694root 11241100x8000000000000000536666Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:06.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6e826ed55b7dec542021-12-21 11:31:06.694root 11241100x8000000000000000536667Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:06.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8f8c4e57629ad9f72021-12-21 11:31:06.694root 11241100x8000000000000000536668Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:06.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d876bd249ac0ed552021-12-21 11:31:06.694root 11241100x8000000000000000536669Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:06.695{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.07511d45b2c41b752021-12-21 11:31:06.695root 11241100x8000000000000000536670Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:06.695{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.05e93b253626d3c42021-12-21 11:31:06.695root 11241100x8000000000000000536671Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:06.695{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7774ea50b92bff902021-12-21 11:31:06.695root 11241100x8000000000000000536672Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:06.695{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.cc5e1b3ab9046b632021-12-21 11:31:06.695root 11241100x8000000000000000536673Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:06.695{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.84cefb91833e4d132021-12-21 11:31:06.695root 11241100x8000000000000000536674Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:06.695{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.051fa675ecc101a82021-12-21 11:31:06.695root 11241100x8000000000000000536675Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:06.695{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.501ab79849757df82021-12-21 11:31:06.695root 11241100x8000000000000000536676Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:06.695{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.cb5236a6d5fe1dcc2021-12-21 11:31:06.695root 11241100x8000000000000000536677Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:06.696{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d881f5583b6571922021-12-21 11:31:06.696root 11241100x8000000000000000536678Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:06.696{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e2787c07c59328c82021-12-21 11:31:06.696root 11241100x8000000000000000536679Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:06.696{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8a4fe23996aa985f2021-12-21 11:31:06.696root 11241100x8000000000000000536680Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:06.696{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c38edfdc9da7b84e2021-12-21 11:31:06.696root 11241100x8000000000000000536681Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:06.697{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b468a1ab3fa034bd2021-12-21 11:31:06.697root 11241100x8000000000000000536682Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:07.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.fa590026c22454202021-12-21 11:31:07.193root 11241100x8000000000000000536683Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:07.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9a576404fe9b4c402021-12-21 11:31:07.193root 11241100x8000000000000000536684Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:07.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3f77d211ba5610ad2021-12-21 11:31:07.193root 11241100x8000000000000000536685Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:07.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b1bdda7f35528e1e2021-12-21 11:31:07.193root 11241100x8000000000000000536686Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:07.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.acb3b98e111d91042021-12-21 11:31:07.193root 11241100x8000000000000000536687Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:07.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.264d047fff4253752021-12-21 11:31:07.194root 11241100x8000000000000000536688Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:07.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.642584fb5e508ded2021-12-21 11:31:07.194root 11241100x8000000000000000536689Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:07.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.cf2ed399fea9c40b2021-12-21 11:31:07.194root 11241100x8000000000000000536690Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:07.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f93e9bac08b6d8ed2021-12-21 11:31:07.194root 11241100x8000000000000000536691Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:07.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c0845b417145337f2021-12-21 11:31:07.194root 11241100x8000000000000000536692Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:07.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.524c3ae906d1d5ef2021-12-21 11:31:07.194root 11241100x8000000000000000536693Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:07.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0105e57f74603e862021-12-21 11:31:07.194root 11241100x8000000000000000536694Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:07.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.bc93670ba86a3c422021-12-21 11:31:07.194root 11241100x8000000000000000536695Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:07.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7884e6e380f1e6722021-12-21 11:31:07.194root 11241100x8000000000000000536696Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:07.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6a640bced7bf27e52021-12-21 11:31:07.194root 11241100x8000000000000000536697Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:07.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.814b8858b70020a32021-12-21 11:31:07.194root 11241100x8000000000000000536698Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:07.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.fdaf9cbed15c55332021-12-21 11:31:07.194root 11241100x8000000000000000536699Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:07.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.463c385af462f4c82021-12-21 11:31:07.194root 11241100x8000000000000000536700Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:07.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ef66b8d1b034e90b2021-12-21 11:31:07.194root 11241100x8000000000000000536701Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:07.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.527a13d59ea2e6932021-12-21 11:31:07.194root 11241100x8000000000000000536702Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:07.195{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.87dd14a3529a8b1e2021-12-21 11:31:07.195root 11241100x8000000000000000536703Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:07.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f304130d97c8c0e82021-12-21 11:31:07.693root 11241100x8000000000000000536704Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:07.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.938e63d411b8f5002021-12-21 11:31:07.693root 11241100x8000000000000000536705Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:07.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0ddd769689d262872021-12-21 11:31:07.693root 11241100x8000000000000000536706Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:07.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6830ed11bbfa1d932021-12-21 11:31:07.693root 11241100x8000000000000000536707Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:07.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.13991f558349b24f2021-12-21 11:31:07.693root 11241100x8000000000000000536708Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:07.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.118dbc17ac9332f32021-12-21 11:31:07.693root 11241100x8000000000000000536709Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:07.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b1354f32ffb8399a2021-12-21 11:31:07.693root 11241100x8000000000000000536710Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:07.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2bd89876169535aa2021-12-21 11:31:07.693root 11241100x8000000000000000536711Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:07.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.307141c60b39a81f2021-12-21 11:31:07.693root 11241100x8000000000000000536712Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:07.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.cb7a343fccc508e82021-12-21 11:31:07.693root 11241100x8000000000000000536713Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:07.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.830bfb63250abfdf2021-12-21 11:31:07.694root 11241100x8000000000000000536714Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:07.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f6c7817cd1ec82602021-12-21 11:31:07.694root 11241100x8000000000000000536715Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:07.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.07b171d03d91f4612021-12-21 11:31:07.694root 11241100x8000000000000000536716Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:07.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0eedba0ac85b6b6a2021-12-21 11:31:07.694root 11241100x8000000000000000536717Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:07.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c5e738e7c89f34472021-12-21 11:31:07.694root 11241100x8000000000000000536718Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:07.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4c9d5efa74c094b02021-12-21 11:31:07.694root 11241100x8000000000000000536719Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:07.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.21af75968158bec32021-12-21 11:31:07.694root 11241100x8000000000000000536720Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:07.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0b759825972a5ddd2021-12-21 11:31:07.694root 11241100x8000000000000000536721Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:07.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1173659020c149102021-12-21 11:31:07.694root 11241100x8000000000000000536722Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:07.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5d78581715fcef232021-12-21 11:31:07.694root 11241100x8000000000000000536723Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:07.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.67148c0a784c16ca2021-12-21 11:31:07.694root 11241100x8000000000000000536724Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:08.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.26e9f63e2534f2ee2021-12-21 11:31:08.193root 11241100x8000000000000000536725Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:08.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7781d8521e93a5322021-12-21 11:31:08.193root 11241100x8000000000000000536726Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:08.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4358273498fea8732021-12-21 11:31:08.193root 11241100x8000000000000000536727Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:08.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4db2c657ed721f0a2021-12-21 11:31:08.194root 11241100x8000000000000000536728Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:08.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.50bde060e5aea7222021-12-21 11:31:08.194root 11241100x8000000000000000536729Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:08.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.77a0f7ef7ffac7662021-12-21 11:31:08.194root 11241100x8000000000000000536730Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:08.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a88eb60bc61f571c2021-12-21 11:31:08.194root 11241100x8000000000000000536731Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:08.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.aa327a8afd392ba52021-12-21 11:31:08.194root 11241100x8000000000000000536732Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:08.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3dfe0bbc3be47cd22021-12-21 11:31:08.194root 11241100x8000000000000000536733Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:08.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.12a6f06fa0d1016f2021-12-21 11:31:08.194root 11241100x8000000000000000536734Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:08.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.dbc14bf7b7f95d182021-12-21 11:31:08.194root 11241100x8000000000000000536735Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:08.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5fc4005a062904362021-12-21 11:31:08.194root 11241100x8000000000000000536736Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:08.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.718c0c4e15cb382d2021-12-21 11:31:08.194root 11241100x8000000000000000536737Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:08.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a6bee4979b0fdd562021-12-21 11:31:08.194root 11241100x8000000000000000536738Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:08.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.02b96f42eda059232021-12-21 11:31:08.194root 11241100x8000000000000000536739Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:08.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.128f073d067c645d2021-12-21 11:31:08.194root 11241100x8000000000000000536740Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:08.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e12b55cfa61412022021-12-21 11:31:08.194root 11241100x8000000000000000536741Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:08.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f29456347df47b662021-12-21 11:31:08.194root 11241100x8000000000000000536742Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:08.195{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b717e721007f52aa2021-12-21 11:31:08.195root 11241100x8000000000000000536743Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:08.195{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.cdf4fd84972179802021-12-21 11:31:08.195root 11241100x8000000000000000536744Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:08.195{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.76496cd7c86601842021-12-21 11:31:08.195root 11241100x8000000000000000536745Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:08.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0c4e627e999923172021-12-21 11:31:08.693root 11241100x8000000000000000536746Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:08.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.677b8eb9d7516f062021-12-21 11:31:08.693root 11241100x8000000000000000536747Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:08.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.509ee924de8b5bd62021-12-21 11:31:08.693root 11241100x8000000000000000536748Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:08.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0e8b458830f8a6a52021-12-21 11:31:08.693root 11241100x8000000000000000536749Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:08.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.701bb809e9b4fc252021-12-21 11:31:08.693root 11241100x8000000000000000536750Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:08.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.14d370aed95d4b042021-12-21 11:31:08.693root 11241100x8000000000000000536751Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:08.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9397043a46dc5d4c2021-12-21 11:31:08.693root 11241100x8000000000000000536752Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:08.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.57246c8da8963f9c2021-12-21 11:31:08.693root 11241100x8000000000000000536753Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:08.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.03899cf5d33cde262021-12-21 11:31:08.693root 11241100x8000000000000000536754Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:08.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.064b102040e8ba392021-12-21 11:31:08.693root 11241100x8000000000000000536755Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:08.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5b091cf44b97bdc02021-12-21 11:31:08.693root 11241100x8000000000000000536756Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:08.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b44e736966f1abe92021-12-21 11:31:08.693root 11241100x8000000000000000536757Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:08.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.349c73e26143b4a02021-12-21 11:31:08.693root 11241100x8000000000000000536758Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:08.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.beffdd07bc51642e2021-12-21 11:31:08.694root 11241100x8000000000000000536759Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:08.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5f79ec3160d639222021-12-21 11:31:08.694root 11241100x8000000000000000536760Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:08.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.aa75be05d88f97f22021-12-21 11:31:08.694root 11241100x8000000000000000536761Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:08.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2e3fd036c422f5a92021-12-21 11:31:08.694root 11241100x8000000000000000536762Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:08.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7539fa705a9dc8392021-12-21 11:31:08.694root 11241100x8000000000000000536763Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:08.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.afc8daac6086d3cf2021-12-21 11:31:08.694root 11241100x8000000000000000536764Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:08.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.eb6732fcf5c3f4d32021-12-21 11:31:08.694root 11241100x8000000000000000536765Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:08.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.94a8ebecc8cc0c132021-12-21 11:31:08.694root 11241100x8000000000000000536766Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:08.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2fd867d8aac461e22021-12-21 11:31:08.694root 11241100x8000000000000000536767Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:08.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.00f8fb88fe622aea2021-12-21 11:31:08.694root 11241100x8000000000000000536768Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:08.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c0d6cd99404b4da22021-12-21 11:31:08.694root 11241100x8000000000000000536769Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:08.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d6de8b90a34492332021-12-21 11:31:08.694root 11241100x8000000000000000536770Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:09.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3e7803391a02ff5d2021-12-21 11:31:09.193root 11241100x8000000000000000536771Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:09.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3415d03de8d3345f2021-12-21 11:31:09.193root 11241100x8000000000000000536772Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:09.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0053e0c43b4839e52021-12-21 11:31:09.193root 11241100x8000000000000000536773Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:09.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a876c216b8d0d7502021-12-21 11:31:09.193root 11241100x8000000000000000536774Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:09.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.fb540c31f7baaa952021-12-21 11:31:09.193root 11241100x8000000000000000536775Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:09.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e417bed769e499a72021-12-21 11:31:09.193root 11241100x8000000000000000536776Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:09.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f450937a65c6e08a2021-12-21 11:31:09.193root 11241100x8000000000000000536777Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:09.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.51d5a99aa702e8012021-12-21 11:31:09.193root 11241100x8000000000000000536778Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:09.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7abf2160c2eab4d82021-12-21 11:31:09.193root 11241100x8000000000000000536779Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:09.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f570bb53cebcca2f2021-12-21 11:31:09.193root 11241100x8000000000000000536780Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:09.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0ca364db6bc4d03a2021-12-21 11:31:09.194root 11241100x8000000000000000536781Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:09.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2544eba0dbb6de6d2021-12-21 11:31:09.194root 11241100x8000000000000000536782Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:09.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a89217a0912fc01d2021-12-21 11:31:09.194root 11241100x8000000000000000536783Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:09.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.75e2725130915b632021-12-21 11:31:09.194root 11241100x8000000000000000536784Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:09.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4fe16524b4145a0c2021-12-21 11:31:09.194root 11241100x8000000000000000536785Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:09.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.95fb68d1531ded562021-12-21 11:31:09.194root 11241100x8000000000000000536786Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:09.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ca1308076dc6e1f82021-12-21 11:31:09.194root 11241100x8000000000000000536787Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:09.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ea000282e0c102992021-12-21 11:31:09.194root 11241100x8000000000000000536788Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:09.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0dcaf7665e6033712021-12-21 11:31:09.194root 11241100x8000000000000000536789Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:09.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ae8e7f880f3fc4f72021-12-21 11:31:09.194root 11241100x8000000000000000536790Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:09.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.66e5904401db79712021-12-21 11:31:09.194root 23542300x8000000000000000536791Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:09.248{ec2b6afe-95d2-61c1-3038-b84203560000}5272root/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/spool/splunk/tracker.log--- 11241100x8000000000000000536792Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:09.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8b82934b44def96e2021-12-21 11:31:09.693root 11241100x8000000000000000536793Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:09.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5bf2598d835459432021-12-21 11:31:09.693root 11241100x8000000000000000536794Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:09.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.052b17e7cedae8ea2021-12-21 11:31:09.693root 11241100x8000000000000000536795Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:09.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1f79aebc33ccecb42021-12-21 11:31:09.694root 11241100x8000000000000000536796Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:09.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.457cded3976c06aa2021-12-21 11:31:09.694root 11241100x8000000000000000536797Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:09.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0cb701ce788917ab2021-12-21 11:31:09.694root 11241100x8000000000000000536798Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:09.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ad716228cfa776342021-12-21 11:31:09.694root 11241100x8000000000000000536799Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:09.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.20b52eaf9465234b2021-12-21 11:31:09.694root 11241100x8000000000000000536800Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:09.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d9ee90bc07efa80e2021-12-21 11:31:09.694root 11241100x8000000000000000536801Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:09.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1f38e6bc1ebc128f2021-12-21 11:31:09.694root 11241100x8000000000000000536802Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:09.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.382957cd60be8e582021-12-21 11:31:09.694root 11241100x8000000000000000536803Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:09.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c3c9784558e860fd2021-12-21 11:31:09.694root 11241100x8000000000000000536804Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:09.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c92e0ab85cfb28d42021-12-21 11:31:09.694root 11241100x8000000000000000536805Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:09.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.be9b0425d02d2d432021-12-21 11:31:09.694root 11241100x8000000000000000536806Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:09.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.35bf0d89c2a0c2452021-12-21 11:31:09.694root 11241100x8000000000000000536807Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:09.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d1022aaaf38c58472021-12-21 11:31:09.694root 11241100x8000000000000000536808Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:09.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b37e55f15795e86e2021-12-21 11:31:09.694root 11241100x8000000000000000536809Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:09.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.072cad2cc6960acf2021-12-21 11:31:09.694root 11241100x8000000000000000536810Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:09.695{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ba4d49f10c8048352021-12-21 11:31:09.695root 11241100x8000000000000000536811Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:09.695{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.fabc1e9c490070bc2021-12-21 11:31:09.695root 11241100x8000000000000000536812Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:09.695{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f6947e9d57dc16042021-12-21 11:31:09.695root 11241100x8000000000000000536813Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:09.695{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1e4c095c018477b22021-12-21 11:31:09.695root 11241100x8000000000000000536814Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:10.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d7b6b74ce7294c342021-12-21 11:31:10.193root 11241100x8000000000000000536815Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:10.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.fc2e0f8be21149462021-12-21 11:31:10.193root 11241100x8000000000000000536816Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:10.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e77f7722b16271b32021-12-21 11:31:10.193root 11241100x8000000000000000536817Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:10.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c9c20eb19ef2391c2021-12-21 11:31:10.193root 11241100x8000000000000000536818Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:10.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d28b0836b20917472021-12-21 11:31:10.193root 11241100x8000000000000000536819Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:10.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f4168741f2ced9682021-12-21 11:31:10.193root 11241100x8000000000000000536820Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:10.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.89dd5c9cfb03ebf82021-12-21 11:31:10.193root 11241100x8000000000000000536821Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:10.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.091ae2d2d18cc8e92021-12-21 11:31:10.194root 11241100x8000000000000000536822Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:10.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8c0213d4d941418e2021-12-21 11:31:10.194root 11241100x8000000000000000536823Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:10.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e2ded6a84b8eec1d2021-12-21 11:31:10.194root 11241100x8000000000000000536824Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:10.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f5948e46f67807092021-12-21 11:31:10.194root 11241100x8000000000000000536825Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:10.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e2e2199c3c5088f22021-12-21 11:31:10.194root 11241100x8000000000000000536826Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:10.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a5945c5cd84683fe2021-12-21 11:31:10.194root 11241100x8000000000000000536827Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:10.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4d4f5df69d749a582021-12-21 11:31:10.194root 11241100x8000000000000000536828Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:10.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.78595dd12a54ab482021-12-21 11:31:10.194root 11241100x8000000000000000536829Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:10.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.25ace12dc5c6825d2021-12-21 11:31:10.194root 11241100x8000000000000000536830Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:10.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.89549640ad0086072021-12-21 11:31:10.194root 11241100x8000000000000000536831Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:10.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.21316ec87adc1dd72021-12-21 11:31:10.194root 11241100x8000000000000000536832Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:10.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.febe6988ea0c7b4e2021-12-21 11:31:10.194root 11241100x8000000000000000536833Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:10.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b832ed78a46a9ad62021-12-21 11:31:10.194root 11241100x8000000000000000536834Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:10.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.376c2ec775babfcb2021-12-21 11:31:10.194root 11241100x8000000000000000536835Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:10.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9e6fcd86c406fd622021-12-21 11:31:10.194root 354300x8000000000000000536836Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:10.258{ec2b6afe-95d9-61c1-5175-3a0400000000}5346/opt/splunkforwarder/etc/apps/Splunk_TA_stream/linux_x86_64/bin/streamfwdroottcptruefalse10.0.1.25-48654-false10.0.1.12-8000- 11241100x8000000000000000536837Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:10.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8c78a701b13353f42021-12-21 11:31:10.693root 11241100x8000000000000000536838Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:10.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.97c1428723ed01df2021-12-21 11:31:10.694root 11241100x8000000000000000536839Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:10.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.62b017e9b5c004662021-12-21 11:31:10.694root 11241100x8000000000000000536840Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:10.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.654f1136303cf64e2021-12-21 11:31:10.694root 11241100x8000000000000000536841Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:10.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b12c3e9f79a1aede2021-12-21 11:31:10.694root 11241100x8000000000000000536842Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:10.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1ff6e34b7bcd23262021-12-21 11:31:10.694root 11241100x8000000000000000536843Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:10.695{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5d7c9568514363652021-12-21 11:31:10.695root 11241100x8000000000000000536844Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:10.695{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ee472a7719bb3e482021-12-21 11:31:10.695root 11241100x8000000000000000536845Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:10.695{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3d40e063471caf992021-12-21 11:31:10.695root 11241100x8000000000000000536846Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:10.695{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.fc5faba3b1fdc74b2021-12-21 11:31:10.695root 11241100x8000000000000000536847Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:10.695{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.28e681709d30c9652021-12-21 11:31:10.695root 11241100x8000000000000000536848Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:10.695{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f3f64b554e87f3e52021-12-21 11:31:10.695root 11241100x8000000000000000536849Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:10.696{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c4b22fc15d7a4f6d2021-12-21 11:31:10.696root 11241100x8000000000000000536850Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:10.696{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8e8b04a5f35740a82021-12-21 11:31:10.696root 11241100x8000000000000000536851Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:10.696{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d2c0ef3bf0c41e7f2021-12-21 11:31:10.696root 11241100x8000000000000000536852Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:10.696{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1bd69b479bca894a2021-12-21 11:31:10.696root 11241100x8000000000000000536853Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:10.696{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9a3cd1f46006d0222021-12-21 11:31:10.696root 11241100x8000000000000000536854Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:10.696{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2b998d3d42d1433a2021-12-21 11:31:10.696root 11241100x8000000000000000536855Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:10.697{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e1516e389603ba1f2021-12-21 11:31:10.697root 11241100x8000000000000000536856Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:10.697{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7f44e841840612de2021-12-21 11:31:10.697root 11241100x8000000000000000536857Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:10.697{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f188464c714877522021-12-21 11:31:10.697root 11241100x8000000000000000536858Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:10.697{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ccd23e7c68aeba262021-12-21 11:31:10.697root 11241100x8000000000000000536859Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:10.697{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e8f16a3e4a55a54d2021-12-21 11:31:10.697root 11241100x8000000000000000536860Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:11.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ba97cb1962dbc4902021-12-21 11:31:11.193root 11241100x8000000000000000536861Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:11.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e4aa10a08db1bac22021-12-21 11:31:11.193root 11241100x8000000000000000536862Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:11.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ffc6fc35246b17522021-12-21 11:31:11.193root 11241100x8000000000000000536863Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:11.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.71b40e46bb57138b2021-12-21 11:31:11.194root 11241100x8000000000000000536864Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:11.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f6e7bb3cf1d2e3d62021-12-21 11:31:11.194root 11241100x8000000000000000536865Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:11.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3b14b744239826672021-12-21 11:31:11.194root 11241100x8000000000000000536866Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:11.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ed53dda41caaa6482021-12-21 11:31:11.194root 11241100x8000000000000000536867Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:11.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4ca1dda768f9ef782021-12-21 11:31:11.194root 11241100x8000000000000000536868Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:11.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.18ca757e4f53a1632021-12-21 11:31:11.194root 11241100x8000000000000000536869Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:11.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4f6e95a004352ca82021-12-21 11:31:11.194root 11241100x8000000000000000536870Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:11.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.34c0f049b51fdb1a2021-12-21 11:31:11.194root 11241100x8000000000000000536871Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:11.195{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.531ff525a006e2902021-12-21 11:31:11.195root 11241100x8000000000000000536872Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:11.195{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.fbade7487dcc38db2021-12-21 11:31:11.195root 11241100x8000000000000000536873Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:11.195{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a897aade2cc905ac2021-12-21 11:31:11.195root 11241100x8000000000000000536874Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:11.195{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a16484ee1fea0d672021-12-21 11:31:11.195root 11241100x8000000000000000536875Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:11.195{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0005acad3753ae9b2021-12-21 11:31:11.195root 11241100x8000000000000000536876Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:11.195{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6c6a11f1203d5d972021-12-21 11:31:11.195root 11241100x8000000000000000536877Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:11.195{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4d41d0e5877af8dc2021-12-21 11:31:11.195root 11241100x8000000000000000536878Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:11.195{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.85faf82b2d30dfcb2021-12-21 11:31:11.195root 11241100x8000000000000000536879Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:11.195{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ab30afe810c5ab252021-12-21 11:31:11.195root 11241100x8000000000000000536880Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:11.195{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8afa99f7fea30b082021-12-21 11:31:11.195root 11241100x8000000000000000536881Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:11.195{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5ce45de43f446b972021-12-21 11:31:11.195root 11241100x8000000000000000536882Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:11.195{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.aef231bd4b917a9d2021-12-21 11:31:11.195root 11241100x8000000000000000536883Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:11.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4dd0d95fd27b59ac2021-12-21 11:31:11.693root 11241100x8000000000000000536884Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:11.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.def6a2de5d9e27152021-12-21 11:31:11.693root 11241100x8000000000000000536885Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:11.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9286e71f508ddab72021-12-21 11:31:11.693root 11241100x8000000000000000536886Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:11.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9e53b5b7f7be0da82021-12-21 11:31:11.693root 11241100x8000000000000000536887Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:11.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.cd66d87471057d562021-12-21 11:31:11.693root 11241100x8000000000000000536888Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:11.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9d111bac30e9b5c32021-12-21 11:31:11.693root 11241100x8000000000000000536889Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:11.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8efdab244ffb5a022021-12-21 11:31:11.693root 11241100x8000000000000000536890Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:11.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f59cafe8ab017e3b2021-12-21 11:31:11.694root 11241100x8000000000000000536891Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:11.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9d4ec3932733fd8c2021-12-21 11:31:11.694root 11241100x8000000000000000536892Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:11.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0867f68f8b6d16d82021-12-21 11:31:11.694root 11241100x8000000000000000536893Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:11.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2bf2bb5e96ea26072021-12-21 11:31:11.694root 11241100x8000000000000000536894Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:11.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.eacdaacd60d155bb2021-12-21 11:31:11.694root 11241100x8000000000000000536895Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:11.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.675bc903c0d7f5c92021-12-21 11:31:11.694root 11241100x8000000000000000536896Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:11.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.cb8d43d6f1011ca02021-12-21 11:31:11.694root 11241100x8000000000000000536897Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:11.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.bcf89623f50a3d2a2021-12-21 11:31:11.694root 11241100x8000000000000000536898Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:11.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9a3e771062b2c7612021-12-21 11:31:11.694root 11241100x8000000000000000536899Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:11.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3961037f529fd8ac2021-12-21 11:31:11.694root 11241100x8000000000000000536900Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:11.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8e731f143f3775a12021-12-21 11:31:11.694root 11241100x8000000000000000536901Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:11.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.62b5a54a8a9739ab2021-12-21 11:31:11.694root 11241100x8000000000000000536902Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:11.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.256776faf31a60f22021-12-21 11:31:11.694root 11241100x8000000000000000536903Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:11.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7d59783e4bbfddc62021-12-21 11:31:11.694root 11241100x8000000000000000536904Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:11.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.edff47baf0789b1f2021-12-21 11:31:11.694root 11241100x8000000000000000536905Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:11.695{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a79e006e6df30ed32021-12-21 11:31:11.695root 11241100x8000000000000000536906Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:12.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3caf9039d430c37a2021-12-21 11:31:12.193root 11241100x8000000000000000536907Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:12.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7da04a7d1597d7212021-12-21 11:31:12.193root 11241100x8000000000000000536908Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:12.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.27db7806acdb39762021-12-21 11:31:12.193root 11241100x8000000000000000536909Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:12.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.35785d18f1d2c7012021-12-21 11:31:12.193root 11241100x8000000000000000536910Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:12.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b6f57617287786fa2021-12-21 11:31:12.193root 11241100x8000000000000000536911Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:12.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.10af0e854a1437102021-12-21 11:31:12.193root 11241100x8000000000000000536912Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:12.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4353979fe8c76e1b2021-12-21 11:31:12.193root 11241100x8000000000000000536913Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:12.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4b6cc57e02d4f58d2021-12-21 11:31:12.194root 11241100x8000000000000000536914Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:12.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.47cae424bc9844132021-12-21 11:31:12.194root 11241100x8000000000000000536915Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:12.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7e0a16490b478cc32021-12-21 11:31:12.194root 11241100x8000000000000000536916Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:12.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2a6d0c4385b799ab2021-12-21 11:31:12.194root 11241100x8000000000000000536917Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:12.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d632773ab087797d2021-12-21 11:31:12.194root 11241100x8000000000000000536918Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:12.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.212612b76909824c2021-12-21 11:31:12.194root 11241100x8000000000000000536919Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:12.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ab9aa0e92a4494282021-12-21 11:31:12.194root 11241100x8000000000000000536920Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:12.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6b85ee50e11376b92021-12-21 11:31:12.194root 11241100x8000000000000000536921Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:12.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.fa1f69c37e7401012021-12-21 11:31:12.194root 11241100x8000000000000000536922Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:12.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.16953c3aa2ae64212021-12-21 11:31:12.194root 11241100x8000000000000000536923Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:12.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.666e679463377aab2021-12-21 11:31:12.194root 11241100x8000000000000000536924Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:12.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9a137092d5b731eb2021-12-21 11:31:12.194root 11241100x8000000000000000536925Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:12.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f67bf7b53f5806c52021-12-21 11:31:12.194root 11241100x8000000000000000536926Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:12.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.42557e919ce605b22021-12-21 11:31:12.194root 11241100x8000000000000000536927Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:12.195{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d2cbf51cde70fce62021-12-21 11:31:12.195root 11241100x8000000000000000536928Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:12.195{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.dcea3ce4f7ff74402021-12-21 11:31:12.195root 11241100x8000000000000000536929Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:12.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2171bf183979a5802021-12-21 11:31:12.693root 11241100x8000000000000000536930Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:12.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f48e83197f7180472021-12-21 11:31:12.693root 11241100x8000000000000000536931Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:12.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c9d3c5895dd669d12021-12-21 11:31:12.693root 11241100x8000000000000000536932Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:12.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.015c12f8ce8b29ed2021-12-21 11:31:12.693root 11241100x8000000000000000536933Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:12.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a8627f76dad125be2021-12-21 11:31:12.693root 11241100x8000000000000000536934Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:12.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a3a178a858f5643a2021-12-21 11:31:12.694root 11241100x8000000000000000536935Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:12.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6b34c23f62af315c2021-12-21 11:31:12.694root 11241100x8000000000000000536936Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:12.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.51a28135c16c69ee2021-12-21 11:31:12.694root 11241100x8000000000000000536937Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:12.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.bd40bad20e64d3fe2021-12-21 11:31:12.694root 11241100x8000000000000000536938Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:12.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.18c3ff50a5d0593b2021-12-21 11:31:12.694root 11241100x8000000000000000536939Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:12.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9b793ec2099533322021-12-21 11:31:12.694root 11241100x8000000000000000536940Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:12.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f071e29da6e46a4a2021-12-21 11:31:12.694root 11241100x8000000000000000536941Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:12.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c74b88aadcf1c6dc2021-12-21 11:31:12.694root 11241100x8000000000000000536942Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:12.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3f023cbfb91f42c62021-12-21 11:31:12.694root 11241100x8000000000000000536943Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:12.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4761760d696065a32021-12-21 11:31:12.694root 11241100x8000000000000000536944Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:12.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5b4cb8c65ffaf45d2021-12-21 11:31:12.694root 11241100x8000000000000000536945Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:12.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6024bb5ded29761a2021-12-21 11:31:12.694root 11241100x8000000000000000536946Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:12.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9bf3f095ffb26ec22021-12-21 11:31:12.694root 11241100x8000000000000000536947Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:12.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.04788f6abc7be5ed2021-12-21 11:31:12.694root 11241100x8000000000000000536948Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:12.695{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.316cb431b6b6861d2021-12-21 11:31:12.695root 11241100x8000000000000000536949Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:12.695{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.230eb42149c669802021-12-21 11:31:12.695root 11241100x8000000000000000536950Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:12.695{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f9bd744dc943d2a22021-12-21 11:31:12.695root 11241100x8000000000000000536951Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:12.695{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.acbf04be9914141d2021-12-21 11:31:12.695root 11241100x8000000000000000536952Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:13.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.dcdca33d63aa69cf2021-12-21 11:31:13.193root 11241100x8000000000000000536953Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:13.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0f0e0b62d12bc9f92021-12-21 11:31:13.193root 11241100x8000000000000000536954Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:13.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5decd93e7c0730b02021-12-21 11:31:13.193root 11241100x8000000000000000536955Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:13.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4c557d9cd69e7b8c2021-12-21 11:31:13.193root 11241100x8000000000000000536956Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:13.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.fa83c8b0166835132021-12-21 11:31:13.193root 11241100x8000000000000000536957Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:13.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a5b392eee9a022102021-12-21 11:31:13.193root 11241100x8000000000000000536958Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:13.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a862dc453f31487c2021-12-21 11:31:13.193root 11241100x8000000000000000536959Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:13.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2bbe4e966e8b075f2021-12-21 11:31:13.193root 11241100x8000000000000000536960Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:13.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a7ce5a9bfccbdd9b2021-12-21 11:31:13.193root 11241100x8000000000000000536961Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:13.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.25e11bccc8b281622021-12-21 11:31:13.193root 11241100x8000000000000000536962Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:13.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.da350a1a66b9ecda2021-12-21 11:31:13.193root 11241100x8000000000000000536963Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:13.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c5deb9d1b9e00ed92021-12-21 11:31:13.193root 11241100x8000000000000000536964Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:13.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7c0560e86459c0262021-12-21 11:31:13.193root 11241100x8000000000000000536965Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:13.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f3bc7c279aac3d882021-12-21 11:31:13.193root 11241100x8000000000000000536966Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:13.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.aed444aca954e0762021-12-21 11:31:13.193root 11241100x8000000000000000536967Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:13.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.14c40a750dfde2242021-12-21 11:31:13.194root 11241100x8000000000000000536968Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:13.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.dc1047e61c6aa9e32021-12-21 11:31:13.194root 11241100x8000000000000000536969Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:13.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d2207d7ca71bcb5d2021-12-21 11:31:13.194root 11241100x8000000000000000536970Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:13.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.cccdd7081ce7b6242021-12-21 11:31:13.194root 11241100x8000000000000000536971Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:13.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.76ed9dce3c7ec0922021-12-21 11:31:13.194root 11241100x8000000000000000536972Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:13.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.916ea6774cbf2a9d2021-12-21 11:31:13.194root 11241100x8000000000000000536973Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:13.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.49c43efa78693b712021-12-21 11:31:13.194root 11241100x8000000000000000536974Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:13.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.fdbd511f71c676a22021-12-21 11:31:13.194root 11241100x8000000000000000536975Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:13.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.cd6d7d6bc596ec252021-12-21 11:31:13.194root 11241100x8000000000000000536976Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:13.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e4594ca3e3e7696e2021-12-21 11:31:13.194root 11241100x8000000000000000536977Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:13.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.04c35d65ca3ddb3c2021-12-21 11:31:13.693root 11241100x8000000000000000536978Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:13.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9e45aa43df5751a72021-12-21 11:31:13.693root 11241100x8000000000000000536979Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:13.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8429567dea1e6c012021-12-21 11:31:13.693root 11241100x8000000000000000536980Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:13.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a6563bce0eae99362021-12-21 11:31:13.693root 11241100x8000000000000000536981Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:13.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.843624ae2c81c8a12021-12-21 11:31:13.693root 11241100x8000000000000000536982Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:13.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.fbb977ddddd3771f2021-12-21 11:31:13.693root 11241100x8000000000000000536983Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:13.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a03600e7fcb958f52021-12-21 11:31:13.693root 11241100x8000000000000000536984Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:13.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a7e0ac19a48664ed2021-12-21 11:31:13.693root 11241100x8000000000000000536985Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:13.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d278b04e0033135d2021-12-21 11:31:13.693root 11241100x8000000000000000536986Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:13.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.fd02db9ce6de04962021-12-21 11:31:13.693root 11241100x8000000000000000536987Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:13.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3d489b0d8f22dc862021-12-21 11:31:13.693root 11241100x8000000000000000536988Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:13.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.645df8e5405a9c802021-12-21 11:31:13.693root 11241100x8000000000000000536989Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:13.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.68ad44b0f34ec7d02021-12-21 11:31:13.693root 11241100x8000000000000000536990Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:13.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8c5a04d3b330bf4f2021-12-21 11:31:13.693root 11241100x8000000000000000536991Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:13.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ff31bca0800346442021-12-21 11:31:13.694root 11241100x8000000000000000536992Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:13.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5a5556dd6b3a3e8f2021-12-21 11:31:13.694root 11241100x8000000000000000536993Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:13.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d9d9a980aeebcd112021-12-21 11:31:13.694root 11241100x8000000000000000536994Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:13.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0afff4a6fda69e412021-12-21 11:31:13.694root 11241100x8000000000000000536995Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:13.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.19177b8cb6e73a752021-12-21 11:31:13.694root 11241100x8000000000000000536996Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:13.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.304a591c79fcbbf72021-12-21 11:31:13.694root 11241100x8000000000000000536997Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:13.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.95cee388e72275b32021-12-21 11:31:13.694root 11241100x8000000000000000536998Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:13.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d1245d6036a8f11e2021-12-21 11:31:13.694root 11241100x8000000000000000536999Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:13.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d57a1b96d4293c692021-12-21 11:31:13.694root 11241100x8000000000000000537000Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:13.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9f9eb342e3197b672021-12-21 11:31:13.694root 11241100x8000000000000000537001Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:13.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1f4247661b469d0c2021-12-21 11:31:13.694root 11241100x8000000000000000537002Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:13.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ea76c633b74828ca2021-12-21 11:31:13.694root 11241100x8000000000000000537003Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:14.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.904f1053a31eb3f92021-12-21 11:31:14.193root 11241100x8000000000000000537004Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:14.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.55b1efb0b2c686282021-12-21 11:31:14.193root 11241100x8000000000000000537005Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:14.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.85d0bd91dec604512021-12-21 11:31:14.193root 11241100x8000000000000000537006Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:14.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.920c1da3b06304182021-12-21 11:31:14.193root 11241100x8000000000000000537007Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:14.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d9ae35b1c87bbd342021-12-21 11:31:14.193root 11241100x8000000000000000537008Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:14.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6190a3bde085e6962021-12-21 11:31:14.194root 11241100x8000000000000000537009Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:14.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.54d30b46f42dc2892021-12-21 11:31:14.194root 11241100x8000000000000000537010Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:14.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.799045937c717ef02021-12-21 11:31:14.194root 11241100x8000000000000000537011Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:14.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f8c7ab6134c3cf652021-12-21 11:31:14.194root 11241100x8000000000000000537012Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:14.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a3023787ac21e4fd2021-12-21 11:31:14.194root 11241100x8000000000000000537013Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:14.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ed9cfd923356f0a72021-12-21 11:31:14.194root 11241100x8000000000000000537014Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:14.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4b8067caf53595b32021-12-21 11:31:14.194root 11241100x8000000000000000537015Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:14.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.00c8f03b80867b1e2021-12-21 11:31:14.194root 11241100x8000000000000000537016Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:14.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a3d954c399a4da742021-12-21 11:31:14.194root 11241100x8000000000000000537017Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:14.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.50a006fcca6437022021-12-21 11:31:14.194root 11241100x8000000000000000537018Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:14.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ba8f368fa5427af42021-12-21 11:31:14.194root 11241100x8000000000000000537019Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:14.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.414b7ad010c002ba2021-12-21 11:31:14.194root 11241100x8000000000000000537020Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:14.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a5ae30cedeb217c62021-12-21 11:31:14.194root 11241100x8000000000000000537021Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:14.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4fe6a06cda85ac4b2021-12-21 11:31:14.194root 11241100x8000000000000000537022Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:14.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9a9c54d5cda3da5c2021-12-21 11:31:14.194root 11241100x8000000000000000537023Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:14.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.72dcbc1a0110072f2021-12-21 11:31:14.194root 11241100x8000000000000000537024Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:14.195{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4ac61a63f6435ac22021-12-21 11:31:14.195root 11241100x8000000000000000537025Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:14.195{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a6d53af773014ca12021-12-21 11:31:14.195root 11241100x8000000000000000537026Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:14.699{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7a51eea70a932d222021-12-21 11:31:14.699root 11241100x8000000000000000537027Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:14.699{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c6f65bb98484bd5a2021-12-21 11:31:14.699root 11241100x8000000000000000537028Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:14.699{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a8f5285e00903a052021-12-21 11:31:14.699root 11241100x8000000000000000537029Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:14.699{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2e116fc00f0b77842021-12-21 11:31:14.699root 11241100x8000000000000000537030Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:14.699{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2b5e2f0650fff7072021-12-21 11:31:14.699root 11241100x8000000000000000537031Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:14.699{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.01dce6e38c70da402021-12-21 11:31:14.699root 11241100x8000000000000000537032Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:14.699{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.59341fab582ea9082021-12-21 11:31:14.699root 11241100x8000000000000000537033Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:14.699{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1efb451d024226912021-12-21 11:31:14.699root 11241100x8000000000000000537034Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:14.699{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b98cc6901ec026692021-12-21 11:31:14.699root 11241100x8000000000000000537035Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:14.699{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.eb1424c90aad9c4c2021-12-21 11:31:14.699root 11241100x8000000000000000537036Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:14.699{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.def73ee524ac16432021-12-21 11:31:14.699root 11241100x8000000000000000537037Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:14.699{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.df065999aa583a422021-12-21 11:31:14.699root 11241100x8000000000000000537038Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:14.700{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4572fbeb81e670482021-12-21 11:31:14.700root 11241100x8000000000000000537039Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:14.700{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.994b82b7844304cc2021-12-21 11:31:14.700root 11241100x8000000000000000537040Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:14.700{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9193f68651625a342021-12-21 11:31:14.700root 11241100x8000000000000000537041Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:14.700{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7285544695462bb02021-12-21 11:31:14.700root 11241100x8000000000000000537042Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:14.700{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ef589dea9488cdca2021-12-21 11:31:14.700root 11241100x8000000000000000537043Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:14.700{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0f67a684deb752512021-12-21 11:31:14.700root 11241100x8000000000000000537044Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:14.700{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5dba96bdb7303d062021-12-21 11:31:14.700root 11241100x8000000000000000537045Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:14.700{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.61cf5c621d3d002e2021-12-21 11:31:14.700root 11241100x8000000000000000537046Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:14.700{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.119d3ed3202d6fc52021-12-21 11:31:14.700root 11241100x8000000000000000537047Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:14.700{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.47c5d8cd6af7568d2021-12-21 11:31:14.700root 11241100x8000000000000000537048Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:14.701{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.cf75c5c3cd1ea0a52021-12-21 11:31:14.701root 11241100x8000000000000000537049Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:15.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.14ce6194cfcf335d2021-12-21 11:31:15.193root 11241100x8000000000000000537050Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:15.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4a92a0b452e7eca02021-12-21 11:31:15.193root 11241100x8000000000000000537051Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:15.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9e386b027653d5ee2021-12-21 11:31:15.193root 11241100x8000000000000000537052Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:15.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.574441891ababcec2021-12-21 11:31:15.193root 11241100x8000000000000000537053Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:15.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e32cf29b75c20bb02021-12-21 11:31:15.193root 11241100x8000000000000000537054Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:15.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f808a798a59dd9102021-12-21 11:31:15.193root 11241100x8000000000000000537055Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:15.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b86f1be1f39ec4fd2021-12-21 11:31:15.194root 11241100x8000000000000000537056Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:15.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.10f2820d5418d4a72021-12-21 11:31:15.194root 11241100x8000000000000000537057Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:15.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.958a7eab075f71aa2021-12-21 11:31:15.194root 11241100x8000000000000000537058Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:15.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.79ae593511f625072021-12-21 11:31:15.194root 11241100x8000000000000000537059Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:15.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a360980b10c43b442021-12-21 11:31:15.194root 11241100x8000000000000000537060Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:15.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4a465aac7da6120d2021-12-21 11:31:15.194root 11241100x8000000000000000537061Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:15.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4698737ab25f9cff2021-12-21 11:31:15.194root 11241100x8000000000000000537062Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:15.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1865dbfe6e60d2c82021-12-21 11:31:15.194root 11241100x8000000000000000537063Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:15.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c12ab3a536aa46a02021-12-21 11:31:15.194root 11241100x8000000000000000537064Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:15.195{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2f6d05b87f30e8ab2021-12-21 11:31:15.195root 11241100x8000000000000000537065Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:15.195{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.07aa2447f78741872021-12-21 11:31:15.195root 11241100x8000000000000000537066Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:15.195{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.fa77d8419569fce32021-12-21 11:31:15.195root 11241100x8000000000000000537067Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:15.195{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.23ccda63ce8892f52021-12-21 11:31:15.195root 11241100x8000000000000000537068Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:15.195{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0f31c29360670e3f2021-12-21 11:31:15.195root 11241100x8000000000000000537069Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:15.195{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.bd74135a267dba442021-12-21 11:31:15.195root 11241100x8000000000000000537070Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:15.195{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.fc042624e552ba3f2021-12-21 11:31:15.195root 11241100x8000000000000000537071Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:15.195{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.71e4f6801eee50802021-12-21 11:31:15.195root 11241100x8000000000000000537072Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:15.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a9d6b33c6e7076402021-12-21 11:31:15.693root 11241100x8000000000000000537073Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:15.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.140f1e31abc4f3cf2021-12-21 11:31:15.693root 11241100x8000000000000000537074Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:15.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b8a6a3ae56b1fd722021-12-21 11:31:15.693root 11241100x8000000000000000537075Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:15.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d8a449091b7acc5f2021-12-21 11:31:15.693root 11241100x8000000000000000537076Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:15.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.974fca0001e24ed72021-12-21 11:31:15.693root 11241100x8000000000000000537077Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:15.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6b834eade6c676f92021-12-21 11:31:15.693root 11241100x8000000000000000537078Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:15.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ec0ff295c1a42f8a2021-12-21 11:31:15.693root 11241100x8000000000000000537079Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:15.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.971305b0ca2402072021-12-21 11:31:15.693root 11241100x8000000000000000537080Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:15.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3abe71f8c0253c402021-12-21 11:31:15.693root 11241100x8000000000000000537081Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:15.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a93edf23532df8872021-12-21 11:31:15.694root 11241100x8000000000000000537082Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:15.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.847feb078c3724572021-12-21 11:31:15.694root 11241100x8000000000000000537083Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:15.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e758fb3493bc5c772021-12-21 11:31:15.694root 11241100x8000000000000000537084Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:15.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.bb99269eb7baf2ae2021-12-21 11:31:15.694root 11241100x8000000000000000537085Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:15.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1af82a95c098c8d02021-12-21 11:31:15.694root 11241100x8000000000000000537086Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:15.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.fca6905d733c671f2021-12-21 11:31:15.694root 11241100x8000000000000000537087Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:15.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8e07e36fe552a8ba2021-12-21 11:31:15.694root 11241100x8000000000000000537088Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:15.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c15ffd8edaa8722e2021-12-21 11:31:15.694root 11241100x8000000000000000537089Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:15.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.101936015a61cdf12021-12-21 11:31:15.694root 11241100x8000000000000000537090Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:15.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.fe1bce5fdf7ea7362021-12-21 11:31:15.694root 11241100x8000000000000000537091Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:15.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.77913b64e0253c362021-12-21 11:31:15.694root 11241100x8000000000000000537092Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:15.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c1a22e73595f41142021-12-21 11:31:15.694root 11241100x8000000000000000537093Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:15.695{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.47779ca7297fc19b2021-12-21 11:31:15.695root 11241100x8000000000000000537094Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:15.695{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.52eda8e1356d659b2021-12-21 11:31:15.695root 354300x8000000000000000537095Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:16.140{ec2b6afe-95d9-61c1-5175-3a0400000000}5346/opt/splunkforwarder/etc/apps/Splunk_TA_stream/linux_x86_64/bin/streamfwdroottcptruefalse10.0.1.25-48656-false10.0.1.12-8000- 11241100x8000000000000000537096Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:16.142{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.65de5444f6b576012021-12-21 11:31:16.142root 11241100x8000000000000000537097Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:16.142{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.33877b24f7a06d0e2021-12-21 11:31:16.142root 11241100x8000000000000000537098Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:16.142{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e09eacb81e6d83482021-12-21 11:31:16.142root 11241100x8000000000000000537099Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:16.142{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b6c5771b4e4e6e4b2021-12-21 11:31:16.142root 11241100x8000000000000000537100Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:16.142{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4002727fc0740cc72021-12-21 11:31:16.142root 11241100x8000000000000000537101Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:16.142{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0e7953b39a8a13c02021-12-21 11:31:16.142root 11241100x8000000000000000537102Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:16.142{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.97f9ab821e03e0682021-12-21 11:31:16.142root 11241100x8000000000000000537103Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:16.142{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.afe31e536c5da5162021-12-21 11:31:16.142root 11241100x8000000000000000537104Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:16.142{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.32ece128014baba42021-12-21 11:31:16.142root 11241100x8000000000000000537105Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:16.142{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.170fda6c698171772021-12-21 11:31:16.142root 11241100x8000000000000000537106Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:16.142{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2e11e917abea90032021-12-21 11:31:16.142root 11241100x8000000000000000537107Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:16.143{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.38791aa0d90b1cd22021-12-21 11:31:16.143root 11241100x8000000000000000537108Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:16.143{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.cdfc1a1fa14ef2182021-12-21 11:31:16.143root 11241100x8000000000000000537109Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:16.143{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.62eaf2f34b7c56982021-12-21 11:31:16.143root 11241100x8000000000000000537110Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:16.143{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4c98cae78847cb0c2021-12-21 11:31:16.143root 11241100x8000000000000000537111Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:16.143{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.dcd100dc77879d7a2021-12-21 11:31:16.143root 11241100x8000000000000000537112Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:16.143{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3e59619da18996532021-12-21 11:31:16.143root 11241100x8000000000000000537113Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:16.143{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f9e19a202ff8e53e2021-12-21 11:31:16.143root 11241100x8000000000000000537114Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:16.144{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.31bc79d37f25682d2021-12-21 11:31:16.144root 11241100x8000000000000000537115Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:16.144{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8c6279beee5105522021-12-21 11:31:16.144root 11241100x8000000000000000537116Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:16.144{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3c99e06fc8d2f8a02021-12-21 11:31:16.144root 11241100x8000000000000000537117Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:16.144{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.cb6e3c12855cfe632021-12-21 11:31:16.144root 11241100x8000000000000000537118Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:16.144{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.341a49aa0abe809c2021-12-21 11:31:16.144root 11241100x8000000000000000537119Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:16.144{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1c61b3955ef522172021-12-21 11:31:16.144root 11241100x8000000000000000537120Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:16.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.299ce184a2ccaf242021-12-21 11:31:16.443root 11241100x8000000000000000537121Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:16.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c3a97f92d9a743082021-12-21 11:31:16.443root 11241100x8000000000000000537122Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:16.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.035075d53dd877632021-12-21 11:31:16.443root 11241100x8000000000000000537123Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:16.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.82cf090a3f00e0ff2021-12-21 11:31:16.444root 11241100x8000000000000000537124Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:16.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0d9d0eeff715131c2021-12-21 11:31:16.444root 11241100x8000000000000000537125Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:16.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.17e3eaf5b19bd0502021-12-21 11:31:16.444root 11241100x8000000000000000537126Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:16.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.aa649824015e91312021-12-21 11:31:16.444root 11241100x8000000000000000537127Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:16.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.39ed022e713f8a4e2021-12-21 11:31:16.444root 11241100x8000000000000000537128Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:16.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6cf1ed39986afe1a2021-12-21 11:31:16.445root 11241100x8000000000000000537129Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:16.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.db0b78f9c06c93cd2021-12-21 11:31:16.445root 11241100x8000000000000000537130Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:16.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b81dfa089ac1367e2021-12-21 11:31:16.445root 11241100x8000000000000000537131Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:16.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7dca2e37783a63072021-12-21 11:31:16.445root 11241100x8000000000000000537132Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:16.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.66c99ca8e3a6107f2021-12-21 11:31:16.445root 11241100x8000000000000000537133Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:16.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e83733deda5d9ae32021-12-21 11:31:16.445root 11241100x8000000000000000537134Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:16.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a24d8dd1ddbd2bf62021-12-21 11:31:16.445root 11241100x8000000000000000537135Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:16.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8edf700f9d117d4d2021-12-21 11:31:16.445root 11241100x8000000000000000537136Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:16.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.cc0ea4670ac86b3e2021-12-21 11:31:16.445root 11241100x8000000000000000537137Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:16.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a6ee9decc65098202021-12-21 11:31:16.445root 11241100x8000000000000000537138Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:16.446{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.bbeffa6dce5d2d602021-12-21 11:31:16.446root 11241100x8000000000000000537139Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:16.446{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.01ce290b86775c0c2021-12-21 11:31:16.446root 11241100x8000000000000000537140Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:16.446{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5e70eba95b60f8782021-12-21 11:31:16.446root 11241100x8000000000000000537141Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:16.446{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.18e865801083457b2021-12-21 11:31:16.446root 11241100x8000000000000000537142Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:16.446{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.197f4fa23c4fed162021-12-21 11:31:16.446root 11241100x8000000000000000537143Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:16.446{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3605e10ef029f98c2021-12-21 11:31:16.446root 11241100x8000000000000000537144Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:16.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3f6d8eddce8d81092021-12-21 11:31:16.943root 11241100x8000000000000000537145Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:16.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.23de67af5e562fac2021-12-21 11:31:16.943root 11241100x8000000000000000537146Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:16.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1c790c41d9dbf5892021-12-21 11:31:16.944root 11241100x8000000000000000537147Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:16.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.80fe6b1840a026782021-12-21 11:31:16.944root 11241100x8000000000000000537148Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:16.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.17738df43b2466fc2021-12-21 11:31:16.944root 11241100x8000000000000000537149Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:16.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2cb63ee847faec392021-12-21 11:31:16.944root 11241100x8000000000000000537150Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:16.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.80c867e32956f0102021-12-21 11:31:16.944root 11241100x8000000000000000537151Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:16.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.704100d5231230512021-12-21 11:31:16.944root 11241100x8000000000000000537152Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:16.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e0233b756b24a2782021-12-21 11:31:16.944root 11241100x8000000000000000537153Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:16.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1da0f93d5786c9632021-12-21 11:31:16.944root 11241100x8000000000000000537154Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:16.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.719c2385959f07032021-12-21 11:31:16.944root 11241100x8000000000000000537155Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:16.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.27ba15dc21d35c362021-12-21 11:31:16.944root 11241100x8000000000000000537156Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:16.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.44f54d2b10e111f32021-12-21 11:31:16.944root 11241100x8000000000000000537157Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:16.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.bc30da299ad611f92021-12-21 11:31:16.945root 11241100x8000000000000000537158Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:16.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a203b0ade3400daa2021-12-21 11:31:16.945root 11241100x8000000000000000537159Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:16.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6ab8e86ae40b010c2021-12-21 11:31:16.945root 11241100x8000000000000000537160Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:16.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.519712a8eaee08112021-12-21 11:31:16.945root 11241100x8000000000000000537161Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:16.946{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.23fcd1a20d4376c72021-12-21 11:31:16.946root 11241100x8000000000000000537162Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:16.946{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0a595895aa9bda1d2021-12-21 11:31:16.946root 11241100x8000000000000000537163Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:16.946{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.68df4ad95a159ee72021-12-21 11:31:16.946root 11241100x8000000000000000537164Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:16.946{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.aeb25c8a2a4415762021-12-21 11:31:16.946root 11241100x8000000000000000537165Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:16.946{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e31d97490e3b7c502021-12-21 11:31:16.946root 11241100x8000000000000000537166Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:16.946{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9f2116e81c1a8e812021-12-21 11:31:16.946root 11241100x8000000000000000537167Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:16.946{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.944dd6d05ac3d9f52021-12-21 11:31:16.946root 11241100x8000000000000000537168Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:17.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f6e3d8b6086783842021-12-21 11:31:17.443root 11241100x8000000000000000537169Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:17.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5e37a3dc01fe22672021-12-21 11:31:17.443root 11241100x8000000000000000537170Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:17.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7e54cf8e4421770e2021-12-21 11:31:17.443root 11241100x8000000000000000537171Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:17.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0c66844f64b5e1802021-12-21 11:31:17.443root 11241100x8000000000000000537172Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:17.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.061b3225c18907732021-12-21 11:31:17.443root 11241100x8000000000000000537173Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:17.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7b45c66bcc76888f2021-12-21 11:31:17.443root 11241100x8000000000000000537174Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:17.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.dbbcc496c024eb382021-12-21 11:31:17.443root 11241100x8000000000000000537175Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:17.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a1fd021c86228c3c2021-12-21 11:31:17.444root 11241100x8000000000000000537176Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:17.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.60db9fa4a57349be2021-12-21 11:31:17.444root 11241100x8000000000000000537177Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:17.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3f129ee2d2caa36b2021-12-21 11:31:17.444root 11241100x8000000000000000537178Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:17.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.bf9719e7da50f31f2021-12-21 11:31:17.444root 11241100x8000000000000000537179Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:17.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.687b82a68ef5eb6c2021-12-21 11:31:17.444root 11241100x8000000000000000537180Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:17.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7b2b5c70c1a09b4a2021-12-21 11:31:17.444root 11241100x8000000000000000537181Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:17.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.75f23555331769572021-12-21 11:31:17.444root 11241100x8000000000000000537182Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:17.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2151c961ee4799492021-12-21 11:31:17.444root 11241100x8000000000000000537183Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:17.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5c7909ef8ea592d92021-12-21 11:31:17.444root 11241100x8000000000000000537184Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:17.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f1e9c40fdde690722021-12-21 11:31:17.444root 11241100x8000000000000000537185Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:17.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2933ced68e8015752021-12-21 11:31:17.444root 11241100x8000000000000000537186Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:17.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.31e6f219b44b40f92021-12-21 11:31:17.445root 11241100x8000000000000000537187Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:17.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.87a0ccaca41395c72021-12-21 11:31:17.445root 11241100x8000000000000000537188Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:17.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c7065bdb56d203012021-12-21 11:31:17.445root 11241100x8000000000000000537189Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:17.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8b4c421d0e1d42c52021-12-21 11:31:17.445root 11241100x8000000000000000537190Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:17.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8848253d819303912021-12-21 11:31:17.445root 11241100x8000000000000000537191Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:17.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.373aa032bbcabe362021-12-21 11:31:17.445root 11241100x8000000000000000537192Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:17.942{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2a638a63053a75622021-12-21 11:31:17.942root 11241100x8000000000000000537193Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:17.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a7b183cd2e0a6b7c2021-12-21 11:31:17.943root 11241100x8000000000000000537194Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:17.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.73d9f6531881adb02021-12-21 11:31:17.943root 11241100x8000000000000000537195Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:17.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5297c57e64868ac72021-12-21 11:31:17.943root 11241100x8000000000000000537196Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:17.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d55a1c1ccf5327eb2021-12-21 11:31:17.943root 11241100x8000000000000000537197Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:17.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3e18ad47b4aa57942021-12-21 11:31:17.943root 11241100x8000000000000000537198Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:17.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ac90fe27545c8d202021-12-21 11:31:17.943root 11241100x8000000000000000537199Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:17.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.06e4cb300d0fea5d2021-12-21 11:31:17.943root 11241100x8000000000000000537200Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:17.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8ae4788d468707f32021-12-21 11:31:17.943root 11241100x8000000000000000537201Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:17.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.701f4977cfac36cd2021-12-21 11:31:17.943root 11241100x8000000000000000537202Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:17.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.666cec34a47cd97c2021-12-21 11:31:17.943root 11241100x8000000000000000537203Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:17.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ff20df4a7eabe5fc2021-12-21 11:31:17.943root 11241100x8000000000000000537204Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:17.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.632b0e7f841efb7e2021-12-21 11:31:17.943root 11241100x8000000000000000537205Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:17.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e3a4f0072f5060a62021-12-21 11:31:17.943root 11241100x8000000000000000537206Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:17.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.519f988f7bdf02392021-12-21 11:31:17.944root 11241100x8000000000000000537207Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:17.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ae2e3074921bb6ed2021-12-21 11:31:17.944root 11241100x8000000000000000537208Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:17.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.47abff3ee6e78aae2021-12-21 11:31:17.944root 11241100x8000000000000000537209Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:17.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5002e4c984add1c52021-12-21 11:31:17.944root 11241100x8000000000000000537210Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:17.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4a8c67b246192d3e2021-12-21 11:31:17.944root 11241100x8000000000000000537211Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:17.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1cc6d85f2eb01e0d2021-12-21 11:31:17.944root 11241100x8000000000000000537212Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:17.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1a498f2907271da92021-12-21 11:31:17.944root 11241100x8000000000000000537213Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:17.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e8b9a186eb523d782021-12-21 11:31:17.944root 11241100x8000000000000000537214Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:17.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d9ae2442e33d798a2021-12-21 11:31:17.945root 11241100x8000000000000000537215Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:17.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.03e3db65cd6f5e352021-12-21 11:31:17.945root 11241100x8000000000000000537216Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:17.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.efcba61fbc86cd432021-12-21 11:31:17.945root 11241100x8000000000000000537217Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:18.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.32cfb4808f46153d2021-12-21 11:31:18.443root 11241100x8000000000000000537218Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:18.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c43c52d537f4d91a2021-12-21 11:31:18.443root 11241100x8000000000000000537219Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:18.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.eb0fcd9cca34f4992021-12-21 11:31:18.443root 11241100x8000000000000000537220Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:18.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7d2221f79ea733212021-12-21 11:31:18.444root 11241100x8000000000000000537221Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:18.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1031b09adcef71a02021-12-21 11:31:18.444root 11241100x8000000000000000537222Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:18.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.53a18de4bef359932021-12-21 11:31:18.444root 11241100x8000000000000000537223Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:18.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a2143dd2893470e92021-12-21 11:31:18.444root 11241100x8000000000000000537224Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:18.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.43177e3348a92aa62021-12-21 11:31:18.444root 11241100x8000000000000000537225Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:18.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.68835b812e81fa882021-12-21 11:31:18.444root 11241100x8000000000000000537226Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:18.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.51692706af12e2222021-12-21 11:31:18.444root 11241100x8000000000000000537227Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:18.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.68c8aacf18c367762021-12-21 11:31:18.444root 11241100x8000000000000000537228Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:18.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.70e212dc933bc2552021-12-21 11:31:18.444root 11241100x8000000000000000537229Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:18.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.91b6b3e5b4b6c5f82021-12-21 11:31:18.444root 11241100x8000000000000000537230Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:18.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6b48d425b83ae9e92021-12-21 11:31:18.445root 11241100x8000000000000000537231Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:18.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.89708eae5bfc18ce2021-12-21 11:31:18.445root 11241100x8000000000000000537232Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:18.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.902e49776673e7de2021-12-21 11:31:18.445root 11241100x8000000000000000537233Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:18.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9565a2b7c1ca050c2021-12-21 11:31:18.445root 11241100x8000000000000000537234Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:18.446{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.87eb84037c5ae0172021-12-21 11:31:18.446root 11241100x8000000000000000537235Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:18.446{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6da9e835af178cd12021-12-21 11:31:18.446root 11241100x8000000000000000537236Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:18.446{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a21135f9998f20ac2021-12-21 11:31:18.446root 11241100x8000000000000000537237Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:18.446{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5988c04886537f4f2021-12-21 11:31:18.446root 11241100x8000000000000000537238Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:18.446{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1b6403597b30d2ab2021-12-21 11:31:18.446root 11241100x8000000000000000537239Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:18.447{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.31cc564eb50aa00c2021-12-21 11:31:18.447root 11241100x8000000000000000537240Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:18.447{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d6f25261a1c5fb152021-12-21 11:31:18.447root 11241100x8000000000000000537241Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:18.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.44b81b66dc3f53ea2021-12-21 11:31:18.943root 11241100x8000000000000000537242Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:18.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1f1cb2666ccc50402021-12-21 11:31:18.943root 11241100x8000000000000000537243Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:18.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.abd9d879ae9b8f762021-12-21 11:31:18.943root 11241100x8000000000000000537244Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:18.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6ed357e5aaf520bb2021-12-21 11:31:18.943root 11241100x8000000000000000537245Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:18.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.318c610f230ecfed2021-12-21 11:31:18.943root 11241100x8000000000000000537246Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:18.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.23e82257849ed9aa2021-12-21 11:31:18.944root 11241100x8000000000000000537247Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:18.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c3a38aea88fa72462021-12-21 11:31:18.944root 11241100x8000000000000000537248Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:18.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ee621d693f247b432021-12-21 11:31:18.944root 11241100x8000000000000000537249Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:18.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f2089fffd21c73d32021-12-21 11:31:18.944root 11241100x8000000000000000537250Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:18.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c39b3cd7ff77ba012021-12-21 11:31:18.944root 11241100x8000000000000000537251Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:18.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.cbecc47edd30de7e2021-12-21 11:31:18.944root 11241100x8000000000000000537252Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:18.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.93d8cce114cc43d02021-12-21 11:31:18.944root 11241100x8000000000000000537253Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:18.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c86d61962f04f98c2021-12-21 11:31:18.944root 11241100x8000000000000000537254Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:18.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.946f048dcdbc8c042021-12-21 11:31:18.944root 11241100x8000000000000000537255Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:18.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f4cba1c656f739ce2021-12-21 11:31:18.944root 11241100x8000000000000000537256Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:18.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e09317b910723ca92021-12-21 11:31:18.944root 11241100x8000000000000000537257Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:18.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.bacec7f3235027732021-12-21 11:31:18.944root 11241100x8000000000000000537258Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:18.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7d0e92ea249f02322021-12-21 11:31:18.945root 11241100x8000000000000000537259Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:18.946{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.71c93f84cef7a8582021-12-21 11:31:18.946root 11241100x8000000000000000537260Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:18.946{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8b678b099055dd5f2021-12-21 11:31:18.946root 11241100x8000000000000000537261Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:18.946{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.26bf0f9153fcd72b2021-12-21 11:31:18.946root 11241100x8000000000000000537262Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:18.946{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.781a20da6ed3e27c2021-12-21 11:31:18.946root 11241100x8000000000000000537263Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:18.946{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.800a7e6f823403b92021-12-21 11:31:18.946root 11241100x8000000000000000537264Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:18.946{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.bbe4be2d9a25533d2021-12-21 11:31:18.946root 11241100x8000000000000000537265Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:18.946{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7c2b30f0fd5163df2021-12-21 11:31:18.946root 11241100x8000000000000000537266Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:18.947{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f85dc55323e83edf2021-12-21 11:31:18.947root 11241100x8000000000000000537267Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:18.947{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c25ef53073e30b092021-12-21 11:31:18.947root 11241100x8000000000000000537268Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:18.947{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.678112b4acabf6d42021-12-21 11:31:18.947root 11241100x8000000000000000537269Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:18.947{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4d0933c95b3896412021-12-21 11:31:18.947root 11241100x8000000000000000537270Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:18.947{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3deb18d3f4ff820b2021-12-21 11:31:18.947root 11241100x8000000000000000537271Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:18.947{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.50886f3d8b711e162021-12-21 11:31:18.947root 11241100x8000000000000000537272Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:18.947{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.bdb2ee120c68f71b2021-12-21 11:31:18.947root 11241100x8000000000000000537273Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:18.947{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c7255b9538f1d81e2021-12-21 11:31:18.947root 11241100x8000000000000000537274Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:18.948{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.525691201fbe25b72021-12-21 11:31:18.948root 11241100x8000000000000000537275Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:19.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e39f2e581d10ea972021-12-21 11:31:19.443root 11241100x8000000000000000537276Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:19.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.be6d027186711eb12021-12-21 11:31:19.443root 11241100x8000000000000000537277Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:19.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.80017f449cbc89df2021-12-21 11:31:19.443root 11241100x8000000000000000537278Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:19.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c64fa9d88a89724b2021-12-21 11:31:19.443root 11241100x8000000000000000537279Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:19.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e94392ac63c19d782021-12-21 11:31:19.443root 11241100x8000000000000000537280Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:19.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b6f95ef88f0ac0fb2021-12-21 11:31:19.443root 11241100x8000000000000000537281Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:19.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7ad7dd1cbdc298082021-12-21 11:31:19.443root 11241100x8000000000000000537282Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:19.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6bbb249baf489dd42021-12-21 11:31:19.444root 11241100x8000000000000000537283Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:19.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.59eee054b608de672021-12-21 11:31:19.444root 11241100x8000000000000000537284Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:19.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5d2314c0562d35682021-12-21 11:31:19.444root 11241100x8000000000000000537285Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:19.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d3da50d192fb19ed2021-12-21 11:31:19.444root 11241100x8000000000000000537286Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:19.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c46a6cd64c5e5aaf2021-12-21 11:31:19.444root 11241100x8000000000000000537287Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:19.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b9e4009ed83615b82021-12-21 11:31:19.444root 11241100x8000000000000000537288Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:19.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1b2af59f0ac3754e2021-12-21 11:31:19.444root 11241100x8000000000000000537289Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:19.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8cba791052a4513a2021-12-21 11:31:19.444root 11241100x8000000000000000537290Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:19.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a5f0891a3ecd5c492021-12-21 11:31:19.444root 11241100x8000000000000000537291Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:19.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9c7f2c8b39f4ef692021-12-21 11:31:19.444root 11241100x8000000000000000537292Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:19.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5525bc3338f2af032021-12-21 11:31:19.444root 11241100x8000000000000000537293Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:19.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.63c368623b0f39622021-12-21 11:31:19.444root 11241100x8000000000000000537294Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:19.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.41aa756f1a2b59a22021-12-21 11:31:19.444root 11241100x8000000000000000537295Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:19.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e4da7b42c2ff97ab2021-12-21 11:31:19.444root 11241100x8000000000000000537296Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:19.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a7dc99ef80b43e5c2021-12-21 11:31:19.445root 11241100x8000000000000000537297Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:19.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1733ac1738980d4d2021-12-21 11:31:19.445root 11241100x8000000000000000537298Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:19.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d49eeda650c175212021-12-21 11:31:19.445root 11241100x8000000000000000537299Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:19.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.cd08e4c47b934df02021-12-21 11:31:19.943root 11241100x8000000000000000537300Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:19.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.35bebab8f2a9182d2021-12-21 11:31:19.943root 11241100x8000000000000000537301Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:19.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ff0fe599116707b62021-12-21 11:31:19.943root 11241100x8000000000000000537302Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:19.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.42f19de8956da7f52021-12-21 11:31:19.943root 11241100x8000000000000000537303Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:19.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.167dfcc784273e2f2021-12-21 11:31:19.943root 11241100x8000000000000000537304Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:19.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a33aa98e8f4e3c4e2021-12-21 11:31:19.943root 11241100x8000000000000000537305Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:19.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c2b007f566a1954e2021-12-21 11:31:19.943root 11241100x8000000000000000537306Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:19.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5533186f27044ccd2021-12-21 11:31:19.944root 11241100x8000000000000000537307Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:19.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.647fd49c2094b9342021-12-21 11:31:19.944root 11241100x8000000000000000537308Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:19.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.009074a27d11ae542021-12-21 11:31:19.944root 11241100x8000000000000000537309Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:19.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.bc6ffaa2174ac5442021-12-21 11:31:19.944root 11241100x8000000000000000537310Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:19.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.88fe377109ca7f7b2021-12-21 11:31:19.944root 11241100x8000000000000000537311Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:19.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9d9d71ea66f86b6c2021-12-21 11:31:19.944root 11241100x8000000000000000537312Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:19.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6f1cb74875b703682021-12-21 11:31:19.944root 11241100x8000000000000000537313Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:19.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.17fceda4209b4bc62021-12-21 11:31:19.944root 11241100x8000000000000000537314Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:19.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.35221a10ed544e332021-12-21 11:31:19.944root 11241100x8000000000000000537315Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:19.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1aacbe90b7c7d28b2021-12-21 11:31:19.944root 11241100x8000000000000000537316Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:19.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f00ed3c1fe6d509d2021-12-21 11:31:19.944root 11241100x8000000000000000537317Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:19.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5f3ca01fda6ddd172021-12-21 11:31:19.944root 11241100x8000000000000000537318Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:19.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.24cb39f9d249481e2021-12-21 11:31:19.944root 11241100x8000000000000000537319Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:19.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f3b24a47cc8a37f42021-12-21 11:31:19.944root 11241100x8000000000000000537320Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:19.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.fdfbed992d1b88332021-12-21 11:31:19.944root 11241100x8000000000000000537321Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:19.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9b5bd1a19797fde32021-12-21 11:31:19.944root 11241100x8000000000000000537322Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:19.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.dc2293f28a7375e82021-12-21 11:31:19.945root 11241100x8000000000000000537323Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:19.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.daf991d7d92e02092021-12-21 11:31:19.945root 11241100x8000000000000000537324Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:19.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.60d4b0cafe298fdd2021-12-21 11:31:19.945root 11241100x8000000000000000537325Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:19.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b4649d864ca291b42021-12-21 11:31:19.945root 11241100x8000000000000000537326Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:19.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.25a3641b1e1138db2021-12-21 11:31:19.945root 11241100x8000000000000000537327Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:19.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.378f91ae5bd138e82021-12-21 11:31:19.945root 11241100x8000000000000000537328Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:19.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.562f0e07ffc86e112021-12-21 11:31:19.945root 154100x8000000000000000537329Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:19.946{ec2b6afe-bb07-61c1-68e4-9a6690550000}9882/bin/ps-----ps -e -o pid,ppid,state,command/var/snap/amazon-ssm-agent/4046root{ec2b6afe-0000-0000-0000-000000000000}04294967295no level-{00000000-0000-0000-0000-000000000000}2319--- 534500x8000000000000000537330Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:19.958{ec2b6afe-bb07-61c1-68e4-9a6690550000}9882/bin/psroot 11241100x8000000000000000537331Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:20.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d9ab1d9e48774e6b2021-12-21 11:31:20.443root 11241100x8000000000000000537332Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:20.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5f55e1376299d9b72021-12-21 11:31:20.443root 11241100x8000000000000000537333Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:20.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5d1af1b4a13527d62021-12-21 11:31:20.443root 11241100x8000000000000000537334Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:20.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.84b1e2d482b3c4e12021-12-21 11:31:20.443root 11241100x8000000000000000537335Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:20.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0306f1c0a8fdef8e2021-12-21 11:31:20.444root 11241100x8000000000000000537336Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:20.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6537b2fa2f042e6e2021-12-21 11:31:20.444root 11241100x8000000000000000537337Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:20.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.abb7d989013320fd2021-12-21 11:31:20.444root 11241100x8000000000000000537338Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:20.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c741b3d0129ce59c2021-12-21 11:31:20.444root 11241100x8000000000000000537339Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:20.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.946d358cf66580342021-12-21 11:31:20.444root 11241100x8000000000000000537340Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:20.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.36928392686d2efc2021-12-21 11:31:20.444root 11241100x8000000000000000537341Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:20.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.bbb00cf8f1f527212021-12-21 11:31:20.444root 11241100x8000000000000000537342Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:20.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.71c98f71491ebec02021-12-21 11:31:20.444root 11241100x8000000000000000537343Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:20.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.af7a459ef906fcef2021-12-21 11:31:20.444root 11241100x8000000000000000537344Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:20.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e42d8fa28a4501da2021-12-21 11:31:20.444root 11241100x8000000000000000537345Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:20.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.57daab704ae5a03b2021-12-21 11:31:20.444root 11241100x8000000000000000537346Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:20.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d6cc8ee328bdd3d32021-12-21 11:31:20.444root 11241100x8000000000000000537347Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:20.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0bd2a8a61fffc12b2021-12-21 11:31:20.444root 11241100x8000000000000000537348Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:20.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c7572f001998fdb52021-12-21 11:31:20.444root 11241100x8000000000000000537349Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:20.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a586a5786be3f2742021-12-21 11:31:20.444root 11241100x8000000000000000537350Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:20.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.32c6473aa55d76372021-12-21 11:31:20.445root 11241100x8000000000000000537351Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:20.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4ed3bdae33c763f22021-12-21 11:31:20.445root 11241100x8000000000000000537352Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:20.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8f5989e6dd92edb02021-12-21 11:31:20.445root 11241100x8000000000000000537353Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:20.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1ec26655c61cce102021-12-21 11:31:20.445root 11241100x8000000000000000537354Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:20.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d354adb66650548f2021-12-21 11:31:20.445root 11241100x8000000000000000537355Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:20.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ba74a3bbebafcae82021-12-21 11:31:20.445root 11241100x8000000000000000537356Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:20.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3c44c45d08251fe92021-12-21 11:31:20.445root 11241100x8000000000000000537357Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:20.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1eb84443dd5f927e2021-12-21 11:31:20.943root 11241100x8000000000000000537358Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:20.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.28fa9367dc2a32782021-12-21 11:31:20.943root 11241100x8000000000000000537359Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:20.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0d27520b7001bc8b2021-12-21 11:31:20.943root 11241100x8000000000000000537360Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:20.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.80a91f8091fde84d2021-12-21 11:31:20.943root 11241100x8000000000000000537361Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:20.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a0ff2d08ff52f6022021-12-21 11:31:20.943root 11241100x8000000000000000537362Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:20.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.422b9d7bbc84cfea2021-12-21 11:31:20.943root 11241100x8000000000000000537363Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:20.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ccc22d5e7eb88fad2021-12-21 11:31:20.943root 11241100x8000000000000000537364Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:20.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b7017ff4ea50b88b2021-12-21 11:31:20.943root 11241100x8000000000000000537365Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:20.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5b31c1d6f2d34f852021-12-21 11:31:20.943root 11241100x8000000000000000537366Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:20.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.32f92e6c6644ca802021-12-21 11:31:20.944root 11241100x8000000000000000537367Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:20.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.01f7e336492aae082021-12-21 11:31:20.944root 11241100x8000000000000000537368Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:20.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5bb82348a59889b52021-12-21 11:31:20.944root 11241100x8000000000000000537369Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:20.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d185ea727d2aa0462021-12-21 11:31:20.944root 11241100x8000000000000000537370Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:20.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9f280e47e4989c7c2021-12-21 11:31:20.944root 11241100x8000000000000000537371Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:20.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.78d08e95b029c2ea2021-12-21 11:31:20.944root 11241100x8000000000000000537372Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:20.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e01868403903e6912021-12-21 11:31:20.944root 11241100x8000000000000000537373Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:20.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.09c34b04da1a0ea92021-12-21 11:31:20.944root 11241100x8000000000000000537374Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:20.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.86c13c13bea9cc8e2021-12-21 11:31:20.944root 11241100x8000000000000000537375Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:20.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3949187677786a6f2021-12-21 11:31:20.945root 11241100x8000000000000000537376Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:20.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5b16328ac3cdad0a2021-12-21 11:31:20.945root 11241100x8000000000000000537377Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:20.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.370cae8db46c606d2021-12-21 11:31:20.945root 11241100x8000000000000000537378Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:20.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.246a5bedea03d81f2021-12-21 11:31:20.945root 11241100x8000000000000000537379Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:20.946{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4f386a303c5542eb2021-12-21 11:31:20.946root 11241100x8000000000000000537380Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:20.946{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7ca645bd8adcf75f2021-12-21 11:31:20.946root 11241100x8000000000000000537381Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:20.946{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c3a0a45b6425445d2021-12-21 11:31:20.946root 11241100x8000000000000000537382Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:20.946{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2965b7b02ff196ff2021-12-21 11:31:20.946root 11241100x8000000000000000537383Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:20.946{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.08cff3a03bcd85a12021-12-21 11:31:20.946root 11241100x8000000000000000537384Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:20.946{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d8fbd75a48363e362021-12-21 11:31:20.946root 354300x8000000000000000537385Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:21.222{ec2b6afe-95d9-61c1-5175-3a0400000000}5346/opt/splunkforwarder/etc/apps/Splunk_TA_stream/linux_x86_64/bin/streamfwdroottcptruefalse10.0.1.25-48658-false10.0.1.12-8000- 11241100x8000000000000000537386Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:21.223{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b3cb15197fdd54282021-12-21 11:31:21.223root 11241100x8000000000000000537387Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:21.223{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.deac855272da1aae2021-12-21 11:31:21.223root 11241100x8000000000000000537388Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:21.223{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4c1b6e2ae9b7a7e82021-12-21 11:31:21.223root 11241100x8000000000000000537389Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:21.223{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.cc76a5952dc82abf2021-12-21 11:31:21.223root 11241100x8000000000000000537390Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:21.223{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8bb6cab4272bc2232021-12-21 11:31:21.223root 11241100x8000000000000000537391Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:21.223{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4b852d63a70c7c9a2021-12-21 11:31:21.223root 11241100x8000000000000000537392Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:21.223{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.40cb2d2644e1292c2021-12-21 11:31:21.223root 11241100x8000000000000000537393Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:21.223{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8be059ad0dd219582021-12-21 11:31:21.223root 11241100x8000000000000000537394Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:21.223{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f7209e3f9821535c2021-12-21 11:31:21.223root 11241100x8000000000000000537395Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:21.224{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e5edc7845786dd782021-12-21 11:31:21.224root 11241100x8000000000000000537396Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:21.224{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f51ac902aa361ca42021-12-21 11:31:21.224root 11241100x8000000000000000537397Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:21.224{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.bd403aec631b76ba2021-12-21 11:31:21.224root 11241100x8000000000000000537398Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:21.224{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4889f6708e3993302021-12-21 11:31:21.224root 11241100x8000000000000000537399Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:21.224{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3f55aadf5679ff182021-12-21 11:31:21.224root 11241100x8000000000000000537400Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:21.224{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.aa68c53241c1ad9b2021-12-21 11:31:21.224root 11241100x8000000000000000537401Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:21.224{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8bd5f6ab66e8c8772021-12-21 11:31:21.224root 11241100x8000000000000000537402Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:21.224{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c699769b6b029c742021-12-21 11:31:21.224root 11241100x8000000000000000537403Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:21.224{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.dc3ad75f13fc64702021-12-21 11:31:21.224root 11241100x8000000000000000537404Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:21.224{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.cf4162433d8d18242021-12-21 11:31:21.224root 11241100x8000000000000000537405Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:21.225{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1322b325081789222021-12-21 11:31:21.225root 11241100x8000000000000000537406Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:21.225{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ad2b85ba00a54b5a2021-12-21 11:31:21.225root 11241100x8000000000000000537407Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:21.225{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9790250f18bfaea32021-12-21 11:31:21.225root 11241100x8000000000000000537408Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:21.225{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9696fa244e3fad042021-12-21 11:31:21.225root 11241100x8000000000000000537409Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:21.225{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f43d81eb433a0d852021-12-21 11:31:21.225root 11241100x8000000000000000537410Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:21.225{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d91484118d4a42622021-12-21 11:31:21.225root 11241100x8000000000000000537411Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:21.225{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.bde52056bd8a3dfc2021-12-21 11:31:21.225root 11241100x8000000000000000537412Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:21.225{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d46ed5f971e3cada2021-12-21 11:31:21.225root 11241100x8000000000000000537413Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:21.225{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0b0279e0a785f5c62021-12-21 11:31:21.225root 11241100x8000000000000000537414Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:21.225{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.631848748730ded42021-12-21 11:31:21.225root 11241100x8000000000000000537415Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:21.225{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9c66d21475a8176f2021-12-21 11:31:21.225root 11241100x8000000000000000537416Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:21.225{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c0bb8d807f29e27d2021-12-21 11:31:21.225root 11241100x8000000000000000537417Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:21.226{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ec3dbb42e820c7e72021-12-21 11:31:21.226root 11241100x8000000000000000537418Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:21.226{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9ac7b5f3c76345092021-12-21 11:31:21.226root 11241100x8000000000000000537419Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:21.226{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c11a09a53da0b4112021-12-21 11:31:21.226root 11241100x8000000000000000537420Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:21.226{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.67284903794a05fa2021-12-21 11:31:21.226root 11241100x8000000000000000537421Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:21.226{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c7cd05ab6566499b2021-12-21 11:31:21.226root 11241100x8000000000000000537422Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:21.226{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.197f3d3ed9ce0c2f2021-12-21 11:31:21.226root 11241100x8000000000000000537423Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:21.226{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c0c498a310fdc7662021-12-21 11:31:21.226root 11241100x8000000000000000537424Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:21.226{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e5584e48e81da6972021-12-21 11:31:21.226root 11241100x8000000000000000537425Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:21.226{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.eef45b5fe817c64f2021-12-21 11:31:21.226root 11241100x8000000000000000537426Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:21.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.85746ee0ccd443032021-12-21 11:31:21.693root 11241100x8000000000000000537427Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:21.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a9f043e0d989938a2021-12-21 11:31:21.693root 11241100x8000000000000000537428Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:21.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2da39d31bf741e9c2021-12-21 11:31:21.693root 11241100x8000000000000000537429Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:21.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.cb5afde3801c108e2021-12-21 11:31:21.694root 11241100x8000000000000000537430Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:21.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b64e3a00a3f7fb0a2021-12-21 11:31:21.694root 11241100x8000000000000000537431Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:21.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4a514c3698f4d2502021-12-21 11:31:21.694root 11241100x8000000000000000537432Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:21.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d95f1e9443ffff832021-12-21 11:31:21.694root 11241100x8000000000000000537433Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:21.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5efaf61ec90ac1f62021-12-21 11:31:21.694root 11241100x8000000000000000537434Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:21.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.224357aaadf82ff72021-12-21 11:31:21.694root 11241100x8000000000000000537435Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:21.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.dd7c3e4634f887722021-12-21 11:31:21.694root 11241100x8000000000000000537436Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:21.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ae32c95f6ece2ab82021-12-21 11:31:21.694root 11241100x8000000000000000537437Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:21.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.71815cf26de469f62021-12-21 11:31:21.694root 11241100x8000000000000000537438Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:21.695{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.daeb26ead731ed682021-12-21 11:31:21.695root 354300x8000000000000000537468Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:32.056{ec2b6afe-95d9-61c1-5175-3a0400000000}5346/opt/splunkforwarder/etc/apps/Splunk_TA_stream/linux_x86_64/bin/streamfwdroottcptruefalse10.0.1.25-48664-false10.0.1.12-8000- 11241100x8000000000000000537469Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:32.442{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d4a61e42f78268e22021-12-21 11:31:32.442root 11241100x8000000000000000537470Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:32.942{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.be99d3221caa84942021-12-21 11:31:32.942root 11241100x8000000000000000537471Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:33.442{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d417204875da807d2021-12-21 11:31:33.442root 11241100x8000000000000000537472Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:33.942{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1dcea5f770b561a92021-12-21 11:31:33.942root 11241100x8000000000000000537473Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:34.442{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.35f7d76ef3dd13b12021-12-21 11:31:34.442root 11241100x8000000000000000537474Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:34.942{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a8affae2883841dd2021-12-21 11:31:34.942root 11241100x8000000000000000537475Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:35.442{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.35217ca2249d2a212021-12-21 11:31:35.442root 11241100x8000000000000000537476Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:35.942{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9ac20ab1118f8b7f2021-12-21 11:31:35.942root 11241100x8000000000000000537477Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:36.326{ec2b6afe-95d2-61c1-3038-b84203560000}5272/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/spool/splunk/tracker.log2021-12-21 11:31:36.326root 11241100x8000000000000000537478Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:36.327{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.651f836c621efc6d2021-12-21 11:31:36.327root 11241100x8000000000000000537479Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:36.328{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.eb4cb7a1962541412021-12-21 11:31:36.328root 11241100x8000000000000000537480Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:36.692{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.93e44083c3965dc72021-12-21 11:31:36.692root 11241100x8000000000000000537481Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:36.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2e56b853bb35a4322021-12-21 11:31:36.693root 11241100x8000000000000000537482Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:37.192{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7989b239e7f81e392021-12-21 11:31:37.192root 11241100x8000000000000000537483Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:37.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a8cdf9c527e2fa612021-12-21 11:31:37.193root 11241100x8000000000000000537484Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:37.692{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.bdbbb92c42db422c2021-12-21 11:31:37.692root 11241100x8000000000000000537485Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:37.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e1f9d9c06e313fa52021-12-21 11:31:37.693root 354300x8000000000000000537486Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:38.035{ec2b6afe-95d9-61c1-5175-3a0400000000}5346/opt/splunkforwarder/etc/apps/Splunk_TA_stream/linux_x86_64/bin/streamfwdroottcptruefalse10.0.1.25-48666-false10.0.1.12-8000- 11241100x8000000000000000537487Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:38.036{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6b09d91064bedf522021-12-21 11:31:38.036root 11241100x8000000000000000537488Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:38.036{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4782f115b440d5c82021-12-21 11:31:38.036root 11241100x8000000000000000537489Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:38.442{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f1211a29a1c265172021-12-21 11:31:38.442root 11241100x8000000000000000537490Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:38.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.cd1620aa7f0fc3072021-12-21 11:31:38.443root 11241100x8000000000000000537491Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:38.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ad7fe42fd04b724c2021-12-21 11:31:38.443root 11241100x8000000000000000537492Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:38.942{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1cf51a29f73043d72021-12-21 11:31:38.942root 11241100x8000000000000000537493Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:38.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.44abec501bddea112021-12-21 11:31:38.943root 11241100x8000000000000000537494Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:38.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ddc42202fe8453b02021-12-21 11:31:38.943root 23542300x8000000000000000537495Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:39.329{ec2b6afe-95d2-61c1-3038-b84203560000}5272root/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/spool/splunk/tracker.log--- 11241100x8000000000000000537496Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:39.329{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5c894b98986976e62021-12-21 11:31:39.329root 11241100x8000000000000000537497Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:39.330{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.cdf8e3bc7b4e69542021-12-21 11:31:39.330root 11241100x8000000000000000537498Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:39.330{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.70714d213be62b9c2021-12-21 11:31:39.330root 11241100x8000000000000000537499Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:39.692{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c959396f0d99e6902021-12-21 11:31:39.692root 11241100x8000000000000000537500Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:39.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b0a1afb2ed2b43f12021-12-21 11:31:39.693root 11241100x8000000000000000537501Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:39.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.99a764cd564e685a2021-12-21 11:31:39.693root 11241100x8000000000000000537502Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:39.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.924a286c82e3f1d22021-12-21 11:31:39.693root 11241100x8000000000000000537503Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:40.192{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f4dbb100a5eed96a2021-12-21 11:31:40.192root 11241100x8000000000000000537504Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:40.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.95131cbdd9113cce2021-12-21 11:31:40.193root 11241100x8000000000000000537505Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:40.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d9d1be1beb73db232021-12-21 11:31:40.193root 11241100x8000000000000000537506Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:40.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a4d8992ec32d9bee2021-12-21 11:31:40.193root 11241100x8000000000000000537507Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:40.692{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e1a8dd83f5cf343b2021-12-21 11:31:40.692root 11241100x8000000000000000537508Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:40.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.93f6319ad567008f2021-12-21 11:31:40.693root 11241100x8000000000000000537509Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:40.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.23a81eb64cdbeb7f2021-12-21 11:31:40.693root 11241100x8000000000000000537510Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:40.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.86ac8ebf7d51d5a52021-12-21 11:31:40.693root 11241100x8000000000000000537511Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:41.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.02e008b900f661062021-12-21 11:31:41.193root 11241100x8000000000000000537512Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:41.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ce9d279d8db42f1d2021-12-21 11:31:41.193root 11241100x8000000000000000537513Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:41.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.67b71f1387a51d952021-12-21 11:31:41.193root 11241100x8000000000000000537514Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:41.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.973c3452856062002021-12-21 11:31:41.193root 11241100x8000000000000000537515Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:41.692{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2f02ad8a0a1e1cd02021-12-21 11:31:41.692root 11241100x8000000000000000537516Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:41.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d0153e4e859c21e72021-12-21 11:31:41.693root 11241100x8000000000000000537517Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:41.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ba2f96d9afcdbe622021-12-21 11:31:41.693root 11241100x8000000000000000537518Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:41.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e1ae2c0c9e37b5032021-12-21 11:31:41.693root 11241100x8000000000000000537519Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:42.192{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.fa983cc28ae13c762021-12-21 11:31:42.192root 11241100x8000000000000000537520Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:42.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f356865a4bce9ada2021-12-21 11:31:42.193root 11241100x8000000000000000537521Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:42.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6dd5b2787ea28b802021-12-21 11:31:42.193root 11241100x8000000000000000537522Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:42.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a6bbcefe5642a9382021-12-21 11:31:42.193root 11241100x8000000000000000537523Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:42.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3d0cb4a243f21ad02021-12-21 11:31:42.693root 11241100x8000000000000000537524Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:42.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.787d7262429a86ea2021-12-21 11:31:42.693root 11241100x8000000000000000537525Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:42.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.978e2df856786aa62021-12-21 11:31:42.693root 11241100x8000000000000000537526Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:42.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9d8c0ec1a267ec2e2021-12-21 11:31:42.694root 11241100x8000000000000000537527Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:43.192{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e1bc0b599c739f152021-12-21 11:31:43.192root 11241100x8000000000000000537528Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:43.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.eb3d941048c2883a2021-12-21 11:31:43.193root 11241100x8000000000000000537529Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:43.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.81d16357fb1d16df2021-12-21 11:31:43.193root 11241100x8000000000000000537530Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:43.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.08ea58fcb24fe4e12021-12-21 11:31:43.193root 354300x8000000000000000537531Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:43.252{ec2b6afe-95d9-61c1-5175-3a0400000000}5346/opt/splunkforwarder/etc/apps/Splunk_TA_stream/linux_x86_64/bin/streamfwdroottcptruefalse10.0.1.25-48668-false10.0.1.12-8000- 11241100x8000000000000000537532Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:43.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c27767ce84f065972021-12-21 11:31:43.693root 11241100x8000000000000000537533Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:43.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a7f07f3e61d61c0a2021-12-21 11:31:43.693root 11241100x8000000000000000537534Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:43.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6b89738411308d2a2021-12-21 11:31:43.693root 11241100x8000000000000000537535Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:43.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d6b23e7efd0387ff2021-12-21 11:31:43.694root 11241100x8000000000000000537536Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:43.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ecd82ccff431eb6f2021-12-21 11:31:43.694root 11241100x8000000000000000537537Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:44.192{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3bc993695f12dc022021-12-21 11:31:44.192root 11241100x8000000000000000537538Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:44.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7ef025073b8a56ff2021-12-21 11:31:44.193root 11241100x8000000000000000537539Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:44.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6d5d31cbb2e0f9b22021-12-21 11:31:44.193root 11241100x8000000000000000537540Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:44.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8b812ef3f836482c2021-12-21 11:31:44.193root 11241100x8000000000000000537541Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:44.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f3ce554caeb7a8e62021-12-21 11:31:44.194root 11241100x8000000000000000537542Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:44.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6fc6343703fdbfa12021-12-21 11:31:44.693root 11241100x8000000000000000537543Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:44.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.62ad44d7170b000c2021-12-21 11:31:44.693root 11241100x8000000000000000537544Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:44.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.525be4d49e64d1f52021-12-21 11:31:44.693root 11241100x8000000000000000537545Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:44.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9c0408e140abc3b72021-12-21 11:31:44.693root 11241100x8000000000000000537546Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:44.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7fdce7e296da224f2021-12-21 11:31:44.693root 534500x8000000000000000537547Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:44.894{00000000-0000-0000-0000-000000000000}9883<unknown process>ubuntu 534500x8000000000000000537548Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:44.897{00000000-0000-0000-0000-000000000000}9884<unknown process>ubuntu 534500x8000000000000000537549Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:44.899{00000000-0000-0000-0000-000000000000}9885<unknown process>ubuntu 11241100x8000000000000000537550Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:44.899{ec2b6afe-aacb-61c1-0834-fdd63c560000}5677/bin/bash/tmp/sh-thd.FA1jYY2021-12-21 11:31:44.899ubuntu 23542300x8000000000000000537551Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:44.899{ec2b6afe-aacb-61c1-0834-fdd63c560000}5677ubuntu/bin/bash/tmp/sh-thd.FA1jYY--- 11241100x8000000000000000537552Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:45.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6962ff4382d325762021-12-21 11:31:45.193root 11241100x8000000000000000537553Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:45.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.68b57f128bb950202021-12-21 11:31:45.193root 11241100x8000000000000000537554Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:45.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.190509dc4382400f2021-12-21 11:31:45.193root 11241100x8000000000000000537555Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:45.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7c5a0667b2b4988d2021-12-21 11:31:45.193root 11241100x8000000000000000537556Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:45.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.810247f9367063a32021-12-21 11:31:45.193root 11241100x8000000000000000537557Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:45.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.68d7568e1c908cae2021-12-21 11:31:45.193root 11241100x8000000000000000537558Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:45.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e74ec0d52ddfc02a2021-12-21 11:31:45.193root 11241100x8000000000000000537559Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:45.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.84b4d71ab0bace4a2021-12-21 11:31:45.193root 11241100x8000000000000000537560Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:45.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.cb654ee4e064fc3c2021-12-21 11:31:45.194root 11241100x8000000000000000537561Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:45.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c8ecdb9a408058932021-12-21 11:31:45.194root 11241100x8000000000000000537562Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:45.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.903b43f68867972d2021-12-21 11:31:45.194root 11241100x8000000000000000537563Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:45.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f54fdd91a42669672021-12-21 11:31:45.194root 11241100x8000000000000000537564Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:45.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f64bf19a9771600c2021-12-21 11:31:45.194root 11241100x8000000000000000537565Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:45.195{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.319a339e57ea05462021-12-21 11:31:45.195root 154100x8000000000000000537566Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:45.479{ec2b6afe-bb21-61c1-089e-285c01560000}9886/usr/bin/sudo-----sudo setcap cap_setuid=ep ./evil_bin/home/ubuntuubuntu{ec2b6afe-aacb-61c1-e803-000000000000}10006no level-{ec2b6afe-aacb-61c1-0834-fdd63c560000}5677/bin/bash-bashubuntu 11241100x8000000000000000537567Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:45.482{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8c1305178a5d3ef62021-12-21 11:31:45.482root 11241100x8000000000000000537568Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:45.482{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.46808692c8af1c062021-12-21 11:31:45.482root 11241100x8000000000000000537569Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:45.482{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7ecdd0bf2cba3a652021-12-21 11:31:45.482root 11241100x8000000000000000537570Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:45.482{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.abd5d359b6a188112021-12-21 11:31:45.482root 11241100x8000000000000000537571Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:45.483{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d4c866c5f600671b2021-12-21 11:31:45.483root 11241100x8000000000000000537572Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:45.483{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.67055c82039cbc762021-12-21 11:31:45.483root 11241100x8000000000000000537573Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:45.484{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.465fb80ce584e79d2021-12-21 11:31:45.484root 11241100x8000000000000000537574Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:45.484{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.221a983fe9496b4d2021-12-21 11:31:45.484root 11241100x8000000000000000537575Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:45.484{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.99a1ccc63d8a68a92021-12-21 11:31:45.484root 11241100x8000000000000000537576Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:45.484{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.94bdb63ecdb8a0b62021-12-21 11:31:45.484root 11241100x8000000000000000537577Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:45.484{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.66cdd567e249ef112021-12-21 11:31:45.484root 354300x8000000000000000537578Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:45.485{ec2b6afe-bb21-61c1-089e-285c01560000}9886/usr/bin/sudoubuntuudptruefalse127.0.0.1-53189-false127.0.0.53-53- 354300x8000000000000000537579Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:45.486{ec2b6afe-9247-61c1-c097-2e4cb4550000}2604/lib/systemd/systemd-resolvedsystemd-resolveudptruefalse10.0.1.25-57495-false10.0.0.2-53- 354300x8000000000000000537580Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:45.486{ec2b6afe-9247-61c1-c097-2e4cb4550000}2604/lib/systemd/systemd-resolvedsystemd-resolveudptruefalse10.0.1.25-55401-false10.0.0.2-53- 354300x8000000000000000537581Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:45.487{ec2b6afe-9247-61c1-c097-2e4cb4550000}2604/lib/systemd/systemd-resolvedsystemd-resolveudptruefalse127.0.0.53-53-false127.0.0.1-53189- 354300x8000000000000000537582Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:45.487{ec2b6afe-bb21-61c1-089e-285c01560000}9886/usr/bin/sudoubuntuudpfalsefalse127.0.0.53-53-false127.0.0.1-53189- 354300x8000000000000000537583Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:45.498{ec2b6afe-bb21-61c1-089e-285c01560000}9886/usr/bin/sudoubuntuudptruefalse127.0.0.1-46353-false127.0.0.53-53- 354300x8000000000000000537584Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:45.498{ec2b6afe-9247-61c1-c097-2e4cb4550000}2604/lib/systemd/systemd-resolvedsystemd-resolveudptruefalse127.0.0.53-53-false127.0.0.1-46353- 154100x8000000000000000537585Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:45.504{ec2b6afe-bb21-61c1-8077-a5381b560000}9887/sbin/setcap-----setcap cap_setuid=ep ./evil_bin/home/ubunturoot{ec2b6afe-0000-0000-0000-000000000000}06no level-{ec2b6afe-bb21-61c1-089e-285c01560000}9886/usr/bin/sudosudoubuntu 534500x8000000000000000537586Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:45.504{ec2b6afe-bb21-61c1-8077-a5381b560000}9887/sbin/setcaproot 534500x8000000000000000537587Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:45.505{ec2b6afe-bb21-61c1-089e-285c01560000}9886/usr/bin/sudoroot 11241100x8000000000000000537588Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:45.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.05876c40a16b3ecd2021-12-21 11:31:45.943root 11241100x8000000000000000537589Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:45.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6e02788226f83f8a2021-12-21 11:31:45.943root 11241100x8000000000000000537590Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:45.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3a93559d8356c54d2021-12-21 11:31:45.943root 11241100x8000000000000000537591Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:45.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7b17ff8a385246332021-12-21 11:31:45.943root 11241100x8000000000000000537592Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:45.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.05cb2a8debd13f0c2021-12-21 11:31:45.944root 11241100x8000000000000000537593Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:45.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.52fdc3eadbad4dc72021-12-21 11:31:45.944root 11241100x8000000000000000537594Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:45.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ae44b247a01865962021-12-21 11:31:45.944root 11241100x8000000000000000537595Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:45.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.80dd82d3630b5c062021-12-21 11:31:45.944root 11241100x8000000000000000537596Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:45.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.86eec97bbf986a062021-12-21 11:31:45.944root 11241100x8000000000000000537597Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:45.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ce99cfbba855e8382021-12-21 11:31:45.944root 11241100x8000000000000000537598Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:45.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e0441666b79ba29b2021-12-21 11:31:45.944root 11241100x8000000000000000537599Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:45.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.78687984e247b3a62021-12-21 11:31:45.944root 11241100x8000000000000000537600Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:45.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.85b8af45d419faf22021-12-21 11:31:45.944root 11241100x8000000000000000537601Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:45.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e87dc638ac33fb962021-12-21 11:31:45.944root 11241100x8000000000000000537602Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:45.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.382a9b5d43f61d842021-12-21 11:31:45.945root 11241100x8000000000000000537603Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:45.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.681592b82bb2b9a42021-12-21 11:31:45.945root 11241100x8000000000000000537604Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:45.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a6c39066c0f273ac2021-12-21 11:31:45.945root 11241100x8000000000000000537605Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:45.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0981cc6d28e5eaf52021-12-21 11:31:45.945root 11241100x8000000000000000537606Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:45.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.30e18679ec2f465c2021-12-21 11:31:45.945root 11241100x8000000000000000537607Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:45.946{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b611f62cffce8c792021-12-21 11:31:45.946root 11241100x8000000000000000537608Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:45.947{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.314424bcafad3fc22021-12-21 11:31:45.947root 11241100x8000000000000000537609Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:46.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e9227a7b2422872f2021-12-21 11:31:46.443root 11241100x8000000000000000537610Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:46.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.231a97a737477ce82021-12-21 11:31:46.443root 11241100x8000000000000000537611Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:46.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.67eb60c30bf55b1d2021-12-21 11:31:46.443root 11241100x8000000000000000537612Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:46.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.cd589aebe00461f82021-12-21 11:31:46.444root 11241100x8000000000000000537613Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:46.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.af5f8788a97b81c72021-12-21 11:31:46.444root 11241100x8000000000000000537614Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:46.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.be1d4a483fdefe292021-12-21 11:31:46.444root 11241100x8000000000000000537615Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:46.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5c7560d1ee9cd9422021-12-21 11:31:46.444root 11241100x8000000000000000537616Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:46.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.43e2a7f70a78901c2021-12-21 11:31:46.444root 11241100x8000000000000000537617Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:46.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.499c3cd7c0379c1f2021-12-21 11:31:46.444root 11241100x8000000000000000537618Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:46.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.45a6b310aa925c7f2021-12-21 11:31:46.444root 11241100x8000000000000000537619Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:46.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0f29d553fed8d29e2021-12-21 11:31:46.444root 11241100x8000000000000000537620Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:46.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d025d9859e85486a2021-12-21 11:31:46.444root 11241100x8000000000000000537621Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:46.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.67e4aa8fcbf020482021-12-21 11:31:46.444root 11241100x8000000000000000537622Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:46.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.600af384977447b52021-12-21 11:31:46.444root 11241100x8000000000000000537623Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:46.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5121a3f44bf4aff12021-12-21 11:31:46.444root 11241100x8000000000000000537624Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:46.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3c8345378057e8892021-12-21 11:31:46.444root 11241100x8000000000000000537625Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:46.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e1cac0dd0fa2df872021-12-21 11:31:46.444root 11241100x8000000000000000537626Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:46.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.712bac189925a1e22021-12-21 11:31:46.444root 11241100x8000000000000000537627Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:46.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8292515b5bb5f1f42021-12-21 11:31:46.444root 11241100x8000000000000000537628Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:46.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e650d4ad090be7ea2021-12-21 11:31:46.445root 11241100x8000000000000000537629Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:46.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.16aebfeb46477fb72021-12-21 11:31:46.445root 11241100x8000000000000000537630Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:46.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.bf477949081cb8f32021-12-21 11:31:46.943root 11241100x8000000000000000537631Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:46.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.77f5f619073f62b42021-12-21 11:31:46.943root 11241100x8000000000000000537632Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:46.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.834bbd782a2dfdc82021-12-21 11:31:46.943root 11241100x8000000000000000537633Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:46.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.88cd1076241e4a262021-12-21 11:31:46.943root 11241100x8000000000000000537634Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:46.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8992614162fa26a22021-12-21 11:31:46.944root 11241100x8000000000000000537635Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:46.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4e789ff9307bb96d2021-12-21 11:31:46.944root 11241100x8000000000000000537636Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:46.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f95c312102dfdf902021-12-21 11:31:46.944root 11241100x8000000000000000537637Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:46.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8bdb383655fbb4a52021-12-21 11:31:46.944root 11241100x8000000000000000537638Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:46.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f2d34778dc1ba7922021-12-21 11:31:46.944root 11241100x8000000000000000537639Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:46.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.df80954c9c8ef8e72021-12-21 11:31:46.944root 11241100x8000000000000000537640Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:46.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.07aaa00aa6de5b362021-12-21 11:31:46.944root 11241100x8000000000000000537641Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:46.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1bc9286a74b961bb2021-12-21 11:31:46.944root 11241100x8000000000000000537642Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:46.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.bb7be44e3a4727352021-12-21 11:31:46.944root 11241100x8000000000000000537643Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:46.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.cd98634b2c767c6f2021-12-21 11:31:46.944root 11241100x8000000000000000537644Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:46.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b7fe4b265c3b612c2021-12-21 11:31:46.944root 11241100x8000000000000000537645Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:46.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c10e5ebd4daea09a2021-12-21 11:31:46.944root 11241100x8000000000000000537646Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:46.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b5ab0a02367ecd7e2021-12-21 11:31:46.944root 11241100x8000000000000000537647Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:46.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.08759853cd60f0cd2021-12-21 11:31:46.944root 11241100x8000000000000000537648Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:46.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2abd755f9a07c1642021-12-21 11:31:46.944root 11241100x8000000000000000537649Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:46.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2680afc2145a3c802021-12-21 11:31:46.944root 11241100x8000000000000000537650Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:46.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.103365c3a4e4f3182021-12-21 11:31:46.945root 11241100x8000000000000000537651Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:47.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.45cbb5d25a0087a02021-12-21 11:31:47.443root 11241100x8000000000000000537652Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:47.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.10d1a5d5047defe42021-12-21 11:31:47.443root 11241100x8000000000000000537653Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:47.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.196f2cd46dffcacc2021-12-21 11:31:47.444root 11241100x8000000000000000537654Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:47.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4c9c5f62bcf8e3732021-12-21 11:31:47.444root 11241100x8000000000000000537655Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:47.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.90fe991d7d49c01e2021-12-21 11:31:47.444root 11241100x8000000000000000537656Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:47.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8e87abac40e2ac912021-12-21 11:31:47.444root 11241100x8000000000000000537657Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:47.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a24392056777fc1e2021-12-21 11:31:47.444root 11241100x8000000000000000537658Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:47.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d9e9c844f6306d182021-12-21 11:31:47.444root 11241100x8000000000000000537659Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:47.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.843c81b096a6a2642021-12-21 11:31:47.444root 11241100x8000000000000000537660Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:47.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.48391b3af453b08c2021-12-21 11:31:47.444root 11241100x8000000000000000537661Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:47.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.716dd8211e70ab522021-12-21 11:31:47.444root 11241100x8000000000000000537662Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:47.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.cc191a7923c9f93e2021-12-21 11:31:47.444root 11241100x8000000000000000537663Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:47.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6e795817ee80e1342021-12-21 11:31:47.444root 11241100x8000000000000000537664Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:47.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c9458857edc867162021-12-21 11:31:47.444root 11241100x8000000000000000537665Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:47.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.73a7e82635ae9f9a2021-12-21 11:31:47.444root 11241100x8000000000000000537666Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:47.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7c3566c330b1d1392021-12-21 11:31:47.444root 11241100x8000000000000000537667Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:47.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.612fa7861eeba7202021-12-21 11:31:47.444root 11241100x8000000000000000537668Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:47.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3e8a558a05e0b5fd2021-12-21 11:31:47.444root 11241100x8000000000000000537669Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:47.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.75c80dc6ef7f02372021-12-21 11:31:47.445root 11241100x8000000000000000537670Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:47.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8e04fcefb3183ee92021-12-21 11:31:47.445root 11241100x8000000000000000537671Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:47.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.137eaea8381312e42021-12-21 11:31:47.445root 11241100x8000000000000000537672Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:47.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.37de3ae8c0a92baf2021-12-21 11:31:47.943root 11241100x8000000000000000537673Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:47.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3c16bc7aa6dad4362021-12-21 11:31:47.943root 11241100x8000000000000000537674Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:47.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c9770b300f161a892021-12-21 11:31:47.943root 11241100x8000000000000000537675Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:47.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2594ca6c19ea8c072021-12-21 11:31:47.943root 11241100x8000000000000000537676Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:47.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f177a29c1d680ad22021-12-21 11:31:47.944root 11241100x8000000000000000537677Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:47.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.22064a0b105d5ba92021-12-21 11:31:47.944root 11241100x8000000000000000537678Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:47.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e0292b3d15418ddc2021-12-21 11:31:47.944root 11241100x8000000000000000537679Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:47.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d51ad0b8fa2d6ec92021-12-21 11:31:47.944root 11241100x8000000000000000537680Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:47.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2dfee8e1b5ba3ba72021-12-21 11:31:47.944root 11241100x8000000000000000537681Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:47.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1dbb29088f1e4b052021-12-21 11:31:47.944root 11241100x8000000000000000537682Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:47.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4c24df4819aef4af2021-12-21 11:31:47.944root 11241100x8000000000000000537683Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:47.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.27e6ae764d7e06242021-12-21 11:31:47.944root 11241100x8000000000000000537684Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:47.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3e3f2980c45ea2232021-12-21 11:31:47.944root 11241100x8000000000000000537685Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:47.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.be5dba008a406e282021-12-21 11:31:47.944root 11241100x8000000000000000537686Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:47.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0a3113acca875b0b2021-12-21 11:31:47.944root 11241100x8000000000000000537687Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:47.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3eb921445bdfaa7b2021-12-21 11:31:47.944root 11241100x8000000000000000537688Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:47.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c5ec01263ae6ca262021-12-21 11:31:47.944root 11241100x8000000000000000537689Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:47.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9b71bcc18c5a6c012021-12-21 11:31:47.944root 11241100x8000000000000000537690Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:47.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9ab2344bef06e5222021-12-21 11:31:47.945root 11241100x8000000000000000537691Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:47.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c67281f0b3c4c3952021-12-21 11:31:47.945root 11241100x8000000000000000537692Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:47.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6c29f5b3e537f2342021-12-21 11:31:47.945root 11241100x8000000000000000537693Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:48.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5e35a1158b3e49062021-12-21 11:31:48.443root 11241100x8000000000000000537694Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:48.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.99466ae12d844cad2021-12-21 11:31:48.443root 11241100x8000000000000000537695Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:48.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.153fa5b4dbeb96922021-12-21 11:31:48.444root 11241100x8000000000000000537696Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:48.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f90961a98960fdc92021-12-21 11:31:48.444root 11241100x8000000000000000537697Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:48.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ff7a06bcfff2e3e72021-12-21 11:31:48.444root 11241100x8000000000000000537698Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:48.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.203c1207c39f18792021-12-21 11:31:48.444root 11241100x8000000000000000537699Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:48.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6090a518abf0353a2021-12-21 11:31:48.444root 11241100x8000000000000000537700Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:48.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0f47e36fc51418f62021-12-21 11:31:48.444root 11241100x8000000000000000537701Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:48.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.028db07a1261f8b82021-12-21 11:31:48.444root 11241100x8000000000000000537702Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:48.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4c80bc1bda5fee7d2021-12-21 11:31:48.444root 11241100x8000000000000000537703Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:48.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1e4ac139d91ce00b2021-12-21 11:31:48.444root 11241100x8000000000000000537704Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:48.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6b2dce243aa0902d2021-12-21 11:31:48.444root 11241100x8000000000000000537705Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:48.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.aceb83f4939ee4ad2021-12-21 11:31:48.444root 11241100x8000000000000000537706Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:48.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a45b61859c06e9182021-12-21 11:31:48.444root 11241100x8000000000000000537707Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:48.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ff67018e7241fa3a2021-12-21 11:31:48.445root 11241100x8000000000000000537708Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:48.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.068461c5d685c9712021-12-21 11:31:48.445root 11241100x8000000000000000537709Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:48.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ca7186ac87d5e3242021-12-21 11:31:48.445root 11241100x8000000000000000537710Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:48.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.79d4378090eb26162021-12-21 11:31:48.445root 11241100x8000000000000000537711Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:48.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9d2e7a056d4d610e2021-12-21 11:31:48.445root 11241100x8000000000000000537712Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:48.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1897337b06f71c5f2021-12-21 11:31:48.445root 11241100x8000000000000000537713Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:48.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.32cc0ef586d4a7332021-12-21 11:31:48.445root 11241100x8000000000000000537714Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:48.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0de18f7817c6d0db2021-12-21 11:31:48.943root 11241100x8000000000000000537715Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:48.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4f0701c58649690c2021-12-21 11:31:48.943root 11241100x8000000000000000537716Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:48.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ab4f006e8128c5a02021-12-21 11:31:48.943root 11241100x8000000000000000537717Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:48.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0e9a762862dca9832021-12-21 11:31:48.943root 11241100x8000000000000000537718Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:48.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.911ca61ca09465842021-12-21 11:31:48.944root 11241100x8000000000000000537719Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:48.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.663068c9d18895b42021-12-21 11:31:48.944root 11241100x8000000000000000537720Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:48.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d1f2d5f2f518b03c2021-12-21 11:31:48.944root 11241100x8000000000000000537721Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:48.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.bb848c2a6792bf2d2021-12-21 11:31:48.944root 11241100x8000000000000000537722Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:48.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d589e3fdfa0c01232021-12-21 11:31:48.944root 11241100x8000000000000000537723Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:48.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.59558a9eb8385fbe2021-12-21 11:31:48.944root 11241100x8000000000000000537724Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:48.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c096638ed9e696202021-12-21 11:31:48.944root 11241100x8000000000000000537725Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:48.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.256f70c2a2ecb7992021-12-21 11:31:48.944root 11241100x8000000000000000537726Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:48.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f59c975fba602bd22021-12-21 11:31:48.944root 11241100x8000000000000000537727Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:48.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.79c05d9711fa05f52021-12-21 11:31:48.944root 11241100x8000000000000000537728Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:48.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d0d21f84f29d6cf22021-12-21 11:31:48.944root 11241100x8000000000000000537729Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:48.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3c91da1f98efe4942021-12-21 11:31:48.944root 11241100x8000000000000000537730Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:48.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c1461675ee3035172021-12-21 11:31:48.944root 11241100x8000000000000000537731Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:48.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c81f6ffd787b5c732021-12-21 11:31:48.944root 11241100x8000000000000000537732Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:48.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a3791734132fd9822021-12-21 11:31:48.944root 11241100x8000000000000000537733Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:48.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c9da02f89353cbf92021-12-21 11:31:48.945root 11241100x8000000000000000537734Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:48.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4b3a9905c028f4132021-12-21 11:31:48.945root 354300x8000000000000000537735Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:49.040{ec2b6afe-95d9-61c1-5175-3a0400000000}5346/opt/splunkforwarder/etc/apps/Splunk_TA_stream/linux_x86_64/bin/streamfwdroottcptruefalse10.0.1.25-48670-false10.0.1.12-8000- 11241100x8000000000000000537736Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:49.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e1a82bf7ad12d0ed2021-12-21 11:31:49.443root 11241100x8000000000000000537737Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:49.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4e2cc17982db51012021-12-21 11:31:49.443root 11241100x8000000000000000537738Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:49.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.dc3d60eab37730542021-12-21 11:31:49.443root 11241100x8000000000000000537739Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:49.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4c8737071dde452c2021-12-21 11:31:49.443root 11241100x8000000000000000537740Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:49.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.cb1e0be3c34d2dfa2021-12-21 11:31:49.444root 11241100x8000000000000000537741Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:49.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.045745bd3d939fbc2021-12-21 11:31:49.444root 11241100x8000000000000000537742Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:49.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7226f4869e557ad62021-12-21 11:31:49.444root 11241100x8000000000000000537743Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:49.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.916c97e9f3056a802021-12-21 11:31:49.444root 11241100x8000000000000000537744Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:49.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.738d0ae52fe94ca22021-12-21 11:31:49.444root 11241100x8000000000000000537745Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:49.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2145e5b64de25db12021-12-21 11:31:49.444root 11241100x8000000000000000537746Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:49.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e968c6f1c22e3baf2021-12-21 11:31:49.444root 11241100x8000000000000000537747Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:49.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ca7ca188566944562021-12-21 11:31:49.444root 11241100x8000000000000000537748Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:49.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4f78ffbb2049156e2021-12-21 11:31:49.444root 11241100x8000000000000000537749Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:49.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a7c9ad0b2fd677762021-12-21 11:31:49.444root 11241100x8000000000000000537750Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:49.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b488cfeb8466a8c42021-12-21 11:31:49.445root 11241100x8000000000000000537751Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:49.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c3df9a22e42a14bf2021-12-21 11:31:49.445root 11241100x8000000000000000537752Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:49.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.41c629d0e8110e422021-12-21 11:31:49.445root 11241100x8000000000000000537753Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:49.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e9c600be18266cad2021-12-21 11:31:49.445root 11241100x8000000000000000537754Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:49.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.57366574e34635292021-12-21 11:31:49.445root 11241100x8000000000000000537755Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:49.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e74dd98bf6537b8c2021-12-21 11:31:49.445root 11241100x8000000000000000537756Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:49.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7290c4c8bc7b09032021-12-21 11:31:49.445root 11241100x8000000000000000537757Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:49.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2b0f17809e07665c2021-12-21 11:31:49.445root 11241100x8000000000000000537758Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:49.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d92dd090c77659042021-12-21 11:31:49.943root 11241100x8000000000000000537759Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:49.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.dd191ec7f5de1a102021-12-21 11:31:49.943root 11241100x8000000000000000537760Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:49.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c64910becda7d4242021-12-21 11:31:49.943root 11241100x8000000000000000537761Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:49.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4e49abe3ecb1dea42021-12-21 11:31:49.943root 11241100x8000000000000000537762Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:49.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.111e6fc4f54808ed2021-12-21 11:31:49.944root 11241100x8000000000000000537763Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:49.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.772d21245f91899a2021-12-21 11:31:49.944root 11241100x8000000000000000537764Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:49.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f43d1c6ea7bf21a22021-12-21 11:31:49.944root 11241100x8000000000000000537765Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:49.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.26b665ea050a9e8c2021-12-21 11:31:49.944root 11241100x8000000000000000537766Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:49.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.268df93a0e464f8a2021-12-21 11:31:49.944root 11241100x8000000000000000537767Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:49.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d3f579a0e7ee53b22021-12-21 11:31:49.944root 11241100x8000000000000000537768Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:49.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3806a300f1ca8f012021-12-21 11:31:49.944root 11241100x8000000000000000537769Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:49.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.82616c5d06a40de42021-12-21 11:31:49.944root 11241100x8000000000000000537770Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:49.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ec45103c9d4863cf2021-12-21 11:31:49.944root 11241100x8000000000000000537771Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:49.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.37284d1eaddb56012021-12-21 11:31:49.944root 11241100x8000000000000000537772Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:49.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.92fb40ffd39bcbe82021-12-21 11:31:49.944root 11241100x8000000000000000537773Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:49.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.72f179ce0a70fef82021-12-21 11:31:49.944root 11241100x8000000000000000537774Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:49.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4e4cb3b7bcb701052021-12-21 11:31:49.944root 11241100x8000000000000000537775Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:49.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4d1b02010686c9472021-12-21 11:31:49.944root 11241100x8000000000000000537776Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:49.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.dd47785d80fb1d0c2021-12-21 11:31:49.945root 11241100x8000000000000000537777Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:49.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e5df510d568a3e4a2021-12-21 11:31:49.945root 11241100x8000000000000000537778Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:49.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6ef7922fb02001272021-12-21 11:31:49.945root 11241100x8000000000000000537779Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:49.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b619c0cb0c39c7212021-12-21 11:31:49.945root 11241100x8000000000000000537780Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:50.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.fac80cfcfc19c3472021-12-21 11:31:50.443root 11241100x8000000000000000537781Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:50.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.78f0e7d836d507e02021-12-21 11:31:50.443root 11241100x8000000000000000537782Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:50.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.db5f1dfb52601b502021-12-21 11:31:50.444root 11241100x8000000000000000537783Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:50.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8d42e1cf4c44e0d42021-12-21 11:31:50.444root 11241100x8000000000000000537784Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:50.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.06e938326e8412672021-12-21 11:31:50.444root 11241100x8000000000000000537785Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:50.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5e6b1b320983615c2021-12-21 11:31:50.444root 11241100x8000000000000000537786Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:50.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a55a2b73ec9937422021-12-21 11:31:50.444root 11241100x8000000000000000537787Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:50.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f73e9d86d8e221482021-12-21 11:31:50.445root 11241100x8000000000000000537788Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:50.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b024e6ad3b14d2992021-12-21 11:31:50.445root 11241100x8000000000000000537789Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:50.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.04ef999f3d5e9dec2021-12-21 11:31:50.445root 11241100x8000000000000000537790Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:50.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1bee6ab6b91b00cd2021-12-21 11:31:50.445root 11241100x8000000000000000537791Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:50.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4b93bbcbf6a4d3f92021-12-21 11:31:50.445root 11241100x8000000000000000537792Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:50.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2190b3615b20d2f62021-12-21 11:31:50.445root 11241100x8000000000000000537793Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:50.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.13777c1050286ff82021-12-21 11:31:50.445root 11241100x8000000000000000537794Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:50.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.14324f8d8a49a3d82021-12-21 11:31:50.445root 11241100x8000000000000000537795Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:50.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.968eddd1f2ab73602021-12-21 11:31:50.445root 11241100x8000000000000000537796Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:50.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.850e9343e16922bc2021-12-21 11:31:50.445root 11241100x8000000000000000537797Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:50.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.029bf4c8fb7e80552021-12-21 11:31:50.445root 11241100x8000000000000000537798Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:50.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.07feb0bd7ea50da22021-12-21 11:31:50.445root 11241100x8000000000000000537799Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:50.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4c0f823b2350189c2021-12-21 11:31:50.445root 11241100x8000000000000000537800Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:50.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0a2c87ed1bf187e42021-12-21 11:31:50.445root 11241100x8000000000000000537801Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:50.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4eaac1614a6a264d2021-12-21 11:31:50.445root 11241100x8000000000000000537802Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:50.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7993efec6ed813502021-12-21 11:31:50.943root 11241100x8000000000000000537803Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:50.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.31a8c59660cb41a32021-12-21 11:31:50.943root 11241100x8000000000000000537804Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:50.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2d8d0d1fc8e6a6872021-12-21 11:31:50.943root 11241100x8000000000000000537805Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:50.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e096310ce6c547e62021-12-21 11:31:50.944root 11241100x8000000000000000537806Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:50.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.aef98dd6572f3bbe2021-12-21 11:31:50.944root 11241100x8000000000000000537807Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:50.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.37c82d47bb99005f2021-12-21 11:31:50.944root 11241100x8000000000000000537808Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:50.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.bc8550fd7f8312cb2021-12-21 11:31:50.944root 11241100x8000000000000000537809Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:50.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.55ddce1662f5f5232021-12-21 11:31:50.944root 11241100x8000000000000000537810Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:50.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.22a5c435f1097f622021-12-21 11:31:50.944root 11241100x8000000000000000537811Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:50.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.491456897fed27c32021-12-21 11:31:50.944root 11241100x8000000000000000537812Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:50.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f39bcc58890370b62021-12-21 11:31:50.944root 11241100x8000000000000000537813Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:50.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.77829478b84096992021-12-21 11:31:50.944root 11241100x8000000000000000537814Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:50.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d008bada012625bc2021-12-21 11:31:50.944root 11241100x8000000000000000537815Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:50.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.87d537ac1a681e5f2021-12-21 11:31:50.944root 11241100x8000000000000000537816Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:50.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.92e3b4599f74df8a2021-12-21 11:31:50.944root 11241100x8000000000000000537817Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:50.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.10adc84d41668eee2021-12-21 11:31:50.945root 11241100x8000000000000000537818Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:50.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.41aaa3c710e3e4e92021-12-21 11:31:50.945root 11241100x8000000000000000537819Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:50.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c0cb009e4e16d8ff2021-12-21 11:31:50.945root 11241100x8000000000000000537820Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:50.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f76ce66debe0fd312021-12-21 11:31:50.945root 11241100x8000000000000000537821Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:50.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.63d3f96c37a4c77b2021-12-21 11:31:50.945root 11241100x8000000000000000537822Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:50.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.078399d3a2d65b152021-12-21 11:31:50.945root 11241100x8000000000000000537823Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:50.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.19731187b13971772021-12-21 11:31:50.945root 11241100x8000000000000000537824Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:51.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.995c100d9a95f9022021-12-21 11:31:51.443root 11241100x8000000000000000537825Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:51.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d75c04fdeabd79e12021-12-21 11:31:51.443root 11241100x8000000000000000537826Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:51.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f7666c425499dab72021-12-21 11:31:51.443root 11241100x8000000000000000537827Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:51.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.aac93be068a5bccc2021-12-21 11:31:51.443root 11241100x8000000000000000537828Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:51.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.06eb539c1d2492052021-12-21 11:31:51.444root 11241100x8000000000000000537829Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:51.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a6534c746e0a7a802021-12-21 11:31:51.444root 11241100x8000000000000000537830Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:51.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2ebbda3e0c57b71c2021-12-21 11:31:51.444root 11241100x8000000000000000537831Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:51.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.135c19cfd890fbde2021-12-21 11:31:51.444root 11241100x8000000000000000537832Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:51.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ec4c3c8a903edceb2021-12-21 11:31:51.444root 11241100x8000000000000000537833Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:51.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.56e4e21696d99a952021-12-21 11:31:51.444root 11241100x8000000000000000537834Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:51.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2274dff07e9ee6622021-12-21 11:31:51.444root 11241100x8000000000000000537835Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:51.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.dc0e8b2d93edc26d2021-12-21 11:31:51.444root 11241100x8000000000000000537836Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:51.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a99b2b28cabeb1e92021-12-21 11:31:51.444root 11241100x8000000000000000537837Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:51.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.bbce9f15f9eace482021-12-21 11:31:51.444root 11241100x8000000000000000537838Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:51.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.19b9c7efffe313b62021-12-21 11:31:51.444root 11241100x8000000000000000537839Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:51.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.626a452785b162322021-12-21 11:31:51.444root 11241100x8000000000000000537840Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:51.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f0768668e91d46662021-12-21 11:31:51.444root 11241100x8000000000000000537841Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:51.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.32fb200ee7febe252021-12-21 11:31:51.444root 11241100x8000000000000000537842Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:51.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.01f39b5a411a22462021-12-21 11:31:51.445root 11241100x8000000000000000537843Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:51.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.df47690f4b3013e12021-12-21 11:31:51.445root 11241100x8000000000000000537844Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:51.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8e356022383734632021-12-21 11:31:51.445root 11241100x8000000000000000537845Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:51.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9ff2b537575dad622021-12-21 11:31:51.445root 11241100x8000000000000000537846Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:51.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.93904bc32044748c2021-12-21 11:31:51.943root 11241100x8000000000000000537847Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:51.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.27358cbddf0b37762021-12-21 11:31:51.943root 11241100x8000000000000000537848Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:51.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d92b4c56516fa4c32021-12-21 11:31:51.943root 11241100x8000000000000000537849Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:51.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2c6e88e27bc9c3c52021-12-21 11:31:51.944root 11241100x8000000000000000537850Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:51.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.68b24881b76092cb2021-12-21 11:31:51.944root 11241100x8000000000000000537851Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:51.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.695989331ef34a222021-12-21 11:31:51.944root 11241100x8000000000000000537852Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:51.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.aab3fa286719b19f2021-12-21 11:31:51.944root 11241100x8000000000000000537853Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:51.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6bd2d8e2aefc17c12021-12-21 11:31:51.944root 11241100x8000000000000000537854Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:51.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.bf8744753dede61e2021-12-21 11:31:51.944root 11241100x8000000000000000537855Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:51.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2857a4b4b80bb12d2021-12-21 11:31:51.944root 11241100x8000000000000000537856Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:51.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4cf388bda484dd7b2021-12-21 11:31:51.944root 11241100x8000000000000000537857Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:51.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.86a0ae8707d8b2c62021-12-21 11:31:51.944root 11241100x8000000000000000537858Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:51.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5cca1875abecad6d2021-12-21 11:31:51.944root 11241100x8000000000000000537859Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:51.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.134f06820d11bcd42021-12-21 11:31:51.944root 11241100x8000000000000000537860Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:51.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.273a1305a4d85dd42021-12-21 11:31:51.944root 11241100x8000000000000000537861Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:51.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2bf0208f4d16c0a42021-12-21 11:31:51.944root 11241100x8000000000000000537862Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:51.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.31337a855ea3b38c2021-12-21 11:31:51.944root 11241100x8000000000000000537863Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:51.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c3360027e7d225f92021-12-21 11:31:51.944root 11241100x8000000000000000537864Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:51.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.37b94c3567969f252021-12-21 11:31:51.945root 11241100x8000000000000000537865Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:51.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e45be1a311ad05fa2021-12-21 11:31:51.945root 11241100x8000000000000000537866Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:51.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.28123855ec31787f2021-12-21 11:31:51.945root 11241100x8000000000000000537867Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:51.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.99cd791f43d616492021-12-21 11:31:51.945root 11241100x8000000000000000537868Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:52.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.85dc6e0b3baa7ec12021-12-21 11:31:52.443root 11241100x8000000000000000537869Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:52.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.828333c0805a77362021-12-21 11:31:52.443root 11241100x8000000000000000537870Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:52.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c93324364526a82b2021-12-21 11:31:52.443root 11241100x8000000000000000537871Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:52.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6e60b9db2a2a5da52021-12-21 11:31:52.443root 11241100x8000000000000000537872Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:52.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.bc113f886606c0732021-12-21 11:31:52.444root 11241100x8000000000000000537873Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:52.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3e3fbcecaeaca37f2021-12-21 11:31:52.444root 11241100x8000000000000000537874Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:52.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ab232e747b3863b62021-12-21 11:31:52.444root 11241100x8000000000000000537875Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:52.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b24c3f029faa04282021-12-21 11:31:52.444root 11241100x8000000000000000537876Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:52.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.230408ef5312b7312021-12-21 11:31:52.444root 11241100x8000000000000000537877Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:52.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4111d33fee77528a2021-12-21 11:31:52.444root 11241100x8000000000000000537878Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:52.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.14f2f35ea41d7af22021-12-21 11:31:52.444root 11241100x8000000000000000537879Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:52.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.254f34ddebb01fbc2021-12-21 11:31:52.444root 11241100x8000000000000000537880Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:52.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.04398aa5109982ec2021-12-21 11:31:52.444root 11241100x8000000000000000537881Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:52.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.023211b147fe2b952021-12-21 11:31:52.444root 11241100x8000000000000000537882Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:52.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b4259c9b05c204742021-12-21 11:31:52.444root 11241100x8000000000000000537883Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:52.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.05fe1234a312c6862021-12-21 11:31:52.444root 11241100x8000000000000000537884Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:52.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.460619822be4e2c92021-12-21 11:31:52.444root 11241100x8000000000000000537885Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:52.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6389a6d0d377ea582021-12-21 11:31:52.444root 11241100x8000000000000000537886Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:52.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b0e421e757036e612021-12-21 11:31:52.445root 11241100x8000000000000000537887Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:52.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.464cd6281c3df8172021-12-21 11:31:52.445root 11241100x8000000000000000537888Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:52.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f25e50be68b078db2021-12-21 11:31:52.445root 11241100x8000000000000000537889Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:52.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a52d094f380d156e2021-12-21 11:31:52.445root 11241100x8000000000000000537890Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:52.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4849edc7bce9f5532021-12-21 11:31:52.943root 11241100x8000000000000000537891Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:52.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b8f49f9cca3b01592021-12-21 11:31:52.943root 11241100x8000000000000000537892Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:52.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b3d3d24dc15c2eee2021-12-21 11:31:52.944root 11241100x8000000000000000537893Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:52.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a8719d014b91061d2021-12-21 11:31:52.944root 11241100x8000000000000000537894Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:52.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5d2982c76dc955522021-12-21 11:31:52.944root 11241100x8000000000000000537895Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:52.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.38002f21cf73cc332021-12-21 11:31:52.944root 11241100x8000000000000000537896Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:52.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.aa15bbbd9cb22f242021-12-21 11:31:52.944root 11241100x8000000000000000537897Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:52.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.474ce9be46a617ba2021-12-21 11:31:52.944root 11241100x8000000000000000537898Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:52.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9ab5da12713da5dd2021-12-21 11:31:52.944root 11241100x8000000000000000537899Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:52.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ec7510218bf9b8a42021-12-21 11:31:52.945root 11241100x8000000000000000537900Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:52.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0d0e316ffed1ebac2021-12-21 11:31:52.945root 11241100x8000000000000000537901Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:52.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d97b5dc702ad4da92021-12-21 11:31:52.945root 11241100x8000000000000000537902Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:52.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.70deb06a0aa4029c2021-12-21 11:31:52.945root 11241100x8000000000000000537903Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:52.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.56df96ee38fc57962021-12-21 11:31:52.945root 11241100x8000000000000000537904Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:52.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3440f41817549c332021-12-21 11:31:52.945root 11241100x8000000000000000537905Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:52.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4d365e0b14cac3f22021-12-21 11:31:52.945root 11241100x8000000000000000537906Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:52.946{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1423ca528f53cc4c2021-12-21 11:31:52.946root 11241100x8000000000000000537907Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:52.947{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.83ab781d628d0a9d2021-12-21 11:31:52.947root 11241100x8000000000000000537908Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:52.947{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.efc502481f388b4a2021-12-21 11:31:52.947root 11241100x8000000000000000537909Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:52.948{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.fa0ffdcbefacb3472021-12-21 11:31:52.948root 11241100x8000000000000000537910Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:52.948{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ea9a28a8386bae772021-12-21 11:31:52.948root 11241100x8000000000000000537911Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:52.948{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6fcb842699694fd72021-12-21 11:31:52.948root 11241100x8000000000000000537912Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:52.948{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.80c66ea42e8a8c6f2021-12-21 11:31:52.948root 11241100x8000000000000000537913Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:52.949{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d37287503c1414ad2021-12-21 11:31:52.949root 11241100x8000000000000000537914Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:53.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.818902513e617d082021-12-21 11:31:53.443root 11241100x8000000000000000537915Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:53.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6936ca87ab14ca7a2021-12-21 11:31:53.444root 11241100x8000000000000000537916Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:53.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.204ebf635ff1281f2021-12-21 11:31:53.444root 11241100x8000000000000000537917Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:53.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.93949844fb7ee52b2021-12-21 11:31:53.444root 11241100x8000000000000000537918Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:53.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9ab228244589e8af2021-12-21 11:31:53.444root 11241100x8000000000000000537919Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:53.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6dc3bc7d08fa0df12021-12-21 11:31:53.444root 11241100x8000000000000000537920Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:53.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.83a2e38508997d6e2021-12-21 11:31:53.445root 11241100x8000000000000000537921Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:53.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2e80ed0492ce34652021-12-21 11:31:53.445root 11241100x8000000000000000537922Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:53.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.535ec4a8bf0db1eb2021-12-21 11:31:53.445root 11241100x8000000000000000537923Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:53.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d4c65c682d0ffb2e2021-12-21 11:31:53.445root 11241100x8000000000000000537924Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:53.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.bd2d6376215b7ad12021-12-21 11:31:53.445root 11241100x8000000000000000537925Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:53.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ef3191d222893de22021-12-21 11:31:53.445root 11241100x8000000000000000537926Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:53.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.70f8b91ee443b3452021-12-21 11:31:53.445root 11241100x8000000000000000537927Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:53.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.86e131a8d2a4977a2021-12-21 11:31:53.445root 11241100x8000000000000000537928Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:53.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ec659e425ffb33f62021-12-21 11:31:53.445root 11241100x8000000000000000537929Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:53.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.cd69269ebe3f9f452021-12-21 11:31:53.445root 11241100x8000000000000000537930Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:53.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.76f4c007165c582a2021-12-21 11:31:53.445root 11241100x8000000000000000537931Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:53.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7a38cc3a0cd128ae2021-12-21 11:31:53.445root 11241100x8000000000000000537932Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:53.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f2097e6310db38b32021-12-21 11:31:53.445root 11241100x8000000000000000537933Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:53.446{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6aed369972c3edac2021-12-21 11:31:53.446root 11241100x8000000000000000537934Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:53.446{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9dc42582712ff2002021-12-21 11:31:53.446root 11241100x8000000000000000537935Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:53.446{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.41d28da1667152602021-12-21 11:31:53.446root 11241100x8000000000000000537936Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:53.446{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2faec8fc6ca4fd6d2021-12-21 11:31:53.446root 11241100x8000000000000000537937Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:53.446{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ffe70c2cd282a6322021-12-21 11:31:53.446root 11241100x8000000000000000537938Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:53.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ed27d97ff8514f2f2021-12-21 11:31:53.943root 11241100x8000000000000000537939Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:53.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9e673d03b559c9c22021-12-21 11:31:53.943root 11241100x8000000000000000537940Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:53.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.653f93d28e98654d2021-12-21 11:31:53.943root 11241100x8000000000000000537941Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:53.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c1048ec8b045d06c2021-12-21 11:31:53.943root 11241100x8000000000000000537942Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:53.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9159e0ae55f714b02021-12-21 11:31:53.943root 11241100x8000000000000000537943Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:53.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.22757ed03402a2d72021-12-21 11:31:53.943root 11241100x8000000000000000537944Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:53.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.561f71f7378f0f972021-12-21 11:31:53.943root 11241100x8000000000000000537945Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:53.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.007205dfce9a4f4d2021-12-21 11:31:53.943root 11241100x8000000000000000537946Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:53.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1cbcb5201237016f2021-12-21 11:31:53.943root 11241100x8000000000000000537947Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:53.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1fa138617b0f41c62021-12-21 11:31:53.943root 11241100x8000000000000000537948Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:53.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.962c8d2103f146a32021-12-21 11:31:53.943root 11241100x8000000000000000537949Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:53.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4429558f6141992f2021-12-21 11:31:53.944root 11241100x8000000000000000537950Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:53.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8802473bf9ee853e2021-12-21 11:31:53.944root 11241100x8000000000000000537951Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:53.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a15386f3ba44cb402021-12-21 11:31:53.944root 11241100x8000000000000000537952Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:53.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.bad15cddd7ceb83c2021-12-21 11:31:53.944root 11241100x8000000000000000537953Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:53.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.78f7572c714f5ed22021-12-21 11:31:53.944root 11241100x8000000000000000537954Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:53.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.25949c11bde970df2021-12-21 11:31:53.944root 11241100x8000000000000000537955Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:53.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d3f56786dec937342021-12-21 11:31:53.944root 11241100x8000000000000000537956Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:53.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f34047b7f7258ed92021-12-21 11:31:53.944root 11241100x8000000000000000537957Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:53.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f6652cb6465bcea62021-12-21 11:31:53.944root 11241100x8000000000000000537958Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:53.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f9289a39bb6978a42021-12-21 11:31:53.944root 11241100x8000000000000000537959Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:53.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a045752819d1a8b22021-12-21 11:31:53.944root 354300x8000000000000000537960Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:54.136{ec2b6afe-95d9-61c1-5175-3a0400000000}5346/opt/splunkforwarder/etc/apps/Splunk_TA_stream/linux_x86_64/bin/streamfwdroottcptruefalse10.0.1.25-48672-false10.0.1.12-8000- 11241100x8000000000000000537961Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:54.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9f7e12dcea86c3542021-12-21 11:31:54.443root 11241100x8000000000000000537962Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:54.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.dc6814b6d7d1eab92021-12-21 11:31:54.443root 11241100x8000000000000000537963Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:54.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f6d8d6b11cb5b2162021-12-21 11:31:54.444root 11241100x8000000000000000537964Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:54.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0bbb8ed33548d3ac2021-12-21 11:31:54.444root 11241100x8000000000000000537965Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:54.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a248354c533439842021-12-21 11:31:54.444root 11241100x8000000000000000537966Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:54.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6df2540e4feff0622021-12-21 11:31:54.444root 11241100x8000000000000000537967Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:54.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a7b4b32eab812b4f2021-12-21 11:31:54.444root 11241100x8000000000000000537968Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:54.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4aba832b6b652ff62021-12-21 11:31:54.445root 11241100x8000000000000000537969Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:54.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b1523eecb8d5c3522021-12-21 11:31:54.445root 11241100x8000000000000000537970Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:54.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8830bf16eb3e8f762021-12-21 11:31:54.445root 11241100x8000000000000000537971Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:54.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b1acad829bbb81962021-12-21 11:31:54.445root 11241100x8000000000000000537972Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:54.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.252eefdb16cd62682021-12-21 11:31:54.445root 11241100x8000000000000000537973Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:54.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a1982b2aecb7bf862021-12-21 11:31:54.445root 11241100x8000000000000000537974Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:54.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.373a2bc5dab1cd812021-12-21 11:31:54.445root 11241100x8000000000000000537975Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:54.446{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7be491818a7b000a2021-12-21 11:31:54.446root 11241100x8000000000000000537976Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:54.446{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.72917cd751d788b82021-12-21 11:31:54.446root 11241100x8000000000000000537977Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:54.446{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c51e000607c0d9eb2021-12-21 11:31:54.446root 11241100x8000000000000000537978Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:54.446{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7ea089ff87176dbe2021-12-21 11:31:54.446root 11241100x8000000000000000537979Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:54.446{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.531d967ae753c23c2021-12-21 11:31:54.446root 11241100x8000000000000000537980Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:54.446{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.678e6a7160b8109b2021-12-21 11:31:54.446root 11241100x8000000000000000537981Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:54.446{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5fcdf3a8ae75449b2021-12-21 11:31:54.446root 11241100x8000000000000000537982Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:54.447{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8bed563a58368cc52021-12-21 11:31:54.447root 11241100x8000000000000000537983Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:54.447{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8e20f394b3c3f9b12021-12-21 11:31:54.447root 11241100x8000000000000000537984Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:54.447{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.74d62f45e4da4e572021-12-21 11:31:54.447root 11241100x8000000000000000537985Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:54.447{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1c985915db2f5f902021-12-21 11:31:54.447root 11241100x8000000000000000537986Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:54.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5144c7b8c57dffa72021-12-21 11:31:54.943root 11241100x8000000000000000537987Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:54.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5d31607a650c77192021-12-21 11:31:54.943root 11241100x8000000000000000537988Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:54.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0cccaa1ae9986f982021-12-21 11:31:54.943root 11241100x8000000000000000537989Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:54.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e60031f5c89c5a242021-12-21 11:31:54.944root 11241100x8000000000000000537990Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:54.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a2ae1e03581c11b42021-12-21 11:31:54.944root 11241100x8000000000000000537991Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:54.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6776e24c092b894c2021-12-21 11:31:54.944root 11241100x8000000000000000537992Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:54.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4fd4934a4f3277a32021-12-21 11:31:54.944root 11241100x8000000000000000537993Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:54.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b2e575b167cb6f002021-12-21 11:31:54.944root 11241100x8000000000000000537994Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:54.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.797092f66dad5ed72021-12-21 11:31:54.944root 11241100x8000000000000000537995Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:54.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.536d59c38cd0668b2021-12-21 11:31:54.944root 11241100x8000000000000000537996Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:54.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d21d0f92985435362021-12-21 11:31:54.944root 11241100x8000000000000000537997Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:54.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4c0f919e21b0f7202021-12-21 11:31:54.944root 11241100x8000000000000000537998Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:54.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.96cbfeb17f1e19782021-12-21 11:31:54.944root 11241100x8000000000000000537999Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:54.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c78b62d8debcc7952021-12-21 11:31:54.945root 11241100x8000000000000000538000Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:54.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2028042946610f442021-12-21 11:31:54.945root 11241100x8000000000000000538001Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:54.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.829ec2b124d9ddba2021-12-21 11:31:54.945root 11241100x8000000000000000538002Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:54.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5bfb202094a89ddf2021-12-21 11:31:54.945root 11241100x8000000000000000538003Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:54.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.96a74aac6a289bab2021-12-21 11:31:54.945root 11241100x8000000000000000538004Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:54.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0be55223d04e48892021-12-21 11:31:54.945root 11241100x8000000000000000538005Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:54.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.edab4d0c4be926232021-12-21 11:31:54.945root 11241100x8000000000000000538006Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:54.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5d412f53806f4d6c2021-12-21 11:31:54.945root 11241100x8000000000000000538007Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:54.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0dabf4c6e940cacb2021-12-21 11:31:54.945root 11241100x8000000000000000538008Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:54.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.663f2c548bea5e112021-12-21 11:31:54.945root 11241100x8000000000000000538009Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:55.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2c4a1bceef3777572021-12-21 11:31:55.443root 11241100x8000000000000000538010Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:55.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.01433d5ab53cd7d02021-12-21 11:31:55.443root 11241100x8000000000000000538011Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:55.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6ef3d927a300d8df2021-12-21 11:31:55.443root 11241100x8000000000000000538012Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:55.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a0911f4b153a1ad02021-12-21 11:31:55.443root 11241100x8000000000000000538013Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:55.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c7fa3d3d65314b462021-12-21 11:31:55.444root 11241100x8000000000000000538014Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:55.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e1fc146a9abab84e2021-12-21 11:31:55.444root 11241100x8000000000000000538015Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:55.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b82b219c82c526b32021-12-21 11:31:55.444root 11241100x8000000000000000538016Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:55.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8d6965f534a892262021-12-21 11:31:55.444root 11241100x8000000000000000538017Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:55.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d586de24d73694492021-12-21 11:31:55.444root 11241100x8000000000000000538018Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:55.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d097f137f016ed7a2021-12-21 11:31:55.444root 11241100x8000000000000000538019Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:55.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.687877f7de51c03f2021-12-21 11:31:55.444root 11241100x8000000000000000538020Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:55.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1c8c265cc7538fa12021-12-21 11:31:55.445root 11241100x8000000000000000538021Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:55.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c59eb116dab559f02021-12-21 11:31:55.445root 11241100x8000000000000000538022Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:55.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a802606d584b6be52021-12-21 11:31:55.445root 11241100x8000000000000000538023Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:55.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.874205590023036b2021-12-21 11:31:55.445root 11241100x8000000000000000538024Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:55.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.86b050425ca936e92021-12-21 11:31:55.445root 11241100x8000000000000000538025Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:55.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3295a01f811f67ea2021-12-21 11:31:55.445root 11241100x8000000000000000538026Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:55.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.bbceab0a80126ca02021-12-21 11:31:55.445root 11241100x8000000000000000538027Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:55.446{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b4e66159a22bb7432021-12-21 11:31:55.446root 11241100x8000000000000000538028Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:55.446{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0715b95d79b75cd02021-12-21 11:31:55.446root 11241100x8000000000000000538029Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:55.446{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4835c9a18f4e55b62021-12-21 11:31:55.446root 11241100x8000000000000000538030Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:55.446{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f78f93fff7a97ee22021-12-21 11:31:55.446root 11241100x8000000000000000538031Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:55.446{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3f88b283fec34e7a2021-12-21 11:31:55.446root 11241100x8000000000000000538032Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:55.446{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.429f3f461ae518912021-12-21 11:31:55.446root 11241100x8000000000000000538033Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:55.447{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.825824b8ca0154e32021-12-21 11:31:55.447root 11241100x8000000000000000538034Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:55.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.25ec7aab7a663d8a2021-12-21 11:31:55.943root 11241100x8000000000000000538035Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:55.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a106bf5e5f6901f32021-12-21 11:31:55.943root 11241100x8000000000000000538036Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:55.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1ef5b14334efb8302021-12-21 11:31:55.943root 11241100x8000000000000000538037Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:55.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e44d90bf113f543e2021-12-21 11:31:55.943root 11241100x8000000000000000538038Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:55.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.96fa2e994c8347c32021-12-21 11:31:55.943root 11241100x8000000000000000538039Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:55.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9e0c75764a874aa62021-12-21 11:31:55.944root 11241100x8000000000000000538040Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:55.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a27ce45b993ba1f42021-12-21 11:31:55.944root 11241100x8000000000000000538041Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:55.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c452a9e46e686ad82021-12-21 11:31:55.944root 11241100x8000000000000000538042Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:55.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.29271f9c3f56feed2021-12-21 11:31:55.944root 11241100x8000000000000000538043Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:55.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8ad71468adbd64142021-12-21 11:31:55.944root 11241100x8000000000000000538044Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:55.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8f0b0271a7a7beff2021-12-21 11:31:55.944root 11241100x8000000000000000538045Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:55.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.dcb560ec54b501e52021-12-21 11:31:55.944root 11241100x8000000000000000538046Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:55.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.438e96047d220f842021-12-21 11:31:55.944root 11241100x8000000000000000538047Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:55.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0b27187bebf71e582021-12-21 11:31:55.944root 11241100x8000000000000000538048Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:55.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.eba5ac449b9d54fd2021-12-21 11:31:55.944root 11241100x8000000000000000538049Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:55.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.bc449da67cf214082021-12-21 11:31:55.944root 11241100x8000000000000000538050Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:55.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c4664a558ab564152021-12-21 11:31:55.944root 11241100x8000000000000000538051Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:55.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.77ef5eed1073b5692021-12-21 11:31:55.945root 11241100x8000000000000000538052Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:55.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.89ceae8c7ac940b42021-12-21 11:31:55.945root 11241100x8000000000000000538053Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:55.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d28845d5aa2146c42021-12-21 11:31:55.945root 11241100x8000000000000000538054Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:55.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f93b63ea0c6f6f502021-12-21 11:31:55.945root 11241100x8000000000000000538055Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:55.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.baa41ef4193dd16d2021-12-21 11:31:55.945root 11241100x8000000000000000538056Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:55.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1168c224fd3b009b2021-12-21 11:31:55.945root 11241100x8000000000000000538057Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:55.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6a196bf4835f7b8c2021-12-21 11:31:55.945root 11241100x8000000000000000538058Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:56.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e8175f5d48783e402021-12-21 11:31:56.443root 11241100x8000000000000000538059Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:56.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a25426fe3fa0de1c2021-12-21 11:31:56.443root 11241100x8000000000000000538060Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:56.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a50def029b4649862021-12-21 11:31:56.443root 11241100x8000000000000000538061Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:56.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.862ac5ac3678f01c2021-12-21 11:31:56.443root 11241100x8000000000000000538062Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:56.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e2c28898123d21842021-12-21 11:31:56.444root 11241100x8000000000000000538063Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:56.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6b696fe78c13d5a52021-12-21 11:31:56.444root 11241100x8000000000000000538064Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:56.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ddf6827f07f6c0b22021-12-21 11:31:56.444root 11241100x8000000000000000538065Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:56.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c1faeb14a540aae82021-12-21 11:31:56.444root 11241100x8000000000000000538066Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:56.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a6c3d85ed6b607cd2021-12-21 11:31:56.444root 11241100x8000000000000000538067Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:56.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ba903b445ff245a72021-12-21 11:31:56.444root 11241100x8000000000000000538068Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:56.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4a2506172e0101ef2021-12-21 11:31:56.444root 11241100x8000000000000000538069Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:56.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.79a399db65c1aa5e2021-12-21 11:31:56.445root 11241100x8000000000000000538070Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:56.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.58aca6fa6c0d433b2021-12-21 11:31:56.445root 11241100x8000000000000000538071Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:56.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f25e02ae0ea5e42f2021-12-21 11:31:56.445root 11241100x8000000000000000538072Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:56.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ebd7b20440c5a4bc2021-12-21 11:31:56.445root 11241100x8000000000000000538073Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:56.446{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9d8cf86be742e5092021-12-21 11:31:56.446root 11241100x8000000000000000538074Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:56.446{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c76771caf364fb312021-12-21 11:31:56.446root 11241100x8000000000000000538075Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:56.446{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4d88d8f3ca89d8812021-12-21 11:31:56.446root 11241100x8000000000000000538076Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:56.446{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f64f27e0b580f4022021-12-21 11:31:56.446root 11241100x8000000000000000538077Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:56.446{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1f42f31702fcd99e2021-12-21 11:31:56.446root 11241100x8000000000000000538078Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:56.447{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.da758afd56233da62021-12-21 11:31:56.447root 11241100x8000000000000000538079Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:56.447{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.fbecee5af2c9efe52021-12-21 11:31:56.447root 11241100x8000000000000000538080Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:56.447{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.cb019f2ac33ec3892021-12-21 11:31:56.447root 11241100x8000000000000000538081Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:56.447{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c1697d02d8db36122021-12-21 11:31:56.447root 11241100x8000000000000000538082Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:56.447{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.43907da7c52f39a32021-12-21 11:31:56.447root 11241100x8000000000000000538083Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:56.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.92806248ef4188502021-12-21 11:31:56.943root 11241100x8000000000000000538084Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:56.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8ad6bd302724fc072021-12-21 11:31:56.943root 11241100x8000000000000000538085Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:56.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3309ec8671cfbbbf2021-12-21 11:31:56.943root 11241100x8000000000000000538086Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:56.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b4fd1b6c63add8fc2021-12-21 11:31:56.943root 11241100x8000000000000000538087Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:56.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7f7087d6aa5ee7332021-12-21 11:31:56.943root 11241100x8000000000000000538088Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:56.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a82343da521250b92021-12-21 11:31:56.943root 11241100x8000000000000000538089Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:56.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b7bd88608a2397732021-12-21 11:31:56.943root 11241100x8000000000000000538090Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:56.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1a8911ec9fe723db2021-12-21 11:31:56.944root 11241100x8000000000000000538091Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:56.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8e434b7a18353cdd2021-12-21 11:31:56.944root 11241100x8000000000000000538092Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:56.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f12024246c7198302021-12-21 11:31:56.944root 11241100x8000000000000000538093Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:56.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.bbf5fdb80265adf82021-12-21 11:31:56.944root 11241100x8000000000000000538094Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:56.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.dd0ef66f3bbddc8d2021-12-21 11:31:56.944root 11241100x8000000000000000538095Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:56.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.bc1f6806bf9de7282021-12-21 11:31:56.944root 11241100x8000000000000000538096Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:56.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6124002e3fd9ae602021-12-21 11:31:56.944root 11241100x8000000000000000538097Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:56.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7397b77451d4dd6d2021-12-21 11:31:56.944root 11241100x8000000000000000538098Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:56.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4eccd17e06e71cde2021-12-21 11:31:56.944root 11241100x8000000000000000538099Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:56.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5e685f0794e4ef592021-12-21 11:31:56.944root 11241100x8000000000000000538100Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:56.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.65999a643d78dcd42021-12-21 11:31:56.944root 11241100x8000000000000000538101Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:56.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8e184341dd5753b32021-12-21 11:31:56.944root 11241100x8000000000000000538102Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:56.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9b43a1355486e3f32021-12-21 11:31:56.945root 11241100x8000000000000000538103Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:56.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.abf3a8d8a055bc6a2021-12-21 11:31:56.945root 11241100x8000000000000000538104Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:56.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3970ec3a3de554152021-12-21 11:31:56.945root 11241100x8000000000000000538105Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:56.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5ba04489e9787ba12021-12-21 11:31:56.945root 11241100x8000000000000000538106Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:57.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5319d39c4889677d2021-12-21 11:31:57.443root 11241100x8000000000000000538107Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:57.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f63bed9e25b5c0112021-12-21 11:31:57.443root 11241100x8000000000000000538108Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:57.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d1a87cad62cf3d7c2021-12-21 11:31:57.444root 11241100x8000000000000000538109Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:57.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0d5fd6120701c1a32021-12-21 11:31:57.444root 11241100x8000000000000000538110Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:57.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f3d052b0b03dd6932021-12-21 11:31:57.444root 11241100x8000000000000000538111Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:57.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7e8081750ce3898f2021-12-21 11:31:57.444root 11241100x8000000000000000538112Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:57.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4c9c01516b287d5f2021-12-21 11:31:57.444root 11241100x8000000000000000538113Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:57.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4883de26457192522021-12-21 11:31:57.444root 11241100x8000000000000000538114Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:57.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.96e43423c5466da62021-12-21 11:31:57.445root 11241100x8000000000000000538115Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:57.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.52094fbf487d6c262021-12-21 11:31:57.445root 11241100x8000000000000000538116Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:57.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.57e6ba5a2946120f2021-12-21 11:31:57.445root 11241100x8000000000000000538117Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:57.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c054d8be914a986f2021-12-21 11:31:57.445root 11241100x8000000000000000538118Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:57.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.54a1924db5101aed2021-12-21 11:31:57.445root 11241100x8000000000000000538119Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:57.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.56d57168a3e297f22021-12-21 11:31:57.445root 11241100x8000000000000000538120Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:57.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.462d9b0e733bff392021-12-21 11:31:57.445root 11241100x8000000000000000538121Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:57.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.bd8c519e79f62da22021-12-21 11:31:57.445root 11241100x8000000000000000538122Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:57.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.88f8295203e8d9832021-12-21 11:31:57.445root 11241100x8000000000000000538123Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:57.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c9042c291b629a5f2021-12-21 11:31:57.445root 11241100x8000000000000000538124Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:57.446{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.309c65a66c71e5de2021-12-21 11:31:57.446root 11241100x8000000000000000538125Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:57.446{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d4eb40a05bdf94e12021-12-21 11:31:57.446root 11241100x8000000000000000538126Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:57.446{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.24d1e473b178888c2021-12-21 11:31:57.446root 11241100x8000000000000000538127Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:57.446{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7e7146ebdd9aacbc2021-12-21 11:31:57.446root 11241100x8000000000000000538128Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:57.446{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.573b67255f17454d2021-12-21 11:31:57.446root 11241100x8000000000000000538129Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:57.942{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ad7acbd95c6d2ee02021-12-21 11:31:57.942root 11241100x8000000000000000538130Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:57.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5b2b5a456c553c0f2021-12-21 11:31:57.943root 11241100x8000000000000000538131Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:57.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ba6c6b281b0592542021-12-21 11:31:57.943root 11241100x8000000000000000538132Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:57.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.41eef2347d001cfa2021-12-21 11:31:57.943root 11241100x8000000000000000538133Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:57.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d989ccd665c989422021-12-21 11:31:57.943root 11241100x8000000000000000538134Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:57.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f5724f10fc0f13992021-12-21 11:31:57.943root 11241100x8000000000000000538135Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:57.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c289f09f4070efe02021-12-21 11:31:57.944root 11241100x8000000000000000538136Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:57.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.cdf3d588f93a1ff62021-12-21 11:31:57.944root 11241100x8000000000000000538137Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:57.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.69e183e2728b12102021-12-21 11:31:57.944root 11241100x8000000000000000538138Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:57.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3d0ea04f8f672ec02021-12-21 11:31:57.944root 11241100x8000000000000000538139Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:57.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b80332dfcbe85aff2021-12-21 11:31:57.944root 11241100x8000000000000000538140Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:57.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.01a9929ac408eb9f2021-12-21 11:31:57.945root 11241100x8000000000000000538141Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:57.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6b3908eab3287b3a2021-12-21 11:31:57.945root 11241100x8000000000000000538142Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:57.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0570a4dab421f7412021-12-21 11:31:57.945root 11241100x8000000000000000538143Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:57.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.611ef1b831db101b2021-12-21 11:31:57.945root 11241100x8000000000000000538144Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:57.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1ec6a539eab3fdac2021-12-21 11:31:57.945root 11241100x8000000000000000538145Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:57.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.36e72e051b4a68c72021-12-21 11:31:57.945root 11241100x8000000000000000538146Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:57.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b4035e5c514feb3a2021-12-21 11:31:57.945root 11241100x8000000000000000538147Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:57.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c8b3f1c156c712862021-12-21 11:31:57.945root 11241100x8000000000000000538148Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:57.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7b2b9a7ab4a1d6772021-12-21 11:31:57.945root 11241100x8000000000000000538149Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:57.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f6b584edcf0fbe7c2021-12-21 11:31:57.945root 11241100x8000000000000000538150Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:57.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a5810edc6bbeb7342021-12-21 11:31:57.945root 11241100x8000000000000000538151Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:57.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.046725e8989ac0fe2021-12-21 11:31:57.945root 11241100x8000000000000000538152Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:57.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.70b281014b8ab7642021-12-21 11:31:57.945root 11241100x8000000000000000538153Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:57.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.18b83ea8d3ddc00e2021-12-21 11:31:57.945root 11241100x8000000000000000538154Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:57.946{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3ad8dde795bf908c2021-12-21 11:31:57.946root 11241100x8000000000000000538155Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:57.946{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.173e12ecd200729c2021-12-21 11:31:57.946root 11241100x8000000000000000538156Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:57.946{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.13ade41f55f671b12021-12-21 11:31:57.946root 11241100x8000000000000000538157Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:57.946{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7149fecb00bf4a1f2021-12-21 11:31:57.946root 11241100x8000000000000000538158Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:58.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.845d03e2384385a92021-12-21 11:31:58.443root 11241100x8000000000000000538159Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:58.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9a2ed095ade9991d2021-12-21 11:31:58.443root 11241100x8000000000000000538160Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:58.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.726c48dda65cf0792021-12-21 11:31:58.443root 11241100x8000000000000000538161Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:58.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2da0c2027c1ab8a62021-12-21 11:31:58.443root 11241100x8000000000000000538162Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:58.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.df12be01517c9efe2021-12-21 11:31:58.444root 11241100x8000000000000000538163Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:58.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.59184db0eb8fca402021-12-21 11:31:58.444root 11241100x8000000000000000538164Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:58.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.014035157d0677782021-12-21 11:31:58.444root 11241100x8000000000000000538165Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:58.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0aa0af9861ebd9132021-12-21 11:31:58.444root 11241100x8000000000000000538166Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:58.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9d77bfa8be1ceecf2021-12-21 11:31:58.444root 11241100x8000000000000000538167Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:58.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ff99aca686d3554a2021-12-21 11:31:58.444root 11241100x8000000000000000538168Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:58.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.33fd55f272c8339f2021-12-21 11:31:58.444root 11241100x8000000000000000538169Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:58.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3931e69bceb639352021-12-21 11:31:58.445root 11241100x8000000000000000538170Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:58.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a6845a680bd327992021-12-21 11:31:58.445root 11241100x8000000000000000538171Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:58.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0dcb6c420098b6ee2021-12-21 11:31:58.445root 11241100x8000000000000000538172Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:58.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4392023add9751aa2021-12-21 11:31:58.445root 11241100x8000000000000000538173Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:58.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e64d7cb96cb37fa72021-12-21 11:31:58.445root 11241100x8000000000000000538174Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:58.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ceae1b38d8edea692021-12-21 11:31:58.445root 11241100x8000000000000000538175Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:58.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.65ea843e4e13e3842021-12-21 11:31:58.445root 11241100x8000000000000000538176Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:58.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.193eea12510c0ba42021-12-21 11:31:58.445root 11241100x8000000000000000538177Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:58.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.545c346ca706d45f2021-12-21 11:31:58.445root 11241100x8000000000000000538178Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:58.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a23d71e46c20f2872021-12-21 11:31:58.445root 11241100x8000000000000000538179Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:58.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8b35d75ddf1a00c12021-12-21 11:31:58.445root 11241100x8000000000000000538180Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:58.446{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9f9ab545996f07762021-12-21 11:31:58.446root 11241100x8000000000000000538181Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:58.446{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.db9f97ac3b80aeab2021-12-21 11:31:58.446root 11241100x8000000000000000538182Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:58.446{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1dbc5c5660dc6eba2021-12-21 11:31:58.446root 11241100x8000000000000000538183Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:58.446{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.fcde1c504a91d4c32021-12-21 11:31:58.446root 11241100x8000000000000000538184Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:58.446{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.57f4e21471cf40ad2021-12-21 11:31:58.446root 11241100x8000000000000000538185Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:58.446{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c6bf562e1ba086b52021-12-21 11:31:58.446root 11241100x8000000000000000538186Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:58.447{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6ce0252510ed542d2021-12-21 11:31:58.447root 11241100x8000000000000000538187Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:58.447{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1ec7de4115bd3ad42021-12-21 11:31:58.447root 11241100x8000000000000000538188Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:58.447{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.485f15e2c893453d2021-12-21 11:31:58.447root 11241100x8000000000000000538189Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:58.447{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a3320ebbcdf9a3142021-12-21 11:31:58.447root 11241100x8000000000000000538190Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:58.447{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.83164cc677ccca372021-12-21 11:31:58.447root 11241100x8000000000000000538191Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:58.447{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e230f9e856e31c402021-12-21 11:31:58.447root 11241100x8000000000000000538192Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:58.447{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a6e51096ea60bd202021-12-21 11:31:58.447root 11241100x8000000000000000538193Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:58.448{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.77a08d621fbe9da92021-12-21 11:31:58.448root 11241100x8000000000000000538194Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:58.448{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.72f602d0861739ef2021-12-21 11:31:58.448root 11241100x8000000000000000538195Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:58.448{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7fad55e62cbcd98f2021-12-21 11:31:58.448root 11241100x8000000000000000538196Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:58.448{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b310a588f933cdf72021-12-21 11:31:58.448root 11241100x8000000000000000538197Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:58.448{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0ee836d144cb3bb12021-12-21 11:31:58.448root 11241100x8000000000000000538198Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:58.448{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e7f3f3d7ca2c3cac2021-12-21 11:31:58.448root 11241100x8000000000000000538199Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:58.448{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.65bbe56fd3f812e32021-12-21 11:31:58.448root 11241100x8000000000000000538200Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:58.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2d7af95dab925aae2021-12-21 11:31:58.943root 11241100x8000000000000000538201Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:58.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.15846b027643d48b2021-12-21 11:31:58.943root 11241100x8000000000000000538202Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:58.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4b70d719649d33002021-12-21 11:31:58.943root 11241100x8000000000000000538203Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:58.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f8fa1ef92b8fc3072021-12-21 11:31:58.944root 11241100x8000000000000000538204Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:58.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3c25b63c5235ac012021-12-21 11:31:58.944root 11241100x8000000000000000538205Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:58.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.21113fcb17a6362d2021-12-21 11:31:58.944root 11241100x8000000000000000538206Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:58.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0059228ac4bc74712021-12-21 11:31:58.944root 11241100x8000000000000000538207Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:58.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.df021960b721b7e52021-12-21 11:31:58.944root 11241100x8000000000000000538208Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:58.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7222a956e90fc30b2021-12-21 11:31:58.944root 11241100x8000000000000000538209Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:58.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.80306a1d51781d9c2021-12-21 11:31:58.945root 11241100x8000000000000000538210Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:58.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.186d6872bf0eb6f82021-12-21 11:31:58.945root 11241100x8000000000000000538211Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:58.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5cff39ed67f6b84c2021-12-21 11:31:58.945root 11241100x8000000000000000538212Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:58.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ffddbee0b3ecbf342021-12-21 11:31:58.945root 11241100x8000000000000000538213Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:58.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3b8f00c6936ef8f72021-12-21 11:31:58.945root 11241100x8000000000000000538214Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:58.946{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ead55c52284d19722021-12-21 11:31:58.946root 11241100x8000000000000000538215Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:58.946{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.bd7faf2a5d9a4b082021-12-21 11:31:58.946root 11241100x8000000000000000538216Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:58.946{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.78e714f267fc09942021-12-21 11:31:58.946root 11241100x8000000000000000538217Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:58.946{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3771828bba399bb22021-12-21 11:31:58.946root 11241100x8000000000000000538218Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:58.946{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1fd964094666cb8d2021-12-21 11:31:58.946root 11241100x8000000000000000538219Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:58.946{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ab381bb91228ff6f2021-12-21 11:31:58.946root 11241100x8000000000000000538220Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:58.946{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.91bfe05840da35f92021-12-21 11:31:58.946root 11241100x8000000000000000538221Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:58.947{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2406efa87febc6e12021-12-21 11:31:58.947root 11241100x8000000000000000538222Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:58.947{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.72e1ddf7b1425f422021-12-21 11:31:58.947root 11241100x8000000000000000538223Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:58.947{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.24989b2058a96d5a2021-12-21 11:31:58.947root 11241100x8000000000000000538224Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:58.947{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e03c5de537ad1abe2021-12-21 11:31:58.947root 11241100x8000000000000000538225Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:58.947{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6d7af99a595c6cd62021-12-21 11:31:58.947root 11241100x8000000000000000538226Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:58.947{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.00392e23a94b6d012021-12-21 11:31:58.947root 354300x8000000000000000538227Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:59.149{ec2b6afe-95d9-61c1-5175-3a0400000000}5346/opt/splunkforwarder/etc/apps/Splunk_TA_stream/linux_x86_64/bin/streamfwdroottcptruefalse10.0.1.25-48674-false10.0.1.12-8000- 11241100x8000000000000000538228Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:59.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.392397cf63e007af2021-12-21 11:31:59.443root 11241100x8000000000000000538229Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:59.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.79723c732d16c6d02021-12-21 11:31:59.444root 11241100x8000000000000000538230Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:59.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2583b2d9dbec1bde2021-12-21 11:31:59.444root 11241100x8000000000000000538231Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:59.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.32d309d62c7ca7da2021-12-21 11:31:59.444root 11241100x8000000000000000538232Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:59.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.583b7f2484222c5c2021-12-21 11:31:59.444root 11241100x8000000000000000538233Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:59.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a1d6855a748215152021-12-21 11:31:59.444root 11241100x8000000000000000538234Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:59.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3c86637ac7b06fc42021-12-21 11:31:59.444root 11241100x8000000000000000538235Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:59.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2878f2e0ad8fc7cc2021-12-21 11:31:59.444root 11241100x8000000000000000538236Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:59.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.071425edf5c071fd2021-12-21 11:31:59.444root 11241100x8000000000000000538237Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:59.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7365d5dd7a1feb902021-12-21 11:31:59.444root 11241100x8000000000000000538238Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:59.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8dbe9ba243bd40572021-12-21 11:31:59.444root 11241100x8000000000000000538239Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:59.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e261a7b04a8eb4de2021-12-21 11:31:59.444root 11241100x8000000000000000538240Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:59.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e97a15a0acaab1762021-12-21 11:31:59.444root 11241100x8000000000000000538241Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:59.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.440d8da5b7408cfd2021-12-21 11:31:59.445root 11241100x8000000000000000538242Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:59.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.210474f67419122b2021-12-21 11:31:59.445root 11241100x8000000000000000538243Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:59.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.47a75223c30ad94c2021-12-21 11:31:59.445root 11241100x8000000000000000538244Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:59.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c5fd22826a7e04ba2021-12-21 11:31:59.445root 11241100x8000000000000000538245Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:59.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b02b5c268dc5a5c82021-12-21 11:31:59.445root 11241100x8000000000000000538246Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:59.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d2152353bd4819cf2021-12-21 11:31:59.445root 11241100x8000000000000000538247Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:59.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e7c84079a91be21e2021-12-21 11:31:59.445root 11241100x8000000000000000538248Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:59.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e6b910ce396eb7be2021-12-21 11:31:59.445root 11241100x8000000000000000538249Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:59.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e9ea38a31f5966d72021-12-21 11:31:59.445root 11241100x8000000000000000538250Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:59.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5b8d5057ee7464c62021-12-21 11:31:59.445root 11241100x8000000000000000538251Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:59.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3e3450d731d40d1a2021-12-21 11:31:59.445root 11241100x8000000000000000538252Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:59.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c80f5e67975e9a2f2021-12-21 11:31:59.943root 11241100x8000000000000000538253Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:59.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1783313b74da78e72021-12-21 11:31:59.943root 11241100x8000000000000000538254Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:59.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b5925d8eeb4236c32021-12-21 11:31:59.943root 11241100x8000000000000000538255Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:59.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d8ec217e232ad7282021-12-21 11:31:59.943root 11241100x8000000000000000538256Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:59.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2a98d2d0ceebbbb12021-12-21 11:31:59.944root 11241100x8000000000000000538257Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:59.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.bf39ad4d925409652021-12-21 11:31:59.944root 11241100x8000000000000000538258Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:59.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3763541ab0dcfe0a2021-12-21 11:31:59.944root 11241100x8000000000000000538259Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:59.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.958cb275c395cece2021-12-21 11:31:59.944root 11241100x8000000000000000538260Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:59.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6f5259b34a8a298a2021-12-21 11:31:59.944root 11241100x8000000000000000538261Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:59.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9a7ad84f692f6f1a2021-12-21 11:31:59.944root 11241100x8000000000000000538262Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:59.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2fc61991aa4c5c782021-12-21 11:31:59.944root 11241100x8000000000000000538263Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:59.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e203fc86dedb09262021-12-21 11:31:59.944root 11241100x8000000000000000538264Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:59.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.22de84ffd562710f2021-12-21 11:31:59.944root 11241100x8000000000000000538265Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:59.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5250cc053164b94b2021-12-21 11:31:59.944root 11241100x8000000000000000538266Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:59.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8491a18584fa458b2021-12-21 11:31:59.944root 11241100x8000000000000000538267Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:59.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.916e2766b82d33e52021-12-21 11:31:59.944root 11241100x8000000000000000538268Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:59.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.cb4d69b4024f7ac22021-12-21 11:31:59.944root 11241100x8000000000000000538269Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:59.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.eeb14285730550fe2021-12-21 11:31:59.944root 11241100x8000000000000000538270Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:59.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c3b98eac48d76e632021-12-21 11:31:59.944root 11241100x8000000000000000538271Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:59.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.80044d5856fe85922021-12-21 11:31:59.944root 11241100x8000000000000000538272Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:59.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.60e06f56698755fe2021-12-21 11:31:59.945root 11241100x8000000000000000538273Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:59.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d3631af0560343d12021-12-21 11:31:59.945root 11241100x8000000000000000538274Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:59.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c70e8d2a74fbd3102021-12-21 11:31:59.945root 11241100x8000000000000000538275Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:31:59.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6c1798f80efeba0c2021-12-21 11:31:59.945root 11241100x8000000000000000538276Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:00.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a8a14f2234be2c8d2021-12-21 11:32:00.443root 11241100x8000000000000000538277Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:00.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.02f244f05693d0422021-12-21 11:32:00.443root 11241100x8000000000000000538278Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:00.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6e1b8c82ff0f05c72021-12-21 11:32:00.444root 11241100x8000000000000000538279Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:00.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d6a98db1f7bcee8d2021-12-21 11:32:00.444root 11241100x8000000000000000538280Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:00.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.883787f9457ff3582021-12-21 11:32:00.444root 11241100x8000000000000000538281Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:00.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.89b34080b075faad2021-12-21 11:32:00.444root 11241100x8000000000000000538282Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:00.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a6a3dd094a936ce32021-12-21 11:32:00.444root 11241100x8000000000000000538283Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:00.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e63d9e681100e6e92021-12-21 11:32:00.444root 11241100x8000000000000000538284Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:00.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.618974440197fb0a2021-12-21 11:32:00.445root 11241100x8000000000000000538285Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:00.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.54e2c05fa48b1c002021-12-21 11:32:00.445root 11241100x8000000000000000538286Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:00.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b1d0759a7bbd76902021-12-21 11:32:00.445root 11241100x8000000000000000538287Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:00.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.dfa2327a60b0cf352021-12-21 11:32:00.445root 11241100x8000000000000000538288Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:00.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.af110b4c68584c2f2021-12-21 11:32:00.445root 11241100x8000000000000000538289Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:00.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.bc053ce468e7515e2021-12-21 11:32:00.445root 11241100x8000000000000000538290Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:00.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ca19029cff1f67c92021-12-21 11:32:00.445root 11241100x8000000000000000538291Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:00.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.dd40cce6bd3d62cc2021-12-21 11:32:00.445root 11241100x8000000000000000538292Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:00.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.047948c2415a87082021-12-21 11:32:00.445root 11241100x8000000000000000538293Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:00.446{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5e88d0387997faf72021-12-21 11:32:00.446root 11241100x8000000000000000538294Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:00.446{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ea3e91ffb56266892021-12-21 11:32:00.446root 11241100x8000000000000000538295Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:00.446{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.36d45b292a1f3b8a2021-12-21 11:32:00.446root 11241100x8000000000000000538296Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:00.446{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6230b46dd1ee1bab2021-12-21 11:32:00.446root 11241100x8000000000000000538297Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:00.446{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.480b333e22f4bddc2021-12-21 11:32:00.446root 11241100x8000000000000000538298Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:00.447{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c049d26562a2438e2021-12-21 11:32:00.447root 11241100x8000000000000000538299Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:00.447{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2cf0d3f277b09b6e2021-12-21 11:32:00.447root 11241100x8000000000000000538300Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:00.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.aa4fb7ea76205d0f2021-12-21 11:32:00.943root 11241100x8000000000000000538301Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:00.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.48aef32f444635722021-12-21 11:32:00.943root 11241100x8000000000000000538302Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:00.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.cb39b933094c17062021-12-21 11:32:00.943root 11241100x8000000000000000538303Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:00.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7f8541c92cf3ec082021-12-21 11:32:00.943root 11241100x8000000000000000538304Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:00.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3b2372f1646d8e132021-12-21 11:32:00.943root 11241100x8000000000000000538305Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:00.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3d346a61ce45be242021-12-21 11:32:00.943root 11241100x8000000000000000538306Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:00.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a8f14477cfa6a38d2021-12-21 11:32:00.944root 11241100x8000000000000000538307Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:00.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.97ed0472cc4d86292021-12-21 11:32:00.944root 11241100x8000000000000000538308Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:00.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a803ea541e81ce062021-12-21 11:32:00.944root 11241100x8000000000000000538309Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:00.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.28def0bb01f386d42021-12-21 11:32:00.944root 11241100x8000000000000000538310Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:00.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.37c0949a3872ec572021-12-21 11:32:00.944root 11241100x8000000000000000538311Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:00.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6ee1e6c33e418a092021-12-21 11:32:00.944root 11241100x8000000000000000538312Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:00.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.bff7c1f1c1d597862021-12-21 11:32:00.944root 11241100x8000000000000000538313Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:00.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d34d53babbb181b02021-12-21 11:32:00.944root 11241100x8000000000000000538314Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:00.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.16fc916aa46637492021-12-21 11:32:00.944root 11241100x8000000000000000538315Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:00.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5560c73ab54105f62021-12-21 11:32:00.944root 11241100x8000000000000000538316Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:00.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.dde7d8c430aef1922021-12-21 11:32:00.945root 11241100x8000000000000000538317Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:00.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4b02607651a216312021-12-21 11:32:00.945root 11241100x8000000000000000538318Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:00.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6c8dea6edfa2ea262021-12-21 11:32:00.945root 11241100x8000000000000000538319Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:00.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3df8e04cf9293e382021-12-21 11:32:00.945root 11241100x8000000000000000538320Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:00.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a2e6a5472fe9bda82021-12-21 11:32:00.945root 11241100x8000000000000000538321Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:00.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.25eb5ca3e39bd4e92021-12-21 11:32:00.945root 11241100x8000000000000000538322Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:00.946{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.886e094740b270e32021-12-21 11:32:00.946root 11241100x8000000000000000538323Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:00.946{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.cf7d74becbb8ff432021-12-21 11:32:00.946root 11241100x8000000000000000538324Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:00.946{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5af6048cfe2a76b02021-12-21 11:32:00.946root 11241100x8000000000000000538325Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:00.946{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c9b77f03ddbfa2782021-12-21 11:32:00.946root 11241100x8000000000000000538326Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:00.946{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e415d37acaa57cd02021-12-21 11:32:00.946root 11241100x8000000000000000538327Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:00.946{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ccdfb317956f2c132021-12-21 11:32:00.946root 11241100x8000000000000000538328Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:00.946{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3a82f439cee901902021-12-21 11:32:00.946root 11241100x8000000000000000538329Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:00.947{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.fcb1668d6ebb94a02021-12-21 11:32:00.947root 11241100x8000000000000000538330Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:00.947{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a08924b4d8b831b52021-12-21 11:32:00.947root 11241100x8000000000000000538331Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:00.947{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.765579e22df45eed2021-12-21 11:32:00.947root 11241100x8000000000000000538332Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:00.948{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1fea623ba7ad3c852021-12-21 11:32:00.948root 11241100x8000000000000000538333Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:00.948{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2d7fda7b98c076f72021-12-21 11:32:00.948root 11241100x8000000000000000538334Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:00.948{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.89ec340313abb1382021-12-21 11:32:00.948root 11241100x8000000000000000538335Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:00.948{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9392a22222c7ade32021-12-21 11:32:00.948root 11241100x8000000000000000538336Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:00.949{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d2a161d31aa8e83f2021-12-21 11:32:00.949root 11241100x8000000000000000538337Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:00.949{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.bcd5481851e90b852021-12-21 11:32:00.949root 11241100x8000000000000000538338Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:00.949{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.502b86c9c7a3cb682021-12-21 11:32:00.949root 11241100x8000000000000000538339Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:01.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.37b21f96002e5f132021-12-21 11:32:01.443root 11241100x8000000000000000538340Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:01.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3ab6e6a6eec09da12021-12-21 11:32:01.443root 11241100x8000000000000000538341Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:01.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1bdba9867f6507f62021-12-21 11:32:01.443root 11241100x8000000000000000538342Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:01.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.dde5060ca61519ca2021-12-21 11:32:01.443root 11241100x8000000000000000538343Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:01.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a021146ba34cc9532021-12-21 11:32:01.444root 11241100x8000000000000000538344Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:01.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a232dabd84d502af2021-12-21 11:32:01.444root 11241100x8000000000000000538345Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:01.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e553ce5ff38042e62021-12-21 11:32:01.444root 11241100x8000000000000000538346Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:01.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9155ec035f0fc5ed2021-12-21 11:32:01.444root 11241100x8000000000000000538347Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:01.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9d6ca5f70e9648132021-12-21 11:32:01.444root 11241100x8000000000000000538348Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:01.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6edb74a8c6c989402021-12-21 11:32:01.444root 11241100x8000000000000000538349Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:01.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.988cf4d9399db75b2021-12-21 11:32:01.444root 11241100x8000000000000000538350Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:01.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6f3147d21a5bf31a2021-12-21 11:32:01.444root 11241100x8000000000000000538351Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:01.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.65bf965f479c08572021-12-21 11:32:01.444root 11241100x8000000000000000538352Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:01.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.146f6455b7ef830b2021-12-21 11:32:01.444root 11241100x8000000000000000538353Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:01.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a79b41de771f60652021-12-21 11:32:01.444root 11241100x8000000000000000538354Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:01.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a79678efb5b54add2021-12-21 11:32:01.445root 11241100x8000000000000000538355Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:01.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.cab61950dfb474342021-12-21 11:32:01.445root 11241100x8000000000000000538356Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:01.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.09a9e6fff98b49bd2021-12-21 11:32:01.445root 11241100x8000000000000000538357Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:01.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d0917a7af05135452021-12-21 11:32:01.445root 11241100x8000000000000000538358Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:01.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.bde960fa2fef80d62021-12-21 11:32:01.445root 11241100x8000000000000000538359Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:01.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e4b9aec100b0ea362021-12-21 11:32:01.445root 11241100x8000000000000000538360Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:01.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9b400d2072cef5c52021-12-21 11:32:01.445root 11241100x8000000000000000538361Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:01.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f2b5b9aab77cb2052021-12-21 11:32:01.445root 11241100x8000000000000000538362Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:01.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.20c214e966287ea22021-12-21 11:32:01.445root 11241100x8000000000000000538363Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:01.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.498e99ac3b25dc5f2021-12-21 11:32:01.943root 11241100x8000000000000000538364Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:01.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1255b6250aac4e7c2021-12-21 11:32:01.943root 11241100x8000000000000000538365Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:01.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d6293dac812960f32021-12-21 11:32:01.943root 11241100x8000000000000000538366Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:01.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d33dae6bd155f7db2021-12-21 11:32:01.943root 11241100x8000000000000000538367Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:01.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3b57d8ba7d2e34e82021-12-21 11:32:01.944root 11241100x8000000000000000538368Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:01.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3beef241b406bf3f2021-12-21 11:32:01.944root 11241100x8000000000000000538369Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:01.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a7d069e7ddb68f362021-12-21 11:32:01.944root 11241100x8000000000000000538370Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:01.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.01cbf1df83cb3b112021-12-21 11:32:01.944root 11241100x8000000000000000538371Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:01.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.17d201b3ee8bfad32021-12-21 11:32:01.944root 11241100x8000000000000000538372Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:01.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.bbf7ae6d9dfc3bfb2021-12-21 11:32:01.944root 11241100x8000000000000000538373Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:01.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c75998557eea08292021-12-21 11:32:01.944root 11241100x8000000000000000538374Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:01.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.cb8dbf008d9045e22021-12-21 11:32:01.944root 11241100x8000000000000000538375Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:01.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3a91e458499e4aa92021-12-21 11:32:01.944root 11241100x8000000000000000538376Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:01.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2d39df6d40e6ceb12021-12-21 11:32:01.945root 11241100x8000000000000000538377Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:01.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f82c9bb1c1022ade2021-12-21 11:32:01.945root 11241100x8000000000000000538378Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:01.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.fb81a6e5ec0ee4ba2021-12-21 11:32:01.945root 11241100x8000000000000000538379Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:01.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a3debf04a8223c752021-12-21 11:32:01.945root 11241100x8000000000000000538380Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:01.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.55d25439d489085d2021-12-21 11:32:01.945root 11241100x8000000000000000538381Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:01.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.03a4596941d22a3e2021-12-21 11:32:01.945root 11241100x8000000000000000538382Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:01.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e9e0fc877d1c90482021-12-21 11:32:01.945root 11241100x8000000000000000538383Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:01.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8def485c2dfc73002021-12-21 11:32:01.945root 11241100x8000000000000000538384Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:01.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.93a38f2c474df3892021-12-21 11:32:01.945root 11241100x8000000000000000538385Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:01.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.cea90a925be6c62e2021-12-21 11:32:01.945root 11241100x8000000000000000538386Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:01.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7f56bff6df896d2d2021-12-21 11:32:01.945root 11241100x8000000000000000538387Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:02.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8dc3185d3d76a3fa2021-12-21 11:32:02.443root 11241100x8000000000000000538388Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:02.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a34afb67bbd824972021-12-21 11:32:02.443root 11241100x8000000000000000538389Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:02.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2b33875535c4d8102021-12-21 11:32:02.443root 11241100x8000000000000000538390Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:02.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.fb4cf4d6b607256c2021-12-21 11:32:02.444root 11241100x8000000000000000538391Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:02.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5e8fd4e0b780437e2021-12-21 11:32:02.444root 11241100x8000000000000000538392Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:02.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5a881e2febba3b562021-12-21 11:32:02.444root 11241100x8000000000000000538393Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:02.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ef9147637bc9f8da2021-12-21 11:32:02.444root 11241100x8000000000000000538394Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:02.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9099a2b07faa00222021-12-21 11:32:02.444root 11241100x8000000000000000538395Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:02.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ced5fcb9ec90cd782021-12-21 11:32:02.444root 11241100x8000000000000000538396Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:02.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b3e6350280b7526d2021-12-21 11:32:02.444root 11241100x8000000000000000538397Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:02.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f90b9f3e65afd3e92021-12-21 11:32:02.445root 11241100x8000000000000000538398Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:02.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.64a4d5c7173266c42021-12-21 11:32:02.445root 11241100x8000000000000000538399Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:02.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e4aecb7778a060da2021-12-21 11:32:02.445root 11241100x8000000000000000538400Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:02.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.66f6f813d7d9be832021-12-21 11:32:02.445root 11241100x8000000000000000538401Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:02.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c3299039072812af2021-12-21 11:32:02.445root 11241100x8000000000000000538402Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:02.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0dda91fd973e34ae2021-12-21 11:32:02.445root 11241100x8000000000000000538403Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:02.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.280ae3c50cbebc602021-12-21 11:32:02.445root 11241100x8000000000000000538404Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:02.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b22b1711e1ea05782021-12-21 11:32:02.445root 11241100x8000000000000000538405Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:02.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.dc4062aca369e04d2021-12-21 11:32:02.445root 11241100x8000000000000000538406Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:02.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.bbe24e6897fcea672021-12-21 11:32:02.445root 11241100x8000000000000000538407Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:02.446{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.92a78f5f80a065d42021-12-21 11:32:02.446root 11241100x8000000000000000538408Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:02.446{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.089272a5fd8093ab2021-12-21 11:32:02.446root 11241100x8000000000000000538409Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:02.446{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.dd463a413ce226f52021-12-21 11:32:02.446root 11241100x8000000000000000538410Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:02.446{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.18e7d8f5bbd219132021-12-21 11:32:02.446root 11241100x8000000000000000538411Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:02.446{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2cbb363532a061012021-12-21 11:32:02.446root 11241100x8000000000000000538412Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:02.446{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4dd0a8836c2339f42021-12-21 11:32:02.446root 11241100x8000000000000000538413Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:02.446{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.70c67d69dbf1e04a2021-12-21 11:32:02.446root 11241100x8000000000000000538414Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:02.446{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8db559ddd61b23192021-12-21 11:32:02.446root 11241100x8000000000000000538415Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:02.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.93ddbc92c12ec2d42021-12-21 11:32:02.943root 11241100x8000000000000000538416Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:02.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d139840f4fb9836f2021-12-21 11:32:02.943root 11241100x8000000000000000538417Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:02.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.69e3b1f0effe8deb2021-12-21 11:32:02.943root 11241100x8000000000000000538418Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:02.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.cf73e60c3fe50ed22021-12-21 11:32:02.943root 11241100x8000000000000000538419Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:02.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f06b447e63708a042021-12-21 11:32:02.943root 11241100x8000000000000000538420Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:02.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d7df98bc9e0569832021-12-21 11:32:02.943root 11241100x8000000000000000538421Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:02.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3bdbe62ff39e12b82021-12-21 11:32:02.943root 11241100x8000000000000000538422Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:02.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a941a3ab8a5fbb9c2021-12-21 11:32:02.943root 11241100x8000000000000000538423Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:02.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.47fb1b1346207ccb2021-12-21 11:32:02.944root 11241100x8000000000000000538424Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:02.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.bbce382656d670b12021-12-21 11:32:02.944root 11241100x8000000000000000538425Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:02.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b3f5f6d0cdcd303d2021-12-21 11:32:02.944root 11241100x8000000000000000538426Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:02.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1e8bb27c4adefd6e2021-12-21 11:32:02.944root 11241100x8000000000000000538427Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:02.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.816e7b1c750bba702021-12-21 11:32:02.944root 11241100x8000000000000000538428Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:02.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.824c4bd182bf295b2021-12-21 11:32:02.944root 11241100x8000000000000000538429Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:02.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7917efd8318293782021-12-21 11:32:02.944root 11241100x8000000000000000538430Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:02.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.911437a5bfba4b7c2021-12-21 11:32:02.944root 11241100x8000000000000000538431Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:02.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ca470ae8f46e55272021-12-21 11:32:02.944root 11241100x8000000000000000538432Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:02.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.99c7eef33b0432ce2021-12-21 11:32:02.944root 11241100x8000000000000000538433Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:02.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.cd70f65c66281c292021-12-21 11:32:02.945root 11241100x8000000000000000538434Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:02.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.967c1b7b2ee0d0fd2021-12-21 11:32:02.945root 11241100x8000000000000000538435Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:02.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6b09c427555086942021-12-21 11:32:02.945root 11241100x8000000000000000538436Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:02.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b7a8360b0068d1f82021-12-21 11:32:02.945root 11241100x8000000000000000538437Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:02.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.834524cce15ea7d22021-12-21 11:32:02.945root 11241100x8000000000000000538438Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:02.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4f9212534f663aa72021-12-21 11:32:02.945root 11241100x8000000000000000538439Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:02.946{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5ef3cd40f14a1cbb2021-12-21 11:32:02.946root 11241100x8000000000000000538440Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:02.946{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ebc018aec0cbc1ab2021-12-21 11:32:02.946root 11241100x8000000000000000538441Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:02.946{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.cc225e319651d4fe2021-12-21 11:32:02.946root 11241100x8000000000000000538442Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:02.946{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.acb901c22877317a2021-12-21 11:32:02.946root 11241100x8000000000000000538443Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:02.946{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.37aaf6ba31a5e96b2021-12-21 11:32:02.946root 11241100x8000000000000000538444Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:02.946{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9d833922b861963a2021-12-21 11:32:02.946root 11241100x8000000000000000538445Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:02.946{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6d3955259512fcce2021-12-21 11:32:02.946root 11241100x8000000000000000538446Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:02.946{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6a57666ebd300c232021-12-21 11:32:02.946root 11241100x8000000000000000538447Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:02.946{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f600bcb111210cbc2021-12-21 11:32:02.946root 11241100x8000000000000000538448Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:02.946{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9300fbb9672456fc2021-12-21 11:32:02.946root 11241100x8000000000000000538449Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:02.946{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.cb340cd2515132b82021-12-21 11:32:02.946root 11241100x8000000000000000538450Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:02.947{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7403ef9958c28b532021-12-21 11:32:02.947root 11241100x8000000000000000538451Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:02.947{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d2e2a104c7a920632021-12-21 11:32:02.947root 11241100x8000000000000000538452Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:02.947{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.757d52ef975c2cd92021-12-21 11:32:02.947root 11241100x8000000000000000538453Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:02.947{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2b7d54f282ed51352021-12-21 11:32:02.947root 11241100x8000000000000000538454Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:02.947{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.648d828a5ebced9c2021-12-21 11:32:02.947root 11241100x8000000000000000538455Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:02.947{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e006eeb903d5d8612021-12-21 11:32:02.947root 11241100x8000000000000000538456Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:02.947{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8a78f3d7136facb52021-12-21 11:32:02.947root 11241100x8000000000000000538457Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:03.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.342caa69c902ba3f2021-12-21 11:32:03.443root 11241100x8000000000000000538458Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:03.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ed6f7c87587a6acd2021-12-21 11:32:03.443root 11241100x8000000000000000538459Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:03.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.29efcd6bec83107f2021-12-21 11:32:03.443root 11241100x8000000000000000538460Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:03.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.bc73415a50cf2a452021-12-21 11:32:03.443root 11241100x8000000000000000538461Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:03.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.53923a4f804b4e252021-12-21 11:32:03.444root 11241100x8000000000000000538462Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:03.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ba764a25f1fcd68c2021-12-21 11:32:03.444root 11241100x8000000000000000538463Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:03.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d8218c2fc858d9ed2021-12-21 11:32:03.444root 11241100x8000000000000000538464Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:03.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9215716542ed90f32021-12-21 11:32:03.444root 11241100x8000000000000000538465Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:03.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5b62d470502b5cd52021-12-21 11:32:03.444root 11241100x8000000000000000538466Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:03.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.39739638c9acc73c2021-12-21 11:32:03.444root 11241100x8000000000000000538467Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:03.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.195f8a1a26c260d22021-12-21 11:32:03.444root 11241100x8000000000000000538468Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:03.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.525e63570ce5a0af2021-12-21 11:32:03.444root 11241100x8000000000000000538469Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:03.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.824ae9bbd11b0da02021-12-21 11:32:03.444root 11241100x8000000000000000538470Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:03.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ba3ab8dd30d6b4d52021-12-21 11:32:03.444root 11241100x8000000000000000538471Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:03.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c92a77301046accc2021-12-21 11:32:03.444root 11241100x8000000000000000538472Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:03.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9c905532f4b44f852021-12-21 11:32:03.444root 11241100x8000000000000000538473Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:03.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5f1496893dc4c6432021-12-21 11:32:03.444root 11241100x8000000000000000538474Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:03.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.35cb80598c43b62a2021-12-21 11:32:03.444root 11241100x8000000000000000538475Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:03.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.67454b49aab5bf5b2021-12-21 11:32:03.444root 11241100x8000000000000000538476Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:03.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.12ebee49227977a42021-12-21 11:32:03.444root 11241100x8000000000000000538477Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:03.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9684b44adb1a12842021-12-21 11:32:03.445root 11241100x8000000000000000538478Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:03.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d49e46d6963fb4b12021-12-21 11:32:03.445root 11241100x8000000000000000538479Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:03.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7477a56c487df0e82021-12-21 11:32:03.445root 11241100x8000000000000000538480Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:03.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.37443eb0d47ff9512021-12-21 11:32:03.445root 11241100x8000000000000000538481Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:03.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ec2df790e28980822021-12-21 11:32:03.943root 11241100x8000000000000000538482Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:03.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8e8e77054cbce84d2021-12-21 11:32:03.943root 11241100x8000000000000000538483Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:03.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4ae8e100d0da75192021-12-21 11:32:03.943root 11241100x8000000000000000538484Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:03.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ba84fc067d8ed7ff2021-12-21 11:32:03.943root 11241100x8000000000000000538485Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:03.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9ba753abce1006652021-12-21 11:32:03.943root 11241100x8000000000000000538486Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:03.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ae97f93f1c223f4b2021-12-21 11:32:03.943root 11241100x8000000000000000538487Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:03.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.19f7915dac55a9e62021-12-21 11:32:03.943root 11241100x8000000000000000538488Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:03.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.edb326366657249d2021-12-21 11:32:03.944root 11241100x8000000000000000538489Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:03.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.978f6f32a1dd62872021-12-21 11:32:03.944root 11241100x8000000000000000538490Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:03.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.50a64f73e1b2400b2021-12-21 11:32:03.944root 11241100x8000000000000000538491Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:03.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a97351704f26f4652021-12-21 11:32:03.944root 11241100x8000000000000000538492Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:03.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e2152db21508ecda2021-12-21 11:32:03.944root 11241100x8000000000000000538493Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:03.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.cb61e269533a5d612021-12-21 11:32:03.944root 11241100x8000000000000000538494Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:03.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d8e7d844bb875d492021-12-21 11:32:03.944root 11241100x8000000000000000538495Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:03.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.205988ed031656cd2021-12-21 11:32:03.944root 11241100x8000000000000000538496Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:03.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8a15d8d9072fc1ea2021-12-21 11:32:03.944root 11241100x8000000000000000538497Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:03.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.df24597c3149b0b12021-12-21 11:32:03.944root 11241100x8000000000000000538498Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:03.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.dc1e934bd7e6237f2021-12-21 11:32:03.944root 11241100x8000000000000000538499Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:03.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.44ca6519f7fd007a2021-12-21 11:32:03.945root 11241100x8000000000000000538500Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:03.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1b2b523b7b8950392021-12-21 11:32:03.945root 11241100x8000000000000000538501Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:03.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d1e6f7e52ab7255a2021-12-21 11:32:03.945root 11241100x8000000000000000538502Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:03.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.552fc2b6b133607d2021-12-21 11:32:03.945root 11241100x8000000000000000538503Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:03.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.dbdc7d94af7a15322021-12-21 11:32:03.945root 11241100x8000000000000000538504Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:03.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.084a7460aaa8d7322021-12-21 11:32:03.945root 11241100x8000000000000000538505Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:03.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1b25aa5f2509c4e52021-12-21 11:32:03.945root 11241100x8000000000000000538506Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:03.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.94d88cc5071202232021-12-21 11:32:03.945root 11241100x8000000000000000538507Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:03.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.130e7ab23d40d3ec2021-12-21 11:32:03.945root 11241100x8000000000000000538508Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:03.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6c03a42894bc440f2021-12-21 11:32:03.945root 11241100x8000000000000000538509Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:03.946{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4cdcbc3200440c5f2021-12-21 11:32:03.946root 354300x8000000000000000538510Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:04.256{ec2b6afe-95d9-61c1-5175-3a0400000000}5346/opt/splunkforwarder/etc/apps/Splunk_TA_stream/linux_x86_64/bin/streamfwdroottcptruefalse10.0.1.25-48676-false10.0.1.12-8000- 11241100x8000000000000000538511Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:04.257{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.28a77cee2cf07d2d2021-12-21 11:32:04.257root 11241100x8000000000000000538512Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:04.257{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.31723e4f32aa9ce02021-12-21 11:32:04.257root 11241100x8000000000000000538513Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:04.257{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c6cad7e61e4c80ff2021-12-21 11:32:04.257root 11241100x8000000000000000538514Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:04.257{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.78aed478d546174e2021-12-21 11:32:04.257root 11241100x8000000000000000538515Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:04.257{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9d22ea0c409dfb7f2021-12-21 11:32:04.257root 11241100x8000000000000000538516Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:04.257{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1241d62eb775e3382021-12-21 11:32:04.257root 11241100x8000000000000000538517Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:04.257{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.338817e526896eeb2021-12-21 11:32:04.257root 11241100x8000000000000000538518Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:04.258{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d30e219205f0f97f2021-12-21 11:32:04.258root 11241100x8000000000000000538519Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:04.258{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5df605d7f47ff1ec2021-12-21 11:32:04.258root 11241100x8000000000000000538520Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:04.258{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.48355fd4845799f62021-12-21 11:32:04.258root 11241100x8000000000000000538521Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:04.258{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6311ab86c2df7f232021-12-21 11:32:04.258root 11241100x8000000000000000538522Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:04.258{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9f2e67ca22bb3b322021-12-21 11:32:04.258root 11241100x8000000000000000538523Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:04.258{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.89e65779f93a7db12021-12-21 11:32:04.258root 11241100x8000000000000000538524Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:04.258{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7d21c0d653a8b4852021-12-21 11:32:04.258root 11241100x8000000000000000538525Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:04.258{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7d3c5eee58750b3a2021-12-21 11:32:04.258root 11241100x8000000000000000538526Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:04.259{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ee49a1b10178a0a52021-12-21 11:32:04.259root 11241100x8000000000000000538527Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:04.259{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0fb24c2e4500d1952021-12-21 11:32:04.259root 11241100x8000000000000000538528Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:04.259{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ef031f9a92791eda2021-12-21 11:32:04.259root 11241100x8000000000000000538529Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:04.259{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c49c2c25ac585b102021-12-21 11:32:04.259root 11241100x8000000000000000538530Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:04.259{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.28a959cee86304182021-12-21 11:32:04.259root 11241100x8000000000000000538531Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:04.259{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ea18f773c63527442021-12-21 11:32:04.259root 11241100x8000000000000000538532Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:04.259{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.eaaa049dc18b90df2021-12-21 11:32:04.259root 11241100x8000000000000000538533Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:04.259{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7a09caf7cd9f5e372021-12-21 11:32:04.259root 11241100x8000000000000000538534Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:04.260{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7ecf3b974f4569b52021-12-21 11:32:04.260root 11241100x8000000000000000538535Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:04.260{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.227f90d876a8a4da2021-12-21 11:32:04.260root 11241100x8000000000000000538536Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:04.260{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c0c192717248422a2021-12-21 11:32:04.260root 11241100x8000000000000000538537Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:04.260{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.496bf0d78cb590d12021-12-21 11:32:04.260root 11241100x8000000000000000538538Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:04.260{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6e61911148bc0fc72021-12-21 11:32:04.260root 11241100x8000000000000000538539Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:04.260{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.fc495c0ababfaf682021-12-21 11:32:04.260root 11241100x8000000000000000538540Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:04.260{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.74ba0ac901b50e912021-12-21 11:32:04.260root 11241100x8000000000000000538541Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:04.260{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c75c2534071ecc5b2021-12-21 11:32:04.260root 11241100x8000000000000000538542Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:04.260{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.65fd96f98fe1042c2021-12-21 11:32:04.260root 11241100x8000000000000000538543Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:04.260{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a724cb6ebf716d702021-12-21 11:32:04.260root 11241100x8000000000000000538544Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:04.260{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.aaa44b1c9edd1dc12021-12-21 11:32:04.260root 11241100x8000000000000000538545Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:04.261{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a72aaf53dbfc1acd2021-12-21 11:32:04.261root 11241100x8000000000000000538546Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:04.261{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ba4a705a73d5c3132021-12-21 11:32:04.261root 11241100x8000000000000000538547Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:04.261{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5828535904ad18112021-12-21 11:32:04.261root 11241100x8000000000000000538548Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:04.261{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.38782b5477c507442021-12-21 11:32:04.261root 11241100x8000000000000000538549Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:04.261{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f3dd0018700121752021-12-21 11:32:04.261root 11241100x8000000000000000538550Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:04.261{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a0109ed101a4314a2021-12-21 11:32:04.261root 11241100x8000000000000000538551Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:04.261{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f9ced58581267e8c2021-12-21 11:32:04.261root 11241100x8000000000000000538552Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:04.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8586d1187f61cad92021-12-21 11:32:04.693root 11241100x8000000000000000538553Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:04.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b8528bfbddafb2c82021-12-21 11:32:04.693root 11241100x8000000000000000538554Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:04.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ec189ff7829c94f02021-12-21 11:32:04.693root 11241100x8000000000000000538555Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:04.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.cca677ac63e3c9a72021-12-21 11:32:04.693root 11241100x8000000000000000538556Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:04.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e8da6566e120ff8a2021-12-21 11:32:04.693root 11241100x8000000000000000538557Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:04.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ce916876b697af7e2021-12-21 11:32:04.693root 11241100x8000000000000000538558Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:04.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.66dedf21f6b7413b2021-12-21 11:32:04.694root 11241100x8000000000000000538559Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:04.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.390a90ab50c949432021-12-21 11:32:04.694root 11241100x8000000000000000538560Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:04.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c28c6c2c79b0e97b2021-12-21 11:32:04.694root 11241100x8000000000000000538561Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:04.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8deaab01828fc52c2021-12-21 11:32:04.694root 11241100x8000000000000000538562Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:04.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d2b899e9034083c02021-12-21 11:32:04.694root 11241100x8000000000000000538563Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:04.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0a8290487c5c2c4a2021-12-21 11:32:04.694root 11241100x8000000000000000538564Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:04.695{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.cd077b80668a4fa62021-12-21 11:32:04.695root 11241100x8000000000000000538565Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:04.695{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.75ef9a1f63bf14cd2021-12-21 11:32:04.695root 11241100x8000000000000000538566Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:04.695{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.97242306594edc232021-12-21 11:32:04.695root 11241100x8000000000000000538567Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:04.695{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b78128c731853e1f2021-12-21 11:32:04.695root 11241100x8000000000000000538568Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:04.695{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0e8cee83216a00772021-12-21 11:32:04.695root 11241100x8000000000000000538569Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:04.696{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0f81bae241c4876f2021-12-21 11:32:04.696root 11241100x8000000000000000538570Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:04.696{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.bc54f03d0928b9732021-12-21 11:32:04.696root 11241100x8000000000000000538571Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:04.696{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5d60328c4da3925b2021-12-21 11:32:04.696root 11241100x8000000000000000538572Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:04.696{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ba1e1769846087112021-12-21 11:32:04.696root 11241100x8000000000000000538573Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:04.696{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6bd578fbf6c4f7222021-12-21 11:32:04.696root 11241100x8000000000000000538574Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:04.696{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b62d5f9f516de7d42021-12-21 11:32:04.696root 11241100x8000000000000000538575Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:04.696{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c19e2cf376ea63142021-12-21 11:32:04.696root 11241100x8000000000000000538576Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:04.697{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.83990ff3d8a1c5062021-12-21 11:32:04.697root 11241100x8000000000000000538577Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:05.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.21ee1152f4b7ec732021-12-21 11:32:05.193root 11241100x8000000000000000538578Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:05.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0db5412f92c8fc0f2021-12-21 11:32:05.194root 11241100x8000000000000000538579Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:05.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7341c24b88a9efc52021-12-21 11:32:05.194root 11241100x8000000000000000538580Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:05.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2bfdf6bc60f17c782021-12-21 11:32:05.194root 11241100x8000000000000000538581Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:05.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2b7e04f21d7695cb2021-12-21 11:32:05.194root 11241100x8000000000000000538582Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:05.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.301e83ec012b71662021-12-21 11:32:05.194root 11241100x8000000000000000538583Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:05.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9afc850c9a5c84352021-12-21 11:32:05.194root 11241100x8000000000000000538584Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:05.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5c2d091848ae41022021-12-21 11:32:05.194root 11241100x8000000000000000538585Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:05.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7cfee386acdec97c2021-12-21 11:32:05.194root 11241100x8000000000000000538586Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:05.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b7267b8875ec33482021-12-21 11:32:05.194root 11241100x8000000000000000538587Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:05.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8b55b0ef6ff3e1bf2021-12-21 11:32:05.194root 11241100x8000000000000000538588Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:05.195{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d42ddac6d051a9512021-12-21 11:32:05.195root 11241100x8000000000000000538589Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:05.195{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ce6910bba4a219782021-12-21 11:32:05.195root 11241100x8000000000000000538590Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:05.195{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b771ff623a968af92021-12-21 11:32:05.195root 11241100x8000000000000000538591Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:05.195{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4a8551676176bfcf2021-12-21 11:32:05.195root 11241100x8000000000000000538592Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:05.195{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f4b778120068ba7c2021-12-21 11:32:05.195root 11241100x8000000000000000538593Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:05.195{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.492beeddbd69859d2021-12-21 11:32:05.195root 11241100x8000000000000000538594Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:05.195{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e6315daa517036b32021-12-21 11:32:05.195root 11241100x8000000000000000538595Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:05.195{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5459da2b22c431c62021-12-21 11:32:05.195root 11241100x8000000000000000538596Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:05.196{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b09262a9f3b5ca232021-12-21 11:32:05.196root 11241100x8000000000000000538597Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:05.196{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.fc2ac51451ae95742021-12-21 11:32:05.196root 11241100x8000000000000000538598Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:05.196{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.fcc7b4e90f5c619b2021-12-21 11:32:05.196root 11241100x8000000000000000538599Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:05.196{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.31dfc5d625d052b22021-12-21 11:32:05.196root 11241100x8000000000000000538600Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:05.196{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c53431daa4d457bb2021-12-21 11:32:05.196root 11241100x8000000000000000538601Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:05.196{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.16bcfccffc9a45e82021-12-21 11:32:05.196root 11241100x8000000000000000538602Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:05.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7deaee44ae37dd512021-12-21 11:32:05.693root 11241100x8000000000000000538603Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:05.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0ca146e0d5bddb002021-12-21 11:32:05.693root 11241100x8000000000000000538604Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:05.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.103253e287df87932021-12-21 11:32:05.693root 11241100x8000000000000000538605Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:05.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8f87a877a5f90aaf2021-12-21 11:32:05.693root 11241100x8000000000000000538606Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:05.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.aedc7df52226ac492021-12-21 11:32:05.693root 11241100x8000000000000000538607Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:05.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.85e240d3c53ce1b22021-12-21 11:32:05.693root 11241100x8000000000000000538608Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:05.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.03e62c53115b15702021-12-21 11:32:05.693root 11241100x8000000000000000538609Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:05.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.61f35d6e22fbc7f82021-12-21 11:32:05.694root 11241100x8000000000000000538610Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:05.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6631742e25dd7f392021-12-21 11:32:05.694root 11241100x8000000000000000538611Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:05.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.99fb6606c172129d2021-12-21 11:32:05.694root 11241100x8000000000000000538612Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:05.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.cb77c79c4daa96362021-12-21 11:32:05.694root 11241100x8000000000000000538613Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:05.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.077cd332f67573f42021-12-21 11:32:05.694root 11241100x8000000000000000538614Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:05.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5408abf45e331b552021-12-21 11:32:05.694root 11241100x8000000000000000538615Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:05.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a560f96037873e402021-12-21 11:32:05.694root 11241100x8000000000000000538616Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:05.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.128bc29b159fc65c2021-12-21 11:32:05.694root 11241100x8000000000000000538617Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:05.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0c0bf4f852347d842021-12-21 11:32:05.694root 11241100x8000000000000000538618Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:05.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1effe54a6d0f7a602021-12-21 11:32:05.694root 11241100x8000000000000000538619Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:05.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b0ae538bc79283c52021-12-21 11:32:05.694root 11241100x8000000000000000538620Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:05.695{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.76b95398b13bcbf62021-12-21 11:32:05.695root 11241100x8000000000000000538621Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:05.695{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.80dcfa5e2de910a52021-12-21 11:32:05.695root 11241100x8000000000000000538622Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:05.695{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ab845cc080ac659e2021-12-21 11:32:05.695root 11241100x8000000000000000538623Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:05.695{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5a1c8b58f0bbce282021-12-21 11:32:05.695root 11241100x8000000000000000538624Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:05.696{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.fe8d511691c9e2dc2021-12-21 11:32:05.696root 11241100x8000000000000000538625Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:05.696{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.74d184dbe020b9502021-12-21 11:32:05.696root 11241100x8000000000000000538626Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:05.696{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5486ced1a60f26d62021-12-21 11:32:05.696root 11241100x8000000000000000538627Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:05.696{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ff9cd5a6264a0fb72021-12-21 11:32:05.696root 11241100x8000000000000000538628Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:05.696{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.21219855d6af8ba82021-12-21 11:32:05.696root 11241100x8000000000000000538629Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:05.696{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e2fef736d30e769e2021-12-21 11:32:05.696root 11241100x8000000000000000538630Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:05.696{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e5901a23b13c00e42021-12-21 11:32:05.696root 11241100x8000000000000000538631Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:05.696{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.657e7acd782604862021-12-21 11:32:05.696root 11241100x8000000000000000538632Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:05.696{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3fed578401c993962021-12-21 11:32:05.696root 11241100x8000000000000000538633Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:05.697{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1694c282cf074c942021-12-21 11:32:05.697root 11241100x8000000000000000538634Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:05.697{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f57b5ea54a9bca502021-12-21 11:32:05.697root 11241100x8000000000000000538635Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:05.697{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0993aaa085c64e772021-12-21 11:32:05.697root 11241100x8000000000000000538636Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:05.697{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.60abd83e619fc8462021-12-21 11:32:05.697root 11241100x8000000000000000538637Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:05.697{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.07a189e574cb9b722021-12-21 11:32:05.697root 11241100x8000000000000000538638Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:05.697{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.42091db62b84919d2021-12-21 11:32:05.697root 11241100x8000000000000000538639Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:05.698{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.fc82511a382d3cbc2021-12-21 11:32:05.698root 11241100x8000000000000000538640Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:05.698{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.31b5f43e4d0118742021-12-21 11:32:05.698root 11241100x8000000000000000538641Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:05.698{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b5a8dd3d218261242021-12-21 11:32:05.698root 11241100x8000000000000000538642Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:05.698{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.40c07e46d77589852021-12-21 11:32:05.698root 11241100x8000000000000000538643Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:05.698{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2ffa10c0779f65472021-12-21 11:32:05.698root 11241100x8000000000000000538644Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:05.698{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b430e93e558268782021-12-21 11:32:05.698root 11241100x8000000000000000538645Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:06.192{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2ad55fa9ab3b6e582021-12-21 11:32:06.192root 11241100x8000000000000000538646Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:06.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.47de3513e458aa1e2021-12-21 11:32:06.193root 11241100x8000000000000000538647Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:06.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.936680a0a8914d712021-12-21 11:32:06.193root 11241100x8000000000000000538648Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:06.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.82fe9793ea36630e2021-12-21 11:32:06.193root 11241100x8000000000000000538649Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:06.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ee592f09da4e5ede2021-12-21 11:32:06.194root 11241100x8000000000000000538650Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:06.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6e53b76d2cfe16ea2021-12-21 11:32:06.194root 11241100x8000000000000000538651Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:06.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e6c5a192798cfd632021-12-21 11:32:06.194root 11241100x8000000000000000538652Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:06.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.25cf311c7575cf442021-12-21 11:32:06.194root 11241100x8000000000000000538653Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:06.195{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.928b90fc5f801d322021-12-21 11:32:06.195root 11241100x8000000000000000538654Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:06.195{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f5bc0b4779fefbec2021-12-21 11:32:06.195root 11241100x8000000000000000538655Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:06.195{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4bc417586cb13a8a2021-12-21 11:32:06.195root 11241100x8000000000000000538656Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:06.195{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.991263915e748d5e2021-12-21 11:32:06.195root 11241100x8000000000000000538657Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:06.195{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.52f37204135109da2021-12-21 11:32:06.195root 11241100x8000000000000000538658Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:06.195{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8b874dbd795048fe2021-12-21 11:32:06.195root 11241100x8000000000000000538659Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:06.195{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.89d9f2e89a19ac842021-12-21 11:32:06.195root 11241100x8000000000000000538660Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:06.195{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9784ad0d49d7ea532021-12-21 11:32:06.195root 11241100x8000000000000000538661Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:06.196{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.36a690731e6e8f5c2021-12-21 11:32:06.196root 11241100x8000000000000000538662Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:06.196{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.61d2329f14fadfad2021-12-21 11:32:06.196root 11241100x8000000000000000538663Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:06.196{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a01ddca09477f3162021-12-21 11:32:06.196root 11241100x8000000000000000538664Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:06.196{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.648b36d8cdb5a8392021-12-21 11:32:06.196root 11241100x8000000000000000538665Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:06.196{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.808bb030082f581c2021-12-21 11:32:06.196root 11241100x8000000000000000538666Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:06.198{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3e7364bc17b0dff82021-12-21 11:32:06.198root 11241100x8000000000000000538667Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:06.198{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.04ccc1c9144434f72021-12-21 11:32:06.198root 11241100x8000000000000000538668Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:06.198{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5300232d789cbd9a2021-12-21 11:32:06.198root 11241100x8000000000000000538669Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:06.199{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.72c5ee2168dd21ed2021-12-21 11:32:06.199root 11241100x8000000000000000538670Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:06.200{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.06df93224bcaa84f2021-12-21 11:32:06.200root 11241100x8000000000000000538671Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:06.200{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1ecec7bf1c0e848d2021-12-21 11:32:06.200root 11241100x8000000000000000538672Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:06.200{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d16fce92fb61dc7a2021-12-21 11:32:06.200root 11241100x8000000000000000538673Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:06.201{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.cdfee005d54d0d992021-12-21 11:32:06.201root 11241100x8000000000000000538674Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:06.201{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.dd9d73114ef0dbc52021-12-21 11:32:06.201root 11241100x8000000000000000538675Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:06.202{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.722d6c573c9d47962021-12-21 11:32:06.202root 11241100x8000000000000000538676Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:06.203{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b9fb793bb032c5cd2021-12-21 11:32:06.203root 11241100x8000000000000000538677Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:06.326{ec2b6afe-95d2-61c1-3038-b84203560000}5272/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/spool/splunk/tracker.log2021-12-21 11:32:06.326root 11241100x8000000000000000538678Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:06.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.95351b04ff738fdf2021-12-21 11:32:06.693root 11241100x8000000000000000538679Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:06.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a946d47b61c12b442021-12-21 11:32:06.693root 11241100x8000000000000000538680Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:06.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7ba21218e2c3dd232021-12-21 11:32:06.693root 11241100x8000000000000000538681Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:06.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.17f777e8fa1dedf72021-12-21 11:32:06.693root 11241100x8000000000000000538682Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:06.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c476881120d1c0ed2021-12-21 11:32:06.693root 11241100x8000000000000000538683Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:06.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.35779678bf01d4262021-12-21 11:32:06.694root 11241100x8000000000000000538684Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:06.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8f8b885df835b1342021-12-21 11:32:06.694root 11241100x8000000000000000538685Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:06.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.69eb43e60ed7c7a12021-12-21 11:32:06.694root 11241100x8000000000000000538686Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:06.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e92049e0b49e1ccb2021-12-21 11:32:06.694root 11241100x8000000000000000538687Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:06.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.33fb45b4553a197f2021-12-21 11:32:06.694root 11241100x8000000000000000538688Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:06.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5f02d8dde06c03af2021-12-21 11:32:06.694root 11241100x8000000000000000538689Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:06.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.eda288c38a7f4ec12021-12-21 11:32:06.694root 11241100x8000000000000000538690Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:06.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1273a07dbeaf95482021-12-21 11:32:06.694root 11241100x8000000000000000538691Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:06.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8eaba97a922adf4d2021-12-21 11:32:06.694root 11241100x8000000000000000538692Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:06.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.824a825763766ce32021-12-21 11:32:06.694root 11241100x8000000000000000538693Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:06.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c2373d55da838dfa2021-12-21 11:32:06.694root 11241100x8000000000000000538694Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:06.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a98a68cd06a541922021-12-21 11:32:06.694root 11241100x8000000000000000538695Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:06.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1e6f899e169559ad2021-12-21 11:32:06.694root 11241100x8000000000000000538696Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:06.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ff0f79e2b2283a712021-12-21 11:32:06.694root 11241100x8000000000000000538697Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:06.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.19e218b61c948c3e2021-12-21 11:32:06.694root 11241100x8000000000000000538698Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:06.695{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.15316c23b3f328f42021-12-21 11:32:06.695root 11241100x8000000000000000538699Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:06.695{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ed8a8fa9187b6a8c2021-12-21 11:32:06.695root 11241100x8000000000000000538700Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:06.695{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8494eb8c20a406a92021-12-21 11:32:06.695root 11241100x8000000000000000538701Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:06.695{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a7e2e3775bb257682021-12-21 11:32:06.695root 11241100x8000000000000000538702Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:06.695{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.fbd0eb889725a3522021-12-21 11:32:06.695root 11241100x8000000000000000538703Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:06.695{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2b725e6c6cf1c66c2021-12-21 11:32:06.695root 11241100x8000000000000000538704Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:06.695{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.258245193e3ad53b2021-12-21 11:32:06.695root 11241100x8000000000000000538705Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:06.695{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.dceac64fb82634082021-12-21 11:32:06.695root 11241100x8000000000000000538706Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:06.695{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.20845af2d7eed6f42021-12-21 11:32:06.695root 11241100x8000000000000000538707Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:06.696{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e5980be2afd253012021-12-21 11:32:06.696root 11241100x8000000000000000538708Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:06.696{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.271a7bf5f853c2de2021-12-21 11:32:06.696root 11241100x8000000000000000538709Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:06.697{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7ef3f36dd519d85f2021-12-21 11:32:06.697root 11241100x8000000000000000538710Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:06.697{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.01e98aa3081cbb2e2021-12-21 11:32:06.697root 11241100x8000000000000000538711Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:07.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8964cfcbd0dd301e2021-12-21 11:32:07.193root 11241100x8000000000000000538712Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:07.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.93879d02ac7e319d2021-12-21 11:32:07.193root 11241100x8000000000000000538713Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:07.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3e82eaf13ddfc8da2021-12-21 11:32:07.193root 11241100x8000000000000000538714Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:07.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.529695ba030e2f3b2021-12-21 11:32:07.193root 11241100x8000000000000000538715Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:07.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2d8abe0e3bb104aa2021-12-21 11:32:07.193root 11241100x8000000000000000538716Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:07.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ff7e163ea4a820c62021-12-21 11:32:07.193root 11241100x8000000000000000538717Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:07.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.de4cb8cffa99e8e72021-12-21 11:32:07.193root 11241100x8000000000000000538718Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:07.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.26248863d220f2572021-12-21 11:32:07.194root 11241100x8000000000000000538719Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:07.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5c123e7ecea028502021-12-21 11:32:07.194root 11241100x8000000000000000538720Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:07.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.82afa7d9b2d791242021-12-21 11:32:07.194root 11241100x8000000000000000538721Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:07.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.37b29f74e5b314432021-12-21 11:32:07.194root 11241100x8000000000000000538722Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:07.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.97b0776010a6c3ab2021-12-21 11:32:07.194root 11241100x8000000000000000538723Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:07.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.dbea3b74ffcd93382021-12-21 11:32:07.194root 11241100x8000000000000000538724Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:07.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.58eeb7b2c806cd4e2021-12-21 11:32:07.194root 11241100x8000000000000000538725Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:07.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2af8cf673a73185f2021-12-21 11:32:07.194root 11241100x8000000000000000538726Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:07.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d7f57d3c02ab73d42021-12-21 11:32:07.194root 11241100x8000000000000000538727Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:07.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.717d670f57568b542021-12-21 11:32:07.194root 11241100x8000000000000000538728Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:07.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8e0c486aa71be5c12021-12-21 11:32:07.194root 11241100x8000000000000000538729Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:07.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ca54221dfc8b9b8f2021-12-21 11:32:07.194root 11241100x8000000000000000538730Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:07.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a2c68ba94e9470942021-12-21 11:32:07.194root 11241100x8000000000000000538731Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:07.195{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0e02362848a574612021-12-21 11:32:07.195root 11241100x8000000000000000538732Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:07.195{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ddcb85d723938f6b2021-12-21 11:32:07.195root 11241100x8000000000000000538733Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:07.195{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5c99b85c889292c52021-12-21 11:32:07.195root 11241100x8000000000000000538734Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:07.195{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.67e5fc4a91f757bb2021-12-21 11:32:07.195root 11241100x8000000000000000538735Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:07.195{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.825ff3594e4e750c2021-12-21 11:32:07.195root 11241100x8000000000000000538736Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:07.195{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ce8bf64582de0de22021-12-21 11:32:07.195root 11241100x8000000000000000538737Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:07.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e229909ab805a14a2021-12-21 11:32:07.693root 11241100x8000000000000000538738Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:07.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a99f9545472d1ff22021-12-21 11:32:07.693root 11241100x8000000000000000538739Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:07.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a88e7a8de0aa70bc2021-12-21 11:32:07.693root 11241100x8000000000000000538740Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:07.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0e4f85a172775e172021-12-21 11:32:07.693root 11241100x8000000000000000538741Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:07.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.468c7c7f451a49e32021-12-21 11:32:07.693root 11241100x8000000000000000538742Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:07.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.42f85e0579c003392021-12-21 11:32:07.693root 11241100x8000000000000000538743Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:07.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.cf0b6cc4f728d8a82021-12-21 11:32:07.693root 11241100x8000000000000000538744Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:07.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5ba9dba957f198c02021-12-21 11:32:07.693root 11241100x8000000000000000538745Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:07.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3c997b1b89e72ca22021-12-21 11:32:07.693root 11241100x8000000000000000538746Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:07.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.bfb1acd795e3fe8f2021-12-21 11:32:07.694root 11241100x8000000000000000538747Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:07.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c36ff9ffb6da3a2d2021-12-21 11:32:07.694root 11241100x8000000000000000538748Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:07.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b9c5d6962c3c8a572021-12-21 11:32:07.694root 11241100x8000000000000000538749Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:07.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c403f50818a1f6972021-12-21 11:32:07.694root 11241100x8000000000000000538750Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:07.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b3151a9abfa4dd012021-12-21 11:32:07.694root 11241100x8000000000000000538751Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:07.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.30171471e5891cab2021-12-21 11:32:07.694root 11241100x8000000000000000538752Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:07.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2af5ffc4dce39fe52021-12-21 11:32:07.694root 11241100x8000000000000000538753Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:07.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b758225e262ef23a2021-12-21 11:32:07.694root 11241100x8000000000000000538754Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:07.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3d617b0779090ce72021-12-21 11:32:07.694root 11241100x8000000000000000538755Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:07.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2527e3203d8a26de2021-12-21 11:32:07.694root 11241100x8000000000000000538756Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:07.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.198898598e7483b82021-12-21 11:32:07.694root 11241100x8000000000000000538757Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:07.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4aa9817758b40ac72021-12-21 11:32:07.694root 11241100x8000000000000000538758Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:07.695{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d4752c6a155f2f1d2021-12-21 11:32:07.695root 11241100x8000000000000000538759Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:07.695{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.65d50f6143457a112021-12-21 11:32:07.695root 11241100x8000000000000000538760Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:07.695{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.055361581793f3a12021-12-21 11:32:07.695root 11241100x8000000000000000538761Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:07.695{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.28904b6cc8eb9dce2021-12-21 11:32:07.695root 11241100x8000000000000000538762Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:07.695{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a40c8c8f1de7f0042021-12-21 11:32:07.695root 11241100x8000000000000000538763Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:07.695{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.95087234c23bbd7e2021-12-21 11:32:07.695root 11241100x8000000000000000538764Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:08.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f76dfb85741f755d2021-12-21 11:32:08.193root 11241100x8000000000000000538765Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:08.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.41ca02de09e703542021-12-21 11:32:08.193root 11241100x8000000000000000538766Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:08.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f1e4233bd181f3092021-12-21 11:32:08.193root 11241100x8000000000000000538767Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:08.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5d7b2706c013b2982021-12-21 11:32:08.193root 11241100x8000000000000000538768Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:08.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.271033cf2e369b662021-12-21 11:32:08.193root 11241100x8000000000000000538769Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:08.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.be31fa133724e8402021-12-21 11:32:08.193root 11241100x8000000000000000538770Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:08.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.86872491b3bc05ec2021-12-21 11:32:08.193root 11241100x8000000000000000538771Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:08.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a059f4c462ad04a72021-12-21 11:32:08.193root 11241100x8000000000000000538772Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:08.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1b6d51412833cb3f2021-12-21 11:32:08.193root 11241100x8000000000000000538773Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:08.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4c61c0cf00c994bd2021-12-21 11:32:08.194root 11241100x8000000000000000538774Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:08.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.608a69ae9b586b592021-12-21 11:32:08.194root 11241100x8000000000000000538775Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:08.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.52ebf6371b5f709e2021-12-21 11:32:08.194root 11241100x8000000000000000538776Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:08.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.25283b77e17952042021-12-21 11:32:08.194root 11241100x8000000000000000538777Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:08.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.05b6ba114e0303e72021-12-21 11:32:08.194root 11241100x8000000000000000538778Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:08.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ba985cb1a976f66f2021-12-21 11:32:08.194root 11241100x8000000000000000538779Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:08.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4e3b576f1e40962a2021-12-21 11:32:08.194root 11241100x8000000000000000538780Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:08.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.317143bf3bcbf1042021-12-21 11:32:08.194root 11241100x8000000000000000538781Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:08.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d8f4d6d571d3979f2021-12-21 11:32:08.194root 11241100x8000000000000000538782Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:08.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6d40ffda6fdfc1022021-12-21 11:32:08.194root 11241100x8000000000000000538783Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:08.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ab5aac42e9067f732021-12-21 11:32:08.194root 11241100x8000000000000000538784Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:08.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4b3fc56a4d6886502021-12-21 11:32:08.194root 11241100x8000000000000000538785Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:08.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b387b3dc9dc17ff32021-12-21 11:32:08.194root 11241100x8000000000000000538786Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:08.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.146537a9daa286e52021-12-21 11:32:08.194root 11241100x8000000000000000538787Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:08.195{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.21199973d6ebd5152021-12-21 11:32:08.195root 11241100x8000000000000000538788Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:08.195{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f0d60f8f2bff68cd2021-12-21 11:32:08.195root 11241100x8000000000000000538789Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:08.195{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ee85081ec248138e2021-12-21 11:32:08.195root 11241100x8000000000000000538790Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:08.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8913d1372510dd282021-12-21 11:32:08.693root 11241100x8000000000000000538791Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:08.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7a863892ee5ed4452021-12-21 11:32:08.693root 11241100x8000000000000000538792Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:08.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b117c5651952f44c2021-12-21 11:32:08.694root 11241100x8000000000000000538793Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:08.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e954489627e26c2c2021-12-21 11:32:08.694root 11241100x8000000000000000538794Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:08.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6a1305def71a1d0d2021-12-21 11:32:08.694root 11241100x8000000000000000538795Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:08.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.822366e9e9cdd6c22021-12-21 11:32:08.694root 11241100x8000000000000000538796Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:08.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.56154014f842ebd72021-12-21 11:32:08.694root 11241100x8000000000000000538797Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:08.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7a83f46ddb38af072021-12-21 11:32:08.694root 11241100x8000000000000000538798Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:08.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2c524143a00782c62021-12-21 11:32:08.694root 11241100x8000000000000000538799Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:08.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.39a545334b439a0b2021-12-21 11:32:08.694root 11241100x8000000000000000538800Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:08.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7f4914ecaa65a1742021-12-21 11:32:08.694root 11241100x8000000000000000538801Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:08.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a33ca760012745702021-12-21 11:32:08.694root 11241100x8000000000000000538802Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:08.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b345de39c9c8e5cd2021-12-21 11:32:08.694root 11241100x8000000000000000538803Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:08.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5db6f90ceff69e562021-12-21 11:32:08.694root 11241100x8000000000000000538804Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:08.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.785235ea819007932021-12-21 11:32:08.694root 11241100x8000000000000000538805Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:08.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b72ea8c974af63be2021-12-21 11:32:08.694root 11241100x8000000000000000538806Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:08.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a742717e7bf09a322021-12-21 11:32:08.694root 11241100x8000000000000000538807Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:08.695{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c826c5ad1e546d2d2021-12-21 11:32:08.695root 11241100x8000000000000000538808Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:08.695{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.37b61ea8712dbb412021-12-21 11:32:08.695root 11241100x8000000000000000538809Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:08.695{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b9cb94b9213b21122021-12-21 11:32:08.695root 11241100x8000000000000000538810Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:08.695{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4871d64ee683c5912021-12-21 11:32:08.695root 11241100x8000000000000000538811Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:08.695{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.04ca927d0ef62ba32021-12-21 11:32:08.695root 11241100x8000000000000000538812Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:08.695{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9c35f341577846be2021-12-21 11:32:08.695root 11241100x8000000000000000538813Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:08.695{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f2b568cbef08f9492021-12-21 11:32:08.695root 11241100x8000000000000000538814Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:08.695{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.159c1dd380772dfe2021-12-21 11:32:08.695root 11241100x8000000000000000538815Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:08.695{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.13b3c14f2d8470bd2021-12-21 11:32:08.695root 11241100x8000000000000000538816Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:09.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.07fe2df7e019b55e2021-12-21 11:32:09.193root 11241100x8000000000000000538817Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:09.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7705db7afaffe9d22021-12-21 11:32:09.193root 11241100x8000000000000000538818Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:09.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0e27a4a115998ebc2021-12-21 11:32:09.193root 11241100x8000000000000000538819Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:09.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6b132bf6f818aa7d2021-12-21 11:32:09.193root 11241100x8000000000000000538820Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:09.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1f7d0329ec4cf15e2021-12-21 11:32:09.193root 11241100x8000000000000000538821Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:09.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e1ccb381bfef4c752021-12-21 11:32:09.193root 11241100x8000000000000000538822Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:09.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.fb9ae5eba21d0ed02021-12-21 11:32:09.193root 11241100x8000000000000000538823Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:09.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0a91f0af9fc900002021-12-21 11:32:09.193root 11241100x8000000000000000538824Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:09.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ecd055b72656ec642021-12-21 11:32:09.193root 11241100x8000000000000000538825Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:09.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.69329a506fadc2602021-12-21 11:32:09.193root 11241100x8000000000000000538826Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:09.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.68075b1d295608e72021-12-21 11:32:09.193root 11241100x8000000000000000538827Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:09.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f24d8c1f1fcf21a22021-12-21 11:32:09.194root 11241100x8000000000000000538828Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:09.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.65f7db5acd62bcca2021-12-21 11:32:09.194root 11241100x8000000000000000538829Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:09.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6498de5420c576f02021-12-21 11:32:09.194root 11241100x8000000000000000538830Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:09.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.659508379330e12c2021-12-21 11:32:09.194root 11241100x8000000000000000538831Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:09.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.474ebf4790332dd82021-12-21 11:32:09.194root 11241100x8000000000000000538832Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:09.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.026e02421f7795c42021-12-21 11:32:09.194root 11241100x8000000000000000538833Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:09.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.868f9e00afade8af2021-12-21 11:32:09.194root 11241100x8000000000000000538834Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:09.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6003855c4ffe25422021-12-21 11:32:09.194root 11241100x8000000000000000538835Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:09.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e877c66d556a5fbd2021-12-21 11:32:09.194root 11241100x8000000000000000538836Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:09.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ed247375ec6a59ed2021-12-21 11:32:09.194root 11241100x8000000000000000538837Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:09.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b95be44ecb20f4502021-12-21 11:32:09.194root 11241100x8000000000000000538838Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:09.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3001d55322c0021c2021-12-21 11:32:09.194root 11241100x8000000000000000538839Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:09.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5f232512893ff76b2021-12-21 11:32:09.194root 11241100x8000000000000000538840Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:09.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b0cef2757faada992021-12-21 11:32:09.194root 11241100x8000000000000000538841Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:09.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.69eb83073eefb3352021-12-21 11:32:09.194root 11241100x8000000000000000538842Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:09.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b50e4b4765af3d252021-12-21 11:32:09.194root 23542300x8000000000000000538843Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:09.328{ec2b6afe-95d2-61c1-3038-b84203560000}5272root/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/spool/splunk/tracker.log--- 11241100x8000000000000000538844Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:09.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.26e9ea50d620c86d2021-12-21 11:32:09.693root 11241100x8000000000000000538845Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:09.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e629e33a5c96fa6c2021-12-21 11:32:09.693root 11241100x8000000000000000538846Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:09.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.da79ecd322d3fdfe2021-12-21 11:32:09.693root 11241100x8000000000000000538847Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:09.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7afa08518e59281a2021-12-21 11:32:09.693root 11241100x8000000000000000538848Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:09.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.06ff63917c1410e72021-12-21 11:32:09.694root 11241100x8000000000000000538849Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:09.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a785dcea43b4951a2021-12-21 11:32:09.694root 11241100x8000000000000000538850Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:09.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f9ee51c7700759c72021-12-21 11:32:09.694root 11241100x8000000000000000538851Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:09.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f9433a5358775a7c2021-12-21 11:32:09.694root 11241100x8000000000000000538852Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:09.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.332f2cf44601eb732021-12-21 11:32:09.694root 11241100x8000000000000000538853Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:09.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c08489ccd3c0cdd02021-12-21 11:32:09.694root 11241100x8000000000000000538854Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:09.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c8842c8c43054fde2021-12-21 11:32:09.694root 11241100x8000000000000000538855Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:09.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.78ed53b20bce65492021-12-21 11:32:09.694root 11241100x8000000000000000538856Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:09.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ff7309fa848fb2352021-12-21 11:32:09.694root 11241100x8000000000000000538857Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:09.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.431b974cfebdbac72021-12-21 11:32:09.694root 11241100x8000000000000000538858Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:09.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d327d86473e0158c2021-12-21 11:32:09.694root 11241100x8000000000000000538859Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:09.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e58ba253a8c7a7132021-12-21 11:32:09.694root 11241100x8000000000000000538860Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:09.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.46b246d534c31c3d2021-12-21 11:32:09.694root 11241100x8000000000000000538861Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:09.695{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2f157806f1aecfa12021-12-21 11:32:09.695root 11241100x8000000000000000538862Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:09.695{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9aae2c76226bcedd2021-12-21 11:32:09.695root 11241100x8000000000000000538863Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:09.695{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.46d3512d625598922021-12-21 11:32:09.695root 11241100x8000000000000000538864Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:09.695{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c027e6a6380adb772021-12-21 11:32:09.695root 11241100x8000000000000000538865Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:09.695{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d0aa14edb5d2a9a12021-12-21 11:32:09.695root 11241100x8000000000000000538866Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:09.695{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0cbd5036276c4d7d2021-12-21 11:32:09.695root 11241100x8000000000000000538867Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:09.695{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c19e7947df6c40c92021-12-21 11:32:09.695root 11241100x8000000000000000538868Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:09.695{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e1fe40710a35b8912021-12-21 11:32:09.695root 11241100x8000000000000000538869Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:09.695{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.82eca7d4fca12e7e2021-12-21 11:32:09.695root 11241100x8000000000000000538870Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:09.695{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b1e795fe2d881d522021-12-21 11:32:09.695root 354300x8000000000000000538871Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:10.184{ec2b6afe-95d9-61c1-5175-3a0400000000}5346/opt/splunkforwarder/etc/apps/Splunk_TA_stream/linux_x86_64/bin/streamfwdroottcptruefalse10.0.1.25-48678-false10.0.1.12-8000- 11241100x8000000000000000538872Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:10.185{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.75fec0ef92315aac2021-12-21 11:32:10.185root 11241100x8000000000000000538873Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:10.185{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ec3ce3381f7dbea62021-12-21 11:32:10.185root 11241100x8000000000000000538874Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:10.185{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4784b4bbeff11e7a2021-12-21 11:32:10.185root 11241100x8000000000000000538875Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:10.185{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.59a8fd377c42d50a2021-12-21 11:32:10.185root 11241100x8000000000000000538876Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:10.185{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.89696cddafe7f4742021-12-21 11:32:10.185root 11241100x8000000000000000538877Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:10.185{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6b284c6976332a112021-12-21 11:32:10.185root 11241100x8000000000000000538878Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:10.186{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.26e0155662849a502021-12-21 11:32:10.186root 11241100x8000000000000000538879Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:10.186{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a89fbec784bfe3682021-12-21 11:32:10.186root 11241100x8000000000000000538880Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:10.186{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ad9dd1b057e7ebb32021-12-21 11:32:10.186root 11241100x8000000000000000538881Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:10.186{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6472f076e8e516772021-12-21 11:32:10.186root 11241100x8000000000000000538882Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:10.186{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9e5938691d4c0a0e2021-12-21 11:32:10.186root 11241100x8000000000000000538883Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:10.186{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a2d09591aa3747c62021-12-21 11:32:10.186root 11241100x8000000000000000538884Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:10.186{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3c174026e55da42a2021-12-21 11:32:10.186root 11241100x8000000000000000538885Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:10.186{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.09b02331ae62f7062021-12-21 11:32:10.186root 11241100x8000000000000000538886Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:10.186{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.895eb0613132571b2021-12-21 11:32:10.186root 11241100x8000000000000000538887Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:10.186{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.39b4061d2e4892f52021-12-21 11:32:10.186root 11241100x8000000000000000538888Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:10.186{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.40f02bfc5c9a51b02021-12-21 11:32:10.186root 11241100x8000000000000000538889Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:10.186{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2680feba3f0835762021-12-21 11:32:10.186root 11241100x8000000000000000538890Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:10.186{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.aae8322a785ee9a92021-12-21 11:32:10.186root 11241100x8000000000000000538891Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:10.186{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6d3e2ec555b5f1752021-12-21 11:32:10.186root 11241100x8000000000000000538892Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:10.186{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.318c06d499b7bfd62021-12-21 11:32:10.186root 11241100x8000000000000000538893Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:10.186{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b4b9ce29766842f72021-12-21 11:32:10.186root 11241100x8000000000000000538894Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:10.186{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.00b8f06a9168548d2021-12-21 11:32:10.186root 11241100x8000000000000000538895Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:10.187{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8add9ac05979ee722021-12-21 11:32:10.187root 11241100x8000000000000000538896Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:10.187{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3c8197efeb523ec22021-12-21 11:32:10.187root 11241100x8000000000000000538897Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:10.187{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4a69d6a03d3811292021-12-21 11:32:10.187root 11241100x8000000000000000538898Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:10.187{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4325b8167c0294572021-12-21 11:32:10.187root 11241100x8000000000000000538899Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:10.187{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.14bf0b7308e805472021-12-21 11:32:10.187root 11241100x8000000000000000538900Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:10.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.fc35c90aa11db7252021-12-21 11:32:10.443root 11241100x8000000000000000538901Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:10.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2511b67280ba9f312021-12-21 11:32:10.443root 11241100x8000000000000000538902Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:10.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8088aac2026e0e6e2021-12-21 11:32:10.443root 11241100x8000000000000000538903Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:10.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4afab570c94b26d02021-12-21 11:32:10.443root 11241100x8000000000000000538904Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:10.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.54404e9a2b4faf782021-12-21 11:32:10.443root 11241100x8000000000000000538905Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:10.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.13b103439b9d54072021-12-21 11:32:10.443root 11241100x8000000000000000538906Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:10.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e76c04a022dba7dd2021-12-21 11:32:10.443root 11241100x8000000000000000538907Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:10.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4b4e3321a9bb66722021-12-21 11:32:10.443root 11241100x8000000000000000538908Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:10.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ee915bfb366030872021-12-21 11:32:10.443root 11241100x8000000000000000538909Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:10.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a32685f5f7d55acc2021-12-21 11:32:10.443root 11241100x8000000000000000538910Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:10.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3b8f3823a75e1ea62021-12-21 11:32:10.443root 11241100x8000000000000000538911Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:10.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b256f2e1a9c35bfb2021-12-21 11:32:10.443root 11241100x8000000000000000538912Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:10.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.55aab825533fd2f92021-12-21 11:32:10.444root 11241100x8000000000000000538913Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:10.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d68878cc3490e3272021-12-21 11:32:10.444root 11241100x8000000000000000538914Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:10.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6903de1ddf19552a2021-12-21 11:32:10.444root 11241100x8000000000000000538915Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:10.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.fe02d28b655b64dd2021-12-21 11:32:10.444root 11241100x8000000000000000538916Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:10.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9f7b20b29e2a34aa2021-12-21 11:32:10.444root 11241100x8000000000000000538917Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:10.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2e2f80a794f2112f2021-12-21 11:32:10.444root 11241100x8000000000000000538918Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:10.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.aeab08c27ad7b93c2021-12-21 11:32:10.444root 11241100x8000000000000000538919Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:10.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0f5f9eb9d746ca6e2021-12-21 11:32:10.444root 11241100x8000000000000000538920Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:10.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.78515b79b1c39dfe2021-12-21 11:32:10.444root 11241100x8000000000000000538921Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:10.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e537e6641b86c95f2021-12-21 11:32:10.444root 11241100x8000000000000000538922Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:10.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f5cc4269bc5a2ee12021-12-21 11:32:10.444root 11241100x8000000000000000538923Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:10.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.614c4ad4acdb157c2021-12-21 11:32:10.444root 11241100x8000000000000000538924Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:10.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9b4d0a20c770a3fc2021-12-21 11:32:10.444root 11241100x8000000000000000538925Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:10.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0b60a6e0f39b5df12021-12-21 11:32:10.444root 11241100x8000000000000000538926Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:10.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.cd950eed59a387e42021-12-21 11:32:10.445root 11241100x8000000000000000538927Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:10.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d5d0458b03af58f32021-12-21 11:32:10.445root 11241100x8000000000000000538928Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:10.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.dc796cadc918b3ed2021-12-21 11:32:10.445root 11241100x8000000000000000538929Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:10.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.bedc10ae9f1dd9ea2021-12-21 11:32:10.943root 11241100x8000000000000000538930Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:10.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.df08e96dca2053522021-12-21 11:32:10.943root 11241100x8000000000000000538931Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:10.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3d9b942cc3182e4a2021-12-21 11:32:10.943root 11241100x8000000000000000538932Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:10.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d3d931b66411ab022021-12-21 11:32:10.943root 11241100x8000000000000000538933Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:10.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ed7fac668533a3902021-12-21 11:32:10.943root 11241100x8000000000000000538934Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:10.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4d24a6f4e3094dab2021-12-21 11:32:10.943root 11241100x8000000000000000538935Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:10.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4e9f190a6614f4762021-12-21 11:32:10.943root 11241100x8000000000000000538936Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:10.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3e22f8bb47a9c0602021-12-21 11:32:10.943root 11241100x8000000000000000538937Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:10.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5e5e331465bab5922021-12-21 11:32:10.943root 11241100x8000000000000000538938Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:10.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c43044b43281daf02021-12-21 11:32:10.943root 11241100x8000000000000000538939Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:10.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.da92f7630ed84ea72021-12-21 11:32:10.944root 11241100x8000000000000000538940Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:10.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.baa2bce5dd66ea092021-12-21 11:32:10.944root 11241100x8000000000000000538941Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:10.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9fd4f1086ffe26e22021-12-21 11:32:10.944root 11241100x8000000000000000538942Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:10.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.abd8a76c90b0a56e2021-12-21 11:32:10.944root 11241100x8000000000000000538943Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:10.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9e8ffafa9928802c2021-12-21 11:32:10.944root 11241100x8000000000000000538944Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:10.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.fe442abbaa8a79882021-12-21 11:32:10.944root 11241100x8000000000000000538945Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:10.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6d3a4b4f8368a6222021-12-21 11:32:10.944root 11241100x8000000000000000538946Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:10.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.839d6bf59c9cf06e2021-12-21 11:32:10.944root 11241100x8000000000000000538947Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:10.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.258164b59711c62d2021-12-21 11:32:10.944root 11241100x8000000000000000538948Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:10.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0554c48dc2ae54522021-12-21 11:32:10.944root 11241100x8000000000000000538949Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:10.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e76d7228ea00f73b2021-12-21 11:32:10.944root 11241100x8000000000000000538950Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:10.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8068e4784d8d4d002021-12-21 11:32:10.944root 11241100x8000000000000000538951Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:10.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.df9ae8e5c1d0da1b2021-12-21 11:32:10.944root 11241100x8000000000000000538952Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:10.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c97649a46ab588d92021-12-21 11:32:10.944root 11241100x8000000000000000538953Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:10.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3dca63168bac7bc62021-12-21 11:32:10.945root 11241100x8000000000000000538954Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:10.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d2c82dc5044a07812021-12-21 11:32:10.945root 11241100x8000000000000000538955Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:10.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5de3041aae5dc9fc2021-12-21 11:32:10.945root 11241100x8000000000000000538956Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:10.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ea00c4d04297c8212021-12-21 11:32:10.945root 11241100x8000000000000000538957Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:10.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9dad1ee3a88a9d422021-12-21 11:32:10.945root 534500x8000000000000000538958Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:11.096{ec2b6afe-9233-61c1-c81a-006eee550000}454/lib/systemd/systemd-journaldroot 11241100x8000000000000000538959Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:11.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0dd6c36006f02eac2021-12-21 11:32:11.443root 11241100x8000000000000000538960Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:11.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5acff6a2152c540e2021-12-21 11:32:11.443root 11241100x8000000000000000538961Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:11.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e8c947b7692119332021-12-21 11:32:11.443root 11241100x8000000000000000538962Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:11.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.09a6e82b349d88242021-12-21 11:32:11.443root 11241100x8000000000000000538963Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:11.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.12b04ed094cdfc9a2021-12-21 11:32:11.444root 11241100x8000000000000000538964Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:11.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ed42517cfa25d9022021-12-21 11:32:11.444root 11241100x8000000000000000538965Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:11.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f65d1abb0b1419932021-12-21 11:32:11.444root 11241100x8000000000000000538966Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:11.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.cac2628a850dbe242021-12-21 11:32:11.444root 11241100x8000000000000000538967Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:11.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b550b2766526c2cd2021-12-21 11:32:11.444root 11241100x8000000000000000538968Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:11.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.fd5bb4dfcf70bdfd2021-12-21 11:32:11.444root 11241100x8000000000000000538969Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:11.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f49cbf2f1730b10d2021-12-21 11:32:11.444root 11241100x8000000000000000538970Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:11.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8e602dd1e006f1602021-12-21 11:32:11.444root 11241100x8000000000000000538971Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:11.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.dc5320ac14f67fa72021-12-21 11:32:11.444root 11241100x8000000000000000538972Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:11.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b1cbea4eaf1c49dc2021-12-21 11:32:11.444root 11241100x8000000000000000538973Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:11.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3d4046d474fa5f772021-12-21 11:32:11.444root 11241100x8000000000000000538974Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:11.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.cb6679137b6667f12021-12-21 11:32:11.444root 11241100x8000000000000000538975Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:11.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a81cfea23d3578af2021-12-21 11:32:11.444root 11241100x8000000000000000538976Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:11.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a02765d074659c6b2021-12-21 11:32:11.444root 11241100x8000000000000000538977Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:11.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.02178cf52e0734392021-12-21 11:32:11.444root 11241100x8000000000000000538978Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:11.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.754b3b52fc65a56e2021-12-21 11:32:11.445root 11241100x8000000000000000538979Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:11.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2f704a58030ac6df2021-12-21 11:32:11.445root 11241100x8000000000000000538980Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:11.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5bd0736a8b411c592021-12-21 11:32:11.445root 11241100x8000000000000000538981Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:11.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7e553e82b0f9391c2021-12-21 11:32:11.445root 11241100x8000000000000000538982Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:11.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f32bc6b8f9f946932021-12-21 11:32:11.445root 11241100x8000000000000000538983Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:11.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.073f92f351d505312021-12-21 11:32:11.445root 11241100x8000000000000000538984Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:11.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2045ef693c791fd42021-12-21 11:32:11.445root 11241100x8000000000000000538985Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:11.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b5834f91ac8da3842021-12-21 11:32:11.445root 11241100x8000000000000000538986Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:11.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b4440d949bcab2902021-12-21 11:32:11.445root 11241100x8000000000000000538987Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:11.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9aae9ac36fc6efd82021-12-21 11:32:11.445root 11241100x8000000000000000538988Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:11.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f22b69e1b572a5d22021-12-21 11:32:11.943root 11241100x8000000000000000538989Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:11.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ad2f160e6e102aea2021-12-21 11:32:11.943root 11241100x8000000000000000538990Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:11.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4a2da248383822b92021-12-21 11:32:11.943root 11241100x8000000000000000538991Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:11.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.dddad81b2913922d2021-12-21 11:32:11.943root 11241100x8000000000000000538992Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:11.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8f4d65d46f6521512021-12-21 11:32:11.943root 11241100x8000000000000000538993Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:11.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ff7c3b2d86b3ceed2021-12-21 11:32:11.943root 11241100x8000000000000000538994Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:11.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f33242cbf3c47c7a2021-12-21 11:32:11.943root 11241100x8000000000000000538995Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:11.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.976bf83aed0ff6df2021-12-21 11:32:11.943root 11241100x8000000000000000538996Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:11.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6260ca40c7f0e8a42021-12-21 11:32:11.944root 11241100x8000000000000000538997Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:11.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3a982a1346e22ae02021-12-21 11:32:11.944root 11241100x8000000000000000538998Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:11.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e30ca14b64f2c1012021-12-21 11:32:11.944root 11241100x8000000000000000538999Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:11.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.97da3d19f8e9c6de2021-12-21 11:32:11.944root 11241100x8000000000000000539000Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:11.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.992b5f67e905501d2021-12-21 11:32:11.944root 11241100x8000000000000000539001Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:11.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e3b46b1afcdf89442021-12-21 11:32:11.944root 11241100x8000000000000000539002Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:11.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.441a609de194fbd82021-12-21 11:32:11.944root 11241100x8000000000000000539003Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:11.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.bf260668ec6518eb2021-12-21 11:32:11.944root 11241100x8000000000000000539004Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:11.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b107cf20beb4fc562021-12-21 11:32:11.944root 11241100x8000000000000000539005Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:11.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.06bba2136f1272382021-12-21 11:32:11.944root 11241100x8000000000000000539006Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:11.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.13e8e94603d9bc5a2021-12-21 11:32:11.944root 11241100x8000000000000000539007Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:11.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ff612ff428ef5edc2021-12-21 11:32:11.944root 11241100x8000000000000000539008Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:11.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.35f402bf0b2c4e7a2021-12-21 11:32:11.945root 11241100x8000000000000000539009Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:11.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c801b22ba225dbb72021-12-21 11:32:11.945root 11241100x8000000000000000539010Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:11.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.13c0b0136d5a54932021-12-21 11:32:11.945root 11241100x8000000000000000539011Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:11.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.12c8508e5184ab8b2021-12-21 11:32:11.945root 11241100x8000000000000000539012Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:11.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.81b764853595a8ef2021-12-21 11:32:11.945root 11241100x8000000000000000539013Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:11.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ecce9e9f317e2d9c2021-12-21 11:32:11.945root 11241100x8000000000000000539014Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:11.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.aba157486dd923482021-12-21 11:32:11.945root 11241100x8000000000000000539015Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:11.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5f19945a21e467652021-12-21 11:32:11.945root 11241100x8000000000000000539016Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:11.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b34f99e8124599ba2021-12-21 11:32:11.945root 11241100x8000000000000000539017Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:11.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3069ca065894b88e2021-12-21 11:32:11.945root 11241100x8000000000000000539018Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:11.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2d87a9e7a7d56b872021-12-21 11:32:11.945root 11241100x8000000000000000539019Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:11.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.62e1b16bbdac695b2021-12-21 11:32:11.945root 11241100x8000000000000000539020Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:12.442{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.afc3f988e4da04ac2021-12-21 11:32:12.442root 11241100x8000000000000000539021Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:12.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6451719e55382dab2021-12-21 11:32:12.443root 11241100x8000000000000000539022Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:12.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.803d0a69838f7fe52021-12-21 11:32:12.443root 11241100x8000000000000000539023Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:12.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.fb8c697f60b2df252021-12-21 11:32:12.443root 11241100x8000000000000000539024Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:12.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c02d6911fa0a86552021-12-21 11:32:12.443root 11241100x8000000000000000539025Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:12.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7a756278dcd5f98b2021-12-21 11:32:12.443root 11241100x8000000000000000539026Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:12.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9a57022ad53d8aeb2021-12-21 11:32:12.443root 11241100x8000000000000000539027Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:12.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.58f2caac73bcf1142021-12-21 11:32:12.443root 11241100x8000000000000000539028Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:12.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.975aa83a9b7f947c2021-12-21 11:32:12.443root 11241100x8000000000000000539029Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:12.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2860d58e0b3a51012021-12-21 11:32:12.444root 11241100x8000000000000000539030Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:12.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.aa684e860c7b546f2021-12-21 11:32:12.444root 11241100x8000000000000000539031Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:12.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d4ee3bfaabd707282021-12-21 11:32:12.444root 11241100x8000000000000000539032Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:12.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7385803ae90c0d6c2021-12-21 11:32:12.444root 11241100x8000000000000000539033Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:12.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.460b4550033bda602021-12-21 11:32:12.444root 11241100x8000000000000000539034Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:12.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a07e8dba4b1594982021-12-21 11:32:12.444root 11241100x8000000000000000539035Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:12.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5e608b7d4cbc95f72021-12-21 11:32:12.444root 11241100x8000000000000000539036Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:12.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f94198b489eb5f102021-12-21 11:32:12.444root 11241100x8000000000000000539037Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:12.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b9aca1e309bf12b42021-12-21 11:32:12.444root 11241100x8000000000000000539038Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:12.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.78ee21070dfd03442021-12-21 11:32:12.444root 11241100x8000000000000000539039Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:12.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d8409471f5f4e1662021-12-21 11:32:12.444root 11241100x8000000000000000539040Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:12.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ec5d64c1e2af68542021-12-21 11:32:12.445root 11241100x8000000000000000539041Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:12.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.78b895dee0335c652021-12-21 11:32:12.445root 11241100x8000000000000000539042Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:12.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0f7744fd705512fc2021-12-21 11:32:12.445root 11241100x8000000000000000539043Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:12.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4e6a1ef61cb6e16e2021-12-21 11:32:12.445root 11241100x8000000000000000539044Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:12.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.80891d7308b2befc2021-12-21 11:32:12.445root 11241100x8000000000000000539045Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:12.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2b5e4dd85de851af2021-12-21 11:32:12.445root 11241100x8000000000000000539046Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:12.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6719a7f547c5e88a2021-12-21 11:32:12.445root 11241100x8000000000000000539047Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:12.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.56f7a938558520802021-12-21 11:32:12.445root 11241100x8000000000000000539048Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:12.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e5f5d6f72dbf6ce72021-12-21 11:32:12.445root 11241100x8000000000000000539049Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:12.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.34d8df15458799a32021-12-21 11:32:12.445root 11241100x8000000000000000539050Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:12.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.25d5c1b713f353a92021-12-21 11:32:12.445root 11241100x8000000000000000539051Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:12.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1d7b99e19ea52ebc2021-12-21 11:32:12.445root 11241100x8000000000000000539052Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:12.446{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1756e216a5e463842021-12-21 11:32:12.446root 11241100x8000000000000000539053Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:12.446{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c164d199760a38aa2021-12-21 11:32:12.446root 11241100x8000000000000000539054Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:12.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.99a57f7864e019622021-12-21 11:32:12.943root 11241100x8000000000000000539055Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:12.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.cc1c702cb2b6eddd2021-12-21 11:32:12.943root 11241100x8000000000000000539056Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:12.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.28f1a7fd713654da2021-12-21 11:32:12.943root 11241100x8000000000000000539057Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:12.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1f7827cba1de35a12021-12-21 11:32:12.943root 11241100x8000000000000000539058Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:12.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.80ebe511403feea32021-12-21 11:32:12.943root 11241100x8000000000000000539059Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:12.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.568d9d1fe6b8ed432021-12-21 11:32:12.943root 11241100x8000000000000000539060Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:12.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.34cb66b7ddc2a18f2021-12-21 11:32:12.943root 11241100x8000000000000000539061Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:12.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5bcf94ab9552182a2021-12-21 11:32:12.944root 11241100x8000000000000000539062Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:12.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8712845e064aafca2021-12-21 11:32:12.944root 11241100x8000000000000000539063Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:12.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ec9367729e69faca2021-12-21 11:32:12.944root 11241100x8000000000000000539064Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:12.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a88ba34355c2972b2021-12-21 11:32:12.944root 11241100x8000000000000000539065Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:12.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.de68cb88f3ffe3622021-12-21 11:32:12.944root 11241100x8000000000000000539066Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:12.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f6d080f5938688712021-12-21 11:32:12.944root 11241100x8000000000000000539067Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:12.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b86d9f9f6232d5db2021-12-21 11:32:12.944root 11241100x8000000000000000539068Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:12.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.bd0b03ee39185a692021-12-21 11:32:12.944root 11241100x8000000000000000539069Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:12.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8b22c9560c2c2cf42021-12-21 11:32:12.944root 11241100x8000000000000000539070Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:12.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d5404fb5e3d618fd2021-12-21 11:32:12.944root 11241100x8000000000000000539071Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:12.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.03beb38e8ccef6ba2021-12-21 11:32:12.945root 11241100x8000000000000000539072Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:12.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.fa6c355a0ea0bc082021-12-21 11:32:12.945root 11241100x8000000000000000539073Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:12.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f4e15d7df045179c2021-12-21 11:32:12.945root 11241100x8000000000000000539074Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:12.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e6001ef9c5de73872021-12-21 11:32:12.945root 11241100x8000000000000000539075Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:12.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ea9ea2aea315c1202021-12-21 11:32:12.945root 11241100x8000000000000000539076Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:12.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b03a26937813fb542021-12-21 11:32:12.945root 11241100x8000000000000000539077Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:12.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b0ec8ccb0189e4912021-12-21 11:32:12.945root 11241100x8000000000000000539078Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:12.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.467b2ed34d9992fb2021-12-21 11:32:12.945root 11241100x8000000000000000539079Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:12.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.90d5134497f832332021-12-21 11:32:12.945root 11241100x8000000000000000539080Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:12.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.40527dc088164c712021-12-21 11:32:12.945root 11241100x8000000000000000539081Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:12.946{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6effcfcdba6558f22021-12-21 11:32:12.946root 11241100x8000000000000000539082Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:12.946{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a893e87ea3b55f952021-12-21 11:32:12.946root 11241100x8000000000000000539083Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:12.946{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4d794b9c9d15d2762021-12-21 11:32:12.946root 11241100x8000000000000000539084Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:12.946{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1a576c30a2978fd82021-12-21 11:32:12.946root 11241100x8000000000000000539085Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:12.946{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a04cf2a543be5ea12021-12-21 11:32:12.946root 11241100x8000000000000000539086Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:12.946{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.aa5f299321766ad22021-12-21 11:32:12.946root 11241100x8000000000000000539087Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:12.946{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b99c0efce71facc92021-12-21 11:32:12.946root 11241100x8000000000000000539088Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:12.946{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2581397cf24967d72021-12-21 11:32:12.946root 11241100x8000000000000000539089Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:12.946{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.23dd8968154fbe152021-12-21 11:32:12.946root 11241100x8000000000000000539090Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:12.946{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8d44d304f1cd20162021-12-21 11:32:12.946root 11241100x8000000000000000539091Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:12.946{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a1e47d95a76b4bce2021-12-21 11:32:12.946root 11241100x8000000000000000539092Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:13.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.bd5820434080983d2021-12-21 11:32:13.443root 11241100x8000000000000000539093Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:13.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d55eca1da2ccb7fc2021-12-21 11:32:13.443root 11241100x8000000000000000539094Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:13.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e8e267bc4f93070b2021-12-21 11:32:13.443root 11241100x8000000000000000539095Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:13.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6cef292119b2f8a82021-12-21 11:32:13.443root 11241100x8000000000000000539096Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:13.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3f7d49991b47147d2021-12-21 11:32:13.444root 11241100x8000000000000000539097Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:13.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.66cffb095b83c3082021-12-21 11:32:13.444root 11241100x8000000000000000539098Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:13.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3333492281daf40f2021-12-21 11:32:13.444root 11241100x8000000000000000539099Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:13.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.383442042c1c0a5b2021-12-21 11:32:13.444root 11241100x8000000000000000539100Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:13.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5ea83eba029d7c2d2021-12-21 11:32:13.444root 11241100x8000000000000000539101Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:13.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.46375687340eee8f2021-12-21 11:32:13.444root 11241100x8000000000000000539102Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:13.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.981ae885e77289632021-12-21 11:32:13.444root 11241100x8000000000000000539103Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:13.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.15be15ed5b3c93012021-12-21 11:32:13.444root 11241100x8000000000000000539104Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:13.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a3063c6695b2c3d32021-12-21 11:32:13.444root 11241100x8000000000000000539105Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:13.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.49f795f24f1471ee2021-12-21 11:32:13.444root 11241100x8000000000000000539106Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:13.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.26522a9247f4f7eb2021-12-21 11:32:13.444root 11241100x8000000000000000539107Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:13.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f51eab031f053fe82021-12-21 11:32:13.445root 11241100x8000000000000000539108Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:13.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6e577e8b10eeffc82021-12-21 11:32:13.445root 11241100x8000000000000000539109Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:13.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0c428313bed6d9a62021-12-21 11:32:13.445root 11241100x8000000000000000539110Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:13.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8482a053ab21acc92021-12-21 11:32:13.445root 11241100x8000000000000000539111Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:13.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.69a9fb588b6e32f42021-12-21 11:32:13.445root 11241100x8000000000000000539112Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:13.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.63a87ed516fabfdb2021-12-21 11:32:13.445root 11241100x8000000000000000539113Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:13.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d021b0063631d6112021-12-21 11:32:13.445root 11241100x8000000000000000539114Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:13.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c3f1c362d901b97c2021-12-21 11:32:13.445root 11241100x8000000000000000539115Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:13.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e3432745b7bff60d2021-12-21 11:32:13.445root 11241100x8000000000000000539116Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:13.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.637b66e211d958d72021-12-21 11:32:13.445root 11241100x8000000000000000539117Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:13.446{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.eb78303ddd0ee8502021-12-21 11:32:13.446root 11241100x8000000000000000539118Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:13.446{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.cd6be12f316a1ef02021-12-21 11:32:13.446root 11241100x8000000000000000539119Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:13.446{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.01963865306648e52021-12-21 11:32:13.446root 11241100x8000000000000000539120Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:13.446{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.05f76c87ae08c6722021-12-21 11:32:13.446root 11241100x8000000000000000539121Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:13.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8b63d6567842a1192021-12-21 11:32:13.943root 11241100x8000000000000000539122Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:13.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.752f2d8d587fa9392021-12-21 11:32:13.943root 11241100x8000000000000000539123Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:13.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f3894653e8eb21a62021-12-21 11:32:13.943root 11241100x8000000000000000539124Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:13.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.dde8239d54c2cad22021-12-21 11:32:13.943root 11241100x8000000000000000539125Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:13.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c7e33325c762b8e62021-12-21 11:32:13.943root 11241100x8000000000000000539126Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:13.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e158d51acca44d602021-12-21 11:32:13.943root 11241100x8000000000000000539127Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:13.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1c6b6a4c7c2173ff2021-12-21 11:32:13.943root 11241100x8000000000000000539128Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:13.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5d72391b4bb4308a2021-12-21 11:32:13.944root 11241100x8000000000000000539129Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:13.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d81dbd63d2a4fe352021-12-21 11:32:13.944root 11241100x8000000000000000539130Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:13.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.32b50bd70d93cb872021-12-21 11:32:13.944root 11241100x8000000000000000539131Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:13.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.79eea368fac833bc2021-12-21 11:32:13.944root 11241100x8000000000000000539132Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:13.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3292a0ef5c5987352021-12-21 11:32:13.944root 11241100x8000000000000000539133Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:13.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.081b78b8fc0e6b4d2021-12-21 11:32:13.944root 11241100x8000000000000000539134Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:13.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5ec703ba7c997b4b2021-12-21 11:32:13.944root 11241100x8000000000000000539135Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:13.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c74cf7026c2d3b652021-12-21 11:32:13.944root 11241100x8000000000000000539136Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:13.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5f8c30a41d1fe0772021-12-21 11:32:13.944root 11241100x8000000000000000539137Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:13.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2d48b2cd088c08c42021-12-21 11:32:13.944root 11241100x8000000000000000539138Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:13.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.811a6fbdd7bccc552021-12-21 11:32:13.944root 11241100x8000000000000000539139Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:13.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.446e23691a275d2b2021-12-21 11:32:13.944root 11241100x8000000000000000539140Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:13.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.43f545345ef51b462021-12-21 11:32:13.944root 11241100x8000000000000000539141Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:13.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.fd7b119782a5e0532021-12-21 11:32:13.944root 11241100x8000000000000000539142Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:13.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.29061205199f10022021-12-21 11:32:13.944root 11241100x8000000000000000539143Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:13.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.35843835b12d55b52021-12-21 11:32:13.945root 11241100x8000000000000000539144Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:13.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c892f5d6d2d7f8572021-12-21 11:32:13.945root 11241100x8000000000000000539145Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:13.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d34a7c942d6d26d12021-12-21 11:32:13.945root 11241100x8000000000000000539146Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:13.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c5854d65d92859d52021-12-21 11:32:13.945root 11241100x8000000000000000539147Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:13.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c83ec4938b9cc9272021-12-21 11:32:13.945root 11241100x8000000000000000539148Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:13.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.012b27eadde310632021-12-21 11:32:13.945root 11241100x8000000000000000539149Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:13.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.163dec123afaa36f2021-12-21 11:32:13.945root 11241100x8000000000000000539150Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:14.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4b94efa70bd1be472021-12-21 11:32:14.443root 11241100x8000000000000000539151Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:14.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.bff919291d2d15a62021-12-21 11:32:14.443root 11241100x8000000000000000539152Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:14.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.fecf3d631d5b65312021-12-21 11:32:14.444root 11241100x8000000000000000539153Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:14.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.39269b9ec0476a892021-12-21 11:32:14.444root 11241100x8000000000000000539154Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:14.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.cbd64311815ab2032021-12-21 11:32:14.444root 11241100x8000000000000000539155Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:14.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.42ee706b24491ca92021-12-21 11:32:14.444root 11241100x8000000000000000539156Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:14.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.569cb1749b72423d2021-12-21 11:32:14.444root 11241100x8000000000000000539157Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:14.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0b27318e20dd7fce2021-12-21 11:32:14.444root 11241100x8000000000000000539158Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:14.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7dd4d6803dd90a672021-12-21 11:32:14.444root 11241100x8000000000000000539159Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:14.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c8c98a08c3b09e122021-12-21 11:32:14.444root 11241100x8000000000000000539160Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:14.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c5b06de3e298998a2021-12-21 11:32:14.444root 11241100x8000000000000000539161Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:14.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.30ba574317fe5f3d2021-12-21 11:32:14.444root 11241100x8000000000000000539162Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:14.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e0464ca4ba562f002021-12-21 11:32:14.444root 11241100x8000000000000000539163Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:14.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6bfc8d703f1581462021-12-21 11:32:14.444root 11241100x8000000000000000539164Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:14.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d97e948ec119ed382021-12-21 11:32:14.444root 11241100x8000000000000000539165Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:14.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6c316f702f8db9dd2021-12-21 11:32:14.445root 11241100x8000000000000000539166Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:14.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.55a9bbe13b867e142021-12-21 11:32:14.445root 11241100x8000000000000000539167Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:14.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.bf156d6cf108189d2021-12-21 11:32:14.445root 11241100x8000000000000000539168Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:14.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1b759a0f5278bd702021-12-21 11:32:14.445root 11241100x8000000000000000539169Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:14.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5490366196a4ece12021-12-21 11:32:14.445root 11241100x8000000000000000539170Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:14.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4ef877a41cf6bb682021-12-21 11:32:14.445root 11241100x8000000000000000539171Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:14.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.fc3cdd4b30f633292021-12-21 11:32:14.445root 11241100x8000000000000000539172Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:14.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.671c55bcbf44fd572021-12-21 11:32:14.445root 11241100x8000000000000000539173Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:14.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.730a83c5897fb8d92021-12-21 11:32:14.445root 11241100x8000000000000000539174Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:14.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.cf028cfcc00c4db72021-12-21 11:32:14.445root 11241100x8000000000000000539175Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:14.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.bb5202b3fc9916462021-12-21 11:32:14.445root 11241100x8000000000000000539176Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:14.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4f45abe9a17fdf182021-12-21 11:32:14.445root 11241100x8000000000000000539177Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:14.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9310b3ec134841ad2021-12-21 11:32:14.445root 11241100x8000000000000000539178Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:14.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6eafdebc3c4ec6872021-12-21 11:32:14.445root 11241100x8000000000000000539179Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:14.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.454f8d0ee176363f2021-12-21 11:32:14.943root 11241100x8000000000000000539180Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:14.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f96cd87ca98430bd2021-12-21 11:32:14.943root 11241100x8000000000000000539181Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:14.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.581e727ca7890df52021-12-21 11:32:14.943root 11241100x8000000000000000539182Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:14.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e26fd03e11cc2be12021-12-21 11:32:14.943root 11241100x8000000000000000539183Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:14.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.caa76e9924e2fd8e2021-12-21 11:32:14.943root 11241100x8000000000000000539184Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:14.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0d8d9c1a7ad78a962021-12-21 11:32:14.944root 11241100x8000000000000000539185Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:14.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4b5d9095dd1f36312021-12-21 11:32:14.944root 11241100x8000000000000000539186Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:14.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a0f06b7b6ca184ae2021-12-21 11:32:14.944root 11241100x8000000000000000539187Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:14.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.effcabd62bb188dd2021-12-21 11:32:14.944root 11241100x8000000000000000539188Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:14.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ed1b051576d08c1c2021-12-21 11:32:14.944root 11241100x8000000000000000539189Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:14.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.fcc0eebfc1fc8f1c2021-12-21 11:32:14.945root 11241100x8000000000000000539190Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:14.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ada1f224e8dbe43e2021-12-21 11:32:14.945root 11241100x8000000000000000539191Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:14.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c8bcb3c854e85cc62021-12-21 11:32:14.945root 11241100x8000000000000000539192Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:14.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.bf1bc140d75583f82021-12-21 11:32:14.945root 11241100x8000000000000000539193Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:14.946{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4a9bd67d8ea599222021-12-21 11:32:14.946root 11241100x8000000000000000539194Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:14.946{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.04146cefac61dfe62021-12-21 11:32:14.946root 11241100x8000000000000000539195Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:14.947{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.21c24600590b9b572021-12-21 11:32:14.947root 11241100x8000000000000000539196Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:14.947{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c69859ae09cd5fde2021-12-21 11:32:14.947root 11241100x8000000000000000539197Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:14.947{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e62d342e200663fb2021-12-21 11:32:14.947root 11241100x8000000000000000539198Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:14.948{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1da04769fdeedbe02021-12-21 11:32:14.948root 11241100x8000000000000000539199Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:14.948{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1915e0c3c68f97692021-12-21 11:32:14.948root 11241100x8000000000000000539200Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:14.949{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8a6ea3958582af832021-12-21 11:32:14.949root 11241100x8000000000000000539201Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:14.949{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4a364ae08e3500202021-12-21 11:32:14.949root 11241100x8000000000000000539202Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:14.950{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.49a40f5f9a203d2e2021-12-21 11:32:14.950root 11241100x8000000000000000539203Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:14.951{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0ade3c3140316e232021-12-21 11:32:14.951root 11241100x8000000000000000539204Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:14.951{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.939cf89d89490cfa2021-12-21 11:32:14.951root 11241100x8000000000000000539205Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:14.951{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.28fc526dacd570212021-12-21 11:32:14.951root 11241100x8000000000000000539206Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:14.951{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4f4063725252f27d2021-12-21 11:32:14.951root 11241100x8000000000000000539207Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:14.952{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7ae4033d598f426b2021-12-21 11:32:14.952root 11241100x8000000000000000539208Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:14.952{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.588d2bcc9a07788d2021-12-21 11:32:14.952root 11241100x8000000000000000539209Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:14.952{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d2e75e32f87a3bc92021-12-21 11:32:14.952root 11241100x8000000000000000539210Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:14.952{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.94caf1384c1e02112021-12-21 11:32:14.952root 354300x8000000000000000539211Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:15.233{ec2b6afe-95d9-61c1-5175-3a0400000000}5346/opt/splunkforwarder/etc/apps/Splunk_TA_stream/linux_x86_64/bin/streamfwdroottcptruefalse10.0.1.25-48680-false10.0.1.12-8000- 11241100x8000000000000000539212Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:15.235{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.fcc80076789dee142021-12-21 11:32:15.235root 11241100x8000000000000000539213Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:15.235{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8cf567f89f6a99442021-12-21 11:32:15.235root 11241100x8000000000000000539214Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:15.235{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d2a1387483a779dc2021-12-21 11:32:15.235root 11241100x8000000000000000539215Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:15.235{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c1502e554bfc701e2021-12-21 11:32:15.235root 11241100x8000000000000000539216Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:15.235{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.eede82b619548d172021-12-21 11:32:15.235root 11241100x8000000000000000539217Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:15.235{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.fe02d851252e4f5a2021-12-21 11:32:15.235root 11241100x8000000000000000539218Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:15.235{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3e7896ac16b228e72021-12-21 11:32:15.235root 11241100x8000000000000000539219Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:15.235{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d9b419c2ae360bc22021-12-21 11:32:15.235root 11241100x8000000000000000539220Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:15.235{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0190effbefe5fe982021-12-21 11:32:15.235root 11241100x8000000000000000539221Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:15.235{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b1503503a1ee49f32021-12-21 11:32:15.235root 11241100x8000000000000000539222Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:15.236{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1b69fa8e79e405982021-12-21 11:32:15.236root 11241100x8000000000000000539223Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:15.236{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.aa345c81ae063e102021-12-21 11:32:15.236root 11241100x8000000000000000539224Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:15.236{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2ce06a093cc74a692021-12-21 11:32:15.236root 11241100x8000000000000000539225Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:15.236{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6d14d9b537e9177a2021-12-21 11:32:15.236root 11241100x8000000000000000539226Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:15.236{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d0427471d6cf79982021-12-21 11:32:15.236root 11241100x8000000000000000539227Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:15.236{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d3b797443ca364b92021-12-21 11:32:15.236root 11241100x8000000000000000539228Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:15.236{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.74626a76444975f42021-12-21 11:32:15.236root 11241100x8000000000000000539229Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:15.236{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.186ea554cf9527f42021-12-21 11:32:15.236root 11241100x8000000000000000539230Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:15.236{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7460ddf79dd479912021-12-21 11:32:15.236root 11241100x8000000000000000539231Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:15.236{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.68643f6c79d7513a2021-12-21 11:32:15.236root 11241100x8000000000000000539232Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:15.237{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9409fd7e8a598ccf2021-12-21 11:32:15.237root 11241100x8000000000000000539233Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:15.237{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.da460c92ace78e4e2021-12-21 11:32:15.237root 11241100x8000000000000000539234Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:15.237{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0b9b2f565146115f2021-12-21 11:32:15.237root 11241100x8000000000000000539235Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:15.237{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.aa572fe053993d2a2021-12-21 11:32:15.237root 11241100x8000000000000000539236Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:15.237{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1efbf5ab6d455f8b2021-12-21 11:32:15.237root 11241100x8000000000000000539237Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:15.237{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.65aed3571482b01d2021-12-21 11:32:15.237root 11241100x8000000000000000539238Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:15.237{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b8e9bac81dbfeb162021-12-21 11:32:15.237root 11241100x8000000000000000539239Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:15.237{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.791d941d5603ec6f2021-12-21 11:32:15.237root 11241100x8000000000000000539240Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:15.237{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.839f4ed0425156302021-12-21 11:32:15.237root 11241100x8000000000000000539241Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:15.238{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c0e056ca778e83602021-12-21 11:32:15.238root 11241100x8000000000000000539242Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:15.238{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f20daf881341783b2021-12-21 11:32:15.238root 11241100x8000000000000000539243Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:15.238{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e4a741d3e3531ac12021-12-21 11:32:15.238root 11241100x8000000000000000539244Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:15.238{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2fdf6a5e08bcd37e2021-12-21 11:32:15.238root 11241100x8000000000000000539245Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:15.238{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e9a61496d0b1efba2021-12-21 11:32:15.238root 11241100x8000000000000000539246Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:15.238{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.614a76a20a93f5232021-12-21 11:32:15.238root 11241100x8000000000000000539247Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:15.238{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.364440bee76c51e32021-12-21 11:32:15.238root 11241100x8000000000000000539248Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:15.238{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f4a5cc0ec83f8c882021-12-21 11:32:15.238root 11241100x8000000000000000539249Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:15.238{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.617edaeb1ea2c7812021-12-21 11:32:15.238root 11241100x8000000000000000539250Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:15.238{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.927080ec74cbfa392021-12-21 11:32:15.238root 11241100x8000000000000000539251Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:15.239{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.70180622fe1fb0152021-12-21 11:32:15.239root 11241100x8000000000000000539252Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:15.239{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b2b6d8015c98aaa32021-12-21 11:32:15.239root 11241100x8000000000000000539253Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:15.239{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e22e7e8636b5c8542021-12-21 11:32:15.239root 11241100x8000000000000000539254Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:15.239{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2266c184e2392b792021-12-21 11:32:15.239root 11241100x8000000000000000539255Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:15.239{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1c02dacd092923e72021-12-21 11:32:15.239root 11241100x8000000000000000539256Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:15.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3318a78edd45bb652021-12-21 11:32:15.693root 11241100x8000000000000000539257Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:15.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.02777f86475b36d72021-12-21 11:32:15.693root 11241100x8000000000000000539258Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:15.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9d46df765286f7302021-12-21 11:32:15.693root 11241100x8000000000000000539259Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:15.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5137dd1fe2a288582021-12-21 11:32:15.693root 11241100x8000000000000000539260Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:15.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.49c97255742d211e2021-12-21 11:32:15.693root 11241100x8000000000000000539261Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:15.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6adc6692b69d4aaf2021-12-21 11:32:15.693root 11241100x8000000000000000539262Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:15.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1876fe9df22870b12021-12-21 11:32:15.694root 11241100x8000000000000000539263Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:15.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.fe76ea1997b7a6dc2021-12-21 11:32:15.694root 11241100x8000000000000000539264Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:15.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ff239ac0a14d56802021-12-21 11:32:15.694root 11241100x8000000000000000539265Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:15.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.16986fb501566ad62021-12-21 11:32:15.694root 11241100x8000000000000000539266Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:15.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.116b390b1c3ff3f42021-12-21 11:32:15.694root 11241100x8000000000000000539267Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:15.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2ed8a37b8df6ec3c2021-12-21 11:32:15.694root 11241100x8000000000000000539268Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:15.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.062bf5cd62e7ee3f2021-12-21 11:32:15.694root 11241100x8000000000000000539269Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:15.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.608a12afae8a8cf72021-12-21 11:32:15.694root 11241100x8000000000000000539270Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:15.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2168f1fb85a16a022021-12-21 11:32:15.694root 11241100x8000000000000000539271Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:15.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.afeacab90bd234722021-12-21 11:32:15.694root 11241100x8000000000000000539272Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:15.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a0c07e4028cb068f2021-12-21 11:32:15.694root 11241100x8000000000000000539273Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:15.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.be3b427bd94e83462021-12-21 11:32:15.694root 11241100x8000000000000000539274Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:15.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7a303dfe70e476bd2021-12-21 11:32:15.694root 11241100x8000000000000000539275Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:15.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8de85a9bdea1712e2021-12-21 11:32:15.694root 11241100x8000000000000000539276Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:15.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b8079dcc907de6bd2021-12-21 11:32:15.694root 11241100x8000000000000000539277Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:15.695{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2a7639e8936a2d862021-12-21 11:32:15.695root 11241100x8000000000000000539278Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:15.695{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.371fba5adfa2cbc52021-12-21 11:32:15.695root 11241100x8000000000000000539279Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:15.695{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2bd3d70321ed7e6e2021-12-21 11:32:15.695root 11241100x8000000000000000539280Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:15.695{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d8bbf2dfff9569132021-12-21 11:32:15.695root 11241100x8000000000000000539281Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:15.695{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.adc964cf59e272cd2021-12-21 11:32:15.695root 11241100x8000000000000000539282Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:15.695{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.45d6ce809c17fd642021-12-21 11:32:15.695root 11241100x8000000000000000539283Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:15.695{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4726ed444c1828a22021-12-21 11:32:15.695root 11241100x8000000000000000539284Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:15.695{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2bdb794002f540eb2021-12-21 11:32:15.695root 11241100x8000000000000000539285Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:15.695{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4311c02cccd009912021-12-21 11:32:15.695root 11241100x8000000000000000539286Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:16.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.391bde1cc260e53b2021-12-21 11:32:16.193root 11241100x8000000000000000539287Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:16.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d9c98024fb7e19a32021-12-21 11:32:16.193root 11241100x8000000000000000539288Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:16.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5747c536e11dbf412021-12-21 11:32:16.193root 11241100x8000000000000000539289Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:16.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e00dcd2882bd84902021-12-21 11:32:16.193root 11241100x8000000000000000539290Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:16.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.cf526095c0c46b322021-12-21 11:32:16.194root 11241100x8000000000000000539291Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:16.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a6922ea20d5e6ab32021-12-21 11:32:16.194root 11241100x8000000000000000539292Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:16.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a10578756d10fbe32021-12-21 11:32:16.194root 11241100x8000000000000000539293Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:16.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.bdc8074e8334bd2f2021-12-21 11:32:16.194root 11241100x8000000000000000539294Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:16.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c5dab895097fb69c2021-12-21 11:32:16.194root 11241100x8000000000000000539295Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:16.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.42f937cf65641c832021-12-21 11:32:16.194root 11241100x8000000000000000539296Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:16.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a8409e66ecc630ea2021-12-21 11:32:16.194root 11241100x8000000000000000539297Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:16.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9847ce9536f54a0d2021-12-21 11:32:16.194root 11241100x8000000000000000539298Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:16.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.81ccfb0ce97fed4f2021-12-21 11:32:16.194root 11241100x8000000000000000539299Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:16.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6f8282f27b3a10462021-12-21 11:32:16.194root 11241100x8000000000000000539300Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:16.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2230c836552b73082021-12-21 11:32:16.194root 11241100x8000000000000000539301Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:16.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.05e8262cd4fbfc202021-12-21 11:32:16.194root 11241100x8000000000000000539302Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:16.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7aeefff4422f7b692021-12-21 11:32:16.194root 11241100x8000000000000000539303Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:16.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.aeaa937da6e04f0f2021-12-21 11:32:16.194root 11241100x8000000000000000539304Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:16.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b8593c9f08d06b152021-12-21 11:32:16.194root 11241100x8000000000000000539305Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:16.195{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8ca370e0a8667a552021-12-21 11:32:16.195root 11241100x8000000000000000539306Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:16.195{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f5aae012c668eafd2021-12-21 11:32:16.195root 11241100x8000000000000000539307Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:16.195{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.51786c56b9d79c7b2021-12-21 11:32:16.195root 11241100x8000000000000000539308Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:16.195{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f9656b40c2066e2e2021-12-21 11:32:16.195root 11241100x8000000000000000539309Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:16.195{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ac3745ce2b1ddd032021-12-21 11:32:16.195root 11241100x8000000000000000539310Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:16.195{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.11919e0b1cb0a4a62021-12-21 11:32:16.195root 11241100x8000000000000000539311Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:16.195{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.18b8f357c810ec672021-12-21 11:32:16.195root 11241100x8000000000000000539312Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:16.195{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a36c4fa516537c3c2021-12-21 11:32:16.195root 11241100x8000000000000000539313Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:16.195{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b1d523c3318e8eab2021-12-21 11:32:16.195root 11241100x8000000000000000539314Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:16.195{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3f629d1e2523be282021-12-21 11:32:16.195root 11241100x8000000000000000539315Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:16.195{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9d28823907670c712021-12-21 11:32:16.195root 11241100x8000000000000000539316Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:16.195{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.493f0c2132dec5cb2021-12-21 11:32:16.195root 11241100x8000000000000000539317Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:16.195{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4363f6f06d199ec92021-12-21 11:32:16.195root 11241100x8000000000000000539318Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:16.195{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3c7d3a59f34094742021-12-21 11:32:16.195root 11241100x8000000000000000539319Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:16.195{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8d789ae01e1c79672021-12-21 11:32:16.195root 11241100x8000000000000000539320Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:16.196{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.084eca53ecd03ac92021-12-21 11:32:16.196root 11241100x8000000000000000539321Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:16.196{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.55ec6536ab1df8cb2021-12-21 11:32:16.196root 11241100x8000000000000000539322Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:16.196{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e24c29253bbadcca2021-12-21 11:32:16.196root 11241100x8000000000000000539323Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:16.196{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.645c83d12c7eeb102021-12-21 11:32:16.196root 11241100x8000000000000000539324Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:16.196{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a34a4022ad82fd252021-12-21 11:32:16.196root 11241100x8000000000000000539325Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:16.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.443f13cfb66626022021-12-21 11:32:16.693root 11241100x8000000000000000539326Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:16.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.54ab842065a519eb2021-12-21 11:32:16.694root 11241100x8000000000000000539327Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:16.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.288739a92b4936492021-12-21 11:32:16.694root 11241100x8000000000000000539328Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:16.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.de4f1fe3b5099e642021-12-21 11:32:16.694root 11241100x8000000000000000539329Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:16.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a6533211fde355852021-12-21 11:32:16.694root 11241100x8000000000000000539330Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:16.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.189a65c881428b142021-12-21 11:32:16.694root 11241100x8000000000000000539331Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:16.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.87635b0d822fd9ae2021-12-21 11:32:16.694root 11241100x8000000000000000539332Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:16.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.52235b818fa559372021-12-21 11:32:16.694root 11241100x8000000000000000539333Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:16.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8ec4c1d8c4b8d7732021-12-21 11:32:16.694root 11241100x8000000000000000539334Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:16.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f0b8876d84e455282021-12-21 11:32:16.694root 11241100x8000000000000000539335Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:16.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6b8bbc475b83a4b12021-12-21 11:32:16.694root 11241100x8000000000000000539336Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:16.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4882f34266212f4f2021-12-21 11:32:16.694root 11241100x8000000000000000539337Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:16.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c996c613215edce22021-12-21 11:32:16.694root 11241100x8000000000000000539338Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:16.695{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d3df87e642ae84222021-12-21 11:32:16.695root 11241100x8000000000000000539339Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:16.695{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1babbaaa7d0b601e2021-12-21 11:32:16.695root 11241100x8000000000000000539340Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:16.695{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5e0cb82e5273dbb92021-12-21 11:32:16.695root 11241100x8000000000000000539341Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:16.695{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b90a4abc396251862021-12-21 11:32:16.695root 11241100x8000000000000000539342Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:16.695{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0f460df1e6fa02332021-12-21 11:32:16.695root 11241100x8000000000000000539343Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:16.695{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0e967bb7c31460352021-12-21 11:32:16.695root 11241100x8000000000000000539344Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:16.695{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e09a5ce49e9baa872021-12-21 11:32:16.695root 11241100x8000000000000000539345Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:16.695{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.25515f0cb4d9af6f2021-12-21 11:32:16.695root 11241100x8000000000000000539346Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:16.695{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4e3a3b4ae0d09a232021-12-21 11:32:16.695root 11241100x8000000000000000539347Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:16.695{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6d22cbe6006412bd2021-12-21 11:32:16.695root 11241100x8000000000000000539348Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:16.695{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.192d6a73ed7e3ec22021-12-21 11:32:16.695root 11241100x8000000000000000539349Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:16.695{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7deb5cde347310ce2021-12-21 11:32:16.695root 11241100x8000000000000000539350Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:16.695{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c54ad5b8b9ec49b92021-12-21 11:32:16.695root 11241100x8000000000000000539351Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:16.696{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d6d1fddca147a0192021-12-21 11:32:16.696root 11241100x8000000000000000539352Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:16.696{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.fc536d112bf6e1c72021-12-21 11:32:16.696root 11241100x8000000000000000539353Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:16.696{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1613c7e85811b5132021-12-21 11:32:16.696root 11241100x8000000000000000539354Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:16.696{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.013f73b0ee7f13f92021-12-21 11:32:16.696root 11241100x8000000000000000539355Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:17.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0c71d5799c3cf1f92021-12-21 11:32:17.193root 11241100x8000000000000000539356Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:17.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.389daffa62813d332021-12-21 11:32:17.193root 11241100x8000000000000000539357Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:17.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.12867681b974c4002021-12-21 11:32:17.194root 11241100x8000000000000000539358Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:17.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9568f0b8cb00f78b2021-12-21 11:32:17.194root 11241100x8000000000000000539359Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:17.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0dafdd7cf7af9de22021-12-21 11:32:17.194root 11241100x8000000000000000539360Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:17.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e0d5407470298c8f2021-12-21 11:32:17.194root 11241100x8000000000000000539361Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:17.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a98bfde22a7d13e42021-12-21 11:32:17.194root 11241100x8000000000000000539362Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:17.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4280c4bc89ea0e9a2021-12-21 11:32:17.194root 11241100x8000000000000000539363Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:17.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.95481ef35a45c3ae2021-12-21 11:32:17.194root 11241100x8000000000000000539364Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:17.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9b14d180a5d8da112021-12-21 11:32:17.194root 11241100x8000000000000000539365Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:17.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2883e3a2f1f12aad2021-12-21 11:32:17.194root 11241100x8000000000000000539366Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:17.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f91f2cfb5a9f7f082021-12-21 11:32:17.194root 11241100x8000000000000000539367Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:17.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a7b2ff60964a26c62021-12-21 11:32:17.194root 11241100x8000000000000000539368Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:17.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.83abf105296d3f9e2021-12-21 11:32:17.194root 11241100x8000000000000000539369Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:17.195{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.26fafb3d63bd5e0e2021-12-21 11:32:17.195root 11241100x8000000000000000539370Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:17.195{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.bbd23ae86ae184f62021-12-21 11:32:17.195root 11241100x8000000000000000539371Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:17.195{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e20a3604288113412021-12-21 11:32:17.195root 11241100x8000000000000000539372Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:17.195{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ddb64f2e9f9ac0742021-12-21 11:32:17.195root 11241100x8000000000000000539373Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:17.195{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.85d8c1df2436b1f62021-12-21 11:32:17.195root 11241100x8000000000000000539374Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:17.195{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6709a2655e32c0c12021-12-21 11:32:17.195root 11241100x8000000000000000539375Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:17.195{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.87522474ec82223c2021-12-21 11:32:17.195root 11241100x8000000000000000539376Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:17.195{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3f13ebddc1660cfe2021-12-21 11:32:17.195root 11241100x8000000000000000539377Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:17.196{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.517cb0375957e4742021-12-21 11:32:17.196root 11241100x8000000000000000539378Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:17.196{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.945df9590c283e3e2021-12-21 11:32:17.196root 11241100x8000000000000000539379Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:17.196{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.fc490ddcef1f6d9c2021-12-21 11:32:17.196root 11241100x8000000000000000539380Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:17.196{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c1a60cc1b74d35cf2021-12-21 11:32:17.196root 11241100x8000000000000000539381Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:17.196{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.64addd07700f59d22021-12-21 11:32:17.196root 11241100x8000000000000000539382Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:17.196{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.79929b6c8b2337212021-12-21 11:32:17.196root 11241100x8000000000000000539383Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:17.196{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d9a050c465d459252021-12-21 11:32:17.196root 11241100x8000000000000000539384Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:17.196{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b4410d0ea513aacf2021-12-21 11:32:17.196root 11241100x8000000000000000539385Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:17.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.505f994ac0e340cd2021-12-21 11:32:17.693root 11241100x8000000000000000539386Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:17.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8b3038b71dfdf7692021-12-21 11:32:17.693root 11241100x8000000000000000539427Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:36.326{ec2b6afe-95d2-61c1-3038-b84203560000}5272/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/spool/splunk/tracker.log2021-12-21 11:32:36.326root 11241100x8000000000000000539428Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:36.692{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f0282ddf4156aa962021-12-21 11:32:36.692root 11241100x8000000000000000539429Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:37.192{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4acd52500a2b19de2021-12-21 11:32:37.192root 11241100x8000000000000000539430Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:37.692{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a9a8c13618cc79ff2021-12-21 11:32:37.692root 354300x8000000000000000539431Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:38.126{ec2b6afe-95d9-61c1-5175-3a0400000000}5346/opt/splunkforwarder/etc/apps/Splunk_TA_stream/linux_x86_64/bin/streamfwdroottcptruefalse10.0.1.25-48698-false10.0.1.12-8000- 11241100x8000000000000000539432Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:38.127{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b2ae6df7613184812021-12-21 11:32:38.127root 11241100x8000000000000000539433Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:38.442{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.73aaa8370d0854a62021-12-21 11:32:38.442root 11241100x8000000000000000539434Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:38.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7fbc1ea75b23c68b2021-12-21 11:32:38.443root 11241100x8000000000000000539435Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:38.942{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a1e95ed14dc278172021-12-21 11:32:38.942root 11241100x8000000000000000539436Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:38.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.82ee5447ed1477962021-12-21 11:32:38.943root 23542300x8000000000000000539437Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:39.329{ec2b6afe-95d2-61c1-3038-b84203560000}5272root/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/spool/splunk/tracker.log--- 11241100x8000000000000000539438Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:39.329{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.90b9b3e07bfedd432021-12-21 11:32:39.329root 11241100x8000000000000000539439Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:39.329{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2446915fc2698bb92021-12-21 11:32:39.329root 11241100x8000000000000000539440Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:39.329{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.be08bdd2d44454732021-12-21 11:32:39.329root 11241100x8000000000000000539441Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:39.692{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.514974ed1f3791ff2021-12-21 11:32:39.692root 11241100x8000000000000000539442Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:39.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d05e1944c410678f2021-12-21 11:32:39.693root 11241100x8000000000000000539443Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:39.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.01b0ac291cf72be62021-12-21 11:32:39.693root 11241100x8000000000000000539444Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:40.192{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.57e464fbf479392b2021-12-21 11:32:40.192root 11241100x8000000000000000539445Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:40.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7df7474fa55034462021-12-21 11:32:40.193root 11241100x8000000000000000539446Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:40.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ed66fed6834647282021-12-21 11:32:40.193root 11241100x8000000000000000539447Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:40.692{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.fd58548dfd76bd042021-12-21 11:32:40.692root 11241100x8000000000000000539448Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:40.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.14649d55ef4d07332021-12-21 11:32:40.693root 11241100x8000000000000000539449Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:40.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.606ab93b3ff80d252021-12-21 11:32:40.693root 11241100x8000000000000000539450Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:41.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.fbd748a4e7e6ac6e2021-12-21 11:32:41.193root 11241100x8000000000000000539451Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:41.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.129f965369c898cd2021-12-21 11:32:41.193root 11241100x8000000000000000539452Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:41.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a7182e26a349cb602021-12-21 11:32:41.194root 11241100x8000000000000000539453Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:41.692{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.05e76d844cc90fad2021-12-21 11:32:41.692root 11241100x8000000000000000539454Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:41.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8b6e74cea2c857ea2021-12-21 11:32:41.693root 11241100x8000000000000000539455Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:41.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b6af6c0c4f511f3a2021-12-21 11:32:41.693root 11241100x8000000000000000539456Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:42.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.830362a4f435eb662021-12-21 11:32:42.193root 11241100x8000000000000000539457Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:42.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.691ac7b64d1491c22021-12-21 11:32:42.193root 11241100x8000000000000000539458Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:42.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a8c1a74b908c36a82021-12-21 11:32:42.193root 11241100x8000000000000000539459Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:42.692{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.785cdc14f981d8fd2021-12-21 11:32:42.692root 11241100x8000000000000000539460Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:42.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8a04a16a30e8c09b2021-12-21 11:32:42.693root 11241100x8000000000000000539461Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:42.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7b116187d364d8bc2021-12-21 11:32:42.693root 11241100x8000000000000000539462Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:43.192{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.57ff8024ffb364a52021-12-21 11:32:43.192root 11241100x8000000000000000539463Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:43.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.81f4046f9c066ffa2021-12-21 11:32:43.193root 11241100x8000000000000000539464Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:43.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.162743214fa5fa602021-12-21 11:32:43.193root 11241100x8000000000000000539465Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:43.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2ac782ab0d589d852021-12-21 11:32:43.693root 11241100x8000000000000000539466Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:43.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a81376dace2c26c72021-12-21 11:32:43.693root 11241100x8000000000000000539467Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:43.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.69fc37db73ee271c2021-12-21 11:32:43.693root 354300x8000000000000000539468Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:44.122{ec2b6afe-95d9-61c1-5175-3a0400000000}5346/opt/splunkforwarder/etc/apps/Splunk_TA_stream/linux_x86_64/bin/streamfwdroottcptruefalse10.0.1.25-48700-false10.0.1.12-8000- 11241100x8000000000000000539469Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:44.122{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.81bb9894109e44de2021-12-21 11:32:44.122root 11241100x8000000000000000539470Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:44.122{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.59214b0440482cc32021-12-21 11:32:44.122root 11241100x8000000000000000539471Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:44.123{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.143f5a776a5e183f2021-12-21 11:32:44.123root 11241100x8000000000000000539472Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:44.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b2a4f244c701fd042021-12-21 11:32:44.443root 11241100x8000000000000000539473Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:44.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ebcb435c34b2ac482021-12-21 11:32:44.443root 11241100x8000000000000000539474Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:44.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.56b5dd24b9e264ff2021-12-21 11:32:44.443root 11241100x8000000000000000539475Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:44.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.90bbda6e3ea143552021-12-21 11:32:44.443root 11241100x8000000000000000539476Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:44.942{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6cd3d54a80a467de2021-12-21 11:32:44.942root 11241100x8000000000000000539477Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:44.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.da5318fccba639432021-12-21 11:32:44.943root 11241100x8000000000000000539478Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:44.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a2b42a80278890c32021-12-21 11:32:44.943root 11241100x8000000000000000539479Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:44.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b665e287eee85eae2021-12-21 11:32:44.943root 11241100x8000000000000000539480Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:45.442{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8b76fb1bef45239e2021-12-21 11:32:45.442root 11241100x8000000000000000539481Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:45.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2618bfa695eef9532021-12-21 11:32:45.443root 11241100x8000000000000000539482Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:45.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.96f418b9acaacc002021-12-21 11:32:45.443root 11241100x8000000000000000539483Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:45.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2c6358648ac62b302021-12-21 11:32:45.443root 11241100x8000000000000000539484Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:45.942{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e7bf5f6a1eae38e02021-12-21 11:32:45.942root 11241100x8000000000000000539485Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:45.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.56359d59f45cc3cd2021-12-21 11:32:45.943root 11241100x8000000000000000539486Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:45.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ed134148e41a8a562021-12-21 11:32:45.943root 11241100x8000000000000000539487Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:45.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ee711b500de10abd2021-12-21 11:32:45.943root 11241100x8000000000000000539488Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:46.442{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.802b542c5159442e2021-12-21 11:32:46.442root 11241100x8000000000000000539489Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:46.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f2cce82e8671220b2021-12-21 11:32:46.443root 11241100x8000000000000000539490Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:46.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e68a39220d50083a2021-12-21 11:32:46.443root 11241100x8000000000000000539491Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:46.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.11c8120ef3dda0dc2021-12-21 11:32:46.443root 11241100x8000000000000000539492Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:46.942{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3b9d1e757a84cfab2021-12-21 11:32:46.942root 11241100x8000000000000000539493Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:46.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2bf3aafff520443e2021-12-21 11:32:46.943root 11241100x8000000000000000539494Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:46.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6e379de431f6e1052021-12-21 11:32:46.943root 11241100x8000000000000000539495Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:46.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.829f60067cc1569e2021-12-21 11:32:46.943root 11241100x8000000000000000539496Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:47.442{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f38e043f48f9b11f2021-12-21 11:32:47.442root 11241100x8000000000000000539497Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:47.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.347a7f8cd71ef16f2021-12-21 11:32:47.443root 11241100x8000000000000000539498Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:47.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.47da3410faba445d2021-12-21 11:32:47.443root 11241100x8000000000000000539499Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:47.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6a780c87929d66722021-12-21 11:32:47.443root 11241100x8000000000000000539500Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:47.942{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.af0f1958b546cf932021-12-21 11:32:47.942root 11241100x8000000000000000539501Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:47.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.bbbb924c56bdad1c2021-12-21 11:32:47.943root 11241100x8000000000000000539502Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:47.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d8493f760faffb7d2021-12-21 11:32:47.943root 11241100x8000000000000000539503Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:47.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7c66cf291acd868d2021-12-21 11:32:47.943root 11241100x8000000000000000539504Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:48.442{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0ee08f0f0ac566e62021-12-21 11:32:48.442root 11241100x8000000000000000539505Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:48.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.de1f98440c97d2b92021-12-21 11:32:48.443root 11241100x8000000000000000539506Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:48.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.08ca37f9a68e6a732021-12-21 11:32:48.443root 11241100x8000000000000000539507Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:48.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a4c98ed96eea0f442021-12-21 11:32:48.443root 11241100x8000000000000000539508Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:48.942{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.735f1d35942badbc2021-12-21 11:32:48.942root 11241100x8000000000000000539509Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:48.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.09b944c2593de9dd2021-12-21 11:32:48.943root 11241100x8000000000000000539510Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:48.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4158b7918abc1caf2021-12-21 11:32:48.943root 11241100x8000000000000000539511Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:48.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d5f983fea6c4ed842021-12-21 11:32:48.943root 354300x8000000000000000539512Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:49.182{ec2b6afe-95d9-61c1-5175-3a0400000000}5346/opt/splunkforwarder/etc/apps/Splunk_TA_stream/linux_x86_64/bin/streamfwdroottcptruefalse10.0.1.25-48702-false10.0.1.12-8000- 11241100x8000000000000000539513Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:49.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d8ed6a5f2c731ffb2021-12-21 11:32:49.443root 11241100x8000000000000000539514Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:49.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5b15625b4bc3fb0d2021-12-21 11:32:49.443root 11241100x8000000000000000539515Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:49.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.cd5efbb92aeb05ec2021-12-21 11:32:49.443root 11241100x8000000000000000539516Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:49.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1f0c29a5960f28fa2021-12-21 11:32:49.443root 11241100x8000000000000000539517Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:49.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2a953c7942922c012021-12-21 11:32:49.443root 11241100x8000000000000000539518Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:49.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.47a6a01fd46473e62021-12-21 11:32:49.943root 11241100x8000000000000000539519Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:49.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0cb1d80e122502262021-12-21 11:32:49.943root 11241100x8000000000000000539520Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:49.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.35622d009f8e0e3a2021-12-21 11:32:49.943root 11241100x8000000000000000539521Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:49.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.12c4136be4eb6d3b2021-12-21 11:32:49.943root 11241100x8000000000000000539522Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:49.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2897bb1abcb7563f2021-12-21 11:32:49.943root 11241100x8000000000000000539523Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:50.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.44b9fb2f0654f19f2021-12-21 11:32:50.443root 11241100x8000000000000000539524Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:50.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8a68f89fb7a833652021-12-21 11:32:50.443root 11241100x8000000000000000539525Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:50.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.28cffcbecb1b88b92021-12-21 11:32:50.443root 11241100x8000000000000000539526Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:50.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.466db632a72c8ebf2021-12-21 11:32:50.443root 11241100x8000000000000000539527Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:50.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b034958e970b50c22021-12-21 11:32:50.443root 11241100x8000000000000000539528Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:50.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.55b3f33ce9b3e2232021-12-21 11:32:50.943root 11241100x8000000000000000539529Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:50.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.851abd5a78e2f9972021-12-21 11:32:50.943root 11241100x8000000000000000539530Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:50.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1ac199721ca192582021-12-21 11:32:50.943root 11241100x8000000000000000539531Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:50.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.08c090fe862332b32021-12-21 11:32:50.943root 11241100x8000000000000000539532Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:50.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8c210e8b47edd0082021-12-21 11:32:50.943root 11241100x8000000000000000539533Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:51.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.59f932c7a35a2a292021-12-21 11:32:51.443root 11241100x8000000000000000539534Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:51.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.486ab01e046b21402021-12-21 11:32:51.443root 11241100x8000000000000000539535Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:51.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4e97b700233d8ce72021-12-21 11:32:51.443root 11241100x8000000000000000539536Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:51.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5a2620fccd8b0ec82021-12-21 11:32:51.443root 11241100x8000000000000000539537Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:51.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a1ea4589a387e6382021-12-21 11:32:51.443root 11241100x8000000000000000539538Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:51.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.bbc8aef46d5b071f2021-12-21 11:32:51.943root 11241100x8000000000000000539539Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:51.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b65d38d0825a5ddb2021-12-21 11:32:51.943root 11241100x8000000000000000539540Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:51.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c901c29b19c9c5192021-12-21 11:32:51.943root 11241100x8000000000000000539541Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:51.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2d5ece2d3e7b12c52021-12-21 11:32:51.943root 11241100x8000000000000000539542Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:51.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b910159f34c101802021-12-21 11:32:51.943root 11241100x8000000000000000539543Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:52.442{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9ce1a266f5ab9c332021-12-21 11:32:52.442root 11241100x8000000000000000539544Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:52.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4d4f93b45370b1322021-12-21 11:32:52.443root 11241100x8000000000000000539545Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:52.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.55928015e0f2b1e52021-12-21 11:32:52.443root 11241100x8000000000000000539546Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:52.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b1ffe3097c01776f2021-12-21 11:32:52.443root 11241100x8000000000000000539547Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:52.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.71009229f1be722b2021-12-21 11:32:52.443root 11241100x8000000000000000539548Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:52.942{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.67f28e81443a2cdc2021-12-21 11:32:52.942root 11241100x8000000000000000539549Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:52.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7410a6bcc864da702021-12-21 11:32:52.943root 11241100x8000000000000000539550Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:52.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.fa3ca01775a83c9f2021-12-21 11:32:52.943root 11241100x8000000000000000539551Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:52.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a481f44c42cb65092021-12-21 11:32:52.943root 11241100x8000000000000000539552Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:52.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.cc396438fd2a547b2021-12-21 11:32:52.943root 11241100x8000000000000000539553Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:53.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.acc8f190eddf9c302021-12-21 11:32:53.443root 11241100x8000000000000000539554Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:53.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.914ba21fef77beb42021-12-21 11:32:53.443root 11241100x8000000000000000539555Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:53.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.cd98beb1513f03e72021-12-21 11:32:53.443root 11241100x8000000000000000539556Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:53.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.aad7e32522f843782021-12-21 11:32:53.443root 11241100x8000000000000000539557Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:53.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5a86dec24f2030162021-12-21 11:32:53.443root 11241100x8000000000000000539558Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:53.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.06b8c35463feb41e2021-12-21 11:32:53.943root 11241100x8000000000000000539559Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:53.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.fb228088c58bcff82021-12-21 11:32:53.943root 11241100x8000000000000000539560Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:53.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.636e815879315e142021-12-21 11:32:53.943root 11241100x8000000000000000539561Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:53.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d9492470040c7ae52021-12-21 11:32:53.943root 11241100x8000000000000000539562Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:53.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.68fe092e0fd5fd492021-12-21 11:32:53.943root 11241100x8000000000000000539563Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:54.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.56390c42724756892021-12-21 11:32:54.443root 11241100x8000000000000000539564Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:54.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e4d06a594525f5532021-12-21 11:32:54.443root 11241100x8000000000000000539565Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:54.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.15f6b46a71c5a9d82021-12-21 11:32:54.443root 11241100x8000000000000000539566Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:54.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d1377e7829d3928b2021-12-21 11:32:54.443root 11241100x8000000000000000539567Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:54.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7376d8118b01bf952021-12-21 11:32:54.443root 11241100x8000000000000000539568Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:54.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.10a01df5909fcb592021-12-21 11:32:54.943root 11241100x8000000000000000539569Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:54.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d704c1bf05f55e862021-12-21 11:32:54.943root 11241100x8000000000000000539570Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:54.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5665aa793b5fd00e2021-12-21 11:32:54.943root 11241100x8000000000000000539571Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:54.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.fb3679c8b86d868d2021-12-21 11:32:54.943root 11241100x8000000000000000539572Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:54.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.896fec2ab60ee0c12021-12-21 11:32:54.943root 354300x8000000000000000539573Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:55.016{ec2b6afe-95d9-61c1-5175-3a0400000000}5346/opt/splunkforwarder/etc/apps/Splunk_TA_stream/linux_x86_64/bin/streamfwdroottcptruefalse10.0.1.25-48704-false10.0.1.12-8000- 11241100x8000000000000000539574Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:55.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9e2b11a358abcd612021-12-21 11:32:55.443root 11241100x8000000000000000539575Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:55.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b0456a1022293fab2021-12-21 11:32:55.443root 11241100x8000000000000000539576Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:55.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d1715f70220a9e432021-12-21 11:32:55.443root 11241100x8000000000000000539577Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:55.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4f3ef4f12889c0f82021-12-21 11:32:55.443root 11241100x8000000000000000539578Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:55.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.86385bbb2d6a079e2021-12-21 11:32:55.443root 11241100x8000000000000000539579Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:55.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.110435164ebe7d132021-12-21 11:32:55.443root 11241100x8000000000000000539580Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:55.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e78b5f2d3322bf2c2021-12-21 11:32:55.943root 11241100x8000000000000000539581Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:55.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f325270ce13f4f312021-12-21 11:32:55.943root 11241100x8000000000000000539582Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:55.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e76590431b04b8392021-12-21 11:32:55.943root 11241100x8000000000000000539583Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:55.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a9e35fe9b3d3ffe92021-12-21 11:32:55.943root 11241100x8000000000000000539584Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:55.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.23a13fb17da68ba32021-12-21 11:32:55.943root 11241100x8000000000000000539585Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:55.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.18b7afeed8fb04062021-12-21 11:32:55.943root 11241100x8000000000000000539586Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:56.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a1730d11766003e12021-12-21 11:32:56.443root 11241100x8000000000000000539587Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:56.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5b8ad133765b62ac2021-12-21 11:32:56.443root 11241100x8000000000000000539588Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:56.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7ec6033e4e77efa02021-12-21 11:32:56.443root 11241100x8000000000000000539589Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:56.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a75d02ce6e1e7c4f2021-12-21 11:32:56.443root 11241100x8000000000000000539590Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:56.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2fa7831bd8b516a62021-12-21 11:32:56.443root 11241100x8000000000000000539591Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:56.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7af0babdc95dc0682021-12-21 11:32:56.443root 11241100x8000000000000000539592Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:56.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5f4273b5b9c368dc2021-12-21 11:32:56.943root 11241100x8000000000000000539593Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:56.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.691a07c8de62f75e2021-12-21 11:32:56.943root 11241100x8000000000000000539594Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:56.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a685702805232c272021-12-21 11:32:56.943root 11241100x8000000000000000539595Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:56.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6ca51a5dfb1cc5ab2021-12-21 11:32:56.943root 11241100x8000000000000000539596Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:56.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f35e3299e407c09e2021-12-21 11:32:56.943root 11241100x8000000000000000539597Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:56.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.21a09b64de1636482021-12-21 11:32:56.943root 11241100x8000000000000000539598Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:57.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4905f63d1f0c02ea2021-12-21 11:32:57.443root 11241100x8000000000000000539599Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:57.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.bf8d1db8384100dc2021-12-21 11:32:57.443root 11241100x8000000000000000539600Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:57.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f7debeb37bef3f2f2021-12-21 11:32:57.443root 11241100x8000000000000000539601Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:57.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4460c40db7d6723e2021-12-21 11:32:57.443root 11241100x8000000000000000539602Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:57.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.270b6ef3210cb53b2021-12-21 11:32:57.443root 11241100x8000000000000000539603Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:57.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6d8de72d3bf97fe22021-12-21 11:32:57.443root 11241100x8000000000000000539604Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:57.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.437f7bee89a771382021-12-21 11:32:57.943root 11241100x8000000000000000539605Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:57.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f8a86bf0e6a5716b2021-12-21 11:32:57.943root 11241100x8000000000000000539606Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:57.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4f2442410eea0e032021-12-21 11:32:57.943root 11241100x8000000000000000539607Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:57.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a64928594de14cb42021-12-21 11:32:57.943root 11241100x8000000000000000539608Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:57.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.46efa766c25be0082021-12-21 11:32:57.943root 11241100x8000000000000000539609Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:57.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a6a4738d423493042021-12-21 11:32:57.943root 11241100x8000000000000000539610Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:58.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.73ac9978c8ccac7b2021-12-21 11:32:58.443root 11241100x8000000000000000539611Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:58.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.516a297354b3da4c2021-12-21 11:32:58.443root 11241100x8000000000000000539612Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:58.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.aaf56ae2dd5a4a362021-12-21 11:32:58.443root 11241100x8000000000000000539613Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:58.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e04f85379d3b03912021-12-21 11:32:58.443root 11241100x8000000000000000539614Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:58.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5af3f5be3747fa242021-12-21 11:32:58.443root 11241100x8000000000000000539615Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:58.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b6d4a7f6638506732021-12-21 11:32:58.443root 11241100x8000000000000000539616Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:58.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.856b996f497524332021-12-21 11:32:58.943root 11241100x8000000000000000539617Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:58.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.834187e9826be77b2021-12-21 11:32:58.943root 11241100x8000000000000000539618Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:58.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2b8e3cce675a4d012021-12-21 11:32:58.943root 11241100x8000000000000000539619Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:58.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2396671bd3898d5f2021-12-21 11:32:58.943root 11241100x8000000000000000539620Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:58.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d9749b79f510fb2a2021-12-21 11:32:58.943root 11241100x8000000000000000539621Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:58.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f3f7c5afa5a2104f2021-12-21 11:32:58.943root 11241100x8000000000000000539622Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:59.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b6e304413fdafb4c2021-12-21 11:32:59.443root 11241100x8000000000000000539623Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:59.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6af1e1b7986964af2021-12-21 11:32:59.443root 11241100x8000000000000000539624Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:59.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c204ea0979af4a342021-12-21 11:32:59.443root 11241100x8000000000000000539625Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:59.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.aa1941886b408f7b2021-12-21 11:32:59.443root 11241100x8000000000000000539626Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:59.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.12cd7c6aae4891ec2021-12-21 11:32:59.443root 11241100x8000000000000000539627Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:59.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.271cd0421f79251e2021-12-21 11:32:59.443root 11241100x8000000000000000539628Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:59.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.385de25ad0fe19ba2021-12-21 11:32:59.943root 11241100x8000000000000000539629Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:59.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.eb7fb655064516d82021-12-21 11:32:59.943root 11241100x8000000000000000539630Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:59.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3468b145161619482021-12-21 11:32:59.943root 11241100x8000000000000000539631Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:59.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.550878e1eebf57d72021-12-21 11:32:59.943root 11241100x8000000000000000539632Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:59.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.77bbf5b0f638697c2021-12-21 11:32:59.943root 11241100x8000000000000000539633Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:32:59.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.dae311bbfc5952ea2021-12-21 11:32:59.943root 354300x8000000000000000539634Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:00.046{ec2b6afe-95d9-61c1-5175-3a0400000000}5346/opt/splunkforwarder/etc/apps/Splunk_TA_stream/linux_x86_64/bin/streamfwdroottcptruefalse10.0.1.25-48706-false10.0.1.12-8000- 11241100x8000000000000000539635Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:00.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.25ae0e5bcb2fb5482021-12-21 11:33:00.443root 11241100x8000000000000000539636Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:00.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ab6c3c76c1c4e4242021-12-21 11:33:00.443root 11241100x8000000000000000539637Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:00.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0e646249e5d8a8a32021-12-21 11:33:00.443root 11241100x8000000000000000539638Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:00.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.fd6fe56ffcd738a52021-12-21 11:33:00.443root 11241100x8000000000000000539639Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:00.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7278ff2ba0aab71f2021-12-21 11:33:00.443root 11241100x8000000000000000539640Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:00.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6006c092724f038e2021-12-21 11:33:00.443root 11241100x8000000000000000539641Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:00.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.14584c4dc0ef2c682021-12-21 11:33:00.443root 11241100x8000000000000000539642Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:00.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.216a1b3d65117a2f2021-12-21 11:33:00.943root 11241100x8000000000000000539643Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:00.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.62e91a621f2c21742021-12-21 11:33:00.943root 11241100x8000000000000000539644Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:00.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d5a28b3e8173413b2021-12-21 11:33:00.943root 11241100x8000000000000000539645Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:00.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.13ab9e76d2304ca92021-12-21 11:33:00.944root 11241100x8000000000000000539646Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:00.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1192cbbdfdc4c0ee2021-12-21 11:33:00.944root 11241100x8000000000000000539647Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:00.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ef2117142b7fae402021-12-21 11:33:00.944root 11241100x8000000000000000539648Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:00.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.86954986131e0a152021-12-21 11:33:00.944root 11241100x8000000000000000539649Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:01.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a8db0139debac6fe2021-12-21 11:33:01.443root 11241100x8000000000000000539650Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:01.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.55150785a31d9ade2021-12-21 11:33:01.443root 11241100x8000000000000000539651Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:01.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.35cb43686e15ac132021-12-21 11:33:01.443root 11241100x8000000000000000539652Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:01.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9745788a870fb7ff2021-12-21 11:33:01.443root 11241100x8000000000000000539653Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:01.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1cbed7797cb8d8202021-12-21 11:33:01.443root 11241100x8000000000000000539654Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:01.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f72977082f794ca32021-12-21 11:33:01.443root 11241100x8000000000000000539655Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:01.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7c89e9aae81861f22021-12-21 11:33:01.443root 11241100x8000000000000000539656Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:01.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4a00c81f21778fe52021-12-21 11:33:01.943root 11241100x8000000000000000539657Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:01.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b03318f7a5d5f1d52021-12-21 11:33:01.943root 11241100x8000000000000000539658Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:01.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.94f672a2c4dab6d42021-12-21 11:33:01.943root 11241100x8000000000000000539659Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:01.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e49f57443367d5512021-12-21 11:33:01.943root 11241100x8000000000000000539660Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:01.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.079799c670d02c472021-12-21 11:33:01.943root 11241100x8000000000000000539661Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:01.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7fd4165b84a4699c2021-12-21 11:33:01.943root 11241100x8000000000000000539662Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:01.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6d0b1ce9f1a5a9492021-12-21 11:33:01.943root 11241100x8000000000000000539663Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:02.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6209d6f2069b562a2021-12-21 11:33:02.443root 11241100x8000000000000000539664Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:02.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1ef022fd947591282021-12-21 11:33:02.443root 11241100x8000000000000000539665Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:02.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8747ce6218223cb02021-12-21 11:33:02.443root 11241100x8000000000000000539666Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:02.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a35ac51cd3be93032021-12-21 11:33:02.443root 11241100x8000000000000000539667Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:02.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8c0241444b74794c2021-12-21 11:33:02.443root 11241100x8000000000000000539668Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:02.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f24421ccc6b0e3b32021-12-21 11:33:02.443root 11241100x8000000000000000539669Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:02.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8dea154114aab9f62021-12-21 11:33:02.443root 11241100x8000000000000000539670Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:02.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e2da031f506499922021-12-21 11:33:02.943root 11241100x8000000000000000539671Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:02.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8715256f11f839c42021-12-21 11:33:02.943root 11241100x8000000000000000539672Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:02.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a5ddd775ce03b2122021-12-21 11:33:02.943root 11241100x8000000000000000539673Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:02.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3956b22e5b65a4a92021-12-21 11:33:02.943root 11241100x8000000000000000539674Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:02.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3def62c89e5084f02021-12-21 11:33:02.943root 11241100x8000000000000000539675Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:02.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6906affb5b2411ba2021-12-21 11:33:02.943root 11241100x8000000000000000539676Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:02.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.75dac2c4084c011c2021-12-21 11:33:02.943root 11241100x8000000000000000539677Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:03.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.57302b41f86330c12021-12-21 11:33:03.443root 11241100x8000000000000000539678Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:03.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e6e97b6355e5c8522021-12-21 11:33:03.443root 11241100x8000000000000000539679Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:03.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.199188f42241e30b2021-12-21 11:33:03.443root 11241100x8000000000000000539680Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:03.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.011314016c6b89662021-12-21 11:33:03.443root 11241100x8000000000000000539681Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:03.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.30054cabc0898e102021-12-21 11:33:03.443root 11241100x8000000000000000539682Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:03.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c17a4f1b56df895f2021-12-21 11:33:03.443root 11241100x8000000000000000539683Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:03.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1e0a91a39d65c82a2021-12-21 11:33:03.443root 11241100x8000000000000000539684Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:03.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.50ef8a1d95e47e202021-12-21 11:33:03.943root 11241100x8000000000000000539685Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:03.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.685d25fb66f6bd1c2021-12-21 11:33:03.943root 11241100x8000000000000000539686Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:03.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.39efb15416246a742021-12-21 11:33:03.943root 11241100x8000000000000000539687Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:03.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8bfd843662cebc462021-12-21 11:33:03.943root 11241100x8000000000000000539688Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:03.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5aec097c050c67d92021-12-21 11:33:03.943root 11241100x8000000000000000539689Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:03.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.bf8a04654f2d9edb2021-12-21 11:33:03.943root 11241100x8000000000000000539690Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:03.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.34ba6725b13e19cd2021-12-21 11:33:03.943root 11241100x8000000000000000539691Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:04.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.74621db8421d20a22021-12-21 11:33:04.443root 11241100x8000000000000000539692Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:04.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.60d32926cdf49b8b2021-12-21 11:33:04.443root 11241100x8000000000000000539693Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:04.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.139fe5f13983ed452021-12-21 11:33:04.444root 11241100x8000000000000000539694Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:04.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c9cae3d0f73846f62021-12-21 11:33:04.444root 11241100x8000000000000000539695Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:04.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.71dd256b2ebd1fe82021-12-21 11:33:04.444root 11241100x8000000000000000539696Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:04.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9bae5fe13a5b4d4c2021-12-21 11:33:04.444root 11241100x8000000000000000539697Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:04.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.437622c086a230562021-12-21 11:33:04.444root 11241100x8000000000000000539698Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:04.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.044e8754e7de31f42021-12-21 11:33:04.943root 11241100x8000000000000000539699Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:04.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c9dadec29ea3e3832021-12-21 11:33:04.943root 11241100x8000000000000000539700Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:04.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7aa73b36b78076a42021-12-21 11:33:04.943root 11241100x8000000000000000539701Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:04.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e54a6b544677f6d72021-12-21 11:33:04.943root 11241100x8000000000000000539702Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:04.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d023a791204ac4b52021-12-21 11:33:04.943root 11241100x8000000000000000539703Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:04.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a51a4380e60f39362021-12-21 11:33:04.943root 11241100x8000000000000000539704Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:04.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5696a7518c4238c82021-12-21 11:33:04.943root 354300x8000000000000000539705Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:05.095{ec2b6afe-95d9-61c1-5175-3a0400000000}5346/opt/splunkforwarder/etc/apps/Splunk_TA_stream/linux_x86_64/bin/streamfwdroottcptruefalse10.0.1.25-48708-false10.0.1.12-8000- 11241100x8000000000000000539706Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:05.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.78ee12589b84b9622021-12-21 11:33:05.443root 11241100x8000000000000000539707Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:05.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d93c65125720979a2021-12-21 11:33:05.443root 11241100x8000000000000000539708Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:05.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.406b10b5e296d1d72021-12-21 11:33:05.443root 11241100x8000000000000000539709Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:05.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d18b16f6ca07e78c2021-12-21 11:33:05.443root 11241100x8000000000000000539710Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:05.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.38284dd45c800bd32021-12-21 11:33:05.443root 11241100x8000000000000000539711Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:05.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7bbdb7d1a4535de82021-12-21 11:33:05.443root 11241100x8000000000000000539712Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:05.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a61879eb6c548b642021-12-21 11:33:05.443root 11241100x8000000000000000539713Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:05.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5c3cceca7717ae772021-12-21 11:33:05.443root 11241100x8000000000000000539714Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:05.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.45f44f863216778c2021-12-21 11:33:05.943root 11241100x8000000000000000539715Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:05.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3d21d135e7ab00bb2021-12-21 11:33:05.943root 11241100x8000000000000000539716Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:05.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5eabd0e04b56c3622021-12-21 11:33:05.943root 11241100x8000000000000000539717Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:05.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.30765772818adafc2021-12-21 11:33:05.943root 11241100x8000000000000000539718Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:05.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3bcc061286b53d372021-12-21 11:33:05.943root 11241100x8000000000000000539719Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:05.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c88f8b60a91bbd822021-12-21 11:33:05.943root 11241100x8000000000000000539720Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:05.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b9fdce81b1344a292021-12-21 11:33:05.943root 11241100x8000000000000000539721Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:05.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1a943274c0adc4f52021-12-21 11:33:05.944root 11241100x8000000000000000539722Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:06.326{ec2b6afe-95d2-61c1-3038-b84203560000}5272/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/spool/splunk/tracker.log2021-12-21 11:33:06.326root 11241100x8000000000000000539723Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:06.326{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ff939fc102ab18082021-12-21 11:33:06.326root 11241100x8000000000000000539724Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:06.327{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6a372c3b868020702021-12-21 11:33:06.327root 11241100x8000000000000000539725Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:06.327{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8dc24977c1235bb32021-12-21 11:33:06.327root 11241100x8000000000000000539726Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:06.328{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.cc5758b46cd628fb2021-12-21 11:33:06.328root 11241100x8000000000000000539727Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:06.328{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.984e09de691dafec2021-12-21 11:33:06.328root 11241100x8000000000000000539728Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:06.328{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.251ed4c74fd6baf92021-12-21 11:33:06.328root 11241100x8000000000000000539729Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:06.328{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b11e4bc13602a6342021-12-21 11:33:06.328root 11241100x8000000000000000539730Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:06.329{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6b0938a46e1153bc2021-12-21 11:33:06.329root 11241100x8000000000000000539731Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:06.329{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0a7307102f29f3512021-12-21 11:33:06.329root 11241100x8000000000000000539732Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:06.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ea1b9db18b8ebb8e2021-12-21 11:33:06.693root 11241100x8000000000000000539733Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:06.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b001abf4dfa8c60b2021-12-21 11:33:06.693root 11241100x8000000000000000539734Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:06.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.bb8fb225bf1f2cad2021-12-21 11:33:06.693root 11241100x8000000000000000539735Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:06.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.bb59db5d9d067aab2021-12-21 11:33:06.693root 11241100x8000000000000000539736Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:06.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1a4d0c67785ccdab2021-12-21 11:33:06.693root 11241100x8000000000000000539737Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:06.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a5b54bebb216429a2021-12-21 11:33:06.693root 11241100x8000000000000000539738Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:06.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.aa7aebd9adfbba612021-12-21 11:33:06.693root 11241100x8000000000000000539739Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:06.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d1b27566a1ee264d2021-12-21 11:33:06.693root 11241100x8000000000000000539740Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:06.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ebadf811bea2bb942021-12-21 11:33:06.693root 11241100x8000000000000000539741Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:07.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4814a0375370c3de2021-12-21 11:33:07.193root 11241100x8000000000000000539742Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:07.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.48692539265e086f2021-12-21 11:33:07.193root 11241100x8000000000000000539743Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:07.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.478962de5484ee7a2021-12-21 11:33:07.193root 11241100x8000000000000000539744Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:07.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a4681e56edda80b02021-12-21 11:33:07.193root 11241100x8000000000000000539745Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:07.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ce402c9fdb3fcd0d2021-12-21 11:33:07.193root 11241100x8000000000000000539746Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:07.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.cfcc700cb72f98d12021-12-21 11:33:07.193root 11241100x8000000000000000539747Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:07.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f49e4a4636148b8e2021-12-21 11:33:07.193root 11241100x8000000000000000539748Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:07.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f0fe3acb8ea7c8092021-12-21 11:33:07.193root 11241100x8000000000000000539749Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:07.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1a37e21ac09345a52021-12-21 11:33:07.193root 11241100x8000000000000000539750Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:07.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0c633136f23dd4c42021-12-21 11:33:07.693root 11241100x8000000000000000539751Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:07.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a8bd62a4a962ef832021-12-21 11:33:07.693root 11241100x8000000000000000539752Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:07.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b2af7c783a7307432021-12-21 11:33:07.693root 11241100x8000000000000000539753Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:07.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f06c57cb6cbe69de2021-12-21 11:33:07.693root 11241100x8000000000000000539754Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:07.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d9eba6f5251c12752021-12-21 11:33:07.693root 11241100x8000000000000000539755Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:07.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.13082df101b68a6b2021-12-21 11:33:07.693root 11241100x8000000000000000539756Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:07.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.249145a7c8f449362021-12-21 11:33:07.693root 11241100x8000000000000000539757Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:07.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.50922211dd193d102021-12-21 11:33:07.693root 11241100x8000000000000000539758Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:07.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.61240dba6bbe8a662021-12-21 11:33:07.693root 11241100x8000000000000000539759Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:08.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d0373592b6e857fa2021-12-21 11:33:08.193root 11241100x8000000000000000539760Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:08.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1a31056c62a8106b2021-12-21 11:33:08.193root 11241100x8000000000000000539761Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:08.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2b7be55b8002ef232021-12-21 11:33:08.193root 11241100x8000000000000000539762Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:08.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2719d6d17c373e692021-12-21 11:33:08.193root 11241100x8000000000000000539763Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:08.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f4a0a0afbb2bde172021-12-21 11:33:08.193root 11241100x8000000000000000539764Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:08.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ce60e732bafd08a62021-12-21 11:33:08.193root 11241100x8000000000000000539765Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:08.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4b0e4d1b96ebc62a2021-12-21 11:33:08.193root 11241100x8000000000000000539766Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:08.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1f0de91396068ef42021-12-21 11:33:08.193root 11241100x8000000000000000539767Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:08.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3261c484916cbca62021-12-21 11:33:08.193root 11241100x8000000000000000539768Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:08.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a523031daca63ef02021-12-21 11:33:08.693root 11241100x8000000000000000539769Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:08.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.762d327f1b7258272021-12-21 11:33:08.693root 11241100x8000000000000000539770Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:08.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5adc2ec1f214de5a2021-12-21 11:33:08.693root 11241100x8000000000000000539771Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:08.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a1ef636e934eec482021-12-21 11:33:08.693root 11241100x8000000000000000539772Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:08.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.132fa4fc8f92c0fd2021-12-21 11:33:08.693root 11241100x8000000000000000539773Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:08.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4bb958c573b212ca2021-12-21 11:33:08.693root 11241100x8000000000000000539774Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:08.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f0e2d4e1dda4ebc12021-12-21 11:33:08.693root 11241100x8000000000000000539775Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:08.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.477a455c504c60452021-12-21 11:33:08.693root 11241100x8000000000000000539776Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:08.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d96a74cf835e3feb2021-12-21 11:33:08.693root 11241100x8000000000000000539777Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:09.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d8d0df7487696aca2021-12-21 11:33:09.193root 11241100x8000000000000000539778Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:09.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d3d00b905c9f93702021-12-21 11:33:09.193root 11241100x8000000000000000539779Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:09.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.70ec6c98ee8928d52021-12-21 11:33:09.193root 11241100x8000000000000000539780Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:09.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b2fa762b3071a92f2021-12-21 11:33:09.193root 11241100x8000000000000000539781Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:09.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.059b7240c5cdbfa72021-12-21 11:33:09.193root 11241100x8000000000000000539782Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:09.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ee59156d2e8b3d012021-12-21 11:33:09.193root 11241100x8000000000000000539783Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:09.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.690d33454fcc1fed2021-12-21 11:33:09.193root 11241100x8000000000000000539784Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:09.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4f687bcaa98776d22021-12-21 11:33:09.193root 11241100x8000000000000000539785Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:09.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b9fbd83deac49dc72021-12-21 11:33:09.193root 23542300x8000000000000000539786Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:09.327{ec2b6afe-95d2-61c1-3038-b84203560000}5272root/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/spool/splunk/tracker.log--- 11241100x8000000000000000539787Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:09.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a1ab040b81ad7b792021-12-21 11:33:09.693root 11241100x8000000000000000539788Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:09.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f4c988fce75193932021-12-21 11:33:09.693root 11241100x8000000000000000539789Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:09.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a989c802fc5d0eb72021-12-21 11:33:09.693root 11241100x8000000000000000539790Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:09.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.50b4e9555f9436922021-12-21 11:33:09.693root 11241100x8000000000000000539791Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:09.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e04bbf5ad9d460772021-12-21 11:33:09.693root 11241100x8000000000000000539792Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:09.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.cd4ebc6e13be85722021-12-21 11:33:09.693root 11241100x8000000000000000539793Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:09.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d9704693a2d345bc2021-12-21 11:33:09.693root 11241100x8000000000000000539794Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:09.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c4c73b04a8f40d962021-12-21 11:33:09.693root 11241100x8000000000000000539795Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:09.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3634e5a450cdf9dc2021-12-21 11:33:09.693root 11241100x8000000000000000539796Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:09.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c46e05b4aeaeb5492021-12-21 11:33:09.693root 354300x8000000000000000539797Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:10.121{ec2b6afe-95d9-61c1-5175-3a0400000000}5346/opt/splunkforwarder/etc/apps/Splunk_TA_stream/linux_x86_64/bin/streamfwdroottcptruefalse10.0.1.25-48710-false10.0.1.12-8000- 11241100x8000000000000000539798Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:10.122{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.897f6b5d2df9922f2021-12-21 11:33:10.122root 11241100x8000000000000000539799Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:10.122{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d7112ded46a7401f2021-12-21 11:33:10.122root 11241100x8000000000000000539800Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:10.122{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5d120a9c295689c82021-12-21 11:33:10.122root 11241100x8000000000000000539801Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:10.122{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1600b3a35e7d4eeb2021-12-21 11:33:10.122root 11241100x8000000000000000539802Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:10.122{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2302afade30277a12021-12-21 11:33:10.122root 11241100x8000000000000000539803Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:10.122{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a66dcd6e8aa7adb92021-12-21 11:33:10.122root 11241100x8000000000000000539804Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:10.123{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.bf98e033c1a9086e2021-12-21 11:33:10.123root 11241100x8000000000000000539805Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:10.123{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8b67443e0520059d2021-12-21 11:33:10.123root 11241100x8000000000000000539806Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:10.123{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.393e90dfe85884602021-12-21 11:33:10.123root 11241100x8000000000000000539807Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:10.123{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ca254af62b44a2022021-12-21 11:33:10.123root 11241100x8000000000000000539808Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:10.123{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.aca0cc850124a1b62021-12-21 11:33:10.123root 11241100x8000000000000000539809Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:10.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6bb7ff3a98fefd6a2021-12-21 11:33:10.443root 11241100x8000000000000000539810Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:10.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4472855184acaf2f2021-12-21 11:33:10.443root 11241100x8000000000000000539811Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:10.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2de6592b1b383ebb2021-12-21 11:33:10.443root 11241100x8000000000000000539812Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:10.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.451c2f9ebddf33162021-12-21 11:33:10.443root 11241100x8000000000000000539813Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:10.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d2764a5080ecc3a32021-12-21 11:33:10.444root 11241100x8000000000000000539814Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:10.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0e7026b0d66697e92021-12-21 11:33:10.444root 11241100x8000000000000000539815Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:10.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.acddca52a435817c2021-12-21 11:33:10.444root 11241100x8000000000000000539816Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:10.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c674460a233c29332021-12-21 11:33:10.444root 11241100x8000000000000000539817Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:10.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5516a6c702df3c852021-12-21 11:33:10.444root 11241100x8000000000000000539818Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:10.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.bf1d12eea48370b02021-12-21 11:33:10.444root 11241100x8000000000000000539819Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:10.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.59262b2c03ff99792021-12-21 11:33:10.444root 11241100x8000000000000000539820Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:10.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b94079466438a7e22021-12-21 11:33:10.943root 11241100x8000000000000000539821Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:10.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.724648e0627ee32f2021-12-21 11:33:10.943root 11241100x8000000000000000539822Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:10.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6a92f4e9f1aec6722021-12-21 11:33:10.943root 11241100x8000000000000000539823Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:10.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.21a5bbba0ff3085c2021-12-21 11:33:10.943root 11241100x8000000000000000539824Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:10.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5a66231c42ea26082021-12-21 11:33:10.943root 11241100x8000000000000000539825Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:10.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.06f15c60275518e92021-12-21 11:33:10.943root 11241100x8000000000000000539826Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:10.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6094e536b3d212202021-12-21 11:33:10.943root 11241100x8000000000000000539827Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:10.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ffeb5b39ba0cdd322021-12-21 11:33:10.944root 11241100x8000000000000000539828Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:10.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.26554c5e121a884a2021-12-21 11:33:10.944root 11241100x8000000000000000539829Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:10.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e69c4f474de08d342021-12-21 11:33:10.944root 11241100x8000000000000000539830Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:10.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b8d30d664498f5f02021-12-21 11:33:10.944root 11241100x8000000000000000539831Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:11.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7705d0a8dd27027e2021-12-21 11:33:11.443root 11241100x8000000000000000539832Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:11.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f5935ae01f79bf342021-12-21 11:33:11.443root 11241100x8000000000000000539833Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:11.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.93d8d5c0dd2754b32021-12-21 11:33:11.443root 11241100x8000000000000000539834Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:11.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.944e3c4417e56d262021-12-21 11:33:11.444root 11241100x8000000000000000539835Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:11.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.603e2475c78929f82021-12-21 11:33:11.444root 11241100x8000000000000000539836Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:11.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c72995fff5e548d72021-12-21 11:33:11.444root 11241100x8000000000000000539837Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:11.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c24a2bc1fa4176c22021-12-21 11:33:11.444root 11241100x8000000000000000539838Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:11.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.66917069a9987d7b2021-12-21 11:33:11.444root 11241100x8000000000000000539839Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:11.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.da12bee34a6debc92021-12-21 11:33:11.444root 11241100x8000000000000000539840Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:11.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.99d443c7f74a459e2021-12-21 11:33:11.444root 11241100x8000000000000000539841Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:11.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9eb35ded1db2fc342021-12-21 11:33:11.444root 11241100x8000000000000000539842Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:11.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2d9a8c5f614593152021-12-21 11:33:11.943root 11241100x8000000000000000539843Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:11.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b7d48ab07ee4b60a2021-12-21 11:33:11.943root 11241100x8000000000000000539844Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:11.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.bf16b9bf90421c752021-12-21 11:33:11.943root 11241100x8000000000000000539845Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:11.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1f1e31c03590edc92021-12-21 11:33:11.943root 11241100x8000000000000000539846Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:11.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f0388bd5257652752021-12-21 11:33:11.943root 11241100x8000000000000000539847Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:11.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.209a9f5db258d3922021-12-21 11:33:11.943root 11241100x8000000000000000539848Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:11.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.698180c5c50a5c6b2021-12-21 11:33:11.944root 11241100x8000000000000000539849Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:11.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f6cc80bf426c612f2021-12-21 11:33:11.944root 11241100x8000000000000000539850Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:11.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.41acda7b0928c7b42021-12-21 11:33:11.944root 11241100x8000000000000000539851Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:11.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.58ebe32f82823c2b2021-12-21 11:33:11.944root 11241100x8000000000000000539852Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:11.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2d6e3fbe54ec55452021-12-21 11:33:11.944root 11241100x8000000000000000539853Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:12.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a509facc5e7b280a2021-12-21 11:33:12.443root 11241100x8000000000000000539854Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:12.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.04ebd4b564bb1cd52021-12-21 11:33:12.443root 11241100x8000000000000000539855Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:12.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6bffc6038494b18e2021-12-21 11:33:12.443root 11241100x8000000000000000539856Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:12.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4752f655843e75382021-12-21 11:33:12.443root 11241100x8000000000000000539857Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:12.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.18e7a23cd3a7dfa12021-12-21 11:33:12.443root 11241100x8000000000000000539858Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:12.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e5dd306a0d018a432021-12-21 11:33:12.443root 11241100x8000000000000000539859Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:12.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6d11943641094efa2021-12-21 11:33:12.443root 11241100x8000000000000000539860Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:12.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c52500026176d8602021-12-21 11:33:12.443root 11241100x8000000000000000539861Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:12.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4b132ad67bc87a312021-12-21 11:33:12.443root 11241100x8000000000000000539862Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:12.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.83439894c60191442021-12-21 11:33:12.444root 11241100x8000000000000000539863Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:12.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a8882c54e3aa671e2021-12-21 11:33:12.444root 11241100x8000000000000000539864Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:12.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4afc60368e7abd722021-12-21 11:33:12.943root 11241100x8000000000000000539865Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:12.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.874d250baa0d18ff2021-12-21 11:33:12.943root 11241100x8000000000000000539866Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:12.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.dcb3c1321ed0d72e2021-12-21 11:33:12.943root 11241100x8000000000000000539867Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:12.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.079e31fc6579ed852021-12-21 11:33:12.943root 11241100x8000000000000000539868Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:12.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.38d7ed732c79dca12021-12-21 11:33:12.943root 11241100x8000000000000000539869Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:12.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e22e27705531d6732021-12-21 11:33:12.943root 11241100x8000000000000000539870Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:12.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ed7ae1d24c5ef6792021-12-21 11:33:12.943root 11241100x8000000000000000539871Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:12.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e2a4095ad468894d2021-12-21 11:33:12.943root 11241100x8000000000000000539872Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:12.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4c0a1968991113e22021-12-21 11:33:12.944root 11241100x8000000000000000539873Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:12.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.75c1d6d912494c522021-12-21 11:33:12.944root 11241100x8000000000000000539874Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:12.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.edbb4e71731e027a2021-12-21 11:33:12.944root 11241100x8000000000000000539875Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:13.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9b4b2b3d061ac91a2021-12-21 11:33:13.443root 11241100x8000000000000000539876Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:13.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.07f3c497340fc3e62021-12-21 11:33:13.443root 11241100x8000000000000000539877Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:13.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d779678d2aead9722021-12-21 11:33:13.443root 11241100x8000000000000000539878Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:13.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b0c80ac2fe0817892021-12-21 11:33:13.443root 11241100x8000000000000000539879Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:13.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ce88b4af532b15eb2021-12-21 11:33:13.443root 11241100x8000000000000000539880Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:13.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8aed21cef2cfd0482021-12-21 11:33:13.443root 11241100x8000000000000000539881Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:13.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4d45d9b2e1ad86002021-12-21 11:33:13.443root 11241100x8000000000000000539882Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:13.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9e3e803b18cc44202021-12-21 11:33:13.443root 11241100x8000000000000000539883Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:13.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.cb0f169333696a572021-12-21 11:33:13.443root 11241100x8000000000000000539884Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:13.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c9252ffe9e9e7f722021-12-21 11:33:13.443root 11241100x8000000000000000539885Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:13.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.23c1e09a626c63fa2021-12-21 11:33:13.444root 11241100x8000000000000000539886Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:13.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2eb66306832cc2372021-12-21 11:33:13.943root 11241100x8000000000000000539887Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:13.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.34f3885fd90264ec2021-12-21 11:33:13.943root 11241100x8000000000000000539888Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:13.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1a108508cace99ad2021-12-21 11:33:13.943root 11241100x8000000000000000539889Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:13.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b3204d5589ae037b2021-12-21 11:33:13.944root 11241100x8000000000000000539890Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:13.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.369ff104043be8e32021-12-21 11:33:13.944root 11241100x8000000000000000539891Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:13.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.74b11f989ef2472e2021-12-21 11:33:13.944root 11241100x8000000000000000539892Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:13.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4fb0ec27005bbcd22021-12-21 11:33:13.944root 11241100x8000000000000000539893Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:13.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f242e701661285042021-12-21 11:33:13.944root 11241100x8000000000000000539894Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:13.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4ef3232d8c32bf912021-12-21 11:33:13.945root 11241100x8000000000000000539895Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:13.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c8c9273b3cdab1cd2021-12-21 11:33:13.945root 11241100x8000000000000000539896Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:13.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.da01ca63062c7c6c2021-12-21 11:33:13.945root 11241100x8000000000000000539897Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:14.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.182ec1a8505c46d72021-12-21 11:33:14.443root 11241100x8000000000000000539898Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:14.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a0e675c7928d5a472021-12-21 11:33:14.443root 11241100x8000000000000000539899Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:14.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f1feec82deb688c12021-12-21 11:33:14.443root 11241100x8000000000000000539900Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:14.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0d268c2983b3bcab2021-12-21 11:33:14.443root 11241100x8000000000000000539901Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:14.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2ca5b23b37ee22c42021-12-21 11:33:14.443root 11241100x8000000000000000539902Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:14.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7f94bb4d9e78387f2021-12-21 11:33:14.443root 11241100x8000000000000000539903Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:14.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.69ffc5fa2b1f8cf42021-12-21 11:33:14.443root 11241100x8000000000000000539904Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:14.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7230a79dfa1bc7b82021-12-21 11:33:14.443root 11241100x8000000000000000539905Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:14.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.57c435a87409d12b2021-12-21 11:33:14.444root 11241100x8000000000000000539906Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:14.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.58fce80e7ee61d5f2021-12-21 11:33:14.444root 11241100x8000000000000000539907Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:14.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.cec66f460846d3bf2021-12-21 11:33:14.444root 11241100x8000000000000000539908Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:14.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.011c6ed804246b9e2021-12-21 11:33:14.943root 11241100x8000000000000000539909Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:14.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9900f2a376b82b7a2021-12-21 11:33:14.943root 11241100x8000000000000000539910Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:14.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.50a7ebd1393b66b42021-12-21 11:33:14.943root 11241100x8000000000000000539911Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:14.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6cba965950d467612021-12-21 11:33:14.943root 11241100x8000000000000000539912Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:14.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.88f11601a31dbfb72021-12-21 11:33:14.943root 11241100x8000000000000000539913Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:14.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.57e10e4feb3d60502021-12-21 11:33:14.943root 11241100x8000000000000000539914Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:14.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a482e21d82a7a60e2021-12-21 11:33:14.943root 11241100x8000000000000000539915Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:14.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7317bd72b7808b3d2021-12-21 11:33:14.943root 11241100x8000000000000000539916Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:14.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b33e4426e02e34e62021-12-21 11:33:14.943root 11241100x8000000000000000539917Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:14.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f3b9e1537686fd1f2021-12-21 11:33:14.944root 11241100x8000000000000000539918Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:14.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.cde91a16c8bf58df2021-12-21 11:33:14.944root 11241100x8000000000000000539919Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:15.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f8b790dd087ef2cf2021-12-21 11:33:15.443root 11241100x8000000000000000539920Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:15.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1ecfc262735cfd002021-12-21 11:33:15.443root 11241100x8000000000000000539921Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:15.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5a27c85ee616f3f82021-12-21 11:33:15.443root 11241100x8000000000000000539922Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:15.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8cc8e16ecef192102021-12-21 11:33:15.443root 11241100x8000000000000000539923Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:15.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.696495c562b0bb0a2021-12-21 11:33:15.443root 11241100x8000000000000000539924Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:15.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a0d95b2f59c837e92021-12-21 11:33:15.443root 11241100x8000000000000000539925Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:15.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.29c6fb350e5b39902021-12-21 11:33:15.444root 11241100x8000000000000000539926Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:15.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0db3df6f3d0ea4d62021-12-21 11:33:15.444root 11241100x8000000000000000539927Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:15.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0316b46aa021d5532021-12-21 11:33:15.444root 11241100x8000000000000000539928Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:15.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.48cf2e41300f77292021-12-21 11:33:15.444root 11241100x8000000000000000539929Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:15.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.00dee4a127e77c112021-12-21 11:33:15.444root 11241100x8000000000000000539930Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:15.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.55c23678d1e5ee182021-12-21 11:33:15.943root 11241100x8000000000000000539931Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:15.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.26d2872c14b7dd9d2021-12-21 11:33:15.943root 11241100x8000000000000000539932Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:15.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1ea0bedbe28f5d2e2021-12-21 11:33:15.943root 11241100x8000000000000000539933Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:15.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.17226cbda3481c252021-12-21 11:33:15.943root 11241100x8000000000000000539934Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:15.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a31b08736733dbb52021-12-21 11:33:15.943root 11241100x8000000000000000539935Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:15.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7c05c0557ad1725d2021-12-21 11:33:15.943root 11241100x8000000000000000539936Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:15.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0802f58ff87f70322021-12-21 11:33:15.943root 11241100x8000000000000000539937Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:15.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b7db49d8121a5f832021-12-21 11:33:15.944root 11241100x8000000000000000539938Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:15.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.af403c1dca3504722021-12-21 11:33:15.944root 11241100x8000000000000000539939Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:15.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.af7b9052051668ff2021-12-21 11:33:15.944root 11241100x8000000000000000539940Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:15.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c2b6670c2fc8200b2021-12-21 11:33:15.944root 354300x8000000000000000539941Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:16.025{ec2b6afe-95d9-61c1-5175-3a0400000000}5346/opt/splunkforwarder/etc/apps/Splunk_TA_stream/linux_x86_64/bin/streamfwdroottcptruefalse10.0.1.25-48712-false10.0.1.12-8000- 11241100x8000000000000000539942Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:16.442{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1ca8905ba6d86ade2021-12-21 11:33:16.442root 11241100x8000000000000000539943Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:16.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c1c6a94546b9891b2021-12-21 11:33:16.443root 11241100x8000000000000000539944Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:16.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1dbc2b613e7a31492021-12-21 11:33:16.443root 11241100x8000000000000000539945Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:16.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e421e93507c895f22021-12-21 11:33:16.443root 11241100x8000000000000000539946Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:16.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.67918ff5965659872021-12-21 11:33:16.444root 11241100x8000000000000000539947Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:16.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8ce881f9a94ad14a2021-12-21 11:33:16.444root 11241100x8000000000000000539948Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:16.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.59268fc5d00ae5802021-12-21 11:33:16.444root 11241100x8000000000000000539949Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:16.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.49168f7accaf7cf62021-12-21 11:33:16.444root 11241100x8000000000000000539950Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:16.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.cb0d4c4125255c572021-12-21 11:33:16.444root 11241100x8000000000000000539951Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:16.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c741866ff563b72e2021-12-21 11:33:16.444root 11241100x8000000000000000539952Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:16.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.68018b412dbe3ff22021-12-21 11:33:16.444root 11241100x8000000000000000539953Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:16.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4f32721c93e4a90b2021-12-21 11:33:16.444root 11241100x8000000000000000539954Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:16.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ada5e45797255b0c2021-12-21 11:33:16.444root 11241100x8000000000000000539955Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:16.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.82f71fff284f480d2021-12-21 11:33:16.444root 11241100x8000000000000000539956Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:16.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d19c8876b24faf5d2021-12-21 11:33:16.444root 11241100x8000000000000000539957Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:16.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1368e5f3fcaafd2c2021-12-21 11:33:16.444root 11241100x8000000000000000539958Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:16.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1046d961fcd441ad2021-12-21 11:33:16.943root 11241100x8000000000000000539959Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:16.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d69cd8790e4d14e52021-12-21 11:33:16.943root 11241100x8000000000000000539960Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:16.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.92f1c751636499e82021-12-21 11:33:16.943root 11241100x8000000000000000539961Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:16.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8dd716e9a750f8422021-12-21 11:33:16.943root 11241100x8000000000000000539962Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:16.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.16cc95f438225e952021-12-21 11:33:16.943root 11241100x8000000000000000539963Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:16.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f7c9a61f03420c8b2021-12-21 11:33:16.943root 11241100x8000000000000000539964Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:16.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b2e1c7dfde893c682021-12-21 11:33:16.943root 11241100x8000000000000000539965Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:16.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0497c01f1e93010b2021-12-21 11:33:16.943root 11241100x8000000000000000539966Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:16.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.34eac8b0e8c667fa2021-12-21 11:33:16.943root 11241100x8000000000000000539967Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:16.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.63b5b3b4aa75582f2021-12-21 11:33:16.944root 11241100x8000000000000000539968Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:16.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.fd4a7bc38bbe19bf2021-12-21 11:33:16.944root 11241100x8000000000000000539969Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:16.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0b3cf81b77e254a92021-12-21 11:33:16.944root 11241100x8000000000000000539970Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:17.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.59a716890fbab8292021-12-21 11:33:17.443root 11241100x8000000000000000539971Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:17.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7dc1d1c7f89785f32021-12-21 11:33:17.443root 11241100x8000000000000000539972Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:17.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.49612b3c6046ed2a2021-12-21 11:33:17.443root 11241100x8000000000000000539973Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:17.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.53eaa01fee1912282021-12-21 11:33:17.443root 11241100x8000000000000000539974Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:17.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f2bdaeb058f22f022021-12-21 11:33:17.443root 11241100x8000000000000000539975Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:17.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d08a366ec10503352021-12-21 11:33:17.443root 11241100x8000000000000000539976Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:17.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c581de22afe614992021-12-21 11:33:17.443root 11241100x8000000000000000539977Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:17.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.36eaf237d8d7e5642021-12-21 11:33:17.443root 11241100x8000000000000000539978Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:17.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3d5a094be5431f2e2021-12-21 11:33:17.444root 11241100x8000000000000000539979Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:17.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.87ec7087620416682021-12-21 11:33:17.444root 11241100x8000000000000000539980Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:17.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7e0600131b04925d2021-12-21 11:33:17.444root 11241100x8000000000000000539981Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:17.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5c3d616f56f99c212021-12-21 11:33:17.444root 11241100x8000000000000000539982Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:17.942{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7919d451cc37537d2021-12-21 11:33:17.942root 11241100x8000000000000000539983Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:17.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e34b9e9fe15648d82021-12-21 11:33:17.943root 11241100x8000000000000000539984Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:17.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f9f1c7d43ece83352021-12-21 11:33:17.943root 11241100x8000000000000000539985Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:17.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.bb289289352a8e4d2021-12-21 11:33:17.943root 11241100x8000000000000000539986Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:17.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7ca12e86bcbccc302021-12-21 11:33:17.943root 11241100x8000000000000000539987Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:17.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.dc9c9690b35e0a122021-12-21 11:33:17.943root 11241100x8000000000000000539988Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:17.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.24caa97bec3b7d742021-12-21 11:33:17.943root 11241100x8000000000000000539989Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:17.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.87b79aa3f488b8c92021-12-21 11:33:17.944root 11241100x8000000000000000539990Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:17.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7fc516d3d0a131902021-12-21 11:33:17.944root 11241100x8000000000000000539991Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:17.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0843fe4b6d513d2a2021-12-21 11:33:17.944root 11241100x8000000000000000539992Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:17.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.36f7c16c532a50382021-12-21 11:33:17.944root 11241100x8000000000000000539993Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:17.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a92aea4d4f78b97b2021-12-21 11:33:17.944root 11241100x8000000000000000539994Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:18.442{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7174f2610055e98c2021-12-21 11:33:18.442root 11241100x8000000000000000539995Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:18.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3598c336b98b87792021-12-21 11:33:18.443root 11241100x8000000000000000539996Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:18.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f19fbbc7baa4d5132021-12-21 11:33:18.443root 11241100x8000000000000000539997Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:18.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3f0710aff34478242021-12-21 11:33:18.443root 11241100x8000000000000000539998Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:18.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0c736929443fe85c2021-12-21 11:33:18.443root 11241100x8000000000000000539999Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:18.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d172d6d2a0f8786a2021-12-21 11:33:18.443root 11241100x8000000000000000540000Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:18.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b5ddb4f4b13f70522021-12-21 11:33:18.443root 11241100x8000000000000000540001Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:18.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.10fae9cf7f6567662021-12-21 11:33:18.443root 11241100x8000000000000000540002Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:18.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.708f26ff20d933752021-12-21 11:33:18.443root 11241100x8000000000000000540003Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:18.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.26312832eecd8e1b2021-12-21 11:33:18.443root 11241100x8000000000000000540004Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:18.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.522c2e5da0555b9f2021-12-21 11:33:18.443root 11241100x8000000000000000540005Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:18.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.238f2f76e20b52092021-12-21 11:33:18.443root 11241100x8000000000000000540006Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:18.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4cc2b5296aec807f2021-12-21 11:33:18.943root 11241100x8000000000000000540007Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:18.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ea2dabbfdad753022021-12-21 11:33:18.943root 11241100x8000000000000000540008Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:18.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.39cacc5336b9b2fd2021-12-21 11:33:18.943root 11241100x8000000000000000540009Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:18.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8e81f42e64d40bd72021-12-21 11:33:18.943root 11241100x8000000000000000540010Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:18.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.42b8828f09592f752021-12-21 11:33:18.943root 11241100x8000000000000000540011Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:18.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.223dae2187f99b982021-12-21 11:33:18.943root 11241100x8000000000000000540012Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:18.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a047a4d50f31a9432021-12-21 11:33:18.944root 11241100x8000000000000000540013Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:18.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.11a720936bd571ee2021-12-21 11:33:18.944root 11241100x8000000000000000540014Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:18.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b2e2ba9561ce07bd2021-12-21 11:33:18.944root 11241100x8000000000000000540015Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:18.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.858a11deb6db1d532021-12-21 11:33:18.944root 11241100x8000000000000000540016Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:18.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.28195cc56cbfc9bf2021-12-21 11:33:18.944root 11241100x8000000000000000540017Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:18.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b21696c6a96c4d182021-12-21 11:33:18.944root 11241100x8000000000000000540018Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:19.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.41fb1a6f8f61a8f62021-12-21 11:33:19.443root 11241100x8000000000000000540019Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:19.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f5f0947e5265ebeb2021-12-21 11:33:19.443root 11241100x8000000000000000540020Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:19.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.88fc6c79a843cbeb2021-12-21 11:33:19.443root 11241100x8000000000000000540021Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:19.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1f3bb9d454d2badd2021-12-21 11:33:19.443root 11241100x8000000000000000540022Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:19.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f14fd0e79594160a2021-12-21 11:33:19.443root 11241100x8000000000000000540023Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:19.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.57714d30ca267c852021-12-21 11:33:19.443root 11241100x8000000000000000540024Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:19.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.45e64d5af79938832021-12-21 11:33:19.443root 11241100x8000000000000000540025Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:19.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.791243cb20efecef2021-12-21 11:33:19.444root 11241100x8000000000000000540026Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:19.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f2b61798545c79442021-12-21 11:33:19.444root 11241100x8000000000000000540027Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:19.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e504b1f7ae5892b52021-12-21 11:33:19.444root 11241100x8000000000000000540028Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:19.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.338dcc746d9ec58f2021-12-21 11:33:19.444root 11241100x8000000000000000540029Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:19.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.751fef19110c88462021-12-21 11:33:19.444root 11241100x8000000000000000540030Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:19.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.244e2edb8243003f2021-12-21 11:33:19.943root 11241100x8000000000000000540031Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:19.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.94c85bc975b85dd52021-12-21 11:33:19.943root 11241100x8000000000000000540032Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:19.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.244aa559ad9fec6f2021-12-21 11:33:19.943root 11241100x8000000000000000540033Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:19.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8ed89f4f83f082b82021-12-21 11:33:19.943root 11241100x8000000000000000540034Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:19.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c7c1756e4ffd9ad32021-12-21 11:33:19.943root 11241100x8000000000000000540035Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:19.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6fb0ad876907b4522021-12-21 11:33:19.943root 11241100x8000000000000000540036Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:19.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8e7a6a58c099d26c2021-12-21 11:33:19.943root 11241100x8000000000000000540037Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:19.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f88a4ba17996721e2021-12-21 11:33:19.943root 11241100x8000000000000000540038Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:19.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.571abbbf1231fc1a2021-12-21 11:33:19.943root 11241100x8000000000000000540039Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:19.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b7c60dc699c41b9d2021-12-21 11:33:19.944root 11241100x8000000000000000540040Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:19.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8fa6493cb048ef7a2021-12-21 11:33:19.944root 11241100x8000000000000000540041Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:19.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5edfbe89e9e77f972021-12-21 11:33:19.944root 11241100x8000000000000000540042Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:20.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.690a4924aa7145c62021-12-21 11:33:20.443root 11241100x8000000000000000540043Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:20.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e6a099038808016f2021-12-21 11:33:20.443root 11241100x8000000000000000540044Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:20.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1aa0d0cd8acb28422021-12-21 11:33:20.443root 11241100x8000000000000000540045Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:20.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c738e5342eba40822021-12-21 11:33:20.443root 11241100x8000000000000000540046Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:20.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.84dcc7e8c67b16302021-12-21 11:33:20.443root 11241100x8000000000000000540047Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:20.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b318f546211ad0422021-12-21 11:33:20.443root 11241100x8000000000000000540048Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:20.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.277d87c96abd4e7a2021-12-21 11:33:20.443root 11241100x8000000000000000540049Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:20.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a963b77e455189b72021-12-21 11:33:20.443root 11241100x8000000000000000540050Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:20.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b575a10d5089a54f2021-12-21 11:33:20.443root 11241100x8000000000000000540051Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:20.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.36fa13483fee71372021-12-21 11:33:20.443root 11241100x8000000000000000540052Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:20.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b6502dab13040fb02021-12-21 11:33:20.444root 11241100x8000000000000000540053Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:20.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.414eb69adf955c6e2021-12-21 11:33:20.444root 11241100x8000000000000000540054Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:20.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.84f8e6b30e52c61b2021-12-21 11:33:20.943root 11241100x8000000000000000540055Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:20.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5eb468cc03902f222021-12-21 11:33:20.943root 11241100x8000000000000000540056Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:20.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a522c4e297b5f4a72021-12-21 11:33:20.943root 11241100x8000000000000000540057Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:20.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9bb648de19d071102021-12-21 11:33:20.943root 11241100x8000000000000000540058Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:20.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.56106b8e90cdfaee2021-12-21 11:33:20.943root 11241100x8000000000000000540059Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:20.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4ca43c524512bb082021-12-21 11:33:20.943root 11241100x8000000000000000540060Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:20.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e0bdbd7a70145ac82021-12-21 11:33:20.943root 11241100x8000000000000000540061Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:20.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c0a3422cf607dc4a2021-12-21 11:33:20.943root 11241100x8000000000000000540062Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:20.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.99abbf8e23ce34832021-12-21 11:33:20.943root 11241100x8000000000000000540063Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:20.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.773fdd4211c5b91e2021-12-21 11:33:20.944root 11241100x8000000000000000540064Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:20.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f1d767e237e68c942021-12-21 11:33:20.944root 11241100x8000000000000000540065Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:20.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ea1410c4a8f01eda2021-12-21 11:33:20.944root 354300x8000000000000000540066Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:21.202{ec2b6afe-95d9-61c1-5175-3a0400000000}5346/opt/splunkforwarder/etc/apps/Splunk_TA_stream/linux_x86_64/bin/streamfwdroottcptruefalse10.0.1.25-48714-false10.0.1.12-8000- 11241100x8000000000000000540067Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:21.203{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.199b9f9b58e13ada2021-12-21 11:33:21.203root 11241100x8000000000000000540068Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:21.203{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8159cb03e0325c352021-12-21 11:33:21.203root 11241100x8000000000000000540069Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:21.203{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e3f32e9ee648a4872021-12-21 11:33:21.203root 11241100x8000000000000000540070Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:21.203{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.92b78273afa87e0e2021-12-21 11:33:21.203root 11241100x8000000000000000540071Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:21.203{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b547e9c633c64a8b2021-12-21 11:33:21.203root 11241100x8000000000000000540072Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:21.203{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9ea8a65686ddebac2021-12-21 11:33:21.203root 11241100x8000000000000000540073Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:21.203{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2870da2672f549cc2021-12-21 11:33:21.203root 11241100x8000000000000000540074Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:21.203{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a62eae6c07e755f42021-12-21 11:33:21.203root 11241100x8000000000000000540075Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:21.203{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d06c02be521549f32021-12-21 11:33:21.203root 11241100x8000000000000000540076Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:21.203{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e81d75535edfdb682021-12-21 11:33:21.203root 11241100x8000000000000000540077Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:21.204{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f46bb6902bdffb6e2021-12-21 11:33:21.204root 11241100x8000000000000000540078Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:21.204{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.43eb87e56c038fe32021-12-21 11:33:21.204root 11241100x8000000000000000540079Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:21.204{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.520f1dceca7421782021-12-21 11:33:21.204root 11241100x8000000000000000540080Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:21.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3f18cb6889e17fd32021-12-21 11:33:21.693root 11241100x8000000000000000540081Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:21.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.85ea2d926b5214e22021-12-21 11:33:21.693root 11241100x8000000000000000540082Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:21.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a87502a34dfdfcdb2021-12-21 11:33:21.693root 11241100x8000000000000000540083Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:21.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.90250f286c69810d2021-12-21 11:33:21.693root 11241100x8000000000000000540084Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:21.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f52ea29fb525f8942021-12-21 11:33:21.693root 11241100x8000000000000000540085Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:21.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.338668674c5f41572021-12-21 11:33:21.693root 11241100x8000000000000000540086Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:21.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.75cea7fc52921e6b2021-12-21 11:33:21.693root 11241100x8000000000000000540087Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:21.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.23db2bd1c35581112021-12-21 11:33:21.693root 11241100x8000000000000000540088Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:21.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.70cd6ad664afce9d2021-12-21 11:33:21.693root 11241100x8000000000000000540089Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:21.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2b7fd5b71d581ce02021-12-21 11:33:21.694root 11241100x8000000000000000540090Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:21.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.07c03c860e092d432021-12-21 11:33:21.694root 11241100x8000000000000000540091Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:21.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a29ddb2de2059dc72021-12-21 11:33:21.694root 11241100x8000000000000000540092Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:21.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9fca1cd57376c0292021-12-21 11:33:21.694root 154100x8000000000000000540093Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:21.976{ec2b6afe-bb81-61c1-6854-39722c560000}9890/bin/ps-----ps -e -o pid,ppid,state,command/var/snap/amazon-ssm-agent/4046root{ec2b6afe-0000-0000-0000-000000000000}04294967295no level-{00000000-0000-0000-0000-000000000000}2319--- 11241100x8000000000000000540094Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:21.977{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.449b9a440a49a1162021-12-21 11:33:21.977root 11241100x8000000000000000540095Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:21.978{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.567f41c4a46ca39b2021-12-21 11:33:21.978root 11241100x8000000000000000540096Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:21.978{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5409a341cb3ac8632021-12-21 11:33:21.978root 11241100x8000000000000000540097Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:21.978{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.159c0470d831c55f2021-12-21 11:33:21.978root 11241100x8000000000000000540098Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:21.979{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.785cf12f71c076de2021-12-21 11:33:21.979root 11241100x8000000000000000540099Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:21.979{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7ba4929ffb165a2e2021-12-21 11:33:21.979root 11241100x8000000000000000540100Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:21.979{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f6634102c47296872021-12-21 11:33:21.979root 11241100x8000000000000000540101Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:21.979{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3c775d4b7e1ef5552021-12-21 11:33:21.979root 11241100x8000000000000000540102Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:21.979{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.424e2ee8da360e9c2021-12-21 11:33:21.979root 11241100x8000000000000000540103Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:21.979{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.eb2b259e00f9b5012021-12-21 11:33:21.979root 11241100x8000000000000000540104Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:21.979{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6944be75eb4380ab2021-12-21 11:33:21.979root 11241100x8000000000000000540105Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:21.980{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d80f0c4a81009b0c2021-12-21 11:33:21.980root 11241100x8000000000000000540106Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:21.980{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.eda6c5d8e9b19a1f2021-12-21 11:33:21.980root 534500x8000000000000000540107Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:22.000{ec2b6afe-bb81-61c1-6854-39722c560000}9890/bin/psroot 11241100x8000000000000000540108Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:22.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.033d4525a616b8842021-12-21 11:33:22.443root 11241100x8000000000000000540109Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:22.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.bd699d994319e2af2021-12-21 11:33:22.443root 11241100x8000000000000000540110Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:22.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.77490653128ef9f72021-12-21 11:33:22.443root 11241100x8000000000000000540111Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:22.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.604e866aa3acba232021-12-21 11:33:22.443root 11241100x8000000000000000540112Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:22.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2f241725d7dda25e2021-12-21 11:33:22.444root 11241100x8000000000000000540113Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:22.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.33990c6bb8dad7862021-12-21 11:33:22.444root 11241100x8000000000000000540114Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:22.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d7f0dfa7ed8464d72021-12-21 11:33:22.444root 11241100x8000000000000000540115Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:22.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ca216b5e862747032021-12-21 11:33:22.444root 11241100x8000000000000000540116Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:22.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.065d51e25cd5d0172021-12-21 11:33:22.444root 11241100x8000000000000000540117Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:22.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ef8eaa78233f1e752021-12-21 11:33:22.444root 11241100x8000000000000000540118Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:22.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.dbf280da9665ff3f2021-12-21 11:33:22.444root 11241100x8000000000000000540119Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:22.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9e34ae85fe3376392021-12-21 11:33:22.444root 11241100x8000000000000000540120Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:22.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.25955ba5da7e5a492021-12-21 11:33:22.444root 11241100x8000000000000000540121Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:22.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.42b0c286b072475a2021-12-21 11:33:22.445root 11241100x8000000000000000540122Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:22.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e5b99258de59042f2021-12-21 11:33:22.445root 11241100x8000000000000000540123Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:22.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5f9fdb4e3fa7ee742021-12-21 11:33:22.943root 11241100x8000000000000000540124Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:22.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0fd4ca76f1e6c7cc2021-12-21 11:33:22.943root 11241100x8000000000000000540125Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:22.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.66429992061dd4032021-12-21 11:33:22.943root 11241100x8000000000000000540126Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:22.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.dfa64857d81fde6d2021-12-21 11:33:22.943root 11241100x8000000000000000540127Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:22.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4e17ddc5faea9d3c2021-12-21 11:33:22.943root 11241100x8000000000000000540128Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:22.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.68ac1ffc9226e9422021-12-21 11:33:22.943root 11241100x8000000000000000540129Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:22.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.235d2cc74d36c2df2021-12-21 11:33:22.944root 11241100x8000000000000000540130Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:22.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4704cbce62a75b162021-12-21 11:33:22.944root 11241100x8000000000000000540131Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:22.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f909ed2887a298502021-12-21 11:33:22.944root 11241100x8000000000000000540132Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:22.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1304e1886ffd94602021-12-21 11:33:22.944root 11241100x8000000000000000540133Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:22.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2fa235e46c811c322021-12-21 11:33:22.944root 11241100x8000000000000000540134Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:22.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c4e8b2b137f285162021-12-21 11:33:22.944root 11241100x8000000000000000540135Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:22.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ca7f5bba90dd412e2021-12-21 11:33:22.944root 11241100x8000000000000000540136Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:22.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a6c2f1e633d82e9b2021-12-21 11:33:22.944root 11241100x8000000000000000540137Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:22.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.79d6130a38bb9ae72021-12-21 11:33:22.944root 11241100x8000000000000000540138Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:23.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.14e2976ec9f3227d2021-12-21 11:33:23.443root 11241100x8000000000000000540139Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:23.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b899cc2abf526b7d2021-12-21 11:33:23.443root 11241100x8000000000000000540140Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:23.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.14463b137f2caef32021-12-21 11:33:23.443root 11241100x8000000000000000540141Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:23.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.67d1decf145f61712021-12-21 11:33:23.443root 11241100x8000000000000000540142Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:23.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.83ece2cdbc21a0be2021-12-21 11:33:23.443root 11241100x8000000000000000540143Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:23.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3fdb705207b2a3022021-12-21 11:33:23.444root 11241100x8000000000000000540144Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:23.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0230bcc3eacd6b692021-12-21 11:33:23.444root 11241100x8000000000000000540145Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:23.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.59395edaab3566fe2021-12-21 11:33:23.444root 11241100x8000000000000000540146Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:23.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7774cc7ee3ddad042021-12-21 11:33:23.444root 11241100x8000000000000000540147Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:23.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.33df2112ee5d24082021-12-21 11:33:23.444root 11241100x8000000000000000540148Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:23.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.45bf27be7293ef142021-12-21 11:33:23.444root 11241100x8000000000000000540149Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:23.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.399fac6fb8e7bae02021-12-21 11:33:23.444root 11241100x8000000000000000540150Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:23.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d49031a8f0be5fdc2021-12-21 11:33:23.444root 11241100x8000000000000000540151Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:23.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.59cc15b9eb4a57fa2021-12-21 11:33:23.444root 11241100x8000000000000000540152Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:23.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1b8d216f5073592c2021-12-21 11:33:23.445root 11241100x8000000000000000540153Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:23.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a95e7988a5c37f052021-12-21 11:33:23.943root 11241100x8000000000000000540154Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:23.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a06db74f763881812021-12-21 11:33:23.943root 11241100x8000000000000000540155Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:23.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9239d4f5de45b9582021-12-21 11:33:23.943root 11241100x8000000000000000540156Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:23.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5cda9cad308dec892021-12-21 11:33:23.943root 11241100x8000000000000000540157Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:23.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8db6bb61fcb9d47e2021-12-21 11:33:23.943root 11241100x8000000000000000540158Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:23.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4fa43a2bf29a054a2021-12-21 11:33:23.944root 11241100x8000000000000000540159Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:23.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a1828f787013d7392021-12-21 11:33:23.944root 11241100x8000000000000000540160Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:23.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0599ef457680e34c2021-12-21 11:33:23.944root 11241100x8000000000000000540161Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:23.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9477a04051dac00b2021-12-21 11:33:23.944root 11241100x8000000000000000540162Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:23.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d3c1a782721225b22021-12-21 11:33:23.944root 11241100x8000000000000000540163Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:23.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f9149d6219b7a3af2021-12-21 11:33:23.944root 11241100x8000000000000000540164Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:23.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9e2aceb1fa50c8bd2021-12-21 11:33:23.944root 11241100x8000000000000000540165Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:23.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8106f2c603712b0c2021-12-21 11:33:23.944root 11241100x8000000000000000540166Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:23.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.446ebea3bb1282da2021-12-21 11:33:23.944root 11241100x8000000000000000540167Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:23.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.fc9d0c0372f8af662021-12-21 11:33:23.944root 11241100x8000000000000000540168Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:24.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ee17e7308c5b73f82021-12-21 11:33:24.443root 11241100x8000000000000000540169Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:24.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f36803aa3e8f8e612021-12-21 11:33:24.443root 11241100x8000000000000000540170Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:24.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.017cbd622b373c0e2021-12-21 11:33:24.443root 11241100x8000000000000000540171Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:24.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1d2c95fb009abf0e2021-12-21 11:33:24.443root 11241100x8000000000000000540172Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:24.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b4d405d426bb63782021-12-21 11:33:24.443root 11241100x8000000000000000540173Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:24.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ef4903a98e11943d2021-12-21 11:33:24.444root 11241100x8000000000000000540174Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:24.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.cabc8be8d2b7e21d2021-12-21 11:33:24.444root 11241100x8000000000000000540175Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:24.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a6fc681ecbdb86022021-12-21 11:33:24.444root 11241100x8000000000000000540176Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:24.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.de3e9a9844740c082021-12-21 11:33:24.444root 11241100x8000000000000000540177Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:24.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.47bd1401f63af9b32021-12-21 11:33:24.444root 11241100x8000000000000000540178Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:24.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c2d7dde59a3a62c42021-12-21 11:33:24.444root 11241100x8000000000000000540179Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:24.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.71d4e2a87115eb4f2021-12-21 11:33:24.444root 11241100x8000000000000000540180Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:24.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8140e1aaf70a6e062021-12-21 11:33:24.444root 11241100x8000000000000000540181Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:24.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2dcf7829b49e3dd42021-12-21 11:33:24.444root 11241100x8000000000000000540182Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:24.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ae0b41648723835d2021-12-21 11:33:24.445root 11241100x8000000000000000540183Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:24.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2f36a95587f5abc12021-12-21 11:33:24.943root 11241100x8000000000000000540184Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:24.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9169951b8f3de9122021-12-21 11:33:24.943root 11241100x8000000000000000540185Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:24.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.569924e40e28b7362021-12-21 11:33:24.943root 11241100x8000000000000000540186Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:24.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.460c102e806599b02021-12-21 11:33:24.943root 11241100x8000000000000000540187Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:24.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1f52a7b586e2f2602021-12-21 11:33:24.943root 11241100x8000000000000000540188Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:24.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ccbf464617c875fc2021-12-21 11:33:24.943root 11241100x8000000000000000540189Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:24.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.16569a764c5fb6942021-12-21 11:33:24.943root 11241100x8000000000000000540190Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:24.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2b178d744a9a1f3c2021-12-21 11:33:24.944root 11241100x8000000000000000540191Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:24.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.49feb7a05f7815bb2021-12-21 11:33:24.944root 11241100x8000000000000000540192Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:24.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.aa2dfa1f15fadf7b2021-12-21 11:33:24.944root 11241100x8000000000000000540193Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:24.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.30b83c9bcf23c9312021-12-21 11:33:24.944root 11241100x8000000000000000540194Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:24.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e0f3af67098607632021-12-21 11:33:24.944root 11241100x8000000000000000540195Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:24.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.eab5f76a345dc2d72021-12-21 11:33:24.944root 11241100x8000000000000000540196Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:24.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f414723e991d83d82021-12-21 11:33:24.944root 11241100x8000000000000000540197Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:24.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c8ecc515c0fee39b2021-12-21 11:33:24.944root 11241100x8000000000000000540198Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:25.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a840f797862b1a852021-12-21 11:33:25.443root 11241100x8000000000000000540199Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:25.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.da7af25d54afe13c2021-12-21 11:33:25.443root 11241100x8000000000000000540200Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:25.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d95ecbbe03daf7082021-12-21 11:33:25.443root 11241100x8000000000000000540201Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:25.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0dbe02993e1e8ed92021-12-21 11:33:25.443root 11241100x8000000000000000540202Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:25.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c67b9cabd8c4f54b2021-12-21 11:33:25.443root 11241100x8000000000000000540203Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:25.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d0b68d189d6933192021-12-21 11:33:25.443root 11241100x8000000000000000540204Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:25.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2c988b47933866862021-12-21 11:33:25.443root 11241100x8000000000000000540205Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:25.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.31e075624f8bc5662021-12-21 11:33:25.444root 11241100x8000000000000000540206Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:25.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b6a79e068583465b2021-12-21 11:33:25.444root 11241100x8000000000000000540207Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:25.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a70db963dc54c75b2021-12-21 11:33:25.444root 11241100x8000000000000000540208Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:25.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.bdd131d78c16b7252021-12-21 11:33:25.444root 11241100x8000000000000000540209Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:25.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.bce27449151cdc052021-12-21 11:33:25.444root 11241100x8000000000000000540210Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:25.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.32f3f98c462257632021-12-21 11:33:25.444root 11241100x8000000000000000540211Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:25.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.053a6d7cdc442fe92021-12-21 11:33:25.444root 11241100x8000000000000000540212Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:25.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.df92ef6911ea65032021-12-21 11:33:25.444root 354300x8000000000000000540213Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:25.491{ec2b6afe-95d2-61c1-3038-b84203560000}5272/opt/splunkforwarder/bin/splunkdroottcptruefalse10.0.1.25-35780-false10.0.1.12-8089- 11241100x8000000000000000540214Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:25.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4debd324da00b9292021-12-21 11:33:25.943root 11241100x8000000000000000540215Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:25.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.78a49f5d1faf3b902021-12-21 11:33:25.943root 11241100x8000000000000000540216Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:25.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8fbb004e1e48a9e52021-12-21 11:33:25.943root 11241100x8000000000000000540217Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:25.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9a8ed7eafbe865d02021-12-21 11:33:25.943root 11241100x8000000000000000540218Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:25.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b2172301330ad5ca2021-12-21 11:33:25.943root 11241100x8000000000000000540219Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:25.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.05c850589c38ede42021-12-21 11:33:25.943root 11241100x8000000000000000540220Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:25.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b7a3146aa5a699952021-12-21 11:33:25.944root 11241100x8000000000000000540221Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:25.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.cbc5649feb5237582021-12-21 11:33:25.944root 11241100x8000000000000000540222Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:25.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1388aec6da37fa682021-12-21 11:33:25.944root 11241100x8000000000000000540223Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:25.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.762e951e9aef86062021-12-21 11:33:25.944root 11241100x8000000000000000540224Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:25.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b4e47e2ed525969d2021-12-21 11:33:25.944root 11241100x8000000000000000540225Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:25.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.11564b793fac0ce02021-12-21 11:33:25.944root 11241100x8000000000000000540226Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:25.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f8ffb4f2bf3de9062021-12-21 11:33:25.944root 11241100x8000000000000000540227Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:25.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.595afc6dd2a334ee2021-12-21 11:33:25.944root 11241100x8000000000000000540228Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:25.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c194783289d4b6a42021-12-21 11:33:25.944root 11241100x8000000000000000540229Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:25.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.37fa761c7919f7472021-12-21 11:33:25.944root 11241100x8000000000000000540230Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:26.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.47cc88cd85caf2092021-12-21 11:33:26.443root 11241100x8000000000000000540231Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:26.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d0a26659c52c66ee2021-12-21 11:33:26.443root 11241100x8000000000000000540232Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:26.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e0921825664e52f32021-12-21 11:33:26.443root 11241100x8000000000000000540233Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:26.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8bb4d0ef8f8b3e1c2021-12-21 11:33:26.443root 11241100x8000000000000000540234Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:26.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.80ca4592452d59e42021-12-21 11:33:26.443root 11241100x8000000000000000540235Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:26.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.97b6debc81e7f7e52021-12-21 11:33:26.443root 11241100x8000000000000000540236Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:26.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.28d46a9b5687e4bd2021-12-21 11:33:26.443root 11241100x8000000000000000540237Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:26.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ac5c25e92ad2dc182021-12-21 11:33:26.444root 11241100x8000000000000000540238Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:26.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.843e99333fbe4e1d2021-12-21 11:33:26.444root 11241100x8000000000000000540239Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:26.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4a6505a3022680d52021-12-21 11:33:26.444root 11241100x8000000000000000540240Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:26.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ed901f7346266f952021-12-21 11:33:26.444root 11241100x8000000000000000540241Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:26.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.108899c4381fddd12021-12-21 11:33:26.444root 11241100x8000000000000000540242Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:26.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4724a795b5f6eb752021-12-21 11:33:26.444root 11241100x8000000000000000540243Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:26.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.47154ba0cb715fda2021-12-21 11:33:26.444root 11241100x8000000000000000540244Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:26.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5dd285e02dc2aee72021-12-21 11:33:26.444root 11241100x8000000000000000540245Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:26.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.065be762d615a9042021-12-21 11:33:26.444root 11241100x8000000000000000540246Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:26.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d423a432af327e292021-12-21 11:33:26.943root 11241100x8000000000000000540247Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:26.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9106c9cbee8e838b2021-12-21 11:33:26.943root 11241100x8000000000000000540248Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:26.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ff4340a539280a7b2021-12-21 11:33:26.943root 11241100x8000000000000000540249Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:26.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.dfe66b6a74b63f5f2021-12-21 11:33:26.943root 11241100x8000000000000000540250Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:26.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.54d36159ceba6e102021-12-21 11:33:26.943root 11241100x8000000000000000540251Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:26.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0de056739819f1012021-12-21 11:33:26.943root 11241100x8000000000000000540252Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:26.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.455848251f3a9c192021-12-21 11:33:26.943root 11241100x8000000000000000540253Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:26.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5f279ebc61571e062021-12-21 11:33:26.944root 11241100x8000000000000000540254Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:26.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.17091f0e0e06e0822021-12-21 11:33:26.944root 11241100x8000000000000000540255Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:26.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.701900332740b9b32021-12-21 11:33:26.944root 11241100x8000000000000000540256Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:26.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.fdc6c84e66f97cfe2021-12-21 11:33:26.944root 11241100x8000000000000000540257Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:26.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.13e720d3623279d72021-12-21 11:33:26.944root 11241100x8000000000000000540258Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:26.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d8146cec021229a62021-12-21 11:33:26.944root 11241100x8000000000000000540259Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:26.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.41c34d45d22f9d002021-12-21 11:33:26.944root 11241100x8000000000000000540260Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:26.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a6defa8cc1c92ddd2021-12-21 11:33:26.944root 11241100x8000000000000000540261Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:26.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5cf0b536c74aa5202021-12-21 11:33:26.944root 354300x8000000000000000540262Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:27.106{ec2b6afe-95d9-61c1-5175-3a0400000000}5346/opt/splunkforwarder/etc/apps/Splunk_TA_stream/linux_x86_64/bin/streamfwdroottcptruefalse10.0.1.25-48718-false10.0.1.12-8000- 11241100x8000000000000000540263Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:27.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.66120a5e155b51762021-12-21 11:33:27.443root 11241100x8000000000000000540264Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:27.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.42e1b88fae74ae6f2021-12-21 11:33:27.443root 11241100x8000000000000000540265Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:27.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0fdd412768d67d512021-12-21 11:33:27.443root 11241100x8000000000000000540266Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:27.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.32ac18b8b6d7fbe02021-12-21 11:33:27.443root 11241100x8000000000000000540267Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:27.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8a251b06db5cd7b22021-12-21 11:33:27.443root 11241100x8000000000000000540268Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:27.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ea5f1c14a3abf5522021-12-21 11:33:27.444root 11241100x8000000000000000540269Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:27.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.89586376cea12ac92021-12-21 11:33:27.444root 11241100x8000000000000000540270Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:27.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.169bf9926e664bff2021-12-21 11:33:27.444root 11241100x8000000000000000540271Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:27.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8e3d06d0759e06092021-12-21 11:33:27.444root 11241100x8000000000000000540272Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:27.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9b68c3078ee6fabf2021-12-21 11:33:27.444root 11241100x8000000000000000540273Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:27.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.60a850b51ba0df472021-12-21 11:33:27.444root 11241100x8000000000000000540274Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:27.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.aff68b44d2af911b2021-12-21 11:33:27.444root 11241100x8000000000000000540275Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:27.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7048c87deaf3c3612021-12-21 11:33:27.444root 11241100x8000000000000000540276Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:27.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.bbb637e3dc63c3292021-12-21 11:33:27.444root 11241100x8000000000000000540277Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:27.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.95f46e6a6570b9752021-12-21 11:33:27.444root 11241100x8000000000000000540278Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:27.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.78de2d37d6de627b2021-12-21 11:33:27.444root 11241100x8000000000000000540279Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:27.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.962efbd1c4380fcf2021-12-21 11:33:27.444root 11241100x8000000000000000540280Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:27.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e24c5824e8d75ca12021-12-21 11:33:27.943root 11241100x8000000000000000540281Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:27.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.726f1eef45630af92021-12-21 11:33:27.943root 11241100x8000000000000000540282Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:27.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1b6a7f247db60d7c2021-12-21 11:33:27.943root 11241100x8000000000000000540283Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:27.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.58c05ca4e6b791122021-12-21 11:33:27.943root 11241100x8000000000000000540284Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:27.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.bc94d20f5568a6a02021-12-21 11:33:27.943root 11241100x8000000000000000540285Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:27.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b392665e1a66d81a2021-12-21 11:33:27.944root 11241100x8000000000000000540286Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:27.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.bcfb0a34ff960f642021-12-21 11:33:27.944root 11241100x8000000000000000540287Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:27.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.56b5b47063522cba2021-12-21 11:33:27.944root 11241100x8000000000000000540288Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:27.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.af474a8180cd153d2021-12-21 11:33:27.944root 11241100x8000000000000000540289Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:27.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5aec329ef3b4eddf2021-12-21 11:33:27.944root 11241100x8000000000000000540290Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:27.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.df4e15c557cce4ae2021-12-21 11:33:27.944root 11241100x8000000000000000540291Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:27.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.98664082016e7eb12021-12-21 11:33:27.944root 11241100x8000000000000000540292Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:27.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.490387f0654bf98c2021-12-21 11:33:27.944root 11241100x8000000000000000540293Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:27.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.29651fe5ee61b6012021-12-21 11:33:27.944root 11241100x8000000000000000540294Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:27.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1bb63d86356d62332021-12-21 11:33:27.944root 11241100x8000000000000000540295Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:27.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.db4905715a7928602021-12-21 11:33:27.944root 11241100x8000000000000000540296Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:27.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8518ae1249a634b42021-12-21 11:33:27.944root 11241100x8000000000000000540297Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:28.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8537c6728f8717cf2021-12-21 11:33:28.443root 11241100x8000000000000000540298Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:28.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b76e4653d58c007a2021-12-21 11:33:28.443root 11241100x8000000000000000540299Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:28.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b4445efcc214741a2021-12-21 11:33:28.443root 11241100x8000000000000000540300Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:28.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9fd59ad9c40f6fa72021-12-21 11:33:28.443root 11241100x8000000000000000540301Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:28.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.18168a36836dc64b2021-12-21 11:33:28.444root 11241100x8000000000000000540302Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:28.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.94742414e0c250d52021-12-21 11:33:28.444root 11241100x8000000000000000540303Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:28.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5127bbb3b54b7e952021-12-21 11:33:28.444root 11241100x8000000000000000540304Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:28.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.90243631656f32d42021-12-21 11:33:28.444root 11241100x8000000000000000540305Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:28.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ed33c777734bb43f2021-12-21 11:33:28.444root 11241100x8000000000000000540306Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:28.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.77476ae21c32115a2021-12-21 11:33:28.444root 11241100x8000000000000000540307Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:28.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.fa905b3cd5c48d6c2021-12-21 11:33:28.444root 11241100x8000000000000000540308Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:28.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.704117b7071ae7672021-12-21 11:33:28.444root 11241100x8000000000000000540309Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:28.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ce57bc86f06fb82d2021-12-21 11:33:28.444root 11241100x8000000000000000540310Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:28.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e446f10d37ff7d9e2021-12-21 11:33:28.444root 11241100x8000000000000000540311Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:28.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.41d9abf351b336012021-12-21 11:33:28.444root 11241100x8000000000000000540312Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:28.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c52ceea100e8f2572021-12-21 11:33:28.444root 11241100x8000000000000000540313Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:28.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.63ec60bd26d03f4d2021-12-21 11:33:28.444root 11241100x8000000000000000540314Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:28.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b049a262958cb1322021-12-21 11:33:28.943root 11241100x8000000000000000540315Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:28.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.004aa14ef2dc59052021-12-21 11:33:28.943root 11241100x8000000000000000540316Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:28.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b228906aec60a2292021-12-21 11:33:28.943root 11241100x8000000000000000540317Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:28.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.fe5e0892e92fd0ee2021-12-21 11:33:28.943root 11241100x8000000000000000540318Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:28.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.fec04e0ea1b498022021-12-21 11:33:28.944root 11241100x8000000000000000540319Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:28.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b7206d57d47ba97f2021-12-21 11:33:28.944root 11241100x8000000000000000540320Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:28.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a223239fc3f2544e2021-12-21 11:33:28.944root 11241100x8000000000000000540321Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:28.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e889959dd7c2d64f2021-12-21 11:33:28.944root 11241100x8000000000000000540322Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:28.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2b5d768a408949712021-12-21 11:33:28.944root 11241100x8000000000000000540323Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:28.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.728de015c71a662b2021-12-21 11:33:28.944root 11241100x8000000000000000540324Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:28.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4262b8a2e12d83042021-12-21 11:33:28.944root 11241100x8000000000000000540325Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:28.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9bd784d96128fc582021-12-21 11:33:28.944root 11241100x8000000000000000540326Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:28.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.26d10b95c7f481c72021-12-21 11:33:28.944root 11241100x8000000000000000540327Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:28.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.917914f24cba68fd2021-12-21 11:33:28.944root 11241100x8000000000000000540328Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:28.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9facaf5397c3743e2021-12-21 11:33:28.944root 11241100x8000000000000000540329Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:28.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8f27bc906aaac8f12021-12-21 11:33:28.944root 11241100x8000000000000000540330Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:28.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.137edfdd256862502021-12-21 11:33:28.944root 11241100x8000000000000000540331Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:29.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2e79433bafa39f422021-12-21 11:33:29.443root 11241100x8000000000000000540332Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:29.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.69439e46612ef5d22021-12-21 11:33:29.443root 11241100x8000000000000000540333Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:29.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6aaf613b135cbbde2021-12-21 11:33:29.443root 11241100x8000000000000000540334Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:29.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.cfb5d7686d4ec8ce2021-12-21 11:33:29.443root 11241100x8000000000000000540335Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:29.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1713163e3619f44e2021-12-21 11:33:29.443root 11241100x8000000000000000540336Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:29.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c8462edaaabdc27b2021-12-21 11:33:29.444root 11241100x8000000000000000540337Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:29.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.985f6ad513a4ab6b2021-12-21 11:33:29.444root 11241100x8000000000000000540338Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:29.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7ca8b85e86a7bea32021-12-21 11:33:29.444root 11241100x8000000000000000540339Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:29.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0cc100aaec99a58c2021-12-21 11:33:29.444root 11241100x8000000000000000540340Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:29.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.837fc8587a60c0612021-12-21 11:33:29.444root 11241100x8000000000000000540341Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:29.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f1289c8bb3f37c1e2021-12-21 11:33:29.444root 11241100x8000000000000000540342Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:29.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.415686627e3168ca2021-12-21 11:33:29.444root 11241100x8000000000000000540343Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:29.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.bdc608761cadc76a2021-12-21 11:33:29.444root 11241100x8000000000000000540344Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:29.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.606e62fc2815f80c2021-12-21 11:33:29.444root 11241100x8000000000000000540345Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:29.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7e879fcd479ba1242021-12-21 11:33:29.444root 11241100x8000000000000000540346Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:29.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.addd94b4cebd868a2021-12-21 11:33:29.444root 11241100x8000000000000000540347Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:29.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1a7698db6840215a2021-12-21 11:33:29.444root 11241100x8000000000000000540348Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:29.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2f16b6c504bf07df2021-12-21 11:33:29.943root 11241100x8000000000000000540349Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:29.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f990045a491ec3282021-12-21 11:33:29.943root 11241100x8000000000000000540350Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:29.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d211e47fbb2787692021-12-21 11:33:29.943root 11241100x8000000000000000540351Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:29.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.91721761069b35842021-12-21 11:33:29.943root 11241100x8000000000000000540352Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:29.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.324724c92e8b101d2021-12-21 11:33:29.943root 11241100x8000000000000000540353Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:29.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.fcd756e2e78ebfe82021-12-21 11:33:29.943root 11241100x8000000000000000540354Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:29.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d74a755ec3b528f12021-12-21 11:33:29.944root 11241100x8000000000000000540355Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:29.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.be648e16f948f23f2021-12-21 11:33:29.944root 11241100x8000000000000000540356Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:29.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0ffe941a5e2eed602021-12-21 11:33:29.944root 11241100x8000000000000000540357Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:29.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.92cd0adf7b57c8002021-12-21 11:33:29.944root 11241100x8000000000000000540358Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:29.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b45f8990b790f4c62021-12-21 11:33:29.944root 11241100x8000000000000000540359Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:29.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.74fcf47497bbb4a42021-12-21 11:33:29.944root 11241100x8000000000000000540360Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:29.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f524028ccd0363f02021-12-21 11:33:29.944root 11241100x8000000000000000540361Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:29.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.90a469669103e7912021-12-21 11:33:29.944root 11241100x8000000000000000540362Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:29.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c4159d55f4f367772021-12-21 11:33:29.944root 11241100x8000000000000000540363Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:29.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f97ee3b2674cfa422021-12-21 11:33:29.944root 11241100x8000000000000000540364Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:29.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6dcb3e5e15a5cb272021-12-21 11:33:29.944root 11241100x8000000000000000540365Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:30.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2aa7b42db64551692021-12-21 11:33:30.443root 11241100x8000000000000000540366Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:30.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.06a9ce25a67d665a2021-12-21 11:33:30.443root 11241100x8000000000000000540367Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:30.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.558fb2f7a0d8321b2021-12-21 11:33:30.443root 11241100x8000000000000000540368Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:30.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5198e0bcaaae78c12021-12-21 11:33:30.443root 11241100x8000000000000000540369Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:30.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.78199e6cc49fb1fa2021-12-21 11:33:30.443root 11241100x8000000000000000540370Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:30.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.34d0549f428f97342021-12-21 11:33:30.444root 11241100x8000000000000000540371Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:30.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e2c25938c739f7b02021-12-21 11:33:30.444root 11241100x8000000000000000540372Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:30.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f1eada37336481fe2021-12-21 11:33:30.444root 11241100x8000000000000000540373Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:30.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.614b5349e8b49fa92021-12-21 11:33:30.444root 11241100x8000000000000000540374Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:30.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d551187c04ce53922021-12-21 11:33:30.444root 11241100x8000000000000000540375Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:30.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.bf07f8753f24363f2021-12-21 11:33:30.444root 11241100x8000000000000000540376Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:30.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ab793d189c8ac7f22021-12-21 11:33:30.444root 11241100x8000000000000000540377Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:30.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.326bdd394eb32e432021-12-21 11:33:30.444root 11241100x8000000000000000540378Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:30.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2079ca98ab2336512021-12-21 11:33:30.444root 11241100x8000000000000000540379Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:30.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.651df1b9ea55e7742021-12-21 11:33:30.444root 11241100x8000000000000000540380Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:30.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b9f21d9fc5fb60de2021-12-21 11:33:30.444root 11241100x8000000000000000540381Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:30.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.04b25bab653a166a2021-12-21 11:33:30.444root 11241100x8000000000000000540382Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:30.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3f1cb2b1c71fac652021-12-21 11:33:30.943root 11241100x8000000000000000540383Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:30.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.df7257bbf34c746b2021-12-21 11:33:30.943root 11241100x8000000000000000540384Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:30.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.cf9d5473796bc4ba2021-12-21 11:33:30.943root 11241100x8000000000000000540385Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:30.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d01b0cb07c0372122021-12-21 11:33:30.943root 11241100x8000000000000000540386Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:30.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b263be804ab937a92021-12-21 11:33:30.944root 11241100x8000000000000000540387Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:30.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b809b4fc0afec4d72021-12-21 11:33:30.944root 11241100x8000000000000000540388Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:30.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f56957ed25bddcad2021-12-21 11:33:30.944root 11241100x8000000000000000540389Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:30.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.009f416933265bf72021-12-21 11:33:30.944root 11241100x8000000000000000540390Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:30.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4981e7087ec93ec02021-12-21 11:33:30.944root 11241100x8000000000000000540391Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:30.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8c4b95f152302dcf2021-12-21 11:33:30.944root 11241100x8000000000000000540392Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:30.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.dcbe121d5320de782021-12-21 11:33:30.944root 11241100x8000000000000000540393Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:30.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.75b0fc1bb7ceca592021-12-21 11:33:30.944root 11241100x8000000000000000540394Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:30.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e1f5c4231dde5bdb2021-12-21 11:33:30.944root 11241100x8000000000000000540395Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:30.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9874d6a5c6e61e2e2021-12-21 11:33:30.944root 11241100x8000000000000000540396Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:30.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.18705b95965a900d2021-12-21 11:33:30.944root 11241100x8000000000000000540397Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:30.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6d9ccdedbf8ab2862021-12-21 11:33:30.944root 11241100x8000000000000000540398Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:30.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.44a6f6cd0f094d8e2021-12-21 11:33:30.944root 11241100x8000000000000000540399Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:31.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.82fc2790d23608062021-12-21 11:33:31.443root 11241100x8000000000000000540400Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:31.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.fa9aaff752c6f7082021-12-21 11:33:31.443root 11241100x8000000000000000540401Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:31.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.910a6b07b710e2a22021-12-21 11:33:31.443root 11241100x8000000000000000540402Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:31.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5f030c556031cd912021-12-21 11:33:31.443root 11241100x8000000000000000540403Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:31.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.15551c94b062adf52021-12-21 11:33:31.443root 11241100x8000000000000000540404Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:31.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.641074e4db293d8a2021-12-21 11:33:31.444root 11241100x8000000000000000540405Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:31.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3e110e167468266d2021-12-21 11:33:31.444root 11241100x8000000000000000540406Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:31.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.218b7dd1c795b5a62021-12-21 11:33:31.444root 11241100x8000000000000000540407Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:31.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d18bf720857ed4352021-12-21 11:33:31.444root 11241100x8000000000000000540408Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:31.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3277ae25c65466dd2021-12-21 11:33:31.444root 11241100x8000000000000000540409Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:31.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.08cfe3dab7d546762021-12-21 11:33:31.444root 11241100x8000000000000000540410Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:31.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.215add2db4566b242021-12-21 11:33:31.444root 11241100x8000000000000000540411Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:31.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3768e51791363f402021-12-21 11:33:31.444root 11241100x8000000000000000540412Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:31.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.583b6a73efc285652021-12-21 11:33:31.444root 11241100x8000000000000000540413Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:31.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5c736dc1bf9ab9502021-12-21 11:33:31.444root 11241100x8000000000000000540414Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:31.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1ce5b19dfb88d8852021-12-21 11:33:31.444root 11241100x8000000000000000540415Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:31.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1ed8ebdb73e499de2021-12-21 11:33:31.444root 11241100x8000000000000000540416Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:31.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2b2a773aa21f3baf2021-12-21 11:33:31.943root 11241100x8000000000000000540417Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:31.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.561714ce80540a5b2021-12-21 11:33:31.943root 11241100x8000000000000000540418Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:31.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d47ce9b3d73b4e9d2021-12-21 11:33:31.943root 11241100x8000000000000000540419Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:31.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.45aae4cb5ca9d2812021-12-21 11:33:31.943root 11241100x8000000000000000540420Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:31.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5ed21d95886f78072021-12-21 11:33:31.943root 11241100x8000000000000000540421Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:31.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.786522752f65ffb52021-12-21 11:33:31.943root 11241100x8000000000000000540422Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:31.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8a5afe433818ff8d2021-12-21 11:33:31.944root 11241100x8000000000000000540423Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:31.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.29e06ca4368da5992021-12-21 11:33:31.944root 11241100x8000000000000000540424Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:31.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ec137819a5ecbc492021-12-21 11:33:31.944root 11241100x8000000000000000540425Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:31.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9019da3c0dd962122021-12-21 11:33:31.944root 11241100x8000000000000000540426Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:31.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ef70bcc4dc0a77102021-12-21 11:33:31.944root 11241100x8000000000000000540427Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:31.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.db0a4d6810b90ab92021-12-21 11:33:31.944root 11241100x8000000000000000540428Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:31.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6a541192d1bd6daa2021-12-21 11:33:31.944root 11241100x8000000000000000540429Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:31.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6fcc5c4700003f8e2021-12-21 11:33:31.944root 11241100x8000000000000000540430Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:31.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6749f24aeb92cd332021-12-21 11:33:31.944root 11241100x8000000000000000540431Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:31.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3ca74f149a367bfd2021-12-21 11:33:31.944root 11241100x8000000000000000540432Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:31.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.439389abbf71d1c42021-12-21 11:33:31.944root 11241100x8000000000000000540433Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:32.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.48aa55f2d79470a02021-12-21 11:33:32.443root 11241100x8000000000000000540434Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:32.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.35e03013ccd261532021-12-21 11:33:32.443root 11241100x8000000000000000540435Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:32.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0bc6abe54d3f4a052021-12-21 11:33:32.443root 11241100x8000000000000000540436Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:32.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0813b35818bea7b22021-12-21 11:33:32.443root 11241100x8000000000000000540437Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:32.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.674128084690290c2021-12-21 11:33:32.443root 11241100x8000000000000000540438Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:32.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.871840eb447a8a8f2021-12-21 11:33:32.444root 11241100x8000000000000000540439Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:32.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a8cddb40076384292021-12-21 11:33:32.444root 11241100x8000000000000000540440Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:32.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.bc49b7e2d444383f2021-12-21 11:33:32.444root 11241100x8000000000000000540441Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:32.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7501abe882dfbb752021-12-21 11:33:32.444root 11241100x8000000000000000540442Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:32.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.13fcb201c129b37e2021-12-21 11:33:32.444root 11241100x8000000000000000540443Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:32.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d64a20812910a2f12021-12-21 11:33:32.444root 11241100x8000000000000000540444Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:32.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8bfd33ca4b8bad752021-12-21 11:33:32.444root 11241100x8000000000000000540445Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:32.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.fabeecf2f1febe4e2021-12-21 11:33:32.444root 11241100x8000000000000000540446Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:32.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7d0fe7c690fdcd8b2021-12-21 11:33:32.444root 11241100x8000000000000000540447Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:32.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.db491b810e348e8d2021-12-21 11:33:32.444root 11241100x8000000000000000540448Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:32.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c9c0d83749de20eb2021-12-21 11:33:32.444root 11241100x8000000000000000540449Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:32.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2ec0e95484e7fd7f2021-12-21 11:33:32.444root 11241100x8000000000000000540450Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:32.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.aa5eedb9e1116ca12021-12-21 11:33:32.943root 11241100x8000000000000000540451Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:32.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.acf8b7df5aa6835c2021-12-21 11:33:32.943root 11241100x8000000000000000540452Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:32.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.092cacc5ef958d032021-12-21 11:33:32.943root 11241100x8000000000000000540453Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:32.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.77978623f35bffc32021-12-21 11:33:32.943root 11241100x8000000000000000540454Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:32.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.498223e575b79bea2021-12-21 11:33:32.943root 11241100x8000000000000000540455Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:32.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b5e83adcce26f3bb2021-12-21 11:33:32.944root 11241100x8000000000000000540456Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:32.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.62c3a6a77f424ab22021-12-21 11:33:32.944root 11241100x8000000000000000540457Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:32.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.22d37bc4d8977f792021-12-21 11:33:32.944root 11241100x8000000000000000540458Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:32.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d5c6a31aac93b8b32021-12-21 11:33:32.944root 11241100x8000000000000000540459Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:32.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5b996cf6be0db7c22021-12-21 11:33:32.944root 11241100x8000000000000000540460Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:32.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b28827d57dbc65a02021-12-21 11:33:32.944root 11241100x8000000000000000540461Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:32.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c71b358adb9d385c2021-12-21 11:33:32.944root 11241100x8000000000000000540462Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:32.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.56e7c893615e5fd82021-12-21 11:33:32.944root 11241100x8000000000000000540463Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:32.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.73fe1984bb88ba2e2021-12-21 11:33:32.944root 11241100x8000000000000000540464Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:32.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b4e72377bbfbbadf2021-12-21 11:33:32.944root 11241100x8000000000000000540465Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:32.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.82e1e319c6d89e262021-12-21 11:33:32.944root 11241100x8000000000000000540466Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:32.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.dbaf3076926611c62021-12-21 11:33:32.944root 354300x8000000000000000540467Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:33.016{ec2b6afe-95d9-61c1-5175-3a0400000000}5346/opt/splunkforwarder/etc/apps/Splunk_TA_stream/linux_x86_64/bin/streamfwdroottcptruefalse10.0.1.25-48720-false10.0.1.12-8000- 11241100x8000000000000000540468Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:33.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.03b6fc6e022a83cb2021-12-21 11:33:33.443root 11241100x8000000000000000540469Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:33.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a228bcdba22fc3852021-12-21 11:33:33.443root 11241100x8000000000000000540470Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:33.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3ee632b3f07fca562021-12-21 11:33:33.444root 11241100x8000000000000000540471Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:33.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e1dfb03210b7f80e2021-12-21 11:33:33.444root 11241100x8000000000000000540472Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:33.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.56246d32c5cdc7d02021-12-21 11:33:33.444root 11241100x8000000000000000540473Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:33.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.eea90aab1fe04f5a2021-12-21 11:33:33.444root 11241100x8000000000000000540474Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:33.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.dcebe725b6d23bcf2021-12-21 11:33:33.444root 11241100x8000000000000000540475Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:33.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.42055d95f01a3e782021-12-21 11:33:33.444root 11241100x8000000000000000540476Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:33.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.96c6b0e7b71700382021-12-21 11:33:33.445root 11241100x8000000000000000540477Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:33.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8fb509b1002e49b12021-12-21 11:33:33.445root 11241100x8000000000000000540478Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:33.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b9e7111d80d95cb92021-12-21 11:33:33.445root 11241100x8000000000000000540479Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:33.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6d067dcc85a15e552021-12-21 11:33:33.445root 11241100x8000000000000000540480Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:33.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3c860dd0ceec49ec2021-12-21 11:33:33.445root 11241100x8000000000000000540481Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:33.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8b75786011a8ba572021-12-21 11:33:33.445root 11241100x8000000000000000540482Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:33.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e926c2782d7f65092021-12-21 11:33:33.445root 11241100x8000000000000000540483Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:33.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e2be646f549568922021-12-21 11:33:33.445root 11241100x8000000000000000540484Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:33.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4c6a70ca7e33ede22021-12-21 11:33:33.445root 11241100x8000000000000000540485Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:33.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ac6ba4083971d1492021-12-21 11:33:33.445root 11241100x8000000000000000540486Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:33.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1d503bce5ce6c4062021-12-21 11:33:33.943root 11241100x8000000000000000540487Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:33.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.18d9f6201a7cfe8a2021-12-21 11:33:33.943root 11241100x8000000000000000540488Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:33.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.62053fb2c9e3f26c2021-12-21 11:33:33.943root 11241100x8000000000000000540489Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:33.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.bfea590bd35bd0692021-12-21 11:33:33.944root 11241100x8000000000000000540490Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:33.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.bcdc5fa64b0db4872021-12-21 11:33:33.944root 11241100x8000000000000000540491Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:33.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ced664d048cc33f22021-12-21 11:33:33.944root 11241100x8000000000000000540492Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:33.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.216eb49de3d6bc7b2021-12-21 11:33:33.944root 11241100x8000000000000000540493Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:33.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8f62dbf81952a2202021-12-21 11:33:33.944root 11241100x8000000000000000540494Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:33.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.750f05e828bd94cb2021-12-21 11:33:33.944root 11241100x8000000000000000540495Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:33.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.89f12bb829b03f012021-12-21 11:33:33.944root 11241100x8000000000000000540496Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:33.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0860cce5311fe2682021-12-21 11:33:33.944root 11241100x8000000000000000540497Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:33.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7706baad57eed4cc2021-12-21 11:33:33.944root 11241100x8000000000000000540498Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:33.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.891a6db56110f4902021-12-21 11:33:33.945root 11241100x8000000000000000540499Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:33.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.dce82182bc3e682d2021-12-21 11:33:33.945root 11241100x8000000000000000540500Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:33.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.37c9485a001586ae2021-12-21 11:33:33.945root 11241100x8000000000000000540501Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:33.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3ac2da73ff0d2be62021-12-21 11:33:33.945root 11241100x8000000000000000540502Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:33.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e7a389d41d19452c2021-12-21 11:33:33.945root 11241100x8000000000000000540503Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:33.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.74c5410f9eef331d2021-12-21 11:33:33.945root 11241100x8000000000000000540504Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:34.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d35d7dde889ac5e92021-12-21 11:33:34.443root 11241100x8000000000000000540505Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:34.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b2336cc536a11faf2021-12-21 11:33:34.443root 11241100x8000000000000000540506Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:34.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.63a9b6d9209b517f2021-12-21 11:33:34.443root 11241100x8000000000000000540507Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:34.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.cda3bd8b9c6923282021-12-21 11:33:34.443root 11241100x8000000000000000540508Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:34.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1a8b1e4c0ea4c4db2021-12-21 11:33:34.444root 11241100x8000000000000000540509Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:34.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1ea491e996f045ba2021-12-21 11:33:34.444root 11241100x8000000000000000540510Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:34.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6e56d20d35f47ceb2021-12-21 11:33:34.444root 11241100x8000000000000000540511Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:34.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ee2441d785d5f07b2021-12-21 11:33:34.444root 11241100x8000000000000000540512Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:34.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7628c5efcac6bb562021-12-21 11:33:34.444root 11241100x8000000000000000540513Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:34.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d39d6171c52fa22d2021-12-21 11:33:34.444root 11241100x8000000000000000540514Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:34.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.45dbf3bf12e4c9ae2021-12-21 11:33:34.444root 11241100x8000000000000000540515Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:34.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f75ac86b50f2deb92021-12-21 11:33:34.444root 11241100x8000000000000000540516Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:34.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.eb91b7018f665b192021-12-21 11:33:34.444root 11241100x8000000000000000540517Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:34.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e2e15a03bc6fc7c42021-12-21 11:33:34.444root 11241100x8000000000000000540518Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:34.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7a7cbfcd0f2bab2a2021-12-21 11:33:34.444root 11241100x8000000000000000540519Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:34.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.fdc2de9287f9ea282021-12-21 11:33:34.444root 11241100x8000000000000000540520Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:34.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.38ff2d4f71638ef42021-12-21 11:33:34.444root 11241100x8000000000000000540521Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:34.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.fd33c935bb2e712d2021-12-21 11:33:34.444root 11241100x8000000000000000540522Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:34.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d1bd60b9e97af0a82021-12-21 11:33:34.943root 11241100x8000000000000000540523Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:34.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.557ea49a5ff5ab9e2021-12-21 11:33:34.943root 11241100x8000000000000000540524Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:34.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.27c4f20373036b392021-12-21 11:33:34.943root 11241100x8000000000000000540525Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:34.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3f5503a4fa6a74732021-12-21 11:33:34.943root 11241100x8000000000000000540526Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:34.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8c5d9ec583a501912021-12-21 11:33:34.943root 11241100x8000000000000000540527Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:34.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4869020fcc0b8a4e2021-12-21 11:33:34.944root 11241100x8000000000000000540528Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:34.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.75bac65efd3cdabb2021-12-21 11:33:34.944root 11241100x8000000000000000540529Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:34.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f0021d677155c1712021-12-21 11:33:34.944root 11241100x8000000000000000540530Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:34.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.59880a8b93d4926f2021-12-21 11:33:34.944root 11241100x8000000000000000540531Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:34.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.19b7b26f060ba4882021-12-21 11:33:34.944root 11241100x8000000000000000540532Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:34.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c31138b19e9fa69b2021-12-21 11:33:34.944root 11241100x8000000000000000540533Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:34.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c5cbc0553d063bb92021-12-21 11:33:34.944root 11241100x8000000000000000540534Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:34.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.04b3c204e2da482f2021-12-21 11:33:34.944root 11241100x8000000000000000540535Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:34.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.af5c4951b95b4bda2021-12-21 11:33:34.944root 11241100x8000000000000000540536Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:34.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a26432f8c2e9794a2021-12-21 11:33:34.944root 11241100x8000000000000000540537Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:34.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8f42dc5aa80099092021-12-21 11:33:34.944root 11241100x8000000000000000540538Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:34.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.81613040c07a42ae2021-12-21 11:33:34.944root 11241100x8000000000000000540539Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:34.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.17c1cbc007618e922021-12-21 11:33:34.944root 11241100x8000000000000000540540Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:35.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ed9afbb0dcb010e82021-12-21 11:33:35.443root 11241100x8000000000000000540541Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:35.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a1b1fcf7e4bede902021-12-21 11:33:35.443root 11241100x8000000000000000540542Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:35.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.dec3e1394b4d87b72021-12-21 11:33:35.443root 11241100x8000000000000000540543Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:35.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.47ca2b0f9e0eeb712021-12-21 11:33:35.443root 11241100x8000000000000000540544Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:35.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c0fa87341a3a642e2021-12-21 11:33:35.443root 11241100x8000000000000000540545Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:35.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.648ad616ad62d94b2021-12-21 11:33:35.444root 11241100x8000000000000000540546Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:35.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a8d3196098c8e6702021-12-21 11:33:35.444root 11241100x8000000000000000540547Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:35.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.565fda2f8f3889832021-12-21 11:33:35.444root 11241100x8000000000000000540548Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:35.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.067047f854ac164c2021-12-21 11:33:35.444root 11241100x8000000000000000540549Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:35.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.26d29edd8f9ea2be2021-12-21 11:33:35.444root 11241100x8000000000000000540550Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:35.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.261496d13aa2c7772021-12-21 11:33:35.444root 11241100x8000000000000000540551Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:35.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4ee0558dbf8027092021-12-21 11:33:35.444root 11241100x8000000000000000540552Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:35.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9137de8d58c98a1f2021-12-21 11:33:35.444root 11241100x8000000000000000540553Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:35.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.24c64958e8418a222021-12-21 11:33:35.444root 11241100x8000000000000000540554Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:35.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.30a19c77619e7e132021-12-21 11:33:35.444root 11241100x8000000000000000540555Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:35.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c134c0c8db3032e32021-12-21 11:33:35.444root 11241100x8000000000000000540556Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:35.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d8b47ef042539df52021-12-21 11:33:35.444root 11241100x8000000000000000540557Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:35.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.daefcd2d012be7632021-12-21 11:33:35.444root 11241100x8000000000000000540558Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:35.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d714e92d006ece922021-12-21 11:33:35.943root 11241100x8000000000000000540559Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:35.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.97fdec381583df252021-12-21 11:33:35.943root 11241100x8000000000000000540560Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:35.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.02e90f521da5a0862021-12-21 11:33:35.943root 11241100x8000000000000000540561Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:35.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1b91ee9beda4542f2021-12-21 11:33:35.943root 11241100x8000000000000000540562Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:35.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.dbb55360a87c41022021-12-21 11:33:35.943root 11241100x8000000000000000540563Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:35.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e680adaa1a2e2d5f2021-12-21 11:33:35.944root 11241100x8000000000000000540564Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:35.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.643af9385b3ca1642021-12-21 11:33:35.944root 11241100x8000000000000000540565Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:35.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9aabb0ae132de2db2021-12-21 11:33:35.944root 11241100x8000000000000000540566Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:35.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7934b16d134f70c12021-12-21 11:33:35.944root 11241100x8000000000000000540567Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:35.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.413dd0fa58c108822021-12-21 11:33:35.944root 11241100x8000000000000000540568Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:35.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a02e10f9d7ffbf752021-12-21 11:33:35.944root 11241100x8000000000000000540569Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:35.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5bd88f31b174e5ae2021-12-21 11:33:35.944root 11241100x8000000000000000540570Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:35.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f43d2005562d68a32021-12-21 11:33:35.944root 11241100x8000000000000000540571Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:35.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ca44cd72315ff1962021-12-21 11:33:35.944root 11241100x8000000000000000540572Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:35.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ae8d1ad06345e1fd2021-12-21 11:33:35.944root 11241100x8000000000000000540573Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:35.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6a16151ef94871962021-12-21 11:33:35.944root 11241100x8000000000000000540574Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:35.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.49831c54f8e6f7572021-12-21 11:33:35.944root 11241100x8000000000000000540575Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:35.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c24840766e891c242021-12-21 11:33:35.944root 11241100x8000000000000000540576Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:36.326{ec2b6afe-95d2-61c1-3038-b84203560000}5272/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/spool/splunk/tracker.log2021-12-21 11:33:36.326root 11241100x8000000000000000540577Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:36.327{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.683c0e74e89f393a2021-12-21 11:33:36.327root 11241100x8000000000000000540578Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:36.327{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e06372f44f8187182021-12-21 11:33:36.327root 11241100x8000000000000000540579Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:36.327{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c4f7457e8d108e452021-12-21 11:33:36.327root 11241100x8000000000000000540580Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:36.327{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.cca8fb92377b785c2021-12-21 11:33:36.327root 11241100x8000000000000000540581Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:36.327{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.08df42781564844b2021-12-21 11:33:36.327root 11241100x8000000000000000540582Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:36.328{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2798865dcb6f0fde2021-12-21 11:33:36.328root 11241100x8000000000000000540583Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:36.328{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ed6767715ea049672021-12-21 11:33:36.328root 11241100x8000000000000000540584Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:36.328{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1844c8366a518f432021-12-21 11:33:36.328root 11241100x8000000000000000540585Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:36.328{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.285967b58c37581d2021-12-21 11:33:36.328root 11241100x8000000000000000540586Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:36.328{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.aa468261e976ab712021-12-21 11:33:36.328root 11241100x8000000000000000540587Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:36.328{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b7deda6b4e0577c62021-12-21 11:33:36.328root 11241100x8000000000000000540588Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:36.328{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ffde6c79c54ef7892021-12-21 11:33:36.328root 11241100x8000000000000000540589Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:36.328{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a75b780f0718ec992021-12-21 11:33:36.328root 11241100x8000000000000000540590Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:36.328{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5dc70194148037772021-12-21 11:33:36.328root 11241100x8000000000000000540591Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:36.328{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1b2c03af2da975fa2021-12-21 11:33:36.328root 11241100x8000000000000000540592Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:36.329{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.89f0684b7fd30a632021-12-21 11:33:36.329root 11241100x8000000000000000540593Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:36.329{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2f6d85f972962d932021-12-21 11:33:36.329root 11241100x8000000000000000540594Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:36.329{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.47494959abc4691a2021-12-21 11:33:36.329root 11241100x8000000000000000540595Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:36.329{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.380dc6edfa9e12fb2021-12-21 11:33:36.329root 11241100x8000000000000000540596Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:36.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.10cfbf3b87f8d70c2021-12-21 11:33:36.693root 11241100x8000000000000000540597Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:36.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ba7372eb1d76901e2021-12-21 11:33:36.693root 11241100x8000000000000000540598Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:36.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9e7345b6d50e048e2021-12-21 11:33:36.693root 11241100x8000000000000000540599Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:36.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.666fdd0a7217c7cd2021-12-21 11:33:36.693root 11241100x8000000000000000540600Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:36.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.fc259a4b21926eac2021-12-21 11:33:36.693root 11241100x8000000000000000540601Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:36.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.68c92274409625c52021-12-21 11:33:36.694root 11241100x8000000000000000540602Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:36.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f5a38ffce7b1a7852021-12-21 11:33:36.694root 11241100x8000000000000000540603Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:36.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9e11293a8dc577bc2021-12-21 11:33:36.694root 11241100x8000000000000000540604Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:36.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.bcbaf43a4ccc15ae2021-12-21 11:33:36.694root 11241100x8000000000000000540605Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:36.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2e73727f51e9dd2a2021-12-21 11:33:36.694root 11241100x8000000000000000540606Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:36.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.51d2c56781f6637d2021-12-21 11:33:36.694root 11241100x8000000000000000540607Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:36.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8cd8f8c65eddb3532021-12-21 11:33:36.694root 11241100x8000000000000000540608Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:36.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2dde83aa1d3828182021-12-21 11:33:36.694root 11241100x8000000000000000540609Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:36.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.af0c95c7d946ccbc2021-12-21 11:33:36.694root 11241100x8000000000000000540610Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:36.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.80e18a51bc56f3512021-12-21 11:33:36.694root 11241100x8000000000000000540611Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:36.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c64730d2121ff5a12021-12-21 11:33:36.694root 11241100x8000000000000000540612Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:36.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e40de12702a525662021-12-21 11:33:36.694root 11241100x8000000000000000540613Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:36.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b2de90e3ffb97ed42021-12-21 11:33:36.694root 11241100x8000000000000000540614Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:36.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5d5f6b7504a8712c2021-12-21 11:33:36.694root 11241100x8000000000000000540615Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:37.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f774c5320d5e8f722021-12-21 11:33:37.193root 11241100x8000000000000000540616Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:37.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d7521bdd2d17cec32021-12-21 11:33:37.193root 11241100x8000000000000000540617Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:37.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4028cb4005ad4a7d2021-12-21 11:33:37.193root 11241100x8000000000000000540618Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:37.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.878ccf6ba61c91eb2021-12-21 11:33:37.193root 11241100x8000000000000000540619Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:37.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3e04e2fdcb74f4e02021-12-21 11:33:37.193root 11241100x8000000000000000540620Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:37.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5d786044bdbcb2f02021-12-21 11:33:37.194root 11241100x8000000000000000540621Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:37.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.515c2c2a4bcc024d2021-12-21 11:33:37.194root 11241100x8000000000000000540622Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:37.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.381968f55b7e5a422021-12-21 11:33:37.194root 11241100x8000000000000000540623Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:37.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.fe662aeb75702c532021-12-21 11:33:37.194root 11241100x8000000000000000540624Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:37.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a4bc5d9ea67acf352021-12-21 11:33:37.194root 11241100x8000000000000000540625Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:37.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b1e89466b5aa19a52021-12-21 11:33:37.194root 11241100x8000000000000000540626Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:37.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.70f8ad6a4cf52fbf2021-12-21 11:33:37.194root 11241100x8000000000000000540627Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:37.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ba4303e9e7bc13a32021-12-21 11:33:37.194root 11241100x8000000000000000540628Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:37.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.acf5e7c3781c21432021-12-21 11:33:37.194root 11241100x8000000000000000540629Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:37.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b238cd50360d2a212021-12-21 11:33:37.194root 11241100x8000000000000000540630Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:37.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.db16a54684150f902021-12-21 11:33:37.194root 11241100x8000000000000000540631Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:37.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6817e514a203d2362021-12-21 11:33:37.194root 11241100x8000000000000000540632Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:37.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.fed87881c7eb9f9c2021-12-21 11:33:37.194root 11241100x8000000000000000540633Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:37.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8c3f801ed3334bf62021-12-21 11:33:37.194root 11241100x8000000000000000540634Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:37.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.705abe512ff85dd42021-12-21 11:33:37.693root 11241100x8000000000000000540635Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:37.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.67074c9beab385262021-12-21 11:33:37.693root 11241100x8000000000000000540636Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:37.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b51511d30b7f63f02021-12-21 11:33:37.693root 11241100x8000000000000000540637Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:37.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2edeb558ac947ce72021-12-21 11:33:37.693root 11241100x8000000000000000540638Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:37.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8700b47b8cc376b12021-12-21 11:33:37.693root 11241100x8000000000000000540639Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:37.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.376331b9c57ec6ba2021-12-21 11:33:37.694root 11241100x8000000000000000540640Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:37.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4913d494a59cc7412021-12-21 11:33:37.694root 11241100x8000000000000000540641Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:37.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.807899fef21519c72021-12-21 11:33:37.694root 11241100x8000000000000000540642Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:37.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9e638712762cee102021-12-21 11:33:37.694root 11241100x8000000000000000540643Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:37.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0cebd3dec591f7072021-12-21 11:33:37.694root 11241100x8000000000000000540644Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:37.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8ddf2073095a8a922021-12-21 11:33:37.694root 11241100x8000000000000000540645Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:37.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.838c6804faf806122021-12-21 11:33:37.694root 11241100x8000000000000000540646Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:37.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6b7b2487dbc1472e2021-12-21 11:33:37.694root 11241100x8000000000000000540647Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:37.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e3678154ece468652021-12-21 11:33:37.694root 11241100x8000000000000000540648Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:37.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a985903d788ad0d72021-12-21 11:33:37.694root 11241100x8000000000000000540649Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:37.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8cd56b10b22c59d72021-12-21 11:33:37.694root 11241100x8000000000000000540650Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:37.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0e6c74eed0d08e6e2021-12-21 11:33:37.694root 11241100x8000000000000000540651Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:37.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.fa7e86aa84506f4c2021-12-21 11:33:37.694root 11241100x8000000000000000540652Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:37.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4b9123f4c86e1e882021-12-21 11:33:37.694root 11241100x8000000000000000540653Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:38.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.fed433db1e3f00082021-12-21 11:33:38.193root 11241100x8000000000000000540654Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:38.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.821b7e5d896a6e002021-12-21 11:33:38.193root 11241100x8000000000000000540655Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:38.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ca28dbdeb8c228012021-12-21 11:33:38.193root 11241100x8000000000000000540656Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:38.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3175d2a73f53fecc2021-12-21 11:33:38.193root 11241100x8000000000000000540657Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:38.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.75b62b98148c02242021-12-21 11:33:38.193root 11241100x8000000000000000540658Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:38.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.83f9a66e2ea260932021-12-21 11:33:38.194root 11241100x8000000000000000540659Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:38.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.45b05fc136a216552021-12-21 11:33:38.194root 11241100x8000000000000000540660Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:38.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.943361700d6863602021-12-21 11:33:38.194root 11241100x8000000000000000540661Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:38.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.73c287f8f482a7022021-12-21 11:33:38.194root 11241100x8000000000000000540662Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:38.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c65b2f9cc226c3f12021-12-21 11:33:38.194root 11241100x8000000000000000540663Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:38.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.87730d1dd5509bf12021-12-21 11:33:38.194root 11241100x8000000000000000540664Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:38.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.bebc44e058cdc8f22021-12-21 11:33:38.194root 11241100x8000000000000000540665Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:38.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a5ea64c23e91c6472021-12-21 11:33:38.194root 11241100x8000000000000000540666Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:38.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d7ee6bd088dee3122021-12-21 11:33:38.194root 11241100x8000000000000000540667Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:38.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.113bbfcad7c480bf2021-12-21 11:33:38.194root 11241100x8000000000000000540668Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:38.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.43635aecbdb899362021-12-21 11:33:38.194root 11241100x8000000000000000540669Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:38.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.85c4940e218b3d9f2021-12-21 11:33:38.194root 11241100x8000000000000000540670Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:38.195{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.844e7fecfc21aeeb2021-12-21 11:33:38.195root 11241100x8000000000000000540671Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:38.195{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0ad62a5b888745f22021-12-21 11:33:38.195root 354300x8000000000000000540672Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:38.197{ec2b6afe-95d9-61c1-5175-3a0400000000}5346/opt/splunkforwarder/etc/apps/Splunk_TA_stream/linux_x86_64/bin/streamfwdroottcptruefalse10.0.1.25-48722-false10.0.1.12-8000- 11241100x8000000000000000540673Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:38.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a3da79b9afb754572021-12-21 11:33:38.693root 11241100x8000000000000000540674Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:38.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.df328163fe9ae44c2021-12-21 11:33:38.693root 11241100x8000000000000000540675Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:38.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.34faeba32adcf09c2021-12-21 11:33:38.693root 11241100x8000000000000000540676Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:38.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.54aae38ec971afa22021-12-21 11:33:38.693root 11241100x8000000000000000540677Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:38.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7a2d12d4134e32062021-12-21 11:33:38.694root 11241100x8000000000000000540678Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:38.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6835acb790d357902021-12-21 11:33:38.694root 11241100x8000000000000000540679Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:38.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6a17c5cea7b18d412021-12-21 11:33:38.694root 11241100x8000000000000000540680Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:38.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.38c6ade2ce623efc2021-12-21 11:33:38.694root 11241100x8000000000000000540681Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:38.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7d40a469aeb512822021-12-21 11:33:38.694root 11241100x8000000000000000540682Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:38.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6cff8818ef4299332021-12-21 11:33:38.694root 11241100x8000000000000000540683Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:38.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b6e7514eedde7a4a2021-12-21 11:33:38.694root 11241100x8000000000000000540684Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:38.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0b29063e5fb25b9e2021-12-21 11:33:38.694root 11241100x8000000000000000540685Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:38.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.af7836a0588f792d2021-12-21 11:33:38.694root 11241100x8000000000000000540686Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:38.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.acb96e3b493bea732021-12-21 11:33:38.694root 11241100x8000000000000000540687Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:38.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1c53298f3ff5aba42021-12-21 11:33:38.694root 11241100x8000000000000000540688Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:38.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0669acf00705f0a72021-12-21 11:33:38.694root 11241100x8000000000000000540689Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:38.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4c8122e542df8d782021-12-21 11:33:38.694root 11241100x8000000000000000540690Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:38.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.dd4d7a3db8174a292021-12-21 11:33:38.694root 11241100x8000000000000000540691Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:38.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3f6688c3fb77f0cc2021-12-21 11:33:38.694root 11241100x8000000000000000540692Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:38.695{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.08154c70718e36b82021-12-21 11:33:38.695root 11241100x8000000000000000540693Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:39.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.54218bc997581cea2021-12-21 11:33:39.193root 11241100x8000000000000000540694Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:39.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.edd0cb7e1c1146c72021-12-21 11:33:39.193root 11241100x8000000000000000540695Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:39.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.dd913027ae2700292021-12-21 11:33:39.193root 11241100x8000000000000000540696Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:39.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8a7b2bae6bd0a10e2021-12-21 11:33:39.194root 11241100x8000000000000000540697Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:39.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0fcaab0cce1492272021-12-21 11:33:39.194root 11241100x8000000000000000540698Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:39.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.cff7fb25b1eb9b182021-12-21 11:33:39.194root 11241100x8000000000000000540699Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:39.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.954291ad13ff9bda2021-12-21 11:33:39.194root 11241100x8000000000000000540700Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:39.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.da94fc6db72cc2d12021-12-21 11:33:39.194root 11241100x8000000000000000540701Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:39.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.da254048dec7f9732021-12-21 11:33:39.194root 11241100x8000000000000000540702Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:39.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.60c9e02bbe7be4c22021-12-21 11:33:39.194root 11241100x8000000000000000540703Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:39.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0cd2bdb40d3c13312021-12-21 11:33:39.194root 11241100x8000000000000000540704Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:39.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.59745bd8567803bc2021-12-21 11:33:39.194root 11241100x8000000000000000540705Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:39.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9c2ebac6da7d4a882021-12-21 11:33:39.194root 11241100x8000000000000000540706Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:39.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.636a65eff1e615b12021-12-21 11:33:39.194root 11241100x8000000000000000540707Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:39.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9e7c3094c4cc4bf72021-12-21 11:33:39.194root 11241100x8000000000000000540708Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:39.195{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9341e41d7e20a79b2021-12-21 11:33:39.195root 11241100x8000000000000000540709Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:39.195{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f81ca1993186f86d2021-12-21 11:33:39.195root 11241100x8000000000000000540710Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:39.195{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.16623ba1250727ec2021-12-21 11:33:39.195root 11241100x8000000000000000540711Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:39.195{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9b284eab642b2e522021-12-21 11:33:39.195root 11241100x8000000000000000540712Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:39.195{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.20a01a08df86e2442021-12-21 11:33:39.195root 23542300x8000000000000000540713Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:39.328{ec2b6afe-95d2-61c1-3038-b84203560000}5272root/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/spool/splunk/tracker.log--- 11241100x8000000000000000540714Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:39.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a74cf2cddc1d51bc2021-12-21 11:33:39.693root 11241100x8000000000000000540715Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:39.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a3ad7c7c2535c2662021-12-21 11:33:39.693root 11241100x8000000000000000540716Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:39.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.32313efb46811dc32021-12-21 11:33:39.693root 11241100x8000000000000000540717Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:39.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ae523ef0c360cfa62021-12-21 11:33:39.694root 11241100x8000000000000000540718Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:39.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b3731dbc3beaa5752021-12-21 11:33:39.694root 11241100x8000000000000000540719Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:39.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6aa47a876f16373a2021-12-21 11:33:39.694root 11241100x8000000000000000540720Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:39.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.fa1eead123bc3ad72021-12-21 11:33:39.694root 11241100x8000000000000000540721Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:39.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5bf81a3702c177872021-12-21 11:33:39.694root 11241100x8000000000000000540722Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:39.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4291e684071cfb1c2021-12-21 11:33:39.694root 11241100x8000000000000000540723Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:39.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7ef8c5261963803b2021-12-21 11:33:39.694root 11241100x8000000000000000540724Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:39.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8dde1dc9e777bcbe2021-12-21 11:33:39.694root 11241100x8000000000000000540725Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:39.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.011ffc68068e49182021-12-21 11:33:39.694root 11241100x8000000000000000540726Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:39.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.61bf76ac4e0b43322021-12-21 11:33:39.694root 11241100x8000000000000000540727Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:39.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.adb69fc6ba228e272021-12-21 11:33:39.694root 11241100x8000000000000000540728Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:39.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.251619d64e4d828d2021-12-21 11:33:39.694root 11241100x8000000000000000540729Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:39.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.39f57e2e456583732021-12-21 11:33:39.694root 11241100x8000000000000000540730Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:39.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.90874bbe90bce7ed2021-12-21 11:33:39.694root 11241100x8000000000000000540731Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:39.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.db09089be6a2aa0d2021-12-21 11:33:39.694root 11241100x8000000000000000540732Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:39.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5bd92903a3a2794f2021-12-21 11:33:39.694root 11241100x8000000000000000540733Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:39.695{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.27eb4aa19a9482ab2021-12-21 11:33:39.695root 11241100x8000000000000000540734Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:39.695{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5cc940ecd70b9fec2021-12-21 11:33:39.695root 11241100x8000000000000000540735Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:40.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3d73f0fba57cd5a82021-12-21 11:33:40.193root 11241100x8000000000000000540736Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:40.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.10b470037eb4d2fa2021-12-21 11:33:40.193root 11241100x8000000000000000540737Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:40.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ba84843966c68c652021-12-21 11:33:40.194root 11241100x8000000000000000540738Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:40.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.58c1011dba0c69892021-12-21 11:33:40.194root 11241100x8000000000000000540739Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:40.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b96f9a4fecb873682021-12-21 11:33:40.194root 11241100x8000000000000000540740Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:40.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.64fdf15bf37e19e82021-12-21 11:33:40.194root 11241100x8000000000000000540741Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:40.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c7364963613f6e2f2021-12-21 11:33:40.194root 11241100x8000000000000000540742Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:40.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6e80c95a80ba56d82021-12-21 11:33:40.194root 11241100x8000000000000000540743Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:40.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.07b1ecf75474d0d42021-12-21 11:33:40.194root 11241100x8000000000000000540744Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:40.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b0790d1627c0ee992021-12-21 11:33:40.194root 11241100x8000000000000000540745Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:40.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c09ca06090ef94842021-12-21 11:33:40.194root 11241100x8000000000000000540746Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:40.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.dcdc74f5c756b6bf2021-12-21 11:33:40.194root 11241100x8000000000000000540747Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:40.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7bb3e35e846261e62021-12-21 11:33:40.194root 11241100x8000000000000000540748Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:40.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f2cd2fbebe4eae0f2021-12-21 11:33:40.194root 11241100x8000000000000000540749Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:40.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1790ab698673c5482021-12-21 11:33:40.194root 11241100x8000000000000000540750Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:40.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5e826a160ae32ce02021-12-21 11:33:40.194root 11241100x8000000000000000540751Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:40.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9de8c94d1383102e2021-12-21 11:33:40.194root 11241100x8000000000000000540752Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:40.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e4c5ce9fef45dd8f2021-12-21 11:33:40.194root 11241100x8000000000000000540753Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:40.195{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a7d7dfca45e252db2021-12-21 11:33:40.195root 11241100x8000000000000000540754Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:40.195{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ae2659db792edcd62021-12-21 11:33:40.195root 11241100x8000000000000000540755Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:40.195{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9351f45fb0872c5b2021-12-21 11:33:40.195root 11241100x8000000000000000540756Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:40.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d5fa0e36cb8f44e12021-12-21 11:33:40.693root 11241100x8000000000000000540757Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:40.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a2d3a7ee043d9c842021-12-21 11:33:40.693root 11241100x8000000000000000540758Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:40.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9c234efdbf6860b82021-12-21 11:33:40.694root 11241100x8000000000000000540759Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:40.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.79b8e3599869e13a2021-12-21 11:33:40.694root 11241100x8000000000000000540760Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:40.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.22825b7ec9dac5632021-12-21 11:33:40.694root 11241100x8000000000000000540761Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:40.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b05b7f6329fd4bf42021-12-21 11:33:40.694root 11241100x8000000000000000540762Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:40.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8542a70fded979e32021-12-21 11:33:40.694root 11241100x8000000000000000540763Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:40.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.95ff79a9e71aa7422021-12-21 11:33:40.694root 11241100x8000000000000000540764Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:40.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.37bf59668a19d9e82021-12-21 11:33:40.694root 11241100x8000000000000000540765Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:40.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.898943c267adeca82021-12-21 11:33:40.694root 11241100x8000000000000000540766Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:40.695{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.31eaf8bbdc6777552021-12-21 11:33:40.695root 11241100x8000000000000000540767Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:40.695{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d71557b832b612922021-12-21 11:33:40.695root 11241100x8000000000000000540768Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:40.695{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7d257a3bc855cb2e2021-12-21 11:33:40.695root 11241100x8000000000000000540769Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:40.695{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.81866c9c57cb66242021-12-21 11:33:40.695root 11241100x8000000000000000540770Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:40.695{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f763d5b9e8aa9fed2021-12-21 11:33:40.695root 11241100x8000000000000000540771Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:40.695{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1102f8849240213c2021-12-21 11:33:40.695root 11241100x8000000000000000540772Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:40.695{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8f7141c506355d212021-12-21 11:33:40.695root 11241100x8000000000000000540773Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:40.695{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e2301a53fdb860b52021-12-21 11:33:40.695root 11241100x8000000000000000540774Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:40.696{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e61170c9c47f8bc82021-12-21 11:33:40.696root 11241100x8000000000000000540775Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:40.696{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.68b252d8ef9f95002021-12-21 11:33:40.696root 11241100x8000000000000000540776Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:40.696{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8465f62d1553e3c12021-12-21 11:33:40.696root 11241100x8000000000000000540777Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:41.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c27b55bc1f6c4a4f2021-12-21 11:33:41.193root 11241100x8000000000000000540778Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:41.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.bbbd3bf3e496be872021-12-21 11:33:41.193root 11241100x8000000000000000540779Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:41.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.56bd2827b12d23da2021-12-21 11:33:41.194root 11241100x8000000000000000540780Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:41.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0778ff19c57cc1332021-12-21 11:33:41.194root 11241100x8000000000000000540781Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:41.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.52f011bfe82c93cd2021-12-21 11:33:41.194root 11241100x8000000000000000540782Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:41.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ac628a0d2c693bea2021-12-21 11:33:41.194root 11241100x8000000000000000540783Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:41.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f62e870decf001c22021-12-21 11:33:41.194root 11241100x8000000000000000540784Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:41.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e7608fecfe16e1782021-12-21 11:33:41.194root 11241100x8000000000000000540785Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:41.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2995d9a6ae3f4e922021-12-21 11:33:41.194root 11241100x8000000000000000540786Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:41.195{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c547c7dbf95792182021-12-21 11:33:41.195root 11241100x8000000000000000540787Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:41.195{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ae48f52691d7139c2021-12-21 11:33:41.195root 11241100x8000000000000000540788Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:41.195{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c8cc05bdc65c27d22021-12-21 11:33:41.195root 11241100x8000000000000000540789Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:41.195{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a8639153e74777052021-12-21 11:33:41.195root 11241100x8000000000000000540790Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:41.195{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.126563b3a9406a8d2021-12-21 11:33:41.195root 11241100x8000000000000000540791Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:41.195{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.dbff2b4c4165e3cf2021-12-21 11:33:41.195root 11241100x8000000000000000540792Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:41.195{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b798748bdd866fa12021-12-21 11:33:41.195root 11241100x8000000000000000540793Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:41.195{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a113c4da5500d9fe2021-12-21 11:33:41.195root 11241100x8000000000000000540794Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:41.196{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ea393a6c229e93912021-12-21 11:33:41.196root 11241100x8000000000000000540795Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:41.196{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.af058379e7626b122021-12-21 11:33:41.196root 11241100x8000000000000000540796Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:41.196{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d5b9fb0e8f03f0182021-12-21 11:33:41.196root 11241100x8000000000000000540797Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:41.196{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.254652252f824d122021-12-21 11:33:41.196root 11241100x8000000000000000540798Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:41.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5d07db1d7ab681352021-12-21 11:33:41.693root 11241100x8000000000000000540799Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:41.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f611ed5b61aaafa72021-12-21 11:33:41.693root 11241100x8000000000000000540800Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:41.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3c3d5f590ab080792021-12-21 11:33:41.694root 11241100x8000000000000000540801Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:41.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c0283f5524fc8fef2021-12-21 11:33:41.694root 11241100x8000000000000000540802Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:41.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.cb6ed880373512cd2021-12-21 11:33:41.694root 11241100x8000000000000000540803Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:41.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c1dda993d10d2f4a2021-12-21 11:33:41.694root 11241100x8000000000000000540804Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:41.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.59eff09b06b7818d2021-12-21 11:33:41.694root 11241100x8000000000000000540805Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:41.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2b21d8338c7404922021-12-21 11:33:41.694root 11241100x8000000000000000540806Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:41.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.12bde8ba642a9cf62021-12-21 11:33:41.694root 11241100x8000000000000000540807Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:41.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e968f766211439802021-12-21 11:33:41.694root 11241100x8000000000000000540808Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:41.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3581c315fca5fc7f2021-12-21 11:33:41.694root 11241100x8000000000000000540809Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:41.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6527a4fd2885baa32021-12-21 11:33:41.694root 11241100x8000000000000000540810Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:41.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.eec35e03834804e92021-12-21 11:33:41.694root 11241100x8000000000000000540811Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:41.695{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.846e2561d02965232021-12-21 11:33:41.695root 11241100x8000000000000000540812Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:41.695{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.33129e191129d4ba2021-12-21 11:33:41.695root 11241100x8000000000000000540813Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:41.695{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.24956b8c3f247d2e2021-12-21 11:33:41.695root 11241100x8000000000000000540814Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:41.695{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d5607ac55d82cd1d2021-12-21 11:33:41.695root 11241100x8000000000000000540815Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:41.695{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.85f6dc8d8ecf9b4a2021-12-21 11:33:41.695root 11241100x8000000000000000540816Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:41.695{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.665a21efcf68d1f12021-12-21 11:33:41.695root 11241100x8000000000000000540817Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:41.696{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f1ff2014e9d796072021-12-21 11:33:41.696root 11241100x8000000000000000540818Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:41.696{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9a6175d052d282fe2021-12-21 11:33:41.696root 11241100x8000000000000000540819Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:42.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.cb67e641e841532a2021-12-21 11:33:42.193root 11241100x8000000000000000540820Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:42.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a1d00494cbfab3612021-12-21 11:33:42.193root 11241100x8000000000000000540821Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:42.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.160c00e345e2c4972021-12-21 11:33:42.193root 11241100x8000000000000000540822Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:42.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c7dd2434f151292e2021-12-21 11:33:42.194root 11241100x8000000000000000540823Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:42.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.af2bc5d8a26bde832021-12-21 11:33:42.194root 11241100x8000000000000000540824Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:42.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5253d51c42fecac22021-12-21 11:33:42.194root 11241100x8000000000000000540825Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:42.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.98d89210293a79692021-12-21 11:33:42.194root 11241100x8000000000000000540826Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:42.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0410813804037ab32021-12-21 11:33:42.194root 11241100x8000000000000000540827Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:42.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6f6232684f2c7c2b2021-12-21 11:33:42.194root 11241100x8000000000000000540828Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:42.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.417918bdd53517fe2021-12-21 11:33:42.194root 11241100x8000000000000000540829Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:42.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2c91b6fea65110a72021-12-21 11:33:42.194root 11241100x8000000000000000540830Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:42.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.fc1f4bbf26f212dc2021-12-21 11:33:42.194root 11241100x8000000000000000540831Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:42.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ae9527734dd490d82021-12-21 11:33:42.194root 11241100x8000000000000000540832Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:42.195{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3fb5fe23dc590b352021-12-21 11:33:42.195root 11241100x8000000000000000540833Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:42.195{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a6e2c29333059a9b2021-12-21 11:33:42.195root 11241100x8000000000000000540834Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:42.195{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7bbaf6ca3cfa98a52021-12-21 11:33:42.195root 11241100x8000000000000000540835Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:42.195{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ce002eab6eb9f4652021-12-21 11:33:42.195root 11241100x8000000000000000540836Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:42.195{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.71c080a66a3cfdb72021-12-21 11:33:42.195root 11241100x8000000000000000540837Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:42.195{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a9094890c6ece6312021-12-21 11:33:42.195root 11241100x8000000000000000540838Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:42.195{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2b364e047fea35742021-12-21 11:33:42.195root 11241100x8000000000000000540839Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:42.195{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.74427181976a932d2021-12-21 11:33:42.195root 11241100x8000000000000000540840Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:42.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ddad68d5bd43b0362021-12-21 11:33:42.693root 11241100x8000000000000000540841Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:42.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.eb1d63c0f435e6c62021-12-21 11:33:42.693root 11241100x8000000000000000540842Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:42.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7c6ae4ad5961dc0a2021-12-21 11:33:42.693root 11241100x8000000000000000540843Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:42.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6e9712f7ce49b1262021-12-21 11:33:42.693root 11241100x8000000000000000540844Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:42.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7f951d1334840b3b2021-12-21 11:33:42.694root 11241100x8000000000000000540845Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:42.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0d097893da3fac542021-12-21 11:33:42.694root 11241100x8000000000000000540846Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:42.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4d82441b3c7ad18e2021-12-21 11:33:42.694root 11241100x8000000000000000540847Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:42.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7d677afc8c40d2742021-12-21 11:33:42.694root 11241100x8000000000000000540848Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:42.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.cf22cfd62db4011b2021-12-21 11:33:42.694root 11241100x8000000000000000540849Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:42.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.fc4609642d23cc7a2021-12-21 11:33:42.694root 11241100x8000000000000000540850Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:42.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1b6100667a610e9b2021-12-21 11:33:42.694root 11241100x8000000000000000540851Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:42.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.860092062c3c76b12021-12-21 11:33:42.694root 11241100x8000000000000000540852Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:42.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2fb47185f153b4a02021-12-21 11:33:42.694root 11241100x8000000000000000540853Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:42.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b97f40254c6049822021-12-21 11:33:42.694root 11241100x8000000000000000540854Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:42.695{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2dfaa72116c5f1612021-12-21 11:33:42.695root 11241100x8000000000000000540855Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:42.695{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1f70c107a13190d52021-12-21 11:33:42.695root 11241100x8000000000000000540856Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:42.695{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.abbdccb56415a09d2021-12-21 11:33:42.695root 11241100x8000000000000000540857Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:42.695{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.af48a6104e823ae82021-12-21 11:33:42.695root 11241100x8000000000000000540858Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:42.695{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ff187937d87f60e82021-12-21 11:33:42.695root 11241100x8000000000000000540859Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:42.695{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e0c3240f66882ee82021-12-21 11:33:42.695root 11241100x8000000000000000540860Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:42.695{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.852c426176580ae42021-12-21 11:33:42.695root 11241100x8000000000000000540861Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:43.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ec445c03dbd5d5282021-12-21 11:33:43.193root 11241100x8000000000000000540862Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:43.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d3c5d08b6afc215a2021-12-21 11:33:43.193root 11241100x8000000000000000540863Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:43.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7231558245a4ae052021-12-21 11:33:43.193root 11241100x8000000000000000540864Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:43.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.23577d6ec765efb02021-12-21 11:33:43.194root 11241100x8000000000000000540865Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:43.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a54d77ed5ce6ccc22021-12-21 11:33:43.194root 11241100x8000000000000000540866Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:43.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.24d702b286306d152021-12-21 11:33:43.194root 11241100x8000000000000000540867Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:43.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7745af35e9a7a14e2021-12-21 11:33:43.194root 11241100x8000000000000000540868Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:43.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6f7005f8f3edea252021-12-21 11:33:43.194root 11241100x8000000000000000540869Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:43.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.84281ab8049b30232021-12-21 11:33:43.194root 11241100x8000000000000000540870Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:43.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.eef03a820c96895b2021-12-21 11:33:43.194root 11241100x8000000000000000540871Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:43.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d152913361394c012021-12-21 11:33:43.194root 11241100x8000000000000000540872Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:43.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2e342fd3b0730e6f2021-12-21 11:33:43.194root 11241100x8000000000000000540873Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:43.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8fb6af53f0f63c1b2021-12-21 11:33:43.194root 11241100x8000000000000000540874Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:43.195{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.934b3bb3dd176e992021-12-21 11:33:43.195root 11241100x8000000000000000540875Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:43.195{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.01b8c0bb67e10af42021-12-21 11:33:43.195root 11241100x8000000000000000540876Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:43.195{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6871da6f606aebd42021-12-21 11:33:43.195root 11241100x8000000000000000540877Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:43.195{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.cad41c839679b6512021-12-21 11:33:43.195root 11241100x8000000000000000540878Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:43.195{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7267a87eef39b1ad2021-12-21 11:33:43.195root 11241100x8000000000000000540879Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:43.195{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.bbca3bdbebc4ad712021-12-21 11:33:43.195root 11241100x8000000000000000540880Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:43.195{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7939516f83da96e12021-12-21 11:33:43.195root 11241100x8000000000000000540881Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:43.196{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a1c9ed2f85f595da2021-12-21 11:33:43.196root 11241100x8000000000000000540882Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:43.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a74ea9db0c6611562021-12-21 11:33:43.693root 11241100x8000000000000000540883Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:43.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6f897d6096acd4cf2021-12-21 11:33:43.693root 11241100x8000000000000000540884Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:43.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b11d51c8009335d02021-12-21 11:33:43.693root 11241100x8000000000000000540885Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:43.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.32f28987d788b9532021-12-21 11:33:43.694root 11241100x8000000000000000540886Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:43.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a144f98ce0a5b2722021-12-21 11:33:43.694root 11241100x8000000000000000540887Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:43.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d8a1b062e77670d22021-12-21 11:33:43.694root 11241100x8000000000000000540888Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:43.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2336d20c35f9156f2021-12-21 11:33:43.694root 11241100x8000000000000000540889Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:43.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9516d82575f92ad22021-12-21 11:33:43.694root 11241100x8000000000000000540890Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:43.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.aef13e5b081703972021-12-21 11:33:43.694root 11241100x8000000000000000540891Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:43.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.43f48f09a27884c22021-12-21 11:33:43.694root 11241100x8000000000000000540892Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:43.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4634f271456f453a2021-12-21 11:33:43.694root 11241100x8000000000000000540893Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:43.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.459e007dbe26755f2021-12-21 11:33:43.694root 11241100x8000000000000000540894Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:43.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.aa7d919db494f4a82021-12-21 11:33:43.694root 11241100x8000000000000000540895Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:43.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6b9f7417573e06eb2021-12-21 11:33:43.694root 11241100x8000000000000000540896Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:43.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a7f983483d0a119d2021-12-21 11:33:43.694root 11241100x8000000000000000540897Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:43.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.484630bcbe5c9bd82021-12-21 11:33:43.694root 11241100x8000000000000000540898Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:43.695{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a6678e890298ad362021-12-21 11:33:43.695root 11241100x8000000000000000540899Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:43.695{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ab8fc150eb74a2ba2021-12-21 11:33:43.695root 11241100x8000000000000000540900Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:43.695{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.dbccd2d91e6c77fd2021-12-21 11:33:43.695root 11241100x8000000000000000540901Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:43.695{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4849b3fa346515262021-12-21 11:33:43.695root 11241100x8000000000000000540902Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:43.695{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8af42252285a22ac2021-12-21 11:33:43.695root 354300x8000000000000000540903Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:44.127{ec2b6afe-95d9-61c1-5175-3a0400000000}5346/opt/splunkforwarder/etc/apps/Splunk_TA_stream/linux_x86_64/bin/streamfwdroottcptruefalse10.0.1.25-48724-false10.0.1.12-8000- 11241100x8000000000000000540904Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:44.128{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.034fe41f8c2116d42021-12-21 11:33:44.128root 11241100x8000000000000000540905Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:44.128{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.acfaf3e8ff04b0452021-12-21 11:33:44.128root 11241100x8000000000000000540906Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:44.128{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e4f9a11df24564a02021-12-21 11:33:44.128root 11241100x8000000000000000540907Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:44.128{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4309c9feccfe01d62021-12-21 11:33:44.128root 11241100x8000000000000000540908Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:44.128{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.44e64dd228e249b02021-12-21 11:33:44.128root 11241100x8000000000000000540909Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:44.128{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.70bd9fefa8a41ec32021-12-21 11:33:44.128root 11241100x8000000000000000540910Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:44.128{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.328b817282d894652021-12-21 11:33:44.128root 11241100x8000000000000000540911Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:44.129{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e6857fd4f8fa2b542021-12-21 11:33:44.129root 11241100x8000000000000000540912Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:44.129{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.afc5e4d769d5df252021-12-21 11:33:44.129root 11241100x8000000000000000540913Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:44.129{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.15534c05ede2f0162021-12-21 11:33:44.129root 11241100x8000000000000000540914Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:44.129{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7b54af8acc950d5c2021-12-21 11:33:44.129root 11241100x8000000000000000540915Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:44.129{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7bf0749d2c45254e2021-12-21 11:33:44.129root 11241100x8000000000000000540916Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:44.130{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3324dfc87e3d47692021-12-21 11:33:44.130root 11241100x8000000000000000540917Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:44.130{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f0fecb2592b1df912021-12-21 11:33:44.130root 11241100x8000000000000000540918Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:44.130{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d33b4a8fd4b0ab352021-12-21 11:33:44.130root 11241100x8000000000000000540919Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:44.130{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d58a4124dbd25e282021-12-21 11:33:44.130root 11241100x8000000000000000540920Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:44.130{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0b49ba4d01d538ad2021-12-21 11:33:44.130root 11241100x8000000000000000540921Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:44.130{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2633f4a8d6a5c8f52021-12-21 11:33:44.130root 11241100x8000000000000000540922Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:44.130{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d5cfe7a50825f2d92021-12-21 11:33:44.130root 11241100x8000000000000000540923Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:44.130{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.26c414724cbcbbc72021-12-21 11:33:44.130root 11241100x8000000000000000540924Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:44.130{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ef97d24a3e4946082021-12-21 11:33:44.130root 11241100x8000000000000000540925Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:44.130{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.88d97234c8c80b982021-12-21 11:33:44.130root 11241100x8000000000000000540926Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:44.130{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.fa8f7995e34a00462021-12-21 11:33:44.130root 11241100x8000000000000000540927Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:44.130{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.60120a065f3cb5a12021-12-21 11:33:44.130root 11241100x8000000000000000540928Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:44.131{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6ca5ac98746038b72021-12-21 11:33:44.131root 11241100x8000000000000000540929Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:44.131{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.16051192d19d3acd2021-12-21 11:33:44.131root 11241100x8000000000000000540930Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:44.131{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.51f73e9e37ba0fb42021-12-21 11:33:44.131root 11241100x8000000000000000540931Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:44.131{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1f6f0eafcc14292c2021-12-21 11:33:44.131root 11241100x8000000000000000540932Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:44.131{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9bc86b4749f5d6712021-12-21 11:33:44.131root 11241100x8000000000000000540933Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:44.131{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c65a02f39e98bf5e2021-12-21 11:33:44.131root 11241100x8000000000000000540934Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:44.131{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.90e8ca0e437d27b22021-12-21 11:33:44.131root 11241100x8000000000000000540935Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:44.131{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.327f58895aede73b2021-12-21 11:33:44.131root 11241100x8000000000000000540936Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:44.131{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d9fb9e999a4252c92021-12-21 11:33:44.131root 11241100x8000000000000000540937Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:44.131{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e6ff8736cc9d39ed2021-12-21 11:33:44.131root 11241100x8000000000000000540938Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:44.131{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1e40aa27a66fd4ca2021-12-21 11:33:44.131root 11241100x8000000000000000540939Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:44.132{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ed3e3506f97b25252021-12-21 11:33:44.132root 11241100x8000000000000000540940Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:44.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c69e4982794c47c42021-12-21 11:33:44.443root 11241100x8000000000000000540941Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:44.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.61e3eb47cab335962021-12-21 11:33:44.443root 11241100x8000000000000000540942Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:44.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4bbcc9e2ec192d662021-12-21 11:33:44.444root 11241100x8000000000000000540943Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:44.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1b6ea8b3b73e763a2021-12-21 11:33:44.444root 11241100x8000000000000000540944Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:44.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c2075ef86a30dde52021-12-21 11:33:44.444root 11241100x8000000000000000540945Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:44.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.696869099a9f431e2021-12-21 11:33:44.444root 11241100x8000000000000000540946Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:44.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d229d054299b77472021-12-21 11:33:44.444root 11241100x8000000000000000540947Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:44.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6148143b74379aa42021-12-21 11:33:44.444root 11241100x8000000000000000540948Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:44.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.839728a82746d0642021-12-21 11:33:44.444root 11241100x8000000000000000540949Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:44.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0917bd70ae59071c2021-12-21 11:33:44.444root 11241100x8000000000000000540950Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:44.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.efe34cab537303662021-12-21 11:33:44.444root 11241100x8000000000000000540951Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:44.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.05f62f5e759805cd2021-12-21 11:33:44.444root 11241100x8000000000000000540952Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:44.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4645fab8b058fe332021-12-21 11:33:44.444root 11241100x8000000000000000540953Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:44.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.52b3b27e282aaf3a2021-12-21 11:33:44.444root 11241100x8000000000000000540954Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:44.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8b9c2bfa34ab5dfc2021-12-21 11:33:44.444root 11241100x8000000000000000540955Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:44.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5dad229bd2f1ed752021-12-21 11:33:44.444root 11241100x8000000000000000540956Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:44.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5b7c40f133010ac32021-12-21 11:33:44.444root 11241100x8000000000000000540957Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:44.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.226e8f96289b0df32021-12-21 11:33:44.444root 11241100x8000000000000000540958Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:44.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.953980f84b587d382021-12-21 11:33:44.445root 11241100x8000000000000000540959Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:44.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.381c7fbb413736662021-12-21 11:33:44.445root 11241100x8000000000000000540960Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:44.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0e4bf28a64ae75c22021-12-21 11:33:44.445root 11241100x8000000000000000540961Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:44.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4d00cb2640ab7f9a2021-12-21 11:33:44.445root 11241100x8000000000000000540962Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:44.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.43b06f441d38f1542021-12-21 11:33:44.943root 11241100x8000000000000000540963Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:44.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e385730b68e842a62021-12-21 11:33:44.943root 11241100x8000000000000000540964Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:44.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.da9a63a79668af6c2021-12-21 11:33:44.943root 11241100x8000000000000000540965Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:44.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b71e387b8a9a06c02021-12-21 11:33:44.943root 11241100x8000000000000000540966Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:44.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4b098b02d4e9aae32021-12-21 11:33:44.944root 11241100x8000000000000000540967Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:44.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7d35198a4fa6d0932021-12-21 11:33:44.944root 11241100x8000000000000000540968Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:44.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b1dccff6079f0bb52021-12-21 11:33:44.944root 11241100x8000000000000000540969Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:44.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4cc14e1f52f1f08c2021-12-21 11:33:44.944root 11241100x8000000000000000540970Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:44.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4218fc10b11358042021-12-21 11:33:44.944root 11241100x8000000000000000540971Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:44.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8047d4e3d59c2f702021-12-21 11:33:44.944root 11241100x8000000000000000540972Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:44.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b42cabe792d744442021-12-21 11:33:44.944root 11241100x8000000000000000540973Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:44.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.593fd11aef0485702021-12-21 11:33:44.944root 11241100x8000000000000000540974Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:44.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e211651da286c21e2021-12-21 11:33:44.944root 11241100x8000000000000000540975Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:44.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.732b77605f934c6e2021-12-21 11:33:44.944root 11241100x8000000000000000540976Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:44.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.273a0d8632fe62a52021-12-21 11:33:44.944root 11241100x8000000000000000540977Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:44.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2e0648a2bca80caf2021-12-21 11:33:44.944root 11241100x8000000000000000540978Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:44.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f004a42d98a020812021-12-21 11:33:44.944root 11241100x8000000000000000540979Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:44.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.66fba24aa558e83b2021-12-21 11:33:44.944root 11241100x8000000000000000540980Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:44.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b5ebb27f282cfd8c2021-12-21 11:33:44.944root 11241100x8000000000000000540981Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:44.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b1ebf996cc2a68702021-12-21 11:33:44.945root 11241100x8000000000000000540982Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:44.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0318dc334e8039be2021-12-21 11:33:44.945root 11241100x8000000000000000540983Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:44.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7870f9c715d5762b2021-12-21 11:33:44.945root 11241100x8000000000000000540984Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:45.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.fe797f438d7f7b572021-12-21 11:33:45.443root 11241100x8000000000000000540985Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:45.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f984c3159626a8482021-12-21 11:33:45.443root 11241100x8000000000000000540986Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:45.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.53a81e3c1fbd2ad52021-12-21 11:33:45.443root 11241100x8000000000000000540987Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:45.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.fc780b203b6222892021-12-21 11:33:45.443root 11241100x8000000000000000540988Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:45.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.da2c160a4db697982021-12-21 11:33:45.444root 11241100x8000000000000000540989Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:45.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.eb1c9a39a96d62612021-12-21 11:33:45.444root 11241100x8000000000000000540990Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:45.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ff1c3b612768ec362021-12-21 11:33:45.444root 11241100x8000000000000000540991Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:45.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.69ce3c01f25c3f2e2021-12-21 11:33:45.444root 11241100x8000000000000000540992Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:45.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9cd035cc133985222021-12-21 11:33:45.444root 11241100x8000000000000000540993Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:45.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3f10d9a3b5070f992021-12-21 11:33:45.444root 11241100x8000000000000000540994Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:45.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f5c4c615038ce4092021-12-21 11:33:45.444root 11241100x8000000000000000540995Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:45.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.af2a4c29a3d2e7f62021-12-21 11:33:45.444root 11241100x8000000000000000540996Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:45.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a3a7c93fc6fa81be2021-12-21 11:33:45.444root 11241100x8000000000000000540997Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:45.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a676bf16eaeebf3c2021-12-21 11:33:45.444root 11241100x8000000000000000540998Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:45.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7e7f76dccd266b6c2021-12-21 11:33:45.444root 11241100x8000000000000000540999Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:45.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.167a37a86bcf600a2021-12-21 11:33:45.444root 11241100x8000000000000000541000Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:45.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.75cad02b253a83542021-12-21 11:33:45.445root 11241100x8000000000000000541001Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:45.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8058cf239360a3172021-12-21 11:33:45.445root 11241100x8000000000000000541002Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:45.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5c4379178c00e92d2021-12-21 11:33:45.445root 11241100x8000000000000000541003Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:45.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7ce732694fdc6be82021-12-21 11:33:45.445root 11241100x8000000000000000541004Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:45.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9201aab405475b822021-12-21 11:33:45.445root 11241100x8000000000000000541005Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:45.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e1d0c6ed861d4ffe2021-12-21 11:33:45.445root 11241100x8000000000000000541006Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:45.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b54c92431a0b8c702021-12-21 11:33:45.943root 11241100x8000000000000000541007Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:45.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d66b6c58fa440bf22021-12-21 11:33:45.943root 11241100x8000000000000000541008Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:45.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.cb7f2d89f555aee12021-12-21 11:33:45.943root 11241100x8000000000000000541009Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:45.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.68d2958938aab21e2021-12-21 11:33:45.943root 11241100x8000000000000000541010Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:45.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d4a302ff0b1f7e482021-12-21 11:33:45.944root 11241100x8000000000000000541011Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:45.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.45a257dd6ed717762021-12-21 11:33:45.944root 11241100x8000000000000000541012Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:45.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9016d9452a1a27582021-12-21 11:33:45.944root 11241100x8000000000000000541013Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:45.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2186edeee5272c762021-12-21 11:33:45.944root 11241100x8000000000000000541014Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:45.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.aedf4b9f8a071a622021-12-21 11:33:45.944root 11241100x8000000000000000541015Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:45.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.bf0a5a273c5304032021-12-21 11:33:45.944root 11241100x8000000000000000541016Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:45.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b3036bd968f3f6b82021-12-21 11:33:45.944root 11241100x8000000000000000541017Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:45.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ef43a1c640b837eb2021-12-21 11:33:45.944root 11241100x8000000000000000541018Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:45.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.db06fc0e08e39f652021-12-21 11:33:45.945root 11241100x8000000000000000541019Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:45.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f56748a2fa4918b42021-12-21 11:33:45.945root 11241100x8000000000000000541020Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:45.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0d911b309497371a2021-12-21 11:33:45.945root 11241100x8000000000000000541021Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:45.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f6f481709ecd19292021-12-21 11:33:45.945root 11241100x8000000000000000541022Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:45.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f9084a8dfe2673ce2021-12-21 11:33:45.945root 11241100x8000000000000000541023Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:45.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5a2fa98f5a3397822021-12-21 11:33:45.945root 11241100x8000000000000000541024Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:45.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.36df172bc9498fa12021-12-21 11:33:45.945root 11241100x8000000000000000541025Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:45.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4421a7a45006ced12021-12-21 11:33:45.945root 11241100x8000000000000000541026Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:45.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9a63986d435a664f2021-12-21 11:33:45.945root 11241100x8000000000000000541027Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:45.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b70ec4083b1db7372021-12-21 11:33:45.945root 11241100x8000000000000000541028Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:46.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ccf912d3c7201b622021-12-21 11:33:46.443root 11241100x8000000000000000541029Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:46.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1a67ce521c97bf3c2021-12-21 11:33:46.443root 11241100x8000000000000000541030Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:46.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.69b477768de936c82021-12-21 11:33:46.443root 11241100x8000000000000000541031Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:46.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8b2339f5e732d4562021-12-21 11:33:46.443root 11241100x8000000000000000541032Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:46.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8ec59ebf7624e31d2021-12-21 11:33:46.444root 11241100x8000000000000000541033Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:46.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.152c1b6826f60abf2021-12-21 11:33:46.444root 11241100x8000000000000000541034Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:46.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3c734ac054ba2c042021-12-21 11:33:46.444root 11241100x8000000000000000541035Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:46.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.48c86267a34390072021-12-21 11:33:46.444root 11241100x8000000000000000541036Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:46.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.635380a355ba95662021-12-21 11:33:46.444root 11241100x8000000000000000541037Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:46.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a3086fe3c37a6efa2021-12-21 11:33:46.444root 11241100x8000000000000000541038Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:46.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9f9480a7d9ac519c2021-12-21 11:33:46.444root 11241100x8000000000000000541039Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:46.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e8b26d625227d9b72021-12-21 11:33:46.444root 11241100x8000000000000000541040Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:46.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.fe749a4effc88b972021-12-21 11:33:46.444root 11241100x8000000000000000541041Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:46.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e7423be6e086b3422021-12-21 11:33:46.444root 11241100x8000000000000000541042Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:46.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ed6cc6a6aab326672021-12-21 11:33:46.444root 11241100x8000000000000000541043Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:46.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.415da056270347f22021-12-21 11:33:46.444root 11241100x8000000000000000541044Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:46.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.25e9c5ec5db499592021-12-21 11:33:46.444root 11241100x8000000000000000541045Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:46.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0ee2bd3b317a27282021-12-21 11:33:46.444root 11241100x8000000000000000541046Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:46.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d94366a5b6d09bf32021-12-21 11:33:46.444root 11241100x8000000000000000541047Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:46.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.bf09519052f258892021-12-21 11:33:46.444root 11241100x8000000000000000541048Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:46.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c0fedbb1f459a9ac2021-12-21 11:33:46.445root 11241100x8000000000000000541049Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:46.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f18205cf9caa7dc02021-12-21 11:33:46.445root 11241100x8000000000000000541050Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:46.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.65e043f7c05a9d4f2021-12-21 11:33:46.943root 11241100x8000000000000000541051Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:46.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0e347f0a09aefdab2021-12-21 11:33:46.943root 11241100x8000000000000000541052Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:46.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.25930a13967670712021-12-21 11:33:46.943root 11241100x8000000000000000541053Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:46.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.133bf0d9efc0870b2021-12-21 11:33:46.944root 11241100x8000000000000000541054Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:46.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0e54fe1165e19e142021-12-21 11:33:46.944root 11241100x8000000000000000541055Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:46.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4db79615f805a5fe2021-12-21 11:33:46.944root 11241100x8000000000000000541056Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:46.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.616038930530e8b22021-12-21 11:33:46.944root 11241100x8000000000000000541057Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:46.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.742944080ed389632021-12-21 11:33:46.944root 11241100x8000000000000000541058Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:46.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2f44045f6353a6292021-12-21 11:33:46.944root 11241100x8000000000000000541059Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:46.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2ef4278ec99e45bd2021-12-21 11:33:46.944root 11241100x8000000000000000541060Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:46.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6b319fbe46fd5a732021-12-21 11:33:46.944root 11241100x8000000000000000541061Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:46.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5f8b822394df71ca2021-12-21 11:33:46.944root 11241100x8000000000000000541062Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:46.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.20b857dae30bb41f2021-12-21 11:33:46.944root 11241100x8000000000000000541063Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:46.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.bc833908ce3007e22021-12-21 11:33:46.944root 11241100x8000000000000000541064Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:46.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.619e498d54a6c7b22021-12-21 11:33:46.944root 11241100x8000000000000000541065Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:46.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.eee75466e768a75d2021-12-21 11:33:46.944root 11241100x8000000000000000541066Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:46.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a4406f351c8ffb7e2021-12-21 11:33:46.944root 11241100x8000000000000000541067Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:46.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.79293eb882c1ee462021-12-21 11:33:46.944root 11241100x8000000000000000541068Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:46.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ee0f538e1e60cfcf2021-12-21 11:33:46.944root 11241100x8000000000000000541069Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:46.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.bf5c13091cfb93502021-12-21 11:33:46.945root 11241100x8000000000000000541070Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:46.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6a3a637a3a07977d2021-12-21 11:33:46.945root 11241100x8000000000000000541071Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:46.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9503553bdb222b492021-12-21 11:33:46.945root 11241100x8000000000000000541072Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:47.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3184eccce0531a552021-12-21 11:33:47.443root 11241100x8000000000000000541073Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:47.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9f1e2510d4293a082021-12-21 11:33:47.443root 11241100x8000000000000000541074Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:47.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.bcdc93478677ad942021-12-21 11:33:47.443root 11241100x8000000000000000541075Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:47.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b1acd40cc51607932021-12-21 11:33:47.443root 11241100x8000000000000000541076Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:47.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.779f00a4cb87bd752021-12-21 11:33:47.443root 11241100x8000000000000000541077Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:47.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7b23c1ea39fc043e2021-12-21 11:33:47.444root 11241100x8000000000000000541078Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:47.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6da75460e9a906e62021-12-21 11:33:47.444root 11241100x8000000000000000541079Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:47.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.089c53a29d33513b2021-12-21 11:33:47.444root 11241100x8000000000000000541080Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:47.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d7c0a1e17c4a78382021-12-21 11:33:47.444root 11241100x8000000000000000541081Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:47.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a12eaec2c3f29b042021-12-21 11:33:47.444root 11241100x8000000000000000541082Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:47.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.dd4fe18b29044cb92021-12-21 11:33:47.444root 11241100x8000000000000000541083Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:47.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.451cdcba8732b6152021-12-21 11:33:47.444root 11241100x8000000000000000541084Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:47.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.50e1797a8cc633752021-12-21 11:33:47.444root 11241100x8000000000000000541085Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:47.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3f36c3fdcf7934c52021-12-21 11:33:47.444root 11241100x8000000000000000541086Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:47.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8ca3849bb73e94372021-12-21 11:33:47.444root 11241100x8000000000000000541087Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:47.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8bf249616209fbfd2021-12-21 11:33:47.444root 11241100x8000000000000000541088Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:47.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ff33005d9e2be1422021-12-21 11:33:47.444root 11241100x8000000000000000541089Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:47.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.40923c21c63224e32021-12-21 11:33:47.444root 11241100x8000000000000000541090Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:47.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.20dffd10b2e774f62021-12-21 11:33:47.444root 11241100x8000000000000000541091Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:47.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.be1fb1c0aebbd1292021-12-21 11:33:47.444root 11241100x8000000000000000541092Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:47.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.49cb349216bcf67f2021-12-21 11:33:47.445root 11241100x8000000000000000541093Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:47.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1ec2ac8535e838e32021-12-21 11:33:47.445root 11241100x8000000000000000541094Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:47.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.30a415507b15ba032021-12-21 11:33:47.943root 11241100x8000000000000000541095Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:47.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f4a2aa44d71ed4792021-12-21 11:33:47.943root 11241100x8000000000000000541096Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:47.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ea0254ad7677dfb62021-12-21 11:33:47.943root 11241100x8000000000000000541097Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:47.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b0ae60f329892d0f2021-12-21 11:33:47.943root 11241100x8000000000000000541098Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:47.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.63e8b1df420b9e932021-12-21 11:33:47.944root 11241100x8000000000000000541099Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:47.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1a1ba8dd94fd8d5b2021-12-21 11:33:47.944root 11241100x8000000000000000541100Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:47.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9ac602bc19e500ca2021-12-21 11:33:47.944root 11241100x8000000000000000541101Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:47.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.48c67bf21ac77d742021-12-21 11:33:47.944root 11241100x8000000000000000541102Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:47.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.eff50189990502742021-12-21 11:33:47.944root 11241100x8000000000000000541103Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:47.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.216a416c6ff69c402021-12-21 11:33:47.944root 11241100x8000000000000000541104Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:47.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.53398d626f249e712021-12-21 11:33:47.944root 11241100x8000000000000000541105Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:47.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b8769c3fd9d7d1ea2021-12-21 11:33:47.944root 11241100x8000000000000000541106Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:47.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4e3cdfae284eaa0c2021-12-21 11:33:47.944root 11241100x8000000000000000541107Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:47.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6419e7f1459910682021-12-21 11:33:47.944root 11241100x8000000000000000541108Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:47.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.87ff6c6f0dcd652c2021-12-21 11:33:47.944root 11241100x8000000000000000541109Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:47.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1cef15198f55a18f2021-12-21 11:33:47.944root 11241100x8000000000000000541110Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:47.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2e2e1dbd456e7e432021-12-21 11:33:47.944root 11241100x8000000000000000541111Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:47.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.203c30f9d422f5822021-12-21 11:33:47.945root 11241100x8000000000000000541112Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:47.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.262cf0b0eed0d1752021-12-21 11:33:47.945root 11241100x8000000000000000541113Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:47.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f1d071b005263d0d2021-12-21 11:33:47.945root 11241100x8000000000000000541114Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:47.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b0d1c84a483684f32021-12-21 11:33:47.945root 11241100x8000000000000000541115Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:47.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.89cdfbd228641f732021-12-21 11:33:47.945root 11241100x8000000000000000541116Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:48.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.49d0dbdbed4d5f2c2021-12-21 11:33:48.443root 11241100x8000000000000000541117Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:48.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8c38aac56ff608462021-12-21 11:33:48.443root 11241100x8000000000000000541118Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:48.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7f69a0a0b32e46eb2021-12-21 11:33:48.443root 11241100x8000000000000000541119Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:48.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.610048e3b74aed802021-12-21 11:33:48.443root 11241100x8000000000000000541120Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:48.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2a8fad696819b32f2021-12-21 11:33:48.444root 11241100x8000000000000000541121Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:48.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.dc4c41acb756d2842021-12-21 11:33:48.444root 11241100x8000000000000000541122Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:48.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.bf9790e01e6711742021-12-21 11:33:48.444root 11241100x8000000000000000541123Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:48.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.97485159fcc8f8f82021-12-21 11:33:48.444root 11241100x8000000000000000541124Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:48.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4969eee650fa281b2021-12-21 11:33:48.444root 11241100x8000000000000000541125Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:48.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2c9916829ec830412021-12-21 11:33:48.444root 11241100x8000000000000000541126Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:48.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f80435de28565fe92021-12-21 11:33:48.444root 11241100x8000000000000000541127Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:48.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2e8c64fbc2bf84f32021-12-21 11:33:48.444root 11241100x8000000000000000541128Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:48.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ced27395572301342021-12-21 11:33:48.444root 11241100x8000000000000000541129Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:48.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.59280e992bb8b21b2021-12-21 11:33:48.444root 11241100x8000000000000000541130Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:48.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9a6310d20e90d90c2021-12-21 11:33:48.444root 11241100x8000000000000000541131Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:48.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.cd0574f3a7879ed62021-12-21 11:33:48.444root 11241100x8000000000000000541132Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:48.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d0ab67560b805ed02021-12-21 11:33:48.444root 11241100x8000000000000000541133Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:48.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0328d1d9d5e9b3ef2021-12-21 11:33:48.444root 11241100x8000000000000000541134Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:48.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.167c978ce0410cb02021-12-21 11:33:48.444root 11241100x8000000000000000541135Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:48.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0a2b566e2aa2f6082021-12-21 11:33:48.444root 11241100x8000000000000000541136Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:48.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4c9958ec8cb63adf2021-12-21 11:33:48.445root 11241100x8000000000000000541137Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:48.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9e4c49c2f6c14c682021-12-21 11:33:48.445root 11241100x8000000000000000541138Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:48.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.98f875e1669709d02021-12-21 11:33:48.943root 11241100x8000000000000000541139Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:48.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0bc160db3663fbce2021-12-21 11:33:48.943root 11241100x8000000000000000541140Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:48.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.fc440215f7f9b2652021-12-21 11:33:48.944root 11241100x8000000000000000541141Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:48.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.65c3def2acaddff82021-12-21 11:33:48.944root 11241100x8000000000000000541142Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:48.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.eeee1bbd7c112b6b2021-12-21 11:33:48.944root 11241100x8000000000000000541143Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:48.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7256b3b19ed6b0c82021-12-21 11:33:48.944root 11241100x8000000000000000541144Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:48.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.43bdf0ccb42c3a3a2021-12-21 11:33:48.944root 11241100x8000000000000000541145Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:48.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ed4e9351cc05286e2021-12-21 11:33:48.944root 11241100x8000000000000000541146Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:48.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.512c759fcec77ad62021-12-21 11:33:48.944root 11241100x8000000000000000541147Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:48.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.bca78790b7143d6c2021-12-21 11:33:48.944root 11241100x8000000000000000541148Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:48.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7fee35dc6b5e535f2021-12-21 11:33:48.944root 11241100x8000000000000000541149Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:48.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9386156ab76b9d982021-12-21 11:33:48.944root 11241100x8000000000000000541150Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:48.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.586d62254d6f91bd2021-12-21 11:33:48.944root 11241100x8000000000000000541151Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:48.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d8f36a2d7e9dbaf22021-12-21 11:33:48.944root 11241100x8000000000000000541152Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:48.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ce822e38f90a92bf2021-12-21 11:33:48.944root 11241100x8000000000000000541153Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:48.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.00ac217642f159332021-12-21 11:33:48.944root 11241100x8000000000000000541154Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:48.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.fc24f8e2537a7bc02021-12-21 11:33:48.944root 11241100x8000000000000000541155Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:48.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0d177d7c05d662492021-12-21 11:33:48.945root 11241100x8000000000000000541156Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:48.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.26d33a69275df92d2021-12-21 11:33:48.945root 11241100x8000000000000000541157Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:48.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4b5af3bbdb6af0d42021-12-21 11:33:48.945root 11241100x8000000000000000541158Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:48.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3d5c850b3e4c5e3d2021-12-21 11:33:48.945root 11241100x8000000000000000541159Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:48.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.820b44ccb957d3072021-12-21 11:33:48.945root 11241100x8000000000000000541160Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:49.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d0921a6181ba52362021-12-21 11:33:49.443root 11241100x8000000000000000541161Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:49.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e5bf800b3ca98ba42021-12-21 11:33:49.443root 11241100x8000000000000000541162Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:49.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8e5c12eb3d632c172021-12-21 11:33:49.443root 11241100x8000000000000000541163Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:49.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.065271bb8dea5f102021-12-21 11:33:49.443root 11241100x8000000000000000541164Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:49.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.386812d75e796a342021-12-21 11:33:49.444root 11241100x8000000000000000541165Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:49.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.78005934cebce7862021-12-21 11:33:49.444root 11241100x8000000000000000541166Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:49.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8e94974beeae95fb2021-12-21 11:33:49.444root 11241100x8000000000000000541167Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:49.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.58ae73425130f1d42021-12-21 11:33:49.444root 11241100x8000000000000000541168Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:49.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.10e6979c4f48bd502021-12-21 11:33:49.444root 11241100x8000000000000000541169Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:49.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2b2c5d2a8c1cf4db2021-12-21 11:33:49.444root 11241100x8000000000000000541170Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:49.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.16c0ba8708c24f862021-12-21 11:33:49.444root 11241100x8000000000000000541171Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:49.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.afc151bda671288d2021-12-21 11:33:49.444root 11241100x8000000000000000541172Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:49.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.744325737bd67b7e2021-12-21 11:33:49.444root 11241100x8000000000000000541173Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:49.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4ae9c7ed6b06e2812021-12-21 11:33:49.444root 11241100x8000000000000000541174Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:49.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1c602451c532c3722021-12-21 11:33:49.444root 11241100x8000000000000000541175Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:49.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.56eecaa258b9bcc72021-12-21 11:33:49.444root 11241100x8000000000000000541176Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:49.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.20b4fbc5e3d407632021-12-21 11:33:49.444root 11241100x8000000000000000541177Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:49.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.60bc49200d933f772021-12-21 11:33:49.444root 11241100x8000000000000000541178Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:49.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.970cbf1094aa6b8e2021-12-21 11:33:49.444root 11241100x8000000000000000541179Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:49.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c642540e8fe232922021-12-21 11:33:49.445root 11241100x8000000000000000541180Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:49.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.639e918a21925e962021-12-21 11:33:49.445root 11241100x8000000000000000541181Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:49.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.67c090c7ed8c31b52021-12-21 11:33:49.445root 11241100x8000000000000000541182Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:49.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.807f9df1684631ad2021-12-21 11:33:49.943root 11241100x8000000000000000541183Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:49.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d6271e439730f2f12021-12-21 11:33:49.943root 11241100x8000000000000000541184Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:49.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.190838d5c94b54d92021-12-21 11:33:49.943root 11241100x8000000000000000541185Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:49.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.819631e7dcef0edb2021-12-21 11:33:49.943root 11241100x8000000000000000541186Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:49.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b3ef0404cce860862021-12-21 11:33:49.944root 11241100x8000000000000000541187Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:49.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d28655ff1f21abcf2021-12-21 11:33:49.944root 11241100x8000000000000000541188Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:49.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f69ee50482045bcf2021-12-21 11:33:49.944root 11241100x8000000000000000541189Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:49.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.cbb8f577662a89512021-12-21 11:33:49.944root 11241100x8000000000000000541190Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:49.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f6722d205bd2e01c2021-12-21 11:33:49.944root 11241100x8000000000000000541191Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:49.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.01f6838b9699568c2021-12-21 11:33:49.944root 11241100x8000000000000000541192Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:49.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.83ee1b62e9b549342021-12-21 11:33:49.944root 11241100x8000000000000000541193Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:49.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.27f280d7039bd6902021-12-21 11:33:49.944root 11241100x8000000000000000541194Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:49.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a264722c804cf5c62021-12-21 11:33:49.944root 11241100x8000000000000000541195Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:49.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3a3d07b182c5808d2021-12-21 11:33:49.944root 11241100x8000000000000000541196Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:49.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.471fa69078b879ba2021-12-21 11:33:49.944root 11241100x8000000000000000541197Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:49.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.fb99a09c17322af62021-12-21 11:33:49.944root 11241100x8000000000000000541198Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:49.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5a2332981f3420592021-12-21 11:33:49.944root 11241100x8000000000000000541199Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:49.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ffaeaf6b82db709c2021-12-21 11:33:49.944root 11241100x8000000000000000541200Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:49.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9d3f859706542d222021-12-21 11:33:49.944root 11241100x8000000000000000541201Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:49.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d10b29262e4685ed2021-12-21 11:33:49.945root 11241100x8000000000000000541202Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:49.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.168ab0a1d13bd4ca2021-12-21 11:33:49.945root 11241100x8000000000000000541203Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:49.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a917c1883ac4586e2021-12-21 11:33:49.945root 354300x8000000000000000541204Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:50.077{ec2b6afe-95d9-61c1-5175-3a0400000000}5346/opt/splunkforwarder/etc/apps/Splunk_TA_stream/linux_x86_64/bin/streamfwdroottcptruefalse10.0.1.25-48726-false10.0.1.12-8000- 11241100x8000000000000000541205Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:50.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.24993d51d7b293512021-12-21 11:33:50.443root 11241100x8000000000000000541206Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:50.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f1245dbe629d6f182021-12-21 11:33:50.443root 11241100x8000000000000000541207Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:50.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2476b184f1a947482021-12-21 11:33:50.443root 11241100x8000000000000000541208Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:50.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ffe9bf93132e14fa2021-12-21 11:33:50.443root 11241100x8000000000000000541209Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:50.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.88d5dba52ec2016e2021-12-21 11:33:50.444root 11241100x8000000000000000541210Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:50.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d6ce164acf6e82782021-12-21 11:33:50.444root 11241100x8000000000000000541211Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:50.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.978e88188185f9682021-12-21 11:33:50.444root 11241100x8000000000000000541212Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:50.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1ec7a3c76caf34692021-12-21 11:33:50.444root 11241100x8000000000000000541213Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:50.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.570c8e5578f50c412021-12-21 11:33:50.444root 11241100x8000000000000000541214Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:50.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.801d8ead6ec9e11a2021-12-21 11:33:50.444root 11241100x8000000000000000541215Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:50.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2e56149db41c34f62021-12-21 11:33:50.444root 11241100x8000000000000000541216Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:50.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8ea4b2dfc41bce152021-12-21 11:33:50.444root 11241100x8000000000000000541217Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:50.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5c16e56017640a292021-12-21 11:33:50.444root 11241100x8000000000000000541218Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:50.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3481eabb86ff16072021-12-21 11:33:50.444root 11241100x8000000000000000541219Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:50.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.495a356e962a49d92021-12-21 11:33:50.444root 11241100x8000000000000000541220Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:50.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.19959a976e5c03122021-12-21 11:33:50.444root 11241100x8000000000000000541221Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:50.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2052c186e0c201bd2021-12-21 11:33:50.444root 11241100x8000000000000000541222Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:50.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5563e233db9daadd2021-12-21 11:33:50.444root 11241100x8000000000000000541223Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:50.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c23a5e5594813cfb2021-12-21 11:33:50.444root 11241100x8000000000000000541224Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:50.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.200d68c1bbd311312021-12-21 11:33:50.445root 11241100x8000000000000000541225Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:50.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e8143b128bbccd872021-12-21 11:33:50.445root 11241100x8000000000000000541226Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:50.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8ab10fa242e069c32021-12-21 11:33:50.445root 11241100x8000000000000000541227Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:50.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4df47eb14838ac4d2021-12-21 11:33:50.445root 11241100x8000000000000000541228Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:50.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.51399ea79d817de92021-12-21 11:33:50.943root 11241100x8000000000000000541229Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:50.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0915f72837beb66c2021-12-21 11:33:50.943root 11241100x8000000000000000541230Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:50.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3ec988c43148b8152021-12-21 11:33:50.943root 11241100x8000000000000000541231Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:50.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5159c5e255edfea12021-12-21 11:33:50.944root 11241100x8000000000000000541232Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:50.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0b58f6f1ea4688472021-12-21 11:33:50.944root 11241100x8000000000000000541233Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:50.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.16c8e5c3fdcea1bf2021-12-21 11:33:50.944root 11241100x8000000000000000541234Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:50.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6806a9f19ea9a0be2021-12-21 11:33:50.944root 11241100x8000000000000000541235Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:50.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.403a3450a6ed4c5b2021-12-21 11:33:50.944root 11241100x8000000000000000541236Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:50.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3c1919f4e6af2dec2021-12-21 11:33:50.944root 11241100x8000000000000000541237Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:50.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c2c0c28a7ebec6fc2021-12-21 11:33:50.944root 11241100x8000000000000000541238Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:50.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5e00adea516db2442021-12-21 11:33:50.944root 11241100x8000000000000000541239Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:50.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2e049b44b4163c702021-12-21 11:33:50.944root 11241100x8000000000000000541240Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:50.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a01197a147539f382021-12-21 11:33:50.944root 11241100x8000000000000000541241Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:50.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0f78c347dc4d1c5c2021-12-21 11:33:50.944root 11241100x8000000000000000541242Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:50.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6b66888f97d4f6ad2021-12-21 11:33:50.944root 11241100x8000000000000000541243Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:50.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.bb5e6555846821a32021-12-21 11:33:50.944root 11241100x8000000000000000541244Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:50.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ecfc0f4e8a0b0d052021-12-21 11:33:50.945root 11241100x8000000000000000541245Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:50.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.89afd8562c9c80d92021-12-21 11:33:50.945root 11241100x8000000000000000541246Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:50.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.87bc0e46da5058e82021-12-21 11:33:50.945root 11241100x8000000000000000541247Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:50.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2dc36c037970fa6c2021-12-21 11:33:50.945root 11241100x8000000000000000541248Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:50.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ca2566ed371a1c672021-12-21 11:33:50.945root 11241100x8000000000000000541249Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:50.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6a63904c5b86e9ed2021-12-21 11:33:50.945root 11241100x8000000000000000541250Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:50.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7bdc2e0eade8c9b32021-12-21 11:33:50.945root 11241100x8000000000000000541251Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:51.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a27a3123bb4567652021-12-21 11:33:51.443root 11241100x8000000000000000541252Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:51.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.59c532780a7453082021-12-21 11:33:51.443root 11241100x8000000000000000541253Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:51.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0b644b8582d410222021-12-21 11:33:51.443root 11241100x8000000000000000541254Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:51.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.263a4516f6ea95c82021-12-21 11:33:51.443root 11241100x8000000000000000541255Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:51.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.50f12ae281cb9f252021-12-21 11:33:51.444root 11241100x8000000000000000541256Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:51.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d934d3c3f75a687d2021-12-21 11:33:51.444root 11241100x8000000000000000541257Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:51.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0dbf3fbf7a9a3cc92021-12-21 11:33:51.444root 11241100x8000000000000000541258Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:51.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1a1682877b7a6e242021-12-21 11:33:51.444root 11241100x8000000000000000541259Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:51.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d379e9ea8f19dad22021-12-21 11:33:51.444root 11241100x8000000000000000541260Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:51.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f42c34a97820f48d2021-12-21 11:33:51.444root 11241100x8000000000000000541261Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:51.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.52656c440a33069d2021-12-21 11:33:51.444root 11241100x8000000000000000541262Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:51.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.82a288be287414642021-12-21 11:33:51.445root 11241100x8000000000000000541263Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:51.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5a626a9231247c892021-12-21 11:33:51.445root 11241100x8000000000000000541264Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:51.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.179463418d2882152021-12-21 11:33:51.445root 11241100x8000000000000000541265Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:51.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.74e064d8f26e6e502021-12-21 11:33:51.445root 11241100x8000000000000000541266Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:51.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e2473a8e0b7f7d4c2021-12-21 11:33:51.445root 11241100x8000000000000000541267Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:51.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.28b9b5f3655562532021-12-21 11:33:51.445root 11241100x8000000000000000541268Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:51.446{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.70dc51fef63cd5fb2021-12-21 11:33:51.446root 11241100x8000000000000000541269Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:51.446{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7d4b971679f013f32021-12-21 11:33:51.446root 11241100x8000000000000000541270Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:51.446{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3b93f524b59486c12021-12-21 11:33:51.446root 11241100x8000000000000000541271Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:51.446{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.575c5ccb80e40ce92021-12-21 11:33:51.446root 11241100x8000000000000000541272Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:51.446{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.91d6ad2e6127e3b72021-12-21 11:33:51.446root 11241100x8000000000000000541273Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:51.446{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8b649a74ed42a52c2021-12-21 11:33:51.446root 11241100x8000000000000000541274Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:51.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.46a368b335d42eec2021-12-21 11:33:51.943root 11241100x8000000000000000541275Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:51.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.064125bad411fede2021-12-21 11:33:51.943root 11241100x8000000000000000541276Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:51.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9b997a2e73cf1de02021-12-21 11:33:51.944root 11241100x8000000000000000541277Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:51.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.809e24a4a62ec8aa2021-12-21 11:33:51.944root 11241100x8000000000000000541278Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:51.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ab55fe7abad4babe2021-12-21 11:33:51.944root 11241100x8000000000000000541279Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:51.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a0c84cbbed4a323d2021-12-21 11:33:51.944root 11241100x8000000000000000541280Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:51.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.91457599938ebd312021-12-21 11:33:51.945root 11241100x8000000000000000541281Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:51.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.58cdbc22ed0091772021-12-21 11:33:51.945root 11241100x8000000000000000541282Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:51.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5ee36a838bf430b52021-12-21 11:33:51.945root 11241100x8000000000000000541283Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:51.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2337d804b9381fad2021-12-21 11:33:51.945root 11241100x8000000000000000541284Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:51.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e299f4d1736d67352021-12-21 11:33:51.945root 11241100x8000000000000000541285Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:51.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ccec5648ec23cad22021-12-21 11:33:51.945root 11241100x8000000000000000541286Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:51.946{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.841c3d05c6e4ea7a2021-12-21 11:33:51.946root 11241100x8000000000000000541287Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:51.946{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.bd192fba3ce9a2f42021-12-21 11:33:51.946root 11241100x8000000000000000541288Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:51.946{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9ea20bed6c0de8d72021-12-21 11:33:51.946root 11241100x8000000000000000541289Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:51.946{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3375ae57d6a4dec42021-12-21 11:33:51.946root 11241100x8000000000000000541290Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:51.946{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.813b0d3d482eed762021-12-21 11:33:51.946root 11241100x8000000000000000541291Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:51.947{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d0f45891b1a8e46e2021-12-21 11:33:51.947root 11241100x8000000000000000541292Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:51.947{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.17843ecf3cce47602021-12-21 11:33:51.947root 11241100x8000000000000000541293Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:51.947{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9a024aa4652902952021-12-21 11:33:51.947root 11241100x8000000000000000541294Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:51.947{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.36755032c322cf812021-12-21 11:33:51.947root 11241100x8000000000000000541295Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:51.947{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2a92ce36aa155b772021-12-21 11:33:51.947root 11241100x8000000000000000541296Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:51.948{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7bfcfbe96a6628352021-12-21 11:33:51.948root 11241100x8000000000000000541297Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:52.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.60ade9138de12c1b2021-12-21 11:33:52.443root 11241100x8000000000000000541298Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:52.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a4b641482487859e2021-12-21 11:33:52.443root 11241100x8000000000000000541299Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:52.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.998b8ea997a099a12021-12-21 11:33:52.443root 11241100x8000000000000000541300Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:52.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.747af00474a0ae832021-12-21 11:33:52.443root 11241100x8000000000000000541301Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:52.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b72182bd270841182021-12-21 11:33:52.443root 11241100x8000000000000000541302Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:52.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e94ae134db9c24f72021-12-21 11:33:52.443root 11241100x8000000000000000541303Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:52.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f7ad1602d27df56a2021-12-21 11:33:52.443root 11241100x8000000000000000541304Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:52.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1845872ddfcf68a32021-12-21 11:33:52.444root 11241100x8000000000000000541305Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:52.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9d2408eb73b3854d2021-12-21 11:33:52.444root 11241100x8000000000000000541306Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:52.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.324137e5a1dedc1b2021-12-21 11:33:52.444root 11241100x8000000000000000541307Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:52.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d9291728033285552021-12-21 11:33:52.444root 11241100x8000000000000000541308Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:52.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.54d5f665406a77b42021-12-21 11:33:52.444root 11241100x8000000000000000541309Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:52.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1be344b9ff0ebeb22021-12-21 11:33:52.444root 11241100x8000000000000000541310Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:52.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b18fe08aee1ca4a02021-12-21 11:33:52.444root 11241100x8000000000000000541311Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:52.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.363c6ea4f58de81a2021-12-21 11:33:52.444root 11241100x8000000000000000541312Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:52.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7f5e11e89bbac1582021-12-21 11:33:52.444root 11241100x8000000000000000541313Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:52.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b9e56873230838212021-12-21 11:33:52.444root 11241100x8000000000000000541314Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:52.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9c576421c50c33312021-12-21 11:33:52.444root 11241100x8000000000000000541315Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:52.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.cfe97a452b53d8cf2021-12-21 11:33:52.444root 11241100x8000000000000000541316Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:52.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a80e247c91e2624c2021-12-21 11:33:52.444root 11241100x8000000000000000541317Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:52.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3b93bcd2da7f2cea2021-12-21 11:33:52.444root 11241100x8000000000000000541318Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:52.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.599d280a711469632021-12-21 11:33:52.445root 11241100x8000000000000000541319Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:52.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b50ab9059175f5742021-12-21 11:33:52.445root 11241100x8000000000000000541320Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:52.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3cb7b28688fc85f52021-12-21 11:33:52.445root 11241100x8000000000000000541321Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:52.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8746af3eec6f7b302021-12-21 11:33:52.445root 11241100x8000000000000000541322Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:52.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.536b0231a636540c2021-12-21 11:33:52.445root 11241100x8000000000000000541323Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:52.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.19eb636cd7f630ff2021-12-21 11:33:52.445root 11241100x8000000000000000541324Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:52.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8bc7a873c3fa836d2021-12-21 11:33:52.445root 11241100x8000000000000000541325Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:52.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2e38f581e5ad9e632021-12-21 11:33:52.445root 11241100x8000000000000000541326Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:52.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e3e6ee21dd34448f2021-12-21 11:33:52.445root 11241100x8000000000000000541327Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:52.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9cb771f448895a092021-12-21 11:33:52.445root 11241100x8000000000000000541328Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:52.446{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5db5fcc1cff987292021-12-21 11:33:52.446root 11241100x8000000000000000541329Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:52.446{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.eeb212c08920f7bf2021-12-21 11:33:52.446root 11241100x8000000000000000541330Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:52.446{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b916b96468dc72e82021-12-21 11:33:52.446root 11241100x8000000000000000541331Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:52.446{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.17bdb017b534ee362021-12-21 11:33:52.446root 11241100x8000000000000000541332Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:52.446{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.307b6a1bf23cc5092021-12-21 11:33:52.446root 11241100x8000000000000000541333Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:52.446{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d0e2f5f1d086a04a2021-12-21 11:33:52.446root 11241100x8000000000000000541334Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:52.446{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.177ed4c2319a83212021-12-21 11:33:52.446root 11241100x8000000000000000541335Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:52.446{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3ec9280a96a8cdb32021-12-21 11:33:52.446root 11241100x8000000000000000541336Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:52.447{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d04ee0d1402093622021-12-21 11:33:52.447root 11241100x8000000000000000541337Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:52.447{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.159ad9cd3bda62852021-12-21 11:33:52.447root 11241100x8000000000000000541338Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:52.447{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8c14acfa70bcba042021-12-21 11:33:52.447root 11241100x8000000000000000541339Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:52.448{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.aeb38fed71dc017c2021-12-21 11:33:52.448root 11241100x8000000000000000541340Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:52.448{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.167c71fecffddfd42021-12-21 11:33:52.448root 11241100x8000000000000000541341Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:52.448{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b45d4ca9efd471d92021-12-21 11:33:52.448root 11241100x8000000000000000541342Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:52.448{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7c9f8db86a1cf4852021-12-21 11:33:52.448root 11241100x8000000000000000541343Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:52.448{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.61bf5cd5d527f1cf2021-12-21 11:33:52.448root 11241100x8000000000000000541344Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:52.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3abac573d72f85f52021-12-21 11:33:52.943root 11241100x8000000000000000541345Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:52.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.75ef6074de6594152021-12-21 11:33:52.943root 11241100x8000000000000000541346Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:52.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.69bd7c84e590f1d62021-12-21 11:33:52.943root 11241100x8000000000000000541347Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:52.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8932e94a52febbd02021-12-21 11:33:52.944root 11241100x8000000000000000541348Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:52.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7a3ef6dcea1add832021-12-21 11:33:52.944root 11241100x8000000000000000541349Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:52.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.254bc58e8a4977bb2021-12-21 11:33:52.944root 11241100x8000000000000000541350Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:52.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.bfe5a15b62355cec2021-12-21 11:33:52.944root 11241100x8000000000000000541351Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:52.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.099086acbe7473472021-12-21 11:33:52.944root 11241100x8000000000000000541352Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:52.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.541bcfeb38ed78892021-12-21 11:33:52.944root 11241100x8000000000000000541353Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:52.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.05b60c09922bcd7f2021-12-21 11:33:52.944root 11241100x8000000000000000541354Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:52.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5ce642bf9c3b1d9b2021-12-21 11:33:52.944root 11241100x8000000000000000541355Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:52.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ef711815d73b27ca2021-12-21 11:33:52.945root 11241100x8000000000000000541356Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:52.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f646acfec49ad7722021-12-21 11:33:52.945root 11241100x8000000000000000541357Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:52.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.71c00807dbb021a52021-12-21 11:33:52.945root 11241100x8000000000000000541358Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:52.946{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e08262eea719f7862021-12-21 11:33:52.946root 11241100x8000000000000000541359Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:52.946{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.304cc1fa9de861e82021-12-21 11:33:52.946root 11241100x8000000000000000541360Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:52.946{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a01f9624d1479aeb2021-12-21 11:33:52.946root 11241100x8000000000000000541361Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:52.946{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2521849b946d32e72021-12-21 11:33:52.946root 11241100x8000000000000000541362Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:52.946{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.86ac5dd56a7a0c762021-12-21 11:33:52.946root 11241100x8000000000000000541363Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:52.946{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.acfa418fc9aed7852021-12-21 11:33:52.946root 11241100x8000000000000000541364Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:52.946{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2f26a3844ae139582021-12-21 11:33:52.946root 11241100x8000000000000000541365Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:52.946{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4366cb065d5ec9b42021-12-21 11:33:52.946root 11241100x8000000000000000541366Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:52.946{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9470d948372bd5d22021-12-21 11:33:52.946root 11241100x8000000000000000541367Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:53.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b997186d5218a90e2021-12-21 11:33:53.443root 11241100x8000000000000000541368Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:53.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c9f3559db088d8602021-12-21 11:33:53.443root 11241100x8000000000000000541369Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:53.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f1b427cd49dbaae02021-12-21 11:33:53.443root 11241100x8000000000000000541370Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:53.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9d4e12103cc6b20c2021-12-21 11:33:53.444root 11241100x8000000000000000541371Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:53.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5e0e1f3338ab31552021-12-21 11:33:53.444root 11241100x8000000000000000541372Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:53.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.334879e2806a030e2021-12-21 11:33:53.444root 11241100x8000000000000000541373Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:53.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1d1a6730305c98d72021-12-21 11:33:53.444root 11241100x8000000000000000541374Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:53.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6ebe2ee0318803372021-12-21 11:33:53.444root 11241100x8000000000000000541375Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:53.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a09182a452b831a42021-12-21 11:33:53.444root 11241100x8000000000000000541376Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:53.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5d381170cb6bc0e82021-12-21 11:33:53.444root 11241100x8000000000000000541377Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:53.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.94f8df8a386efa4a2021-12-21 11:33:53.444root 11241100x8000000000000000541378Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:53.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f8a32241360e855c2021-12-21 11:33:53.444root 11241100x8000000000000000541379Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:53.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5e225d9978caa6bc2021-12-21 11:33:53.444root 11241100x8000000000000000541380Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:53.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b5e84f8f1f1f0c942021-12-21 11:33:53.445root 11241100x8000000000000000541381Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:53.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.04812f46769fe1cc2021-12-21 11:33:53.445root 11241100x8000000000000000541382Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:53.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.86ab8d624909ca232021-12-21 11:33:53.445root 11241100x8000000000000000541383Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:53.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ecd3e5595e2047ab2021-12-21 11:33:53.445root 11241100x8000000000000000541384Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:53.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a7e0cec626dca8542021-12-21 11:33:53.445root 11241100x8000000000000000541385Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:53.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3089885e74ef7c722021-12-21 11:33:53.445root 11241100x8000000000000000541386Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:53.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b40af096058a43a02021-12-21 11:33:53.445root 11241100x8000000000000000541387Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:53.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6d5e6b1eefbd225c2021-12-21 11:33:53.445root 11241100x8000000000000000541388Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:53.446{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1f3c8dbbd8efeecf2021-12-21 11:33:53.446root 11241100x8000000000000000541389Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:53.446{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.734988c8c13952882021-12-21 11:33:53.446root 11241100x8000000000000000541390Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:53.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c661dfe4e9b1a5e22021-12-21 11:33:53.943root 11241100x8000000000000000541391Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:53.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f697dd964ba0259d2021-12-21 11:33:53.943root 11241100x8000000000000000541392Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:53.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b30ac4a8177864ff2021-12-21 11:33:53.943root 11241100x8000000000000000541393Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:53.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b1202f8f1efa6d292021-12-21 11:33:53.944root 11241100x8000000000000000541394Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:53.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.aca7a892e253cb8d2021-12-21 11:33:53.944root 11241100x8000000000000000541395Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:53.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0b57a0e2b4262d872021-12-21 11:33:53.944root 11241100x8000000000000000541396Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:53.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.441fd4bc015e8eae2021-12-21 11:33:53.944root 11241100x8000000000000000541397Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:53.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.13679cd0f5b94fac2021-12-21 11:33:53.944root 11241100x8000000000000000541398Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:53.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.74e3ebb39dd9b27f2021-12-21 11:33:53.944root 11241100x8000000000000000541399Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:53.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.17a2ee29399a14602021-12-21 11:33:53.944root 11241100x8000000000000000541400Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:53.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4ecf4ea1452c8ab42021-12-21 11:33:53.944root 11241100x8000000000000000541401Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:53.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e07c8b62d1ea42532021-12-21 11:33:53.944root 11241100x8000000000000000541402Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:53.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.819835599e49d2112021-12-21 11:33:53.944root 11241100x8000000000000000541403Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:53.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f2f58065881c7b002021-12-21 11:33:53.945root 11241100x8000000000000000541404Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:53.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8f8bf4f880e939fb2021-12-21 11:33:53.945root 11241100x8000000000000000541405Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:53.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.17a4a5517498b54d2021-12-21 11:33:53.945root 11241100x8000000000000000541406Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:53.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.24505b320f9b5b8f2021-12-21 11:33:53.945root 11241100x8000000000000000541407Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:53.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8d23d4304d0d64302021-12-21 11:33:53.945root 11241100x8000000000000000541408Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:53.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f565548f9d733e532021-12-21 11:33:53.945root 11241100x8000000000000000541409Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:53.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c272956b3d704de92021-12-21 11:33:53.945root 11241100x8000000000000000541410Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:53.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.868cab8468cc89b62021-12-21 11:33:53.945root 11241100x8000000000000000541411Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:53.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7ae001b304c252882021-12-21 11:33:53.945root 11241100x8000000000000000541412Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:53.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.62a204f2834a9aec2021-12-21 11:33:53.945root 11241100x8000000000000000541413Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:54.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f2009de0c09f1f2b2021-12-21 11:33:54.443root 11241100x8000000000000000541414Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:54.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1ce5214d4c000b0c2021-12-21 11:33:54.443root 11241100x8000000000000000541415Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:54.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.724c3551dafccffe2021-12-21 11:33:54.443root 11241100x8000000000000000541416Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:54.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.cdf15d7dfc86cb542021-12-21 11:33:54.443root 11241100x8000000000000000541417Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:54.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.cb86992564ac40ce2021-12-21 11:33:54.443root 11241100x8000000000000000541418Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:54.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f184b539f769ee292021-12-21 11:33:54.444root 11241100x8000000000000000541419Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:54.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b0945783195982572021-12-21 11:33:54.444root 11241100x8000000000000000541420Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:54.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5136124bf7268f1a2021-12-21 11:33:54.444root 11241100x8000000000000000541421Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:54.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.23e4bf45d5235e232021-12-21 11:33:54.444root 11241100x8000000000000000541422Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:54.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.73d7ad33a39a70472021-12-21 11:33:54.444root 11241100x8000000000000000541423Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:54.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d380a2a0eab87ce62021-12-21 11:33:54.444root 11241100x8000000000000000541424Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:54.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7fd151d6ce2a1f3a2021-12-21 11:33:54.444root 11241100x8000000000000000541425Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:54.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1e2d4f40dfc1d6a52021-12-21 11:33:54.444root 11241100x8000000000000000541426Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:54.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.98bb8244600eb7d12021-12-21 11:33:54.444root 11241100x8000000000000000541427Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:54.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c46f951fc9694c262021-12-21 11:33:54.444root 11241100x8000000000000000541428Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:54.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.cbb8b2da35f5c6202021-12-21 11:33:54.445root 11241100x8000000000000000541429Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:54.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.bf1b493b0a31028f2021-12-21 11:33:54.445root 11241100x8000000000000000541430Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:54.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.084af5a2dae0b2342021-12-21 11:33:54.445root 11241100x8000000000000000541431Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:54.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0f58089096baf4ac2021-12-21 11:33:54.445root 11241100x8000000000000000541432Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:54.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d95e6ddb27e1673f2021-12-21 11:33:54.445root 11241100x8000000000000000541433Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:54.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0b8797417dd71a332021-12-21 11:33:54.445root 11241100x8000000000000000541434Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:54.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.011d2258dd0366c02021-12-21 11:33:54.445root 11241100x8000000000000000541435Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:54.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e71736d5ffd171d92021-12-21 11:33:54.445root 11241100x8000000000000000541436Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:54.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.64d2b8823526e6af2021-12-21 11:33:54.943root 11241100x8000000000000000541437Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:54.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d5a7f3ac8589993b2021-12-21 11:33:54.943root 11241100x8000000000000000541438Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:54.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7dc1ee8b9b6ea14e2021-12-21 11:33:54.944root 11241100x8000000000000000541439Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:54.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.beb7a69d35c9e0fc2021-12-21 11:33:54.944root 11241100x8000000000000000541440Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:54.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0c1f60e8374236662021-12-21 11:33:54.944root 11241100x8000000000000000541441Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:54.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a808e2a922ef12c62021-12-21 11:33:54.944root 11241100x8000000000000000541442Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:54.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.64e6a92775e5ff8e2021-12-21 11:33:54.944root 11241100x8000000000000000541443Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:54.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.08e1ef0ec42552372021-12-21 11:33:54.945root 11241100x8000000000000000541444Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:54.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1ad71269fe860a562021-12-21 11:33:54.945root 11241100x8000000000000000541445Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:54.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7e8f6d4e6db432582021-12-21 11:33:54.945root 11241100x8000000000000000541446Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:54.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4e0af3d3956e05962021-12-21 11:33:54.945root 11241100x8000000000000000541447Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:54.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c8054d11bd848d352021-12-21 11:33:54.945root 11241100x8000000000000000541448Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:54.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9cbe57f80a0018ff2021-12-21 11:33:54.945root 11241100x8000000000000000541449Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:54.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9c39c47cc135ebc22021-12-21 11:33:54.945root 11241100x8000000000000000541450Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:54.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c267f10ee5d60c1a2021-12-21 11:33:54.945root 11241100x8000000000000000541451Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:54.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f73751fd337612e92021-12-21 11:33:54.945root 11241100x8000000000000000541452Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:54.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.61e63458931825f32021-12-21 11:33:54.945root 11241100x8000000000000000541453Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:54.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ad72be9b3761b7982021-12-21 11:33:54.945root 11241100x8000000000000000541454Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:54.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c4b20b9509c940f62021-12-21 11:33:54.945root 11241100x8000000000000000541455Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:54.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c4ee307f5bb6ab902021-12-21 11:33:54.945root 11241100x8000000000000000541456Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:54.946{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.bda82a81258379292021-12-21 11:33:54.946root 11241100x8000000000000000541457Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:54.946{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.91d4a6f7a80422402021-12-21 11:33:54.946root 11241100x8000000000000000541458Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:54.946{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.88f4757d3173fd222021-12-21 11:33:54.946root 354300x8000000000000000541459Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:55.151{ec2b6afe-95d9-61c1-5175-3a0400000000}5346/opt/splunkforwarder/etc/apps/Splunk_TA_stream/linux_x86_64/bin/streamfwdroottcptruefalse10.0.1.25-48728-false10.0.1.12-8000- 11241100x8000000000000000541460Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:55.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.981b436c17f7ca6e2021-12-21 11:33:55.443root 11241100x8000000000000000541461Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:55.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6ef6d5345d1f37ff2021-12-21 11:33:55.443root 11241100x8000000000000000541462Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:55.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.83a4c179c9fb424b2021-12-21 11:33:55.443root 11241100x8000000000000000541463Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:55.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8bb2d8d89bd524462021-12-21 11:33:55.444root 11241100x8000000000000000541464Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:55.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.973c71f0eb5b339d2021-12-21 11:33:55.444root 11241100x8000000000000000541465Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:55.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6c30bdcd0f2c25552021-12-21 11:33:55.444root 11241100x8000000000000000541466Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:55.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5bc876cd362f1c622021-12-21 11:33:55.444root 11241100x8000000000000000541467Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:55.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b381d022f49f14fa2021-12-21 11:33:55.445root 11241100x8000000000000000541468Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:55.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.02570882743c60552021-12-21 11:33:55.445root 11241100x8000000000000000541469Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:55.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7c5462eef34bbcd72021-12-21 11:33:55.445root 11241100x8000000000000000541470Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:55.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6bc8a8dc0b3157f42021-12-21 11:33:55.445root 11241100x8000000000000000541471Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:55.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a5403f335e0afb7d2021-12-21 11:33:55.445root 11241100x8000000000000000541472Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:55.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.348e030ef91438e22021-12-21 11:33:55.445root 11241100x8000000000000000541473Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:55.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1140da9771dfdbc02021-12-21 11:33:55.445root 11241100x8000000000000000541474Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:55.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ffd1c670af8ea7212021-12-21 11:33:55.445root 11241100x8000000000000000541475Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:55.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f64c316d4f5da5152021-12-21 11:33:55.445root 11241100x8000000000000000541476Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:55.446{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4947b366872390742021-12-21 11:33:55.446root 11241100x8000000000000000541477Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:55.446{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.069dc6f638013b2f2021-12-21 11:33:55.446root 11241100x8000000000000000541478Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:55.446{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ee06be969f5a65fd2021-12-21 11:33:55.446root 11241100x8000000000000000541479Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:55.446{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b0301e69f186ad0f2021-12-21 11:33:55.446root 11241100x8000000000000000541480Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:55.447{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ef818cc3ef46297f2021-12-21 11:33:55.447root 11241100x8000000000000000541481Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:55.447{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8234586ee9106ee12021-12-21 11:33:55.447root 11241100x8000000000000000541482Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:55.447{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.18dec48445150f112021-12-21 11:33:55.447root 11241100x8000000000000000541483Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:55.448{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a1f62722b7427d572021-12-21 11:33:55.448root 11241100x8000000000000000541484Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:55.448{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.14dc0c61b21ab5a62021-12-21 11:33:55.448root 11241100x8000000000000000541485Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:55.448{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7a59dbc1c7d5d7db2021-12-21 11:33:55.448root 11241100x8000000000000000541486Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:55.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.bd12d200ccd086212021-12-21 11:33:55.943root 11241100x8000000000000000541487Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:55.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d0ec42d67b9a79bd2021-12-21 11:33:55.943root 11241100x8000000000000000541488Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:55.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c0f85454c2de3c5b2021-12-21 11:33:55.944root 11241100x8000000000000000541489Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:55.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1e266dd546f92f4c2021-12-21 11:33:55.944root 11241100x8000000000000000541490Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:55.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.942980c84fcc8cf42021-12-21 11:33:55.944root 11241100x8000000000000000541491Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:55.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b63adde42f1e460a2021-12-21 11:33:55.944root 11241100x8000000000000000541492Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:55.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2c9d960de4ed26622021-12-21 11:33:55.945root 11241100x8000000000000000541493Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:55.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c441ba52665604c82021-12-21 11:33:55.945root 11241100x8000000000000000541494Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:55.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.775dbb56eea863fc2021-12-21 11:33:55.945root 11241100x8000000000000000541495Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:55.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.486745b0f8f5c0d42021-12-21 11:33:55.945root 11241100x8000000000000000541496Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:55.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.bc07a5557791a9962021-12-21 11:33:55.945root 11241100x8000000000000000541497Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:55.946{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8d7b51372099df212021-12-21 11:33:55.946root 11241100x8000000000000000541498Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:55.946{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.130926057daabcca2021-12-21 11:33:55.946root 11241100x8000000000000000541499Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:55.946{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8b1de65e93b8ad902021-12-21 11:33:55.946root 11241100x8000000000000000541500Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:55.946{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3c052635a498ff892021-12-21 11:33:55.946root 11241100x8000000000000000541501Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:55.946{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.69869798635c927d2021-12-21 11:33:55.946root 11241100x8000000000000000541502Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:55.947{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.85f3bbae5d1b13ae2021-12-21 11:33:55.947root 11241100x8000000000000000541503Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:55.947{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c56ec8939b05cc292021-12-21 11:33:55.947root 11241100x8000000000000000541504Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:55.947{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ead2ce8fffd5e67c2021-12-21 11:33:55.947root 11241100x8000000000000000541505Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:55.947{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3399c81b200f8f192021-12-21 11:33:55.947root 11241100x8000000000000000541506Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:55.948{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.645a6d8ba44894252021-12-21 11:33:55.948root 11241100x8000000000000000541507Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:55.948{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c20695b6682dc6d82021-12-21 11:33:55.948root 11241100x8000000000000000541508Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:55.948{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8623fb6c93cc70cc2021-12-21 11:33:55.948root 11241100x8000000000000000541509Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:55.949{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6601c9858532caf62021-12-21 11:33:55.949root 11241100x8000000000000000541510Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:55.949{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.15ff0ad60255448a2021-12-21 11:33:55.949root 11241100x8000000000000000541511Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:56.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0537173fd3a5e5452021-12-21 11:33:56.443root 11241100x8000000000000000541512Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:56.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.02545782663d3fc32021-12-21 11:33:56.443root 11241100x8000000000000000541513Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:56.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b6ace7c309bd6cff2021-12-21 11:33:56.444root 11241100x8000000000000000541514Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:56.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.729c63fe3bd8a32d2021-12-21 11:33:56.444root 11241100x8000000000000000541515Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:56.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.15bc98c33ec9deff2021-12-21 11:33:56.444root 11241100x8000000000000000541516Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:56.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.227dc02ab86ec56b2021-12-21 11:33:56.444root 11241100x8000000000000000541517Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:56.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f16862633f036a082021-12-21 11:33:56.444root 11241100x8000000000000000541518Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:56.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d3f67c2866b36bef2021-12-21 11:33:56.444root 11241100x8000000000000000541519Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:56.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6ab47690f675949d2021-12-21 11:33:56.445root 11241100x8000000000000000541520Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:56.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3d7eadf7a206fbd72021-12-21 11:33:56.445root 11241100x8000000000000000541521Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:56.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2d41a31a2150d0002021-12-21 11:33:56.445root 11241100x8000000000000000541522Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:56.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b471737c45cca4632021-12-21 11:33:56.445root 11241100x8000000000000000541523Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:56.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.10bf754c453abde32021-12-21 11:33:56.445root 11241100x8000000000000000541524Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:56.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c16c79060670d7bf2021-12-21 11:33:56.445root 11241100x8000000000000000541525Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:56.446{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.713fda6ee27c5a252021-12-21 11:33:56.446root 11241100x8000000000000000541526Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:56.446{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.649d0961d52ba2d82021-12-21 11:33:56.446root 11241100x8000000000000000541527Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:56.446{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e18423b64b6d6e9e2021-12-21 11:33:56.446root 11241100x8000000000000000541528Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:56.446{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e64926ef9d5c0b4e2021-12-21 11:33:56.446root 11241100x8000000000000000541529Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:56.446{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0ed1f6e507173f582021-12-21 11:33:56.446root 11241100x8000000000000000541530Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:56.447{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6614dd73219538f42021-12-21 11:33:56.447root 11241100x8000000000000000541531Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:56.447{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.14f084f8633fb9502021-12-21 11:33:56.447root 11241100x8000000000000000541532Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:56.447{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.389fd3a9ee4c86242021-12-21 11:33:56.447root 11241100x8000000000000000541533Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:56.447{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c2695653551f0dbb2021-12-21 11:33:56.447root 11241100x8000000000000000541534Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:56.447{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.05b2e71dc1b070c72021-12-21 11:33:56.447root 11241100x8000000000000000541535Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:56.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.032e9f492e32f1612021-12-21 11:33:56.943root 11241100x8000000000000000541536Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:56.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c1bd49b589427c072021-12-21 11:33:56.943root 11241100x8000000000000000541537Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:56.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f44c54c74b230adf2021-12-21 11:33:56.943root 11241100x8000000000000000541538Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:56.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.495266582330ae762021-12-21 11:33:56.944root 11241100x8000000000000000541539Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:56.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.30b6531be043c5e02021-12-21 11:33:56.944root 11241100x8000000000000000541540Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:56.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.93aec97aa7d6dd152021-12-21 11:33:56.944root 11241100x8000000000000000541541Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:56.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a65ba5c2f22da31c2021-12-21 11:33:56.944root 11241100x8000000000000000541542Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:56.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c461aef1ec7011a22021-12-21 11:33:56.944root 11241100x8000000000000000541543Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:56.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ebd5669ae95877a52021-12-21 11:33:56.944root 11241100x8000000000000000541544Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:56.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.56b1043a0aa2c83b2021-12-21 11:33:56.944root 11241100x8000000000000000541545Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:56.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1a20d741bc767a9f2021-12-21 11:33:56.944root 11241100x8000000000000000541546Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:56.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.938eb5c116fc19ca2021-12-21 11:33:56.945root 11241100x8000000000000000541547Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:56.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5f8d204a544b39792021-12-21 11:33:56.945root 11241100x8000000000000000541548Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:56.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c542bf7314b443212021-12-21 11:33:56.945root 11241100x8000000000000000541549Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:56.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a92019b2a37a4f5e2021-12-21 11:33:56.945root 11241100x8000000000000000541550Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:56.946{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.34e6aa6dcade2a932021-12-21 11:33:56.946root 11241100x8000000000000000541551Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:56.946{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ab3bc3fcc2ad53f12021-12-21 11:33:56.946root 11241100x8000000000000000541552Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:56.946{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.58213f8b3cff5c892021-12-21 11:33:56.946root 11241100x8000000000000000541553Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:56.946{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8564d5ef19115e732021-12-21 11:33:56.946root 11241100x8000000000000000541554Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:56.947{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.09852db6c2474d1c2021-12-21 11:33:56.947root 11241100x8000000000000000541555Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:56.947{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.01acb4f4ed34e2e52021-12-21 11:33:56.947root 11241100x8000000000000000541556Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:56.948{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.12d74db58430552c2021-12-21 11:33:56.948root 11241100x8000000000000000541557Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:56.948{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.676bb5fe42546fe62021-12-21 11:33:56.948root 11241100x8000000000000000541558Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:56.948{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.92d45e95a75e82862021-12-21 11:33:56.948root 11241100x8000000000000000541559Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:57.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9d7d2bfb014ffd672021-12-21 11:33:57.443root 11241100x8000000000000000541560Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:57.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.60c461ef644bf7482021-12-21 11:33:57.443root 11241100x8000000000000000541561Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:57.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.68818b1d8abaeb4c2021-12-21 11:33:57.444root 11241100x8000000000000000541562Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:57.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.eb244587315c00122021-12-21 11:33:57.444root 11241100x8000000000000000541563Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:57.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0ef8b6a6354702c02021-12-21 11:33:57.444root 11241100x8000000000000000541564Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:57.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.650e2a275040cd8b2021-12-21 11:33:57.444root 11241100x8000000000000000541565Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:57.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.cbc20291d7edac9c2021-12-21 11:33:57.445root 11241100x8000000000000000541566Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:57.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b6c63b744d408baa2021-12-21 11:33:57.445root 11241100x8000000000000000541567Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:57.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.762b5f3ece63f4a92021-12-21 11:33:57.445root 11241100x8000000000000000541568Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:57.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1517cc173c916edc2021-12-21 11:33:57.445root 11241100x8000000000000000541569Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:57.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.98f66f269f4470462021-12-21 11:33:57.445root 11241100x8000000000000000541570Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:57.446{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5a66695ba88816a82021-12-21 11:33:57.446root 11241100x8000000000000000541571Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:57.446{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.23b909ebe8a7dff72021-12-21 11:33:57.446root 11241100x8000000000000000541572Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:57.446{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e8a1101709a6e2692021-12-21 11:33:57.446root 11241100x8000000000000000541573Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:57.447{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2b0e33039de8ac472021-12-21 11:33:57.447root 11241100x8000000000000000541574Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:57.447{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c90301797227eb132021-12-21 11:33:57.447root 11241100x8000000000000000541575Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:57.447{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.70aef72bc0ff3e992021-12-21 11:33:57.447root 11241100x8000000000000000541576Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:33:57.447{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5049ad30618b74552021-12-21 11:33:57.447root 23542300x8000000000000000541604Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:09.328{ec2b6afe-95d2-61c1-3038-b84203560000}5272root/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/spool/splunk/tracker.log--- 11241100x8000000000000000541605Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:09.692{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6b34597202588d4f2021-12-21 11:34:09.692root 11241100x8000000000000000541606Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:10.192{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.daebe6056939ec482021-12-21 11:34:10.192root 11241100x8000000000000000541607Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:10.692{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f5bf9325548c78fd2021-12-21 11:34:10.692root 354300x8000000000000000541608Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:11.174{ec2b6afe-95d9-61c1-5175-3a0400000000}5346/opt/splunkforwarder/etc/apps/Splunk_TA_stream/linux_x86_64/bin/streamfwdroottcptruefalse10.0.1.25-48734-false10.0.1.12-8000- 11241100x8000000000000000541609Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:11.175{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8a80e59fb7b76cef2021-12-21 11:34:11.175root 11241100x8000000000000000541610Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:11.175{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.889d27714b964e2c2021-12-21 11:34:11.175root 11241100x8000000000000000541611Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:11.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.31cc4489d19a7a322021-12-21 11:34:11.443root 11241100x8000000000000000541612Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:11.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c211c6a047e05aa42021-12-21 11:34:11.443root 11241100x8000000000000000541613Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:11.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.fad655e7b846de472021-12-21 11:34:11.943root 11241100x8000000000000000541614Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:11.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.66c2bfbcd0b0edb12021-12-21 11:34:11.943root 11241100x8000000000000000541615Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:12.442{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8fb3c667db03f63a2021-12-21 11:34:12.442root 11241100x8000000000000000541616Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:12.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1720ab9c4fd62c532021-12-21 11:34:12.443root 11241100x8000000000000000541617Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:12.942{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.adebe55a01fa6c522021-12-21 11:34:12.942root 11241100x8000000000000000541618Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:12.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.533b44fb339f19a22021-12-21 11:34:12.943root 11241100x8000000000000000541619Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:13.442{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c10603b1ca9037ea2021-12-21 11:34:13.442root 11241100x8000000000000000541620Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:13.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9da470f90cdf7b552021-12-21 11:34:13.443root 11241100x8000000000000000541621Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:13.942{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.453065101d3ae4b52021-12-21 11:34:13.942root 11241100x8000000000000000541622Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:13.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2ecd548078b4ec7e2021-12-21 11:34:13.943root 11241100x8000000000000000541623Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:14.442{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.cf24a4d73cbd299d2021-12-21 11:34:14.442root 11241100x8000000000000000541624Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:14.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ea262b67d6c5855c2021-12-21 11:34:14.443root 11241100x8000000000000000541625Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:14.942{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b7a37db04c9d177e2021-12-21 11:34:14.942root 11241100x8000000000000000541626Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:14.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ff1d3145a380ac902021-12-21 11:34:14.943root 11241100x8000000000000000541627Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:15.442{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.609365d23488f65c2021-12-21 11:34:15.442root 11241100x8000000000000000541628Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:15.442{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.da4a528de7dc3d292021-12-21 11:34:15.442root 11241100x8000000000000000541629Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:15.942{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.105af0d6cdc6012f2021-12-21 11:34:15.942root 11241100x8000000000000000541630Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:15.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9cc9f70dcf06b6482021-12-21 11:34:15.943root 354300x8000000000000000541631Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:16.188{ec2b6afe-95d9-61c1-5175-3a0400000000}5346/opt/splunkforwarder/etc/apps/Splunk_TA_stream/linux_x86_64/bin/streamfwdroottcptruefalse10.0.1.25-48736-false10.0.1.12-8000- 11241100x8000000000000000541632Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:16.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.eb0d01862a86a9b82021-12-21 11:34:16.443root 11241100x8000000000000000541633Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:16.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3d254582d8d0f9ec2021-12-21 11:34:16.443root 11241100x8000000000000000541634Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:16.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.210cffbcae76ab192021-12-21 11:34:16.443root 11241100x8000000000000000541635Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:16.942{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.de1d30b49c949f362021-12-21 11:34:16.942root 11241100x8000000000000000541636Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:16.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.dcb8da39d8afe0092021-12-21 11:34:16.943root 11241100x8000000000000000541637Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:16.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e841059d00e721ac2021-12-21 11:34:16.943root 11241100x8000000000000000541638Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:17.442{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9a30b12a1a48616b2021-12-21 11:34:17.442root 11241100x8000000000000000541639Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:17.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.24a72b604e2ea4822021-12-21 11:34:17.443root 11241100x8000000000000000541640Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:17.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.949f38a052fa36e52021-12-21 11:34:17.443root 11241100x8000000000000000541641Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:17.942{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.bc249f6e682e3f0a2021-12-21 11:34:17.942root 11241100x8000000000000000541642Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:17.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3acb9ff71f79274b2021-12-21 11:34:17.943root 11241100x8000000000000000541643Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:17.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4e432cbd649be1a82021-12-21 11:34:17.943root 11241100x8000000000000000541644Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:18.442{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3e1152cba7a8a49d2021-12-21 11:34:18.442root 11241100x8000000000000000541645Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:18.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.12fa3013b53aa7782021-12-21 11:34:18.443root 11241100x8000000000000000541646Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:18.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b8b497b5bd11a0372021-12-21 11:34:18.443root 11241100x8000000000000000541647Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:18.942{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.15ecd62ef120bedb2021-12-21 11:34:18.942root 11241100x8000000000000000541648Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:18.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.fdca461b087e9fe12021-12-21 11:34:18.943root 11241100x8000000000000000541649Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:18.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.cd0fbd56d90bcede2021-12-21 11:34:18.943root 11241100x8000000000000000541650Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:19.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.cd6c2914188ee87e2021-12-21 11:34:19.443root 11241100x8000000000000000541651Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:19.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ce8c18fef638a3d72021-12-21 11:34:19.443root 11241100x8000000000000000541652Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:19.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f45f9caf6c553c3b2021-12-21 11:34:19.443root 11241100x8000000000000000541653Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:19.942{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.70cc768a35f59db12021-12-21 11:34:19.942root 11241100x8000000000000000541654Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:19.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7cda4ce0228bad7c2021-12-21 11:34:19.943root 11241100x8000000000000000541655Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:19.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.96489e8d21e620702021-12-21 11:34:19.943root 11241100x8000000000000000541656Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:20.442{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.29ed9fb94906017f2021-12-21 11:34:20.442root 11241100x8000000000000000541657Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:20.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.333aebaac4e2d4df2021-12-21 11:34:20.443root 11241100x8000000000000000541658Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:20.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.df231f562989720c2021-12-21 11:34:20.443root 11241100x8000000000000000541659Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:20.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5895795d571335c92021-12-21 11:34:20.943root 11241100x8000000000000000541660Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:20.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.50f281d81d1c5f9d2021-12-21 11:34:20.943root 11241100x8000000000000000541661Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:20.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.39f6aee7eef2b6d62021-12-21 11:34:20.943root 11241100x8000000000000000541662Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:21.442{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7e74ae9f13a45bb52021-12-21 11:34:21.442root 11241100x8000000000000000541663Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:21.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0bade8850fa831cf2021-12-21 11:34:21.443root 11241100x8000000000000000541664Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:21.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1b6f186dff1d5e3a2021-12-21 11:34:21.443root 11241100x8000000000000000541665Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:21.942{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1cd48bb4a9eb47b12021-12-21 11:34:21.942root 11241100x8000000000000000541666Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:21.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.44422aa024a1c46c2021-12-21 11:34:21.943root 11241100x8000000000000000541667Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:21.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.06069dafff339a192021-12-21 11:34:21.943root 354300x8000000000000000541668Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:22.046{ec2b6afe-95d9-61c1-5175-3a0400000000}5346/opt/splunkforwarder/etc/apps/Splunk_TA_stream/linux_x86_64/bin/streamfwdroottcptruefalse10.0.1.25-48738-false10.0.1.12-8000- 11241100x8000000000000000541669Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:22.442{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.32b2d82939970e0c2021-12-21 11:34:22.442root 11241100x8000000000000000541670Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:22.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4b0173b5057085382021-12-21 11:34:22.443root 11241100x8000000000000000541671Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:22.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4919b05f08ef99b42021-12-21 11:34:22.443root 11241100x8000000000000000541672Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:22.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9c27e6933c629c862021-12-21 11:34:22.443root 11241100x8000000000000000541673Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:22.942{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.159cbc7a1f5421bd2021-12-21 11:34:22.942root 11241100x8000000000000000541674Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:22.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0e431ab591b1973f2021-12-21 11:34:22.943root 11241100x8000000000000000541675Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:22.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d5f9f4d0778001a02021-12-21 11:34:22.943root 11241100x8000000000000000541676Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:22.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4861429f2cf75f5e2021-12-21 11:34:22.943root 154100x8000000000000000541677Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:23.001{ec2b6afe-bbbf-61c1-68d4-9c7ade550000}9891/bin/ps-----ps -e -o pid,ppid,state,command/var/snap/amazon-ssm-agent/4046root{ec2b6afe-0000-0000-0000-000000000000}04294967295no level-{00000000-0000-0000-0000-000000000000}2319--- 534500x8000000000000000541678Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:23.011{ec2b6afe-bbbf-61c1-68d4-9c7ade550000}9891/bin/psroot 11241100x8000000000000000541679Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:23.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5a03bbc015f7e7d32021-12-21 11:34:23.443root 11241100x8000000000000000541680Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:23.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.164057c846b4329a2021-12-21 11:34:23.443root 11241100x8000000000000000541681Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:23.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f68a7e7ab0a30a3e2021-12-21 11:34:23.443root 11241100x8000000000000000541682Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:23.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f0f6220e2616a1262021-12-21 11:34:23.443root 11241100x8000000000000000541683Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:23.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3127b936137f374e2021-12-21 11:34:23.444root 11241100x8000000000000000541684Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:23.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c4ea0b983341deb62021-12-21 11:34:23.444root 11241100x8000000000000000541685Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:23.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.edf9d015487f6e5d2021-12-21 11:34:23.943root 11241100x8000000000000000541686Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:23.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.fa22dc11172f2a3f2021-12-21 11:34:23.943root 11241100x8000000000000000541687Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:23.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.dcc25e357271a1312021-12-21 11:34:23.943root 11241100x8000000000000000541688Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:23.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.67013b9d6ee215912021-12-21 11:34:23.943root 11241100x8000000000000000541689Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:23.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.43cc80750aeeeb512021-12-21 11:34:23.944root 11241100x8000000000000000541690Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:23.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a057202ac55c339e2021-12-21 11:34:23.944root 11241100x8000000000000000541691Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:24.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b67b4c7871422d462021-12-21 11:34:24.443root 11241100x8000000000000000541692Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:24.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4e465635768f2a1e2021-12-21 11:34:24.443root 11241100x8000000000000000541693Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:24.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.12021379fb4971192021-12-21 11:34:24.443root 11241100x8000000000000000541694Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:24.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c5ecb48b0189bc9a2021-12-21 11:34:24.443root 11241100x8000000000000000541695Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:24.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.fc41cacd163dfffe2021-12-21 11:34:24.443root 11241100x8000000000000000541696Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:24.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.37d4c7bff81d848c2021-12-21 11:34:24.444root 11241100x8000000000000000541697Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:24.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.efbea2db065ffa032021-12-21 11:34:24.943root 11241100x8000000000000000541698Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:24.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f30e9d9b200e6dbb2021-12-21 11:34:24.943root 11241100x8000000000000000541699Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:24.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f43802410dbbc6c82021-12-21 11:34:24.943root 11241100x8000000000000000541700Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:24.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e294092c6a4e46a12021-12-21 11:34:24.943root 11241100x8000000000000000541701Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:24.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a46bc6816c2d0b4f2021-12-21 11:34:24.943root 11241100x8000000000000000541702Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:24.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.754eff0bdf73005a2021-12-21 11:34:24.944root 11241100x8000000000000000541703Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:25.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5a8f1872946f31d42021-12-21 11:34:25.443root 11241100x8000000000000000541704Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:25.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0deee484cc69964f2021-12-21 11:34:25.443root 11241100x8000000000000000541705Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:25.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0cf2c7b9de45176a2021-12-21 11:34:25.443root 11241100x8000000000000000541706Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:25.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.286c85e699ec631d2021-12-21 11:34:25.443root 11241100x8000000000000000541707Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:25.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6c10d1068ceaabe52021-12-21 11:34:25.443root 11241100x8000000000000000541708Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:25.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.dadbdfccc8adcc452021-12-21 11:34:25.444root 354300x8000000000000000541709Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:25.495{ec2b6afe-95d2-61c1-3038-b84203560000}5272/opt/splunkforwarder/bin/splunkdroottcptruefalse10.0.1.25-35804-false10.0.1.12-8089- 11241100x8000000000000000541710Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:25.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0254479f962155102021-12-21 11:34:25.943root 11241100x8000000000000000541711Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:25.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e084a57fcd5c4c7e2021-12-21 11:34:25.943root 11241100x8000000000000000541712Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:25.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3913051a874e01572021-12-21 11:34:25.943root 11241100x8000000000000000541713Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:25.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.25e0e6aafcf6b84b2021-12-21 11:34:25.943root 11241100x8000000000000000541714Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:25.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.626d810f86fa73f22021-12-21 11:34:25.943root 11241100x8000000000000000541715Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:25.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.43ab584ea522c0eb2021-12-21 11:34:25.943root 11241100x8000000000000000541716Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:25.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.098168a6d5372ce22021-12-21 11:34:25.943root 11241100x8000000000000000541717Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:26.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7d1da3fda895a19c2021-12-21 11:34:26.443root 11241100x8000000000000000541718Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:26.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.fcaabbe5885c2c912021-12-21 11:34:26.443root 11241100x8000000000000000541719Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:26.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5b617ced7932fa8e2021-12-21 11:34:26.443root 11241100x8000000000000000541720Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:26.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.16fcbfe5d8f687742021-12-21 11:34:26.443root 11241100x8000000000000000541721Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:26.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a19d44a39c8cf3462021-12-21 11:34:26.443root 11241100x8000000000000000541722Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:26.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.eff62405c063701f2021-12-21 11:34:26.443root 11241100x8000000000000000541723Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:26.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.bd2d2a46cab5a2da2021-12-21 11:34:26.443root 11241100x8000000000000000541724Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:26.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.024228125e1518f42021-12-21 11:34:26.943root 11241100x8000000000000000541725Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:26.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.eecdeddf1d3bc67f2021-12-21 11:34:26.943root 11241100x8000000000000000541726Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:26.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5d7902634242c7a62021-12-21 11:34:26.943root 11241100x8000000000000000541727Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:26.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3e28f95a7d16f7d52021-12-21 11:34:26.943root 11241100x8000000000000000541728Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:26.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.37d3fffbea1764d12021-12-21 11:34:26.943root 11241100x8000000000000000541729Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:26.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.428c9dfc89eaf7542021-12-21 11:34:26.943root 11241100x8000000000000000541730Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:26.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f9f7926fe2577f0d2021-12-21 11:34:26.943root 354300x8000000000000000541731Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:27.115{ec2b6afe-95d9-61c1-5175-3a0400000000}5346/opt/splunkforwarder/etc/apps/Splunk_TA_stream/linux_x86_64/bin/streamfwdroottcptruefalse10.0.1.25-48742-false10.0.1.12-8000- 11241100x8000000000000000541732Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:27.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.59aaa6c24bceb2da2021-12-21 11:34:27.443root 11241100x8000000000000000541733Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:27.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5f32e5eb8ac9f4082021-12-21 11:34:27.443root 11241100x8000000000000000541734Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:27.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.84f937a43759f0292021-12-21 11:34:27.443root 11241100x8000000000000000541735Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:27.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d6e5c9d0403fd6842021-12-21 11:34:27.443root 11241100x8000000000000000541736Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:27.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.89dd1bea33b76c3c2021-12-21 11:34:27.443root 11241100x8000000000000000541737Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:27.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e22025dd7866ce252021-12-21 11:34:27.443root 11241100x8000000000000000541738Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:27.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.20e80605512eceda2021-12-21 11:34:27.443root 11241100x8000000000000000541739Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:27.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8dd9127605e97a712021-12-21 11:34:27.443root 11241100x8000000000000000541740Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:27.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.649c2f2d4c5281e52021-12-21 11:34:27.943root 11241100x8000000000000000541741Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:27.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0aff778ef37eab852021-12-21 11:34:27.943root 11241100x8000000000000000541742Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:27.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9a652a6d0ca217ef2021-12-21 11:34:27.943root 11241100x8000000000000000541743Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:27.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7c64457da0a4bf4a2021-12-21 11:34:27.943root 11241100x8000000000000000541744Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:27.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b36d2387af5bccb92021-12-21 11:34:27.943root 11241100x8000000000000000541745Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:27.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.caf17d2f9f91d0ef2021-12-21 11:34:27.943root 11241100x8000000000000000541746Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:27.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.35550b64c51819ae2021-12-21 11:34:27.943root 11241100x8000000000000000541747Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:27.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.32e10842837022662021-12-21 11:34:27.943root 11241100x8000000000000000541748Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:28.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.55477736b2a3d91c2021-12-21 11:34:28.443root 11241100x8000000000000000541749Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:28.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4b01827fd9f6d1a42021-12-21 11:34:28.443root 11241100x8000000000000000541750Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:28.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.317b5dec11a64e1e2021-12-21 11:34:28.443root 11241100x8000000000000000541751Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:28.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0b882ea8efbd8ae22021-12-21 11:34:28.443root 11241100x8000000000000000541752Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:28.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b63b790b1592c5df2021-12-21 11:34:28.443root 11241100x8000000000000000541753Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:28.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.764b33f59aa47e8d2021-12-21 11:34:28.443root 11241100x8000000000000000541754Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:28.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8b383196693884f42021-12-21 11:34:28.443root 11241100x8000000000000000541755Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:28.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.022110f0102492c22021-12-21 11:34:28.443root 11241100x8000000000000000541756Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:28.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7c4561114b034e1d2021-12-21 11:34:28.943root 11241100x8000000000000000541757Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:28.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ca09e4459800e5492021-12-21 11:34:28.943root 11241100x8000000000000000541758Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:28.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.46a9db3ac3e03c7c2021-12-21 11:34:28.943root 11241100x8000000000000000541759Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:28.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3b2f2193bb098f542021-12-21 11:34:28.944root 11241100x8000000000000000541760Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:28.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.df428d1da44593ad2021-12-21 11:34:28.944root 11241100x8000000000000000541761Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:28.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.834db33c80e720c02021-12-21 11:34:28.944root 11241100x8000000000000000541762Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:28.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.370bc26c07fdff752021-12-21 11:34:28.944root 11241100x8000000000000000541763Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:28.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6a291531fc15ecc52021-12-21 11:34:28.944root 11241100x8000000000000000541764Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:29.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.bb4a8fbedace33f92021-12-21 11:34:29.443root 11241100x8000000000000000541765Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:29.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ed3b43e960154f622021-12-21 11:34:29.443root 11241100x8000000000000000541766Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:29.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.12c2a46c81bf730c2021-12-21 11:34:29.443root 11241100x8000000000000000541767Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:29.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.db4a8adc773362632021-12-21 11:34:29.443root 11241100x8000000000000000541768Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:29.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0867fa2bcc7902662021-12-21 11:34:29.444root 11241100x8000000000000000541769Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:29.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0de334218b47d9592021-12-21 11:34:29.444root 11241100x8000000000000000541770Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:29.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3a5af2fe66793ff92021-12-21 11:34:29.444root 11241100x8000000000000000541771Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:29.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9a2bbfd5abeeee3d2021-12-21 11:34:29.444root 11241100x8000000000000000541772Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:29.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.650fbf4b03cc443a2021-12-21 11:34:29.943root 11241100x8000000000000000541773Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:29.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5636f6287a651fb02021-12-21 11:34:29.943root 11241100x8000000000000000541774Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:29.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ae56e28a0a6d4d542021-12-21 11:34:29.943root 11241100x8000000000000000541775Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:29.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ca63d81f98af29c92021-12-21 11:34:29.944root 11241100x8000000000000000541776Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:29.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.bcc98114c63a478a2021-12-21 11:34:29.944root 11241100x8000000000000000541777Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:29.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.868e561a8cf9b5d82021-12-21 11:34:29.944root 11241100x8000000000000000541778Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:29.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3c1f52085d1659a62021-12-21 11:34:29.945root 11241100x8000000000000000541779Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:29.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2baaaaef505016ac2021-12-21 11:34:29.945root 11241100x8000000000000000541780Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:30.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f42855ad177e67cb2021-12-21 11:34:30.443root 11241100x8000000000000000541781Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:30.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c9e6f96e33462b2a2021-12-21 11:34:30.443root 11241100x8000000000000000541782Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:30.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.bab196fdc28eccd12021-12-21 11:34:30.443root 11241100x8000000000000000541783Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:30.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3a1571083aee1d942021-12-21 11:34:30.443root 11241100x8000000000000000541784Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:30.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e465ef05d38deeda2021-12-21 11:34:30.444root 11241100x8000000000000000541785Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:30.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b819c75941163aef2021-12-21 11:34:30.444root 11241100x8000000000000000541786Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:30.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.de1ae3b9855b7f522021-12-21 11:34:30.444root 11241100x8000000000000000541787Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:30.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a7c01fa5626623022021-12-21 11:34:30.444root 11241100x8000000000000000541788Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:30.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.31a43d5bd727fdb92021-12-21 11:34:30.943root 11241100x8000000000000000541789Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:30.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.fa8221b3a453f0eb2021-12-21 11:34:30.943root 11241100x8000000000000000541790Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:30.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.04b91300340912ac2021-12-21 11:34:30.943root 11241100x8000000000000000541791Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:30.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3d368e012c7819692021-12-21 11:34:30.943root 11241100x8000000000000000541792Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:30.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.282965f55a1be8492021-12-21 11:34:30.943root 11241100x8000000000000000541793Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:30.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.13817a8c958b70742021-12-21 11:34:30.943root 11241100x8000000000000000541794Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:30.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.570e21ccf829b0742021-12-21 11:34:30.943root 11241100x8000000000000000541795Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:30.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.285c39312dec0cd62021-12-21 11:34:30.943root 11241100x8000000000000000541796Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:31.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a2cab34ae06501f82021-12-21 11:34:31.443root 11241100x8000000000000000541797Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:31.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.cb5e13f86bec90772021-12-21 11:34:31.443root 11241100x8000000000000000541798Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:31.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a58b111add8e14f52021-12-21 11:34:31.443root 11241100x8000000000000000541799Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:31.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.23c8da5b250996332021-12-21 11:34:31.443root 11241100x8000000000000000541800Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:31.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9074c5d1274a1a862021-12-21 11:34:31.443root 11241100x8000000000000000541801Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:31.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.dadab8292f903c5c2021-12-21 11:34:31.443root 11241100x8000000000000000541802Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:31.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.05493ceefdc862b72021-12-21 11:34:31.443root 11241100x8000000000000000541803Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:31.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c402d62f0aa7a1912021-12-21 11:34:31.443root 11241100x8000000000000000541804Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:31.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b4815375795eecdb2021-12-21 11:34:31.943root 11241100x8000000000000000541805Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:31.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.901efabfd04fc13f2021-12-21 11:34:31.943root 11241100x8000000000000000541806Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:31.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0f733423f775a1032021-12-21 11:34:31.943root 11241100x8000000000000000541807Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:31.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9985198c3eb230812021-12-21 11:34:31.943root 11241100x8000000000000000541808Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:31.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.454c429fd16795482021-12-21 11:34:31.943root 11241100x8000000000000000541809Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:31.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2e9d8fbff3ee7c7b2021-12-21 11:34:31.943root 11241100x8000000000000000541810Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:31.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.180f82dd36ca1a352021-12-21 11:34:31.943root 11241100x8000000000000000541811Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:31.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c96a7e7657908e062021-12-21 11:34:31.943root 11241100x8000000000000000541812Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:32.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.371b6d07656e92e32021-12-21 11:34:32.443root 11241100x8000000000000000541813Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:32.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.353fc783d43c1e4a2021-12-21 11:34:32.443root 11241100x8000000000000000541814Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:32.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.42240b51d2c4cbfa2021-12-21 11:34:32.443root 11241100x8000000000000000541815Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:32.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7b978393f603efaa2021-12-21 11:34:32.443root 11241100x8000000000000000541816Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:32.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e5649634af36481a2021-12-21 11:34:32.444root 11241100x8000000000000000541817Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:32.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b34cce931edd57682021-12-21 11:34:32.444root 11241100x8000000000000000541818Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:32.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4c1dd40ba0dc49192021-12-21 11:34:32.444root 11241100x8000000000000000541819Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:32.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.16eeec500057e3362021-12-21 11:34:32.444root 11241100x8000000000000000541820Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:32.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.38f5429f399e3bd12021-12-21 11:34:32.943root 11241100x8000000000000000541821Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:32.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2f4d09195057ac8c2021-12-21 11:34:32.943root 11241100x8000000000000000541822Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:32.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8eb58d12241c67302021-12-21 11:34:32.943root 11241100x8000000000000000541823Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:32.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9168c4c4673a443d2021-12-21 11:34:32.943root 11241100x8000000000000000541824Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:32.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8b8b56b995abcf4d2021-12-21 11:34:32.943root 11241100x8000000000000000541825Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:32.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.39c18f35ae9f8b762021-12-21 11:34:32.943root 11241100x8000000000000000541826Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:32.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c8c5af097cf70a0f2021-12-21 11:34:32.943root 11241100x8000000000000000541827Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:32.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4df12d56b41346df2021-12-21 11:34:32.943root 354300x8000000000000000541828Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:33.048{ec2b6afe-95d9-61c1-5175-3a0400000000}5346/opt/splunkforwarder/etc/apps/Splunk_TA_stream/linux_x86_64/bin/streamfwdroottcptruefalse10.0.1.25-48744-false10.0.1.12-8000- 11241100x8000000000000000541829Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:33.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0fe2b579768efc562021-12-21 11:34:33.443root 11241100x8000000000000000541830Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:33.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ce4026ac7bff81ff2021-12-21 11:34:33.443root 11241100x8000000000000000541831Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:33.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c7454381ec44bef82021-12-21 11:34:33.443root 11241100x8000000000000000541832Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:33.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d73abab377739db12021-12-21 11:34:33.443root 11241100x8000000000000000541833Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:33.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4f7475855177189d2021-12-21 11:34:33.443root 11241100x8000000000000000541834Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:33.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.31b34532527600902021-12-21 11:34:33.443root 11241100x8000000000000000541835Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:33.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c7b60ae1c8a99fd12021-12-21 11:34:33.444root 11241100x8000000000000000541836Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:33.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0b23378d9dc5e5622021-12-21 11:34:33.444root 11241100x8000000000000000541837Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:33.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e353e148fc2a920b2021-12-21 11:34:33.444root 11241100x8000000000000000541838Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:33.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6f33cd8f37493a3b2021-12-21 11:34:33.943root 11241100x8000000000000000541839Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:33.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4635ee37d8d89f842021-12-21 11:34:33.943root 11241100x8000000000000000541840Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:33.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.76278268acb51cd22021-12-21 11:34:33.943root 11241100x8000000000000000541841Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:33.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.44e108a3879d54ac2021-12-21 11:34:33.943root 11241100x8000000000000000541842Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:33.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.00352c4bba11a9502021-12-21 11:34:33.943root 11241100x8000000000000000541843Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:33.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2a65d7a9b9d3d8552021-12-21 11:34:33.943root 11241100x8000000000000000541844Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:33.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.fe60dc7aed6dd5202021-12-21 11:34:33.943root 11241100x8000000000000000541845Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:33.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.27ace306930b48072021-12-21 11:34:33.943root 11241100x8000000000000000541846Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:33.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.fca155e4168e9a7b2021-12-21 11:34:33.943root 11241100x8000000000000000541847Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:34.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0719ea087243b3be2021-12-21 11:34:34.443root 11241100x8000000000000000541848Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:34.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7a53b7fe2e9ff2e32021-12-21 11:34:34.443root 11241100x8000000000000000541849Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:34.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.31f0f8d74284af2b2021-12-21 11:34:34.443root 11241100x8000000000000000541850Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:34.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.cc02978414e94ded2021-12-21 11:34:34.443root 11241100x8000000000000000541851Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:34.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.90d4a08fe4971f412021-12-21 11:34:34.443root 11241100x8000000000000000541852Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:34.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a028c209109a4a9a2021-12-21 11:34:34.443root 11241100x8000000000000000541853Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:34.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.961c7996fc87a71b2021-12-21 11:34:34.443root 11241100x8000000000000000541854Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:34.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e6e789818edb3d1f2021-12-21 11:34:34.443root 11241100x8000000000000000541855Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:34.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.23db988e2c17bc9d2021-12-21 11:34:34.443root 11241100x8000000000000000541856Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:34.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d7656f86d32659202021-12-21 11:34:34.943root 11241100x8000000000000000541857Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:34.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a6605226ff0509c42021-12-21 11:34:34.943root 11241100x8000000000000000541858Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:34.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c4322e2023b89dc92021-12-21 11:34:34.943root 11241100x8000000000000000541859Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:34.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.fb61e127772890d52021-12-21 11:34:34.943root 11241100x8000000000000000541860Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:34.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.10ec1903847411b32021-12-21 11:34:34.943root 11241100x8000000000000000541861Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:34.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d5044ae2329547c82021-12-21 11:34:34.943root 11241100x8000000000000000541862Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:34.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f9a233d7cd1e67a42021-12-21 11:34:34.943root 11241100x8000000000000000541863Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:34.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1c6d3c56f24a14c12021-12-21 11:34:34.943root 11241100x8000000000000000541864Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:34.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b1678f69285fc2ed2021-12-21 11:34:34.943root 11241100x8000000000000000541865Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:35.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3911836eb03b36e82021-12-21 11:34:35.443root 11241100x8000000000000000541866Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:35.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.56b1684fa4388c522021-12-21 11:34:35.443root 11241100x8000000000000000541867Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:35.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.790263c0899cc8a82021-12-21 11:34:35.443root 11241100x8000000000000000541868Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:35.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f1b58536afdff8db2021-12-21 11:34:35.443root 11241100x8000000000000000541869Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:35.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8192311d830f68fa2021-12-21 11:34:35.443root 11241100x8000000000000000541870Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:35.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f0dac9a9f7c9e07b2021-12-21 11:34:35.443root 11241100x8000000000000000541871Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:35.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e1639ceb37dc5bb42021-12-21 11:34:35.443root 11241100x8000000000000000541872Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:35.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9bcd0c2394de50e72021-12-21 11:34:35.443root 11241100x8000000000000000541873Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:35.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0972646a00c6400b2021-12-21 11:34:35.444root 11241100x8000000000000000541874Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:35.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.efa02a367d07ff612021-12-21 11:34:35.943root 11241100x8000000000000000541875Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:35.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ee07283482843d522021-12-21 11:34:35.943root 11241100x8000000000000000541876Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:35.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.dff429f2a3cd9ce82021-12-21 11:34:35.943root 11241100x8000000000000000541877Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:35.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.521f9c670c02665b2021-12-21 11:34:35.943root 11241100x8000000000000000541878Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:35.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f25a42b840244d512021-12-21 11:34:35.943root 11241100x8000000000000000541879Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:35.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ab6ccf5baed9a3062021-12-21 11:34:35.943root 11241100x8000000000000000541880Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:35.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b39c430fa3a872e82021-12-21 11:34:35.943root 11241100x8000000000000000541881Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:35.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8a8d2520e93172032021-12-21 11:34:35.943root 11241100x8000000000000000541882Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:35.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6ac9730ac13fa0382021-12-21 11:34:35.944root 11241100x8000000000000000541883Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:36.326{ec2b6afe-95d2-61c1-3038-b84203560000}5272/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/spool/splunk/tracker.log2021-12-21 11:34:36.326root 11241100x8000000000000000541884Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:36.326{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.12ce7d04385bc71b2021-12-21 11:34:36.326root 11241100x8000000000000000541885Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:36.326{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8e428b77392ca6cb2021-12-21 11:34:36.326root 11241100x8000000000000000541886Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:36.327{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ee57be87013243502021-12-21 11:34:36.327root 11241100x8000000000000000541887Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:36.327{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d22b09114640f5f12021-12-21 11:34:36.327root 11241100x8000000000000000541888Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:36.327{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.dc66cc09901409a02021-12-21 11:34:36.327root 11241100x8000000000000000541889Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:36.327{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f08e55f612fbc1622021-12-21 11:34:36.327root 11241100x8000000000000000541890Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:36.328{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b73898177bdbc0352021-12-21 11:34:36.328root 11241100x8000000000000000541891Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:36.328{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f2bdcec2382132db2021-12-21 11:34:36.328root 11241100x8000000000000000541892Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:36.328{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.30fb42157570aa562021-12-21 11:34:36.328root 11241100x8000000000000000541893Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:36.328{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.fa79e7d76afcc14b2021-12-21 11:34:36.328root 11241100x8000000000000000541894Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:36.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.93b327ab14d393372021-12-21 11:34:36.693root 11241100x8000000000000000541895Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:36.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.58e3bd1432b6ebea2021-12-21 11:34:36.693root 11241100x8000000000000000541896Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:36.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d7cfd37f17675e3b2021-12-21 11:34:36.693root 11241100x8000000000000000541897Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:36.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a7dee30b8ea6273b2021-12-21 11:34:36.693root 11241100x8000000000000000541898Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:36.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e0b32bc5460b9c372021-12-21 11:34:36.693root 11241100x8000000000000000541899Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:36.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2ead98d89f937d052021-12-21 11:34:36.693root 11241100x8000000000000000541900Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:36.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6b13fe9285ab74f92021-12-21 11:34:36.693root 11241100x8000000000000000541901Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:36.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.25cb83cd8a5f1e492021-12-21 11:34:36.694root 11241100x8000000000000000541902Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:36.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d78344d921e0c03d2021-12-21 11:34:36.694root 11241100x8000000000000000541903Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:36.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.bab02747e705c48b2021-12-21 11:34:36.694root 11241100x8000000000000000541904Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:37.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.293487c36afed3892021-12-21 11:34:37.193root 11241100x8000000000000000541905Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:37.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0b1a94390da5985a2021-12-21 11:34:37.193root 11241100x8000000000000000541906Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:37.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6c99339d3f48579a2021-12-21 11:34:37.193root 11241100x8000000000000000541907Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:37.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0bf6ef8cbc7a69422021-12-21 11:34:37.193root 11241100x8000000000000000541908Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:37.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.dcf342fda7ced4152021-12-21 11:34:37.193root 11241100x8000000000000000541909Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:37.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.676f5399fdeebd742021-12-21 11:34:37.193root 11241100x8000000000000000541910Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:37.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.afba74cf3ab70f8e2021-12-21 11:34:37.193root 11241100x8000000000000000541911Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:37.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c395e105a06f16352021-12-21 11:34:37.194root 11241100x8000000000000000541912Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:37.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.bec8f2277d6cc8172021-12-21 11:34:37.194root 11241100x8000000000000000541913Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:37.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e62deb443fa5f6b22021-12-21 11:34:37.194root 11241100x8000000000000000541914Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:37.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1fd0b73e7ce44a0e2021-12-21 11:34:37.693root 11241100x8000000000000000541915Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:37.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6e1c126db7befba92021-12-21 11:34:37.693root 11241100x8000000000000000541916Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:37.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f346117d23607ed12021-12-21 11:34:37.693root 11241100x8000000000000000541917Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:37.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4dff742d204b34f22021-12-21 11:34:37.693root 11241100x8000000000000000541918Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:37.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.cdc09c2a0f6121492021-12-21 11:34:37.693root 11241100x8000000000000000541919Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:37.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b576eae69eac10252021-12-21 11:34:37.693root 11241100x8000000000000000541920Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:37.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5aa87b40cfb437b12021-12-21 11:34:37.694root 11241100x8000000000000000541921Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:37.696{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b9ef8c9016f0b30c2021-12-21 11:34:37.696root 11241100x8000000000000000541922Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:37.696{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.bd86a5994162a1d42021-12-21 11:34:37.696root 11241100x8000000000000000541923Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:37.696{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b910042bebe7f5d92021-12-21 11:34:37.696root 11241100x8000000000000000541924Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:38.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ee3ce4085285093d2021-12-21 11:34:38.193root 11241100x8000000000000000541925Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:38.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.bdb4c18ccbec4d9d2021-12-21 11:34:38.193root 11241100x8000000000000000541926Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:38.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6812e131c73290342021-12-21 11:34:38.193root 11241100x8000000000000000541927Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:38.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4828e8cb248f8efc2021-12-21 11:34:38.193root 11241100x8000000000000000541928Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:38.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a46fc4d867a2842a2021-12-21 11:34:38.193root 11241100x8000000000000000541929Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:38.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4d187d11337fe99c2021-12-21 11:34:38.193root 11241100x8000000000000000541930Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:38.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.255b74932e25c5362021-12-21 11:34:38.193root 11241100x8000000000000000541931Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:38.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1b1fa1122cd75bba2021-12-21 11:34:38.194root 11241100x8000000000000000541932Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:38.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.acdb6c562c4cfcaf2021-12-21 11:34:38.194root 11241100x8000000000000000541933Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:38.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.977e9417c193384b2021-12-21 11:34:38.194root 354300x8000000000000000541934Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:38.207{ec2b6afe-95d9-61c1-5175-3a0400000000}5346/opt/splunkforwarder/etc/apps/Splunk_TA_stream/linux_x86_64/bin/streamfwdroottcptruefalse10.0.1.25-48746-false10.0.1.12-8000- 11241100x8000000000000000541935Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:38.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.db171e6a8e9243ce2021-12-21 11:34:38.693root 11241100x8000000000000000541936Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:38.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.20a0b7ef90e6a8612021-12-21 11:34:38.693root 11241100x8000000000000000541937Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:38.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.85d144c67482ec5c2021-12-21 11:34:38.693root 11241100x8000000000000000541938Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:38.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b553cb67fabe9b3d2021-12-21 11:34:38.693root 11241100x8000000000000000541939Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:38.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8020804fcf9808c42021-12-21 11:34:38.693root 11241100x8000000000000000541940Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:38.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.fb55a813c75f4ee12021-12-21 11:34:38.693root 11241100x8000000000000000541941Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:38.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c6532cd131801b8b2021-12-21 11:34:38.693root 11241100x8000000000000000541942Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:38.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.cead84865776a5e02021-12-21 11:34:38.693root 11241100x8000000000000000541943Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:38.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8c633d583e50b18b2021-12-21 11:34:38.693root 11241100x8000000000000000541944Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:38.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c8b4ebf3b0cb838a2021-12-21 11:34:38.694root 11241100x8000000000000000541945Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:38.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.99fe35d45bad9ba82021-12-21 11:34:38.694root 11241100x8000000000000000541946Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:39.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5378273edc0757512021-12-21 11:34:39.193root 11241100x8000000000000000541947Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:39.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.43177170d235c2bc2021-12-21 11:34:39.193root 11241100x8000000000000000541948Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:39.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b1a0dc28868e64b62021-12-21 11:34:39.193root 11241100x8000000000000000541949Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:39.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0896d1f47f6a23792021-12-21 11:34:39.193root 11241100x8000000000000000541950Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:39.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6ead98d7d03d7f892021-12-21 11:34:39.193root 11241100x8000000000000000541951Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:39.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b00ae3c42fba8c252021-12-21 11:34:39.193root 11241100x8000000000000000541952Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:39.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8da79d0efce8a00e2021-12-21 11:34:39.193root 11241100x8000000000000000541953Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:39.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.de5c180b042d349a2021-12-21 11:34:39.193root 11241100x8000000000000000541954Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:39.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8603d7d8b7b4aec52021-12-21 11:34:39.193root 11241100x8000000000000000541955Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:39.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3c63abb6d9d2af702021-12-21 11:34:39.194root 11241100x8000000000000000541956Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:39.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2879ffbaca724dff2021-12-21 11:34:39.194root 23542300x8000000000000000541957Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:39.328{ec2b6afe-95d2-61c1-3038-b84203560000}5272root/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/spool/splunk/tracker.log--- 11241100x8000000000000000541958Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:39.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b6b9ce9d7869ab502021-12-21 11:34:39.693root 11241100x8000000000000000541959Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:39.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5499d23546536fe72021-12-21 11:34:39.693root 11241100x8000000000000000541960Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:39.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.aea7715099d1e38d2021-12-21 11:34:39.693root 11241100x8000000000000000541961Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:39.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c1e1d03cf3fe8a102021-12-21 11:34:39.693root 11241100x8000000000000000541962Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:39.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.77ce46edc250ccdf2021-12-21 11:34:39.693root 11241100x8000000000000000541963Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:39.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.158d7b06521264f12021-12-21 11:34:39.693root 11241100x8000000000000000541964Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:39.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b83fa561b5c333c42021-12-21 11:34:39.694root 11241100x8000000000000000541965Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:39.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4f0efc52902ecc8e2021-12-21 11:34:39.694root 11241100x8000000000000000541966Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:39.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6eabed1daca9b5092021-12-21 11:34:39.694root 11241100x8000000000000000541967Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:39.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.009747e9c50d36482021-12-21 11:34:39.694root 11241100x8000000000000000541968Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:39.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.db5e13d2ad7394332021-12-21 11:34:39.694root 11241100x8000000000000000541969Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:39.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.96f5324e8d30ae6b2021-12-21 11:34:39.694root 11241100x8000000000000000541970Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:40.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d714561c75ca96322021-12-21 11:34:40.193root 11241100x8000000000000000541971Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:40.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0c588123a3a6edf02021-12-21 11:34:40.193root 11241100x8000000000000000541972Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:40.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.023f31c1e14a3b1c2021-12-21 11:34:40.193root 11241100x8000000000000000541973Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:40.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f32a5b55e36d6a6c2021-12-21 11:34:40.193root 11241100x8000000000000000541974Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:40.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.01302b2c016c51762021-12-21 11:34:40.193root 11241100x8000000000000000541975Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:40.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ea5442761a09cae92021-12-21 11:34:40.193root 11241100x8000000000000000541976Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:40.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.710bc9a9aeba80c22021-12-21 11:34:40.193root 11241100x8000000000000000541977Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:40.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.169f6f29bd096dc32021-12-21 11:34:40.193root 11241100x8000000000000000541978Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:40.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.194025133159a0072021-12-21 11:34:40.193root 11241100x8000000000000000541979Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:40.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.881f12621193ae482021-12-21 11:34:40.194root 11241100x8000000000000000541980Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:40.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.77e4c78d048bb76c2021-12-21 11:34:40.194root 11241100x8000000000000000541981Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:40.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.558026051b23cf652021-12-21 11:34:40.194root 11241100x8000000000000000541982Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:40.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5bd6b3ffd02a65e32021-12-21 11:34:40.693root 11241100x8000000000000000541983Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:40.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.02c0232c997c8d272021-12-21 11:34:40.693root 11241100x8000000000000000541984Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:40.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f4001a1b121f210f2021-12-21 11:34:40.693root 11241100x8000000000000000541985Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:40.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.de414b127fc493232021-12-21 11:34:40.693root 11241100x8000000000000000541986Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:40.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a2df231692cdfcf42021-12-21 11:34:40.693root 11241100x8000000000000000541987Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:40.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1976c9275ca34f782021-12-21 11:34:40.693root 11241100x8000000000000000541988Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:40.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.62f4cce78897bb512021-12-21 11:34:40.693root 11241100x8000000000000000541989Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:40.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.fbc36d75571c62102021-12-21 11:34:40.693root 11241100x8000000000000000541990Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:40.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1e86ed547b3e6a092021-12-21 11:34:40.693root 11241100x8000000000000000541991Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:40.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f49141302de268692021-12-21 11:34:40.694root 11241100x8000000000000000541992Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:40.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9f5e73bc3a3005e32021-12-21 11:34:40.694root 11241100x8000000000000000541993Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:40.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.da8a48506d591ce32021-12-21 11:34:40.694root 11241100x8000000000000000541994Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:41.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.73f47acd169ab5932021-12-21 11:34:41.193root 11241100x8000000000000000541995Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:41.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c4b9d068c38c850e2021-12-21 11:34:41.193root 11241100x8000000000000000541996Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:41.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.62041a09f1dd0c0f2021-12-21 11:34:41.193root 11241100x8000000000000000541997Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:41.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1ce1c2d96a6e2e7b2021-12-21 11:34:41.193root 11241100x8000000000000000541998Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:41.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ed3aba917b18cce42021-12-21 11:34:41.194root 11241100x8000000000000000541999Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:41.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8088903ecc52dd772021-12-21 11:34:41.194root 11241100x8000000000000000542000Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:41.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9fdb5238ab20ca4f2021-12-21 11:34:41.194root 11241100x8000000000000000542001Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:41.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.89a95f0eaa8383782021-12-21 11:34:41.194root 11241100x8000000000000000542002Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:41.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ab7a63ffbc0af2332021-12-21 11:34:41.194root 11241100x8000000000000000542003Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:41.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2ae30116f930345c2021-12-21 11:34:41.194root 11241100x8000000000000000542004Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:41.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7fc8d7ec37345b5e2021-12-21 11:34:41.194root 11241100x8000000000000000542005Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:41.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.faa8d386adf3c94a2021-12-21 11:34:41.194root 11241100x8000000000000000542006Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:41.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8006b214bbdd71f32021-12-21 11:34:41.693root 11241100x8000000000000000542007Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:41.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.66896878d7e23b032021-12-21 11:34:41.693root 11241100x8000000000000000542008Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:41.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6177b879cb9a04442021-12-21 11:34:41.693root 11241100x8000000000000000542009Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:41.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4d7f83df1fc838262021-12-21 11:34:41.693root 11241100x8000000000000000542010Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:41.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6faf002cf20047032021-12-21 11:34:41.693root 11241100x8000000000000000542011Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:41.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c883c7709fdfd8602021-12-21 11:34:41.693root 11241100x8000000000000000542012Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:41.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.48cc62c61bef66a02021-12-21 11:34:41.693root 11241100x8000000000000000542013Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:41.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3ee54e61ea661cdc2021-12-21 11:34:41.693root 11241100x8000000000000000542014Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:41.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7d00a0159a7acc942021-12-21 11:34:41.693root 11241100x8000000000000000542015Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:41.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.aa3bdb86e0783b432021-12-21 11:34:41.694root 11241100x8000000000000000542016Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:41.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.aab78be351377b4b2021-12-21 11:34:41.694root 11241100x8000000000000000542017Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:41.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ab27a2a454bfd41b2021-12-21 11:34:41.694root 11241100x8000000000000000542018Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:42.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.160ecb5eab4653952021-12-21 11:34:42.193root 11241100x8000000000000000542019Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:42.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5053b78f2ffbf2ee2021-12-21 11:34:42.193root 11241100x8000000000000000542020Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:42.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c58c8e0142f32d282021-12-21 11:34:42.194root 11241100x8000000000000000542021Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:42.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.fa93ae64b3e6613a2021-12-21 11:34:42.194root 11241100x8000000000000000542022Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:42.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.cba2a0ef66a6d8b82021-12-21 11:34:42.194root 11241100x8000000000000000542023Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:42.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.850df1a0e91733432021-12-21 11:34:42.194root 11241100x8000000000000000542024Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:42.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4df5f2af1b24976a2021-12-21 11:34:42.194root 11241100x8000000000000000542025Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:42.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ac6d433043cb760a2021-12-21 11:34:42.194root 11241100x8000000000000000542026Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:42.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9d7fe0b93c9329b32021-12-21 11:34:42.194root 11241100x8000000000000000542027Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:42.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d95ab6bcfb3301be2021-12-21 11:34:42.194root 11241100x8000000000000000542028Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:42.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a5f855b78fe4e2b22021-12-21 11:34:42.194root 11241100x8000000000000000542029Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:42.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f29508722eb2ff5f2021-12-21 11:34:42.194root 11241100x8000000000000000542030Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:42.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d32b963e045f44d62021-12-21 11:34:42.693root 11241100x8000000000000000542031Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:42.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.63a83fd6a3eacea82021-12-21 11:34:42.693root 11241100x8000000000000000542032Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:42.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.08411e066c6605982021-12-21 11:34:42.693root 11241100x8000000000000000542033Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:42.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.88ec0e5059d6ec062021-12-21 11:34:42.693root 11241100x8000000000000000542034Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:42.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.800701c3b8ec0bea2021-12-21 11:34:42.693root 11241100x8000000000000000542035Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:42.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2b168103551199d02021-12-21 11:34:42.693root 11241100x8000000000000000542036Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:42.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.68819212ffe09c6d2021-12-21 11:34:42.693root 11241100x8000000000000000542037Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:42.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.69220a5aad508ca02021-12-21 11:34:42.693root 11241100x8000000000000000542038Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:42.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b3cec5a63c06a7062021-12-21 11:34:42.694root 11241100x8000000000000000542039Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:42.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f2ff3223976a2e692021-12-21 11:34:42.694root 11241100x8000000000000000542040Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:42.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ed4a12ead53b18e02021-12-21 11:34:42.694root 11241100x8000000000000000542041Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:42.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8df16f2de63cacb62021-12-21 11:34:42.694root 11241100x8000000000000000542042Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:43.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.281da3fd53c6111a2021-12-21 11:34:43.193root 11241100x8000000000000000542043Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:43.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.65e21e9a5548ca0a2021-12-21 11:34:43.193root 11241100x8000000000000000542044Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:43.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c3d961f96d0d84b72021-12-21 11:34:43.193root 11241100x8000000000000000542045Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:43.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.be72fba8a196197c2021-12-21 11:34:43.194root 11241100x8000000000000000542046Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:43.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.04da91e2889355172021-12-21 11:34:43.194root 11241100x8000000000000000542047Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:43.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ca2cc9280c4b38382021-12-21 11:34:43.194root 11241100x8000000000000000542048Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:43.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6ad9151312987cc22021-12-21 11:34:43.194root 11241100x8000000000000000542049Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:43.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.43122069a6e1dc702021-12-21 11:34:43.194root 11241100x8000000000000000542050Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:43.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1474efbc697d3fde2021-12-21 11:34:43.194root 11241100x8000000000000000542051Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:43.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.46b406eef25bd8b92021-12-21 11:34:43.194root 11241100x8000000000000000542052Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:43.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a97deff7bd5e4ac02021-12-21 11:34:43.194root 11241100x8000000000000000542053Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:43.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b31602f7b270bcc82021-12-21 11:34:43.194root 11241100x8000000000000000542054Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:43.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7f897f626a297ad22021-12-21 11:34:43.693root 11241100x8000000000000000542055Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:43.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.47a0e6a6e0bfb8062021-12-21 11:34:43.693root 11241100x8000000000000000542056Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:43.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6dd76e496178cf8e2021-12-21 11:34:43.693root 11241100x8000000000000000542057Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:43.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0fbc95ce3156e6cf2021-12-21 11:34:43.693root 11241100x8000000000000000542058Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:43.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.87704a884d9b2a252021-12-21 11:34:43.693root 11241100x8000000000000000542059Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:43.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f1ea85d79b2f7ea62021-12-21 11:34:43.693root 11241100x8000000000000000542060Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:43.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7a4d6c4fe2b59bd92021-12-21 11:34:43.693root 11241100x8000000000000000542061Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:43.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.be317d4f28ed0a372021-12-21 11:34:43.693root 11241100x8000000000000000542062Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:43.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.012c8ac5e0158fcc2021-12-21 11:34:43.693root 11241100x8000000000000000542063Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:43.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c0e2ab172b99768c2021-12-21 11:34:43.693root 11241100x8000000000000000542064Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:43.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e518305e5a1a1eed2021-12-21 11:34:43.694root 11241100x8000000000000000542065Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:43.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6147376cc4982d2d2021-12-21 11:34:43.694root 354300x8000000000000000542066Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:44.118{ec2b6afe-95d9-61c1-5175-3a0400000000}5346/opt/splunkforwarder/etc/apps/Splunk_TA_stream/linux_x86_64/bin/streamfwdroottcptruefalse10.0.1.25-48748-false10.0.1.12-8000- 11241100x8000000000000000542067Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:44.119{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5639e777d58e37a42021-12-21 11:34:44.119root 11241100x8000000000000000542068Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:44.119{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.385e013fd2a93bef2021-12-21 11:34:44.119root 11241100x8000000000000000542069Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:44.119{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.feeb5c32c41f83952021-12-21 11:34:44.119root 11241100x8000000000000000542070Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:44.120{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c7aa267b18f83d682021-12-21 11:34:44.120root 11241100x8000000000000000542071Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:44.120{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5e04fb135d23955e2021-12-21 11:34:44.120root 11241100x8000000000000000542072Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:44.120{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.dab78284a4c69d1a2021-12-21 11:34:44.120root 11241100x8000000000000000542073Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:44.121{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4c972e5ce170c2542021-12-21 11:34:44.121root 11241100x8000000000000000542074Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:44.121{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.cb3f716d99d6237f2021-12-21 11:34:44.121root 11241100x8000000000000000542075Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:44.122{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ee717d735f0d82072021-12-21 11:34:44.122root 11241100x8000000000000000542076Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:44.122{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.abd4bdc9232fb9952021-12-21 11:34:44.122root 11241100x8000000000000000542077Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:44.122{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.44ff88c4f3e389112021-12-21 11:34:44.122root 11241100x8000000000000000542078Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:44.122{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0f6fd09ea9689b042021-12-21 11:34:44.122root 11241100x8000000000000000542079Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:44.122{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a69dd4c4d3e9cc8a2021-12-21 11:34:44.122root 11241100x8000000000000000542080Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:44.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.65fa88363eb9c39a2021-12-21 11:34:44.443root 11241100x8000000000000000542081Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:44.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.90a5f1be46bd02e92021-12-21 11:34:44.443root 11241100x8000000000000000542082Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:44.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5def7d2e9d0fac652021-12-21 11:34:44.443root 11241100x8000000000000000542083Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:44.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.64633f86847143942021-12-21 11:34:44.443root 11241100x8000000000000000542084Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:44.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.bfaa660e61308af32021-12-21 11:34:44.443root 11241100x8000000000000000542085Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:44.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4501400c7e09010d2021-12-21 11:34:44.443root 11241100x8000000000000000542086Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:44.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.63186afa748dcbf42021-12-21 11:34:44.443root 11241100x8000000000000000542087Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:44.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2114f0f4d018860d2021-12-21 11:34:44.443root 11241100x8000000000000000542088Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:44.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.760cda4b287d21a12021-12-21 11:34:44.443root 11241100x8000000000000000542089Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:44.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9175bbf57eefc0362021-12-21 11:34:44.444root 11241100x8000000000000000542090Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:44.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9c2522c9733b01ca2021-12-21 11:34:44.444root 11241100x8000000000000000542091Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:44.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.659fa96c9e8839de2021-12-21 11:34:44.444root 11241100x8000000000000000542092Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:44.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.905a5ec5de0b0c182021-12-21 11:34:44.444root 11241100x8000000000000000542093Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:44.446{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0a1615b4100f50872021-12-21 11:34:44.446root 11241100x8000000000000000542094Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:44.446{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.128149d0ca4bf18a2021-12-21 11:34:44.446root 11241100x8000000000000000542095Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:44.446{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.22e43cddc25b6b3a2021-12-21 11:34:44.446root 11241100x8000000000000000542096Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:44.446{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.80b093604129d1b52021-12-21 11:34:44.446root 11241100x8000000000000000542097Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:44.446{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8c51ff35f92b00ea2021-12-21 11:34:44.446root 11241100x8000000000000000542098Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:44.446{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8c615c74afe18c952021-12-21 11:34:44.446root 11241100x8000000000000000542099Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:44.446{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7c6488fa4af4be902021-12-21 11:34:44.446root 11241100x8000000000000000542100Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:44.446{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a430bf5e7153de952021-12-21 11:34:44.446root 11241100x8000000000000000542101Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:44.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.aecdf8dcc77d43f62021-12-21 11:34:44.943root 11241100x8000000000000000542102Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:44.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e6b1b18453355eb02021-12-21 11:34:44.943root 11241100x8000000000000000542103Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:44.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ff87f5399dda27e12021-12-21 11:34:44.943root 11241100x8000000000000000542104Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:44.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.179629c177e64f942021-12-21 11:34:44.943root 11241100x8000000000000000542105Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:44.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.15e6acd50b8868c42021-12-21 11:34:44.943root 11241100x8000000000000000542106Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:44.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e2f8f442078ba9072021-12-21 11:34:44.943root 11241100x8000000000000000542107Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:44.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.160d6ec044252a9c2021-12-21 11:34:44.943root 11241100x8000000000000000542108Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:44.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9f21956607a90c572021-12-21 11:34:44.943root 11241100x8000000000000000542109Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:44.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4a7fdaf3d2199da22021-12-21 11:34:44.944root 11241100x8000000000000000542110Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:44.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d053b8fdd215284a2021-12-21 11:34:44.944root 11241100x8000000000000000542111Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:44.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.50dbe73c007cc2032021-12-21 11:34:44.944root 11241100x8000000000000000542112Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:44.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1e6568a9876d631d2021-12-21 11:34:44.944root 11241100x8000000000000000542113Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:44.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c4a71586ea66b0642021-12-21 11:34:44.944root 11241100x8000000000000000542114Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:45.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a478263a4294165f2021-12-21 11:34:45.443root 11241100x8000000000000000542115Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:45.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.df4ac91ae36290972021-12-21 11:34:45.443root 11241100x8000000000000000542116Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:45.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7edacad5209f8ee92021-12-21 11:34:45.443root 11241100x8000000000000000542117Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:45.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d1a5054bc1043dfd2021-12-21 11:34:45.443root 11241100x8000000000000000542118Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:45.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ef35e58d77d9942f2021-12-21 11:34:45.443root 11241100x8000000000000000542119Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:45.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ae42d640ef8831482021-12-21 11:34:45.443root 11241100x8000000000000000542120Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:45.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.08e607f862e62c1a2021-12-21 11:34:45.443root 11241100x8000000000000000542121Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:45.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7b725e6cd2e383362021-12-21 11:34:45.443root 11241100x8000000000000000542122Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:45.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.18d0ad8986db6d7a2021-12-21 11:34:45.444root 11241100x8000000000000000542123Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:45.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.033143621e8038f62021-12-21 11:34:45.444root 11241100x8000000000000000542124Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:45.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.af04bd0962a6b2ef2021-12-21 11:34:45.444root 11241100x8000000000000000542125Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:45.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.bbf9091888054e8c2021-12-21 11:34:45.444root 11241100x8000000000000000542126Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:45.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a7789322e9b883612021-12-21 11:34:45.444root 11241100x8000000000000000542127Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:45.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8d40927e09079bc72021-12-21 11:34:45.943root 11241100x8000000000000000542128Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:45.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8176f90a321f94ef2021-12-21 11:34:45.943root 11241100x8000000000000000542129Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:45.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c30292dd8d30a2532021-12-21 11:34:45.943root 11241100x8000000000000000542130Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:45.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.72aa7723cffc998b2021-12-21 11:34:45.943root 11241100x8000000000000000542131Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:45.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1db44e15e9be0f2b2021-12-21 11:34:45.943root 11241100x8000000000000000542132Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:45.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.30acfcc6f0d2bd7d2021-12-21 11:34:45.943root 11241100x8000000000000000542133Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:45.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.094adb919d8dd1702021-12-21 11:34:45.943root 11241100x8000000000000000542134Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:45.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4c67c6f59dffcccd2021-12-21 11:34:45.943root 11241100x8000000000000000542135Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:45.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d888291251e58f912021-12-21 11:34:45.944root 11241100x8000000000000000542136Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:45.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0fbfb3aaacecf91d2021-12-21 11:34:45.944root 11241100x8000000000000000542137Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:45.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ff5bcbad3f514a1c2021-12-21 11:34:45.944root 11241100x8000000000000000542138Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:45.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8018f094513c294e2021-12-21 11:34:45.944root 11241100x8000000000000000542139Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:45.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d0c85c05d495edae2021-12-21 11:34:45.944root 11241100x8000000000000000542140Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:46.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f1487d27cbbd88fe2021-12-21 11:34:46.443root 11241100x8000000000000000542141Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:46.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.422c217bc96bdd802021-12-21 11:34:46.443root 11241100x8000000000000000542142Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:46.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b4687732a51e1f632021-12-21 11:34:46.443root 11241100x8000000000000000542143Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:46.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2e216dc3aae0af272021-12-21 11:34:46.444root 11241100x8000000000000000542144Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:46.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.64b168c0ed5ac0e62021-12-21 11:34:46.444root 11241100x8000000000000000542145Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:46.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.07f60d9068ab3d212021-12-21 11:34:46.444root 11241100x8000000000000000542146Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:46.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e67884592c220f3f2021-12-21 11:34:46.445root 11241100x8000000000000000542147Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:46.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d3664e72290b50102021-12-21 11:34:46.445root 11241100x8000000000000000542148Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:46.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.40d2b8ac3ed2d4dc2021-12-21 11:34:46.445root 11241100x8000000000000000542149Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:46.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5ce6504ef34ba9a72021-12-21 11:34:46.445root 11241100x8000000000000000542150Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:46.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.06d05c785eae2f7c2021-12-21 11:34:46.445root 11241100x8000000000000000542151Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:46.446{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.edb5ffee880372bc2021-12-21 11:34:46.446root 11241100x8000000000000000542152Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:46.446{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.377d818f68deb5a72021-12-21 11:34:46.446root 11241100x8000000000000000542153Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:46.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.250551cde1d6c3da2021-12-21 11:34:46.943root 11241100x8000000000000000542154Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:46.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.63052bc2f65530062021-12-21 11:34:46.943root 11241100x8000000000000000542155Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:46.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.990e60b6de5dab4c2021-12-21 11:34:46.943root 11241100x8000000000000000542156Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:46.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.571e763d11e2606c2021-12-21 11:34:46.943root 11241100x8000000000000000542157Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:46.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7e6bf8cc33019b902021-12-21 11:34:46.943root 11241100x8000000000000000542158Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:46.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d54a3634ef5194c42021-12-21 11:34:46.943root 11241100x8000000000000000542159Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:46.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5be31d995cb0fc6a2021-12-21 11:34:46.943root 11241100x8000000000000000542160Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:46.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1fbc7a0a08cae4be2021-12-21 11:34:46.944root 11241100x8000000000000000542161Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:46.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c999d3e42c4b98c12021-12-21 11:34:46.944root 11241100x8000000000000000542162Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:46.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.73504b37e80eeeff2021-12-21 11:34:46.944root 11241100x8000000000000000542163Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:46.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.350127d9a6bae0ee2021-12-21 11:34:46.944root 11241100x8000000000000000542164Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:46.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.92f4be8e822fb4352021-12-21 11:34:46.944root 11241100x8000000000000000542165Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:46.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.028a27990a4e1f372021-12-21 11:34:46.944root 11241100x8000000000000000542166Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:47.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7a3d0f5f5382892d2021-12-21 11:34:47.443root 11241100x8000000000000000542167Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:47.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.62e737898ba11a632021-12-21 11:34:47.443root 11241100x8000000000000000542168Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:47.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4f9555e391adb7d22021-12-21 11:34:47.443root 11241100x8000000000000000542169Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:47.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.23468e4ea05446fb2021-12-21 11:34:47.444root 11241100x8000000000000000542170Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:47.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5443858484ff20272021-12-21 11:34:47.444root 11241100x8000000000000000542171Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:47.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.98c2785992309e532021-12-21 11:34:47.444root 11241100x8000000000000000542172Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:47.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d88b353e0447e3c52021-12-21 11:34:47.444root 11241100x8000000000000000542173Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:47.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1e2b0f874cad52272021-12-21 11:34:47.444root 11241100x8000000000000000542174Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:47.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6f2240bb56c04cd42021-12-21 11:34:47.445root 11241100x8000000000000000542175Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:47.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ca05f757b354d1282021-12-21 11:34:47.445root 11241100x8000000000000000542176Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:47.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d60bbe23f3bb79ee2021-12-21 11:34:47.445root 11241100x8000000000000000542177Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:47.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1a97714e36807c4e2021-12-21 11:34:47.445root 11241100x8000000000000000542178Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:47.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.bc6b93025f0392442021-12-21 11:34:47.445root 11241100x8000000000000000542179Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:47.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2411244a870cbe372021-12-21 11:34:47.943root 11241100x8000000000000000542180Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:47.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.00905e1a333ac7e92021-12-21 11:34:47.943root 11241100x8000000000000000542181Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:47.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4e520996bed823522021-12-21 11:34:47.943root 11241100x8000000000000000542182Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:47.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4d1b1899cd8ea2742021-12-21 11:34:47.943root 11241100x8000000000000000542183Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:47.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.06019599beca2b342021-12-21 11:34:47.943root 11241100x8000000000000000542184Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:47.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.22b07c89d36ef2532021-12-21 11:34:47.943root 11241100x8000000000000000542185Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:47.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.06b6cd773d98f0702021-12-21 11:34:47.943root 11241100x8000000000000000542186Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:47.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.da9047e6f2ce039b2021-12-21 11:34:47.943root 11241100x8000000000000000542187Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:47.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.94dcb5afc919f96f2021-12-21 11:34:47.943root 11241100x8000000000000000542188Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:47.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5751f31eb0dd21222021-12-21 11:34:47.944root 11241100x8000000000000000542189Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:47.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c0aa3bc6f0af3a812021-12-21 11:34:47.944root 11241100x8000000000000000542190Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:47.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.530ab537c82659622021-12-21 11:34:47.944root 11241100x8000000000000000542191Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:47.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a1d8b3fa1943cfcb2021-12-21 11:34:47.944root 11241100x8000000000000000542192Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:48.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5e527bf22840db632021-12-21 11:34:48.443root 11241100x8000000000000000542193Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:48.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.469b82a24466b7ab2021-12-21 11:34:48.443root 11241100x8000000000000000542194Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:48.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0f7fa8dc8dcd395d2021-12-21 11:34:48.443root 11241100x8000000000000000542195Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:48.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c74b285e240810312021-12-21 11:34:48.443root 11241100x8000000000000000542196Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:48.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.eefab2eba62e906f2021-12-21 11:34:48.443root 11241100x8000000000000000542197Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:48.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c01db6faeb0a34082021-12-21 11:34:48.443root 11241100x8000000000000000542198Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:48.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.cfda32ca45206c6e2021-12-21 11:34:48.444root 11241100x8000000000000000542199Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:48.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7afd77ac76cb69272021-12-21 11:34:48.444root 11241100x8000000000000000542200Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:48.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7715b551c5e677042021-12-21 11:34:48.444root 11241100x8000000000000000542201Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:48.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.efa52bcb903640902021-12-21 11:34:48.444root 11241100x8000000000000000542202Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:48.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.cab88988001733592021-12-21 11:34:48.444root 11241100x8000000000000000542203Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:48.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.24dbcded62369fb62021-12-21 11:34:48.444root 11241100x8000000000000000542204Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:48.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.146df8e39e6ee70a2021-12-21 11:34:48.444root 11241100x8000000000000000542205Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:48.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c363e267046418402021-12-21 11:34:48.943root 11241100x8000000000000000542206Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:48.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.51d1d0b045ad1b482021-12-21 11:34:48.943root 11241100x8000000000000000542207Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:48.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.eb7702393ef2ac622021-12-21 11:34:48.943root 11241100x8000000000000000542208Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:48.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.707f4a3d6ea1b7942021-12-21 11:34:48.943root 11241100x8000000000000000542209Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:48.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5d331c9a3b01d6702021-12-21 11:34:48.943root 11241100x8000000000000000542210Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:48.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.bb5527e5364766402021-12-21 11:34:48.943root 11241100x8000000000000000542211Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:48.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.25f4d8ed171518ad2021-12-21 11:34:48.943root 11241100x8000000000000000542212Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:48.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.fc1059d4211f498d2021-12-21 11:34:48.944root 11241100x8000000000000000542213Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:48.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5c5395b46fdb18072021-12-21 11:34:48.944root 11241100x8000000000000000542214Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:48.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.dc1c79ff5efcdf352021-12-21 11:34:48.944root 11241100x8000000000000000542215Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:48.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.10aa76c36a133edc2021-12-21 11:34:48.944root 11241100x8000000000000000542216Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:48.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.cec7bc7485c9b5b92021-12-21 11:34:48.944root 11241100x8000000000000000542217Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:48.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.bfd9237ca7bc7fab2021-12-21 11:34:48.944root 11241100x8000000000000000542218Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:49.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1269064e68aa63522021-12-21 11:34:49.443root 11241100x8000000000000000542219Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:49.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c64332741ec6a83c2021-12-21 11:34:49.443root 11241100x8000000000000000542220Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:49.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c64b38cd6cada35b2021-12-21 11:34:49.443root 11241100x8000000000000000542221Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:49.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b5998062faa554a42021-12-21 11:34:49.443root 11241100x8000000000000000542222Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:49.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.102125b1deb51a7e2021-12-21 11:34:49.443root 11241100x8000000000000000542223Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:49.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6295bd7ea636b3552021-12-21 11:34:49.443root 11241100x8000000000000000542224Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:49.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.27cfa419f044d5542021-12-21 11:34:49.443root 11241100x8000000000000000542225Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:49.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b714125eedb6d91b2021-12-21 11:34:49.443root 11241100x8000000000000000542226Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:49.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d9967b78243de8962021-12-21 11:34:49.443root 11241100x8000000000000000542227Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:49.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1381891855c9a2db2021-12-21 11:34:49.443root 11241100x8000000000000000542228Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:49.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5cc16d85f623db8b2021-12-21 11:34:49.443root 11241100x8000000000000000542229Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:49.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.89cc661f80d7a4ed2021-12-21 11:34:49.443root 11241100x8000000000000000542230Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:49.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3843b2dee8fb8e512021-12-21 11:34:49.444root 11241100x8000000000000000542231Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:49.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a11698013538d6a02021-12-21 11:34:49.943root 11241100x8000000000000000542232Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:49.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d90e1329ac4d11522021-12-21 11:34:49.943root 11241100x8000000000000000542233Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:49.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4f3400b89a95c8212021-12-21 11:34:49.943root 11241100x8000000000000000542234Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:49.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c3aead5099bc0cb12021-12-21 11:34:49.943root 11241100x8000000000000000542235Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:49.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7770c52873960d432021-12-21 11:34:49.943root 11241100x8000000000000000542236Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:49.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a29a7ebc0ad67cf12021-12-21 11:34:49.943root 11241100x8000000000000000542237Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:49.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.47ee9026929067732021-12-21 11:34:49.943root 11241100x8000000000000000542238Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:49.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6e68c78e6a52edbc2021-12-21 11:34:49.943root 11241100x8000000000000000542239Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:49.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c60988c48100fe3a2021-12-21 11:34:49.943root 11241100x8000000000000000542240Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:49.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ecc09419087cb01e2021-12-21 11:34:49.944root 11241100x8000000000000000542241Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:49.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1be8df16de1f16562021-12-21 11:34:49.944root 11241100x8000000000000000542242Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:49.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.84ecdd556c1caf612021-12-21 11:34:49.944root 11241100x8000000000000000542243Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:49.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d3c98b9b423cf8082021-12-21 11:34:49.944root 354300x8000000000000000542244Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:50.065{ec2b6afe-95d9-61c1-5175-3a0400000000}5346/opt/splunkforwarder/etc/apps/Splunk_TA_stream/linux_x86_64/bin/streamfwdroottcptruefalse10.0.1.25-48750-false10.0.1.12-8000- 11241100x8000000000000000542245Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:50.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b82624af485233d12021-12-21 11:34:50.443root 11241100x8000000000000000542246Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:50.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.109fcfde841c8e192021-12-21 11:34:50.443root 11241100x8000000000000000542247Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:50.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d14e0d707b6b43462021-12-21 11:34:50.443root 11241100x8000000000000000542248Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:50.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c90e9bca7221e6c62021-12-21 11:34:50.443root 11241100x8000000000000000542249Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:50.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7c95eb4535951d462021-12-21 11:34:50.444root 11241100x8000000000000000542250Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:50.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2231e154203991b92021-12-21 11:34:50.444root 11241100x8000000000000000542251Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:50.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f8af86dd8677f65a2021-12-21 11:34:50.444root 11241100x8000000000000000542252Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:50.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.93ee48dd85099e1b2021-12-21 11:34:50.444root 11241100x8000000000000000542253Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:50.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7fc356fe94b017582021-12-21 11:34:50.444root 11241100x8000000000000000542254Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:50.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.449da8cdfae01e352021-12-21 11:34:50.445root 11241100x8000000000000000542255Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:50.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ee5527d4c758db422021-12-21 11:34:50.445root 11241100x8000000000000000542256Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:50.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d1550896d44a6ce12021-12-21 11:34:50.445root 11241100x8000000000000000542257Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:50.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.799ebc5dd4c5d1702021-12-21 11:34:50.445root 11241100x8000000000000000542258Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:50.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.20846e688dfda49c2021-12-21 11:34:50.445root 11241100x8000000000000000542259Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:50.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3d7903accaecbec72021-12-21 11:34:50.943root 11241100x8000000000000000542260Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:50.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0a6e99a9d6578c4a2021-12-21 11:34:50.943root 11241100x8000000000000000542261Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:50.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b8808db5f5b13aef2021-12-21 11:34:50.943root 11241100x8000000000000000542262Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:50.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a43a4b7d3b440f862021-12-21 11:34:50.943root 11241100x8000000000000000542263Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:50.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.fc73d3055b05f87e2021-12-21 11:34:50.943root 11241100x8000000000000000542264Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:50.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b44ef6bc58e5c8722021-12-21 11:34:50.943root 11241100x8000000000000000542265Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:50.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3a06cb05df2e8c472021-12-21 11:34:50.943root 11241100x8000000000000000542266Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:50.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.bf5a4986b73fe39d2021-12-21 11:34:50.943root 11241100x8000000000000000542267Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:50.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.63f230f49d3e55d72021-12-21 11:34:50.944root 11241100x8000000000000000542268Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:50.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2276d54b76e7e71a2021-12-21 11:34:50.944root 11241100x8000000000000000542269Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:50.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.997069c067b71e062021-12-21 11:34:50.944root 11241100x8000000000000000542270Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:50.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1bdf4046bc9c718c2021-12-21 11:34:50.944root 11241100x8000000000000000542271Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:50.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6c8fad1b99e923fb2021-12-21 11:34:50.944root 11241100x8000000000000000542272Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:50.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2131dc6fd8c6e5312021-12-21 11:34:50.944root 11241100x8000000000000000542273Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:51.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0a8e885fc5ed317c2021-12-21 11:34:51.443root 11241100x8000000000000000542274Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:51.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.28798978d8b3a8dc2021-12-21 11:34:51.443root 11241100x8000000000000000542275Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:51.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a747e8e6ef67ee442021-12-21 11:34:51.443root 11241100x8000000000000000542276Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:51.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d54d3b5c1380b3022021-12-21 11:34:51.443root 11241100x8000000000000000542277Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:51.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8948376e02c03cf62021-12-21 11:34:51.443root 11241100x8000000000000000542278Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:51.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a66356c55c1212122021-12-21 11:34:51.443root 11241100x8000000000000000542279Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:51.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.37b7cc4cee86009f2021-12-21 11:34:51.443root 11241100x8000000000000000542280Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:51.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5bf553a3e37a29542021-12-21 11:34:51.443root 11241100x8000000000000000542281Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:51.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2b285d9cf127578e2021-12-21 11:34:51.444root 11241100x8000000000000000542282Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:51.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.44468d3d0371432a2021-12-21 11:34:51.444root 11241100x8000000000000000542283Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:51.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1571b76f0fa2157c2021-12-21 11:34:51.444root 11241100x8000000000000000542284Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:51.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e9fbb33b063b6fad2021-12-21 11:34:51.444root 11241100x8000000000000000542285Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:51.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.058a19f1c233269d2021-12-21 11:34:51.444root 11241100x8000000000000000542286Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:51.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.27fe16a5edaa51d52021-12-21 11:34:51.444root 11241100x8000000000000000542287Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:51.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a38a64d1def32beb2021-12-21 11:34:51.943root 11241100x8000000000000000542288Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:51.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3db12984068bf33b2021-12-21 11:34:51.943root 11241100x8000000000000000542289Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:51.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ea3a1d7cbbd8b3da2021-12-21 11:34:51.943root 11241100x8000000000000000542290Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:51.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6c5d408b6e5b8a9a2021-12-21 11:34:51.943root 11241100x8000000000000000542291Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:51.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.66e4311d3fff7f852021-12-21 11:34:51.943root 11241100x8000000000000000542292Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:51.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4ff05ced1499b4e92021-12-21 11:34:51.943root 11241100x8000000000000000542293Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:51.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d77b5205289a9ab82021-12-21 11:34:51.943root 11241100x8000000000000000542294Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:51.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.77aad1db81c3ee552021-12-21 11:34:51.943root 11241100x8000000000000000542295Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:51.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c3126200682425022021-12-21 11:34:51.944root 11241100x8000000000000000542296Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:51.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ad2f7c0471a996302021-12-21 11:34:51.944root 11241100x8000000000000000542297Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:51.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.06ff447760b6443b2021-12-21 11:34:51.944root 11241100x8000000000000000542298Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:51.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.36fa6efc298ee0f32021-12-21 11:34:51.944root 11241100x8000000000000000542299Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:51.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.767e7b49282d16132021-12-21 11:34:51.944root 11241100x8000000000000000542300Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:51.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.26175e51fc287faf2021-12-21 11:34:51.944root 11241100x8000000000000000542301Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:52.442{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5559d7d39c29ab222021-12-21 11:34:52.442root 11241100x8000000000000000542302Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:52.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.aaa9364c352ce6782021-12-21 11:34:52.443root 11241100x8000000000000000542303Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:52.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1889318d8b46c5222021-12-21 11:34:52.443root 11241100x8000000000000000542304Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:52.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7df7fd1f26ae974a2021-12-21 11:34:52.443root 11241100x8000000000000000542305Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:52.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b046182939f1ac872021-12-21 11:34:52.443root 11241100x8000000000000000542306Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:52.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4778bf1fe923f9aa2021-12-21 11:34:52.443root 11241100x8000000000000000542307Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:52.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.95cf565a4dd26b672021-12-21 11:34:52.443root 11241100x8000000000000000542308Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:52.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3661c097fdd2d7242021-12-21 11:34:52.443root 11241100x8000000000000000542309Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:52.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5c2e727bfab3b0892021-12-21 11:34:52.444root 11241100x8000000000000000542310Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:52.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8272e02bbb1ad8ee2021-12-21 11:34:52.444root 11241100x8000000000000000542311Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:52.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4294f99a52513afe2021-12-21 11:34:52.444root 11241100x8000000000000000542312Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:52.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.109a918720a627ec2021-12-21 11:34:52.444root 11241100x8000000000000000542313Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:52.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e187f22efba178012021-12-21 11:34:52.444root 11241100x8000000000000000542314Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:52.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9f09a6e0f6ae99582021-12-21 11:34:52.444root 11241100x8000000000000000542315Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:52.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e39193a25acda7202021-12-21 11:34:52.943root 11241100x8000000000000000542316Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:52.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.19dd4add5fa9ed112021-12-21 11:34:52.943root 11241100x8000000000000000542317Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:52.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a214185e6f016bb62021-12-21 11:34:52.943root 11241100x8000000000000000542318Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:52.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.991731a0ccc9e4b42021-12-21 11:34:52.943root 11241100x8000000000000000542319Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:52.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.bbdbfbcd410295272021-12-21 11:34:52.943root 11241100x8000000000000000542320Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:52.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.106225d425ab6f322021-12-21 11:34:52.943root 11241100x8000000000000000542321Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:52.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d628c5db60507aa02021-12-21 11:34:52.943root 11241100x8000000000000000542322Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:52.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f1d68cf74dd26ad12021-12-21 11:34:52.944root 11241100x8000000000000000542323Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:52.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.24930e07e0da4d5f2021-12-21 11:34:52.944root 11241100x8000000000000000542324Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:52.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.78c13934b6af23aa2021-12-21 11:34:52.944root 11241100x8000000000000000542325Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:52.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.94e31983bd92a5b52021-12-21 11:34:52.944root 11241100x8000000000000000542326Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:52.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a3245e98603168092021-12-21 11:34:52.944root 11241100x8000000000000000542327Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:52.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9031834bac1329392021-12-21 11:34:52.944root 11241100x8000000000000000542328Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:52.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f83c85b5486081bb2021-12-21 11:34:52.944root 11241100x8000000000000000542329Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:53.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ad22a738cae1cc1d2021-12-21 11:34:53.443root 11241100x8000000000000000542330Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:53.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.76845e45823cfbfc2021-12-21 11:34:53.443root 11241100x8000000000000000542331Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:53.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.918447c1f8625fda2021-12-21 11:34:53.443root 11241100x8000000000000000542332Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:53.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.dc2bd5b48aa0c6112021-12-21 11:34:53.443root 11241100x8000000000000000542333Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:53.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f43762197bda35ef2021-12-21 11:34:53.443root 11241100x8000000000000000542334Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:53.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4adcaba884c628162021-12-21 11:34:53.443root 11241100x8000000000000000542335Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:53.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.244888b162ce22a92021-12-21 11:34:53.443root 11241100x8000000000000000542336Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:53.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.212320f2c500a7c82021-12-21 11:34:53.444root 11241100x8000000000000000542337Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:53.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2134a935267ee49d2021-12-21 11:34:53.444root 11241100x8000000000000000542338Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:53.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4099e98ea7352a552021-12-21 11:34:53.444root 11241100x8000000000000000542339Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:53.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3a49e556a35c4f482021-12-21 11:34:53.444root 11241100x8000000000000000542340Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:53.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e2f4fb9c48dd86542021-12-21 11:34:53.444root 11241100x8000000000000000542341Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:53.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.638f33dfb6b0b7402021-12-21 11:34:53.444root 11241100x8000000000000000542342Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:53.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6103d81159599ef62021-12-21 11:34:53.444root 11241100x8000000000000000542343Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:53.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a1b3ea56b6792ee92021-12-21 11:34:53.943root 11241100x8000000000000000542344Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:53.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b6ddab4a730432ad2021-12-21 11:34:53.943root 11241100x8000000000000000542345Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:53.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.897fb893aa1bc2bb2021-12-21 11:34:53.943root 11241100x8000000000000000542346Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:53.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3c818f705688a9ea2021-12-21 11:34:53.943root 11241100x8000000000000000542347Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:53.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d711df5e12b26d832021-12-21 11:34:53.943root 11241100x8000000000000000542348Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:53.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.59856c274bcced062021-12-21 11:34:53.943root 11241100x8000000000000000542349Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:53.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4e820a74614798622021-12-21 11:34:53.943root 11241100x8000000000000000542350Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:53.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e3bdcaa6079814192021-12-21 11:34:53.943root 11241100x8000000000000000542351Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:53.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.41ad99d2f1501c3a2021-12-21 11:34:53.943root 11241100x8000000000000000542352Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:53.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.eabf80c3a070e11b2021-12-21 11:34:53.943root 11241100x8000000000000000542353Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:53.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a44f72ad14f739f12021-12-21 11:34:53.944root 11241100x8000000000000000542354Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:53.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.09319def8d5d82152021-12-21 11:34:53.944root 11241100x8000000000000000542355Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:53.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.bb144a6a6ba6ab672021-12-21 11:34:53.944root 11241100x8000000000000000542356Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:53.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6cbcefd8c9c4da712021-12-21 11:34:53.944root 11241100x8000000000000000542357Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:54.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.aee9fd471d7748ce2021-12-21 11:34:54.443root 11241100x8000000000000000542358Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:54.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1f32d1aae3a2705f2021-12-21 11:34:54.443root 11241100x8000000000000000542359Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:54.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.667c07581523cf662021-12-21 11:34:54.443root 11241100x8000000000000000542360Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:54.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.137a8635390fc8a22021-12-21 11:34:54.443root 11241100x8000000000000000542361Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:54.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7b0803f2671290fa2021-12-21 11:34:54.443root 11241100x8000000000000000542362Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:54.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.61f71fa73bce7dac2021-12-21 11:34:54.443root 11241100x8000000000000000542363Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:54.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b33ac92abbb90dfd2021-12-21 11:34:54.443root 11241100x8000000000000000542364Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:54.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.036cadd30323aa472021-12-21 11:34:54.444root 11241100x8000000000000000542365Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:54.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.fe6c59b40440ea0e2021-12-21 11:34:54.444root 11241100x8000000000000000542366Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:54.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ed12c0be7bd1246b2021-12-21 11:34:54.444root 11241100x8000000000000000542367Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:54.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6d98083bac109cfb2021-12-21 11:34:54.444root 11241100x8000000000000000542368Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:54.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.607346bdb1d2c8202021-12-21 11:34:54.444root 11241100x8000000000000000542369Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:54.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.66d017aeed11731d2021-12-21 11:34:54.444root 11241100x8000000000000000542370Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:54.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6f1704e05a43578c2021-12-21 11:34:54.444root 11241100x8000000000000000542371Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:54.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0478f31714f6ff7a2021-12-21 11:34:54.943root 11241100x8000000000000000542372Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:54.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.000d8ab12a07839c2021-12-21 11:34:54.943root 11241100x8000000000000000542373Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:54.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.fbb0def7368285172021-12-21 11:34:54.943root 11241100x8000000000000000542374Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:54.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.de7f9e31ca376e612021-12-21 11:34:54.943root 11241100x8000000000000000542375Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:54.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d2977598fbac05062021-12-21 11:34:54.943root 11241100x8000000000000000542376Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:54.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2b6c96c40b320b7a2021-12-21 11:34:54.943root 11241100x8000000000000000542377Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:54.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3b8488cc2a48f53c2021-12-21 11:34:54.943root 11241100x8000000000000000542378Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:54.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a8e7eb1489d340f42021-12-21 11:34:54.943root 11241100x8000000000000000542379Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:54.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.bc238861e42330b42021-12-21 11:34:54.943root 11241100x8000000000000000542380Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:54.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0840f03868e49a072021-12-21 11:34:54.944root 11241100x8000000000000000542381Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:54.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4649ede590f6c6fc2021-12-21 11:34:54.944root 11241100x8000000000000000542382Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:54.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6bfa703c1993fe9d2021-12-21 11:34:54.944root 11241100x8000000000000000542383Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:54.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ce4f9ee9e5af11f12021-12-21 11:34:54.944root 11241100x8000000000000000542384Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:54.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.705cba22bf82ed492021-12-21 11:34:54.944root 354300x8000000000000000542385Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:55.227{ec2b6afe-95d9-61c1-5175-3a0400000000}5346/opt/splunkforwarder/etc/apps/Splunk_TA_stream/linux_x86_64/bin/streamfwdroottcptruefalse10.0.1.25-48752-false10.0.1.12-8000- 11241100x8000000000000000542386Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:55.228{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ca5076fae54ae6722021-12-21 11:34:55.228root 11241100x8000000000000000542387Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:55.228{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1ac57c50859df6362021-12-21 11:34:55.228root 11241100x8000000000000000542388Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:55.228{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c447ecd01e29294c2021-12-21 11:34:55.228root 11241100x8000000000000000542389Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:55.228{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.197a0efaf658200d2021-12-21 11:34:55.228root 11241100x8000000000000000542390Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:55.228{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f651bea10b9cddd02021-12-21 11:34:55.228root 11241100x8000000000000000542391Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:55.228{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.56fc2ef34d2321e32021-12-21 11:34:55.228root 11241100x8000000000000000542392Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:55.229{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b9245f3ea129a4ad2021-12-21 11:34:55.229root 11241100x8000000000000000542393Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:55.229{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.96e69009ac6565a02021-12-21 11:34:55.229root 11241100x8000000000000000542394Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:55.229{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.821034373f84db692021-12-21 11:34:55.229root 11241100x8000000000000000542395Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:55.229{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e848a0cf614770e92021-12-21 11:34:55.229root 11241100x8000000000000000542396Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:55.229{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.852aabbd4ad47ba62021-12-21 11:34:55.229root 11241100x8000000000000000542397Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:55.229{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.009ca631ab8dacb82021-12-21 11:34:55.229root 11241100x8000000000000000542398Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:55.229{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f469d6055c9a3e7e2021-12-21 11:34:55.229root 11241100x8000000000000000542399Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:55.229{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9b9e6c73bf8afd3c2021-12-21 11:34:55.229root 11241100x8000000000000000542400Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:55.229{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.030b711edf135a132021-12-21 11:34:55.229root 11241100x8000000000000000542401Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:55.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1490025839bb2cf22021-12-21 11:34:55.693root 11241100x8000000000000000542402Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:55.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2d67c8cebe4878812021-12-21 11:34:55.693root 11241100x8000000000000000542403Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:55.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.795c223fef10d1072021-12-21 11:34:55.693root 11241100x8000000000000000542404Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:55.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.49527564db1805c92021-12-21 11:34:55.693root 11241100x8000000000000000542405Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:55.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.bb4535c2fcc0fba72021-12-21 11:34:55.694root 11241100x8000000000000000542406Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:55.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f2371c778019f9842021-12-21 11:34:55.694root 11241100x8000000000000000542407Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:55.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.db6cbe0b9492a4122021-12-21 11:34:55.694root 11241100x8000000000000000542408Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:55.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.af78764825f3fcc82021-12-21 11:34:55.694root 11241100x8000000000000000542409Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:55.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.04fea0fcd1783a4d2021-12-21 11:34:55.694root 11241100x8000000000000000542410Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:55.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e18cef8efa5f62102021-12-21 11:34:55.694root 11241100x8000000000000000542411Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:55.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.87a8d345eca264062021-12-21 11:34:55.694root 11241100x8000000000000000542412Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:55.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b9be69eeebc9ba572021-12-21 11:34:55.694root 11241100x8000000000000000542413Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:55.695{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8ec2bc6e4eb829e02021-12-21 11:34:55.695root 11241100x8000000000000000542414Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:55.695{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0dc6f7be095712c92021-12-21 11:34:55.695root 11241100x8000000000000000542415Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:55.695{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9d14084313dbac292021-12-21 11:34:55.695root 11241100x8000000000000000542416Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:56.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.985ffc4f96cbe5662021-12-21 11:34:56.193root 11241100x8000000000000000542417Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:56.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.918014e43162f3c02021-12-21 11:34:56.193root 11241100x8000000000000000542418Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:56.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6e795376fa10f0452021-12-21 11:34:56.193root 11241100x8000000000000000542419Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:56.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e0fd41bcae7dba812021-12-21 11:34:56.193root 11241100x8000000000000000542420Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:56.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f1ad5c8cabefff312021-12-21 11:34:56.193root 11241100x8000000000000000542421Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:56.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b5078eba4a47688a2021-12-21 11:34:56.194root 11241100x8000000000000000542422Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:56.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0a87ffdd029633ee2021-12-21 11:34:56.194root 11241100x8000000000000000542423Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:56.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.63de6400d3bdb6f12021-12-21 11:34:56.194root 11241100x8000000000000000542424Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:56.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e68d2da5088af95c2021-12-21 11:34:56.194root 11241100x8000000000000000542425Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:56.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e8f9bf4ce56a7ff62021-12-21 11:34:56.194root 11241100x8000000000000000542426Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:56.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.cdfdeb2da02fc1302021-12-21 11:34:56.194root 11241100x8000000000000000542427Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:56.195{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c7dc8b61564d37102021-12-21 11:34:56.195root 11241100x8000000000000000542428Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:56.195{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.32c5b425a0b380512021-12-21 11:34:56.195root 11241100x8000000000000000542429Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:56.195{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4a347bdcd4d524032021-12-21 11:34:56.195root 11241100x8000000000000000542430Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:56.195{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4e645949fea0e2bf2021-12-21 11:34:56.195root 11241100x8000000000000000542431Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:56.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.904f02c94e4116042021-12-21 11:34:56.693root 11241100x8000000000000000542432Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:56.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6d14c02772f056c62021-12-21 11:34:56.693root 11241100x8000000000000000542433Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:56.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b4b97db433bcd8cf2021-12-21 11:34:56.693root 11241100x8000000000000000542434Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:56.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7340ab7fcd7d39d32021-12-21 11:34:56.693root 11241100x8000000000000000542435Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:56.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8425bc6d448ae6d42021-12-21 11:34:56.693root 11241100x8000000000000000542436Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:56.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6d3cef4a21ee58dd2021-12-21 11:34:56.693root 11241100x8000000000000000542437Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:56.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e9e99907bf072f762021-12-21 11:34:56.693root 11241100x8000000000000000542438Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:56.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3142b8ac200d6fe82021-12-21 11:34:56.694root 11241100x8000000000000000542439Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:56.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.022430ca279231ce2021-12-21 11:34:56.694root 11241100x8000000000000000542440Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:56.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.162d73a5f3cbe9b42021-12-21 11:34:56.694root 11241100x8000000000000000542441Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:56.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.728c8c4108114f782021-12-21 11:34:56.694root 11241100x8000000000000000542442Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:56.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2281b676347cf5832021-12-21 11:34:56.694root 11241100x8000000000000000542443Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:56.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.072d5a48679741d72021-12-21 11:34:56.694root 11241100x8000000000000000542444Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:56.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0a064550286d17482021-12-21 11:34:56.694root 11241100x8000000000000000542445Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:56.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.da68314937b711532021-12-21 11:34:56.694root 11241100x8000000000000000542446Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:57.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ea594040439200ea2021-12-21 11:34:57.193root 11241100x8000000000000000542447Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:57.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2470e1074e1b40972021-12-21 11:34:57.193root 11241100x8000000000000000542448Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:57.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ef121ea66e738dbb2021-12-21 11:34:57.193root 11241100x8000000000000000542449Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:57.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a15cfb2d98518a4d2021-12-21 11:34:57.193root 11241100x8000000000000000542450Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:57.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.bb6433b574b2b3242021-12-21 11:34:57.193root 11241100x8000000000000000542451Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:57.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.973eec983f09bf4f2021-12-21 11:34:57.193root 11241100x8000000000000000542452Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:57.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8eab955539bce40f2021-12-21 11:34:57.193root 11241100x8000000000000000542453Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:57.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5b18dc2d1849f53f2021-12-21 11:34:57.193root 11241100x8000000000000000542454Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:57.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.31255a6bbbeadbda2021-12-21 11:34:57.193root 11241100x8000000000000000542455Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:57.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.04bb1205f179c22d2021-12-21 11:34:57.193root 11241100x8000000000000000542456Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:57.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.798c58f8d58d0efa2021-12-21 11:34:57.193root 11241100x8000000000000000542457Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:57.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a48a96efe4d6fdbd2021-12-21 11:34:57.193root 11241100x8000000000000000542458Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:57.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9e528824338d7f372021-12-21 11:34:57.194root 11241100x8000000000000000542459Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:57.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0054bfffb3cf20e62021-12-21 11:34:57.194root 11241100x8000000000000000542460Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:57.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.525058fc8001a0312021-12-21 11:34:57.194root 11241100x8000000000000000542461Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:57.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f84fc287868d88292021-12-21 11:34:57.693root 11241100x8000000000000000542462Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:57.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.317cef83b9428b162021-12-21 11:34:57.693root 11241100x8000000000000000542463Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:57.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.479b3c66adc28a082021-12-21 11:34:57.693root 11241100x8000000000000000542464Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:57.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ffb063e1504dffd92021-12-21 11:34:57.693root 11241100x8000000000000000542465Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:57.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1000df298c8a1fa12021-12-21 11:34:57.693root 11241100x8000000000000000542466Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:57.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.16b293b49dd5b8142021-12-21 11:34:57.693root 11241100x8000000000000000542467Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:57.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d6ebf8219da271ca2021-12-21 11:34:57.693root 11241100x8000000000000000542468Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:57.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5ce82d72db1098f22021-12-21 11:34:57.694root 11241100x8000000000000000542469Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:57.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a9b58da3806471102021-12-21 11:34:57.694root 11241100x8000000000000000542470Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:57.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7939e23d61e1a4d02021-12-21 11:34:57.694root 11241100x8000000000000000542471Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:57.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e037a22728ea4aa22021-12-21 11:34:57.694root 11241100x8000000000000000542472Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:57.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6d9ab9253d6619b42021-12-21 11:34:57.694root 11241100x8000000000000000542473Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:57.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.aefde78dcbe0d0df2021-12-21 11:34:57.694root 11241100x8000000000000000542474Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:57.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.26e8e28454412dd62021-12-21 11:34:57.694root 11241100x8000000000000000542475Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:57.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d1592158574731a72021-12-21 11:34:57.694root 11241100x8000000000000000542476Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:58.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ccb73acda137eeeb2021-12-21 11:34:58.193root 11241100x8000000000000000542477Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:58.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e7c5390edf4a0e9d2021-12-21 11:34:58.193root 11241100x8000000000000000542478Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:58.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8d33d9657bec48912021-12-21 11:34:58.193root 11241100x8000000000000000542479Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:58.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b54257086cf353f22021-12-21 11:34:58.193root 11241100x8000000000000000542480Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:58.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.46ad06bd620c375e2021-12-21 11:34:58.193root 11241100x8000000000000000542481Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:58.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9ab28edc92edc1c12021-12-21 11:34:58.193root 11241100x8000000000000000542482Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:58.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.327c0f07fecedb3f2021-12-21 11:34:58.193root 11241100x8000000000000000542483Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:58.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e6c412855d7a4f802021-12-21 11:34:58.193root 11241100x8000000000000000542484Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:58.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.227ebc325b5ebf172021-12-21 11:34:58.194root 11241100x8000000000000000542485Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:58.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a35562782e565a7c2021-12-21 11:34:58.194root 11241100x8000000000000000542486Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:58.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6fd0e9d5459223622021-12-21 11:34:58.194root 11241100x8000000000000000542487Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:58.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d371f210ca8cca062021-12-21 11:34:58.194root 11241100x8000000000000000542488Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:58.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.03404f9b920309af2021-12-21 11:34:58.194root 11241100x8000000000000000542489Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:58.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.abd95eedc2f07f592021-12-21 11:34:58.194root 11241100x8000000000000000542490Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:58.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7ef75d7c543061012021-12-21 11:34:58.194root 11241100x8000000000000000542491Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:58.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9868cc6feb84f6112021-12-21 11:34:58.693root 11241100x8000000000000000542492Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:58.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2951948d07c512892021-12-21 11:34:58.693root 11241100x8000000000000000542493Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:58.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e7566d9d459302d12021-12-21 11:34:58.693root 11241100x8000000000000000542494Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:58.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1d88b5674eeabeab2021-12-21 11:34:58.693root 11241100x8000000000000000542495Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:58.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.560532a717dcfbf52021-12-21 11:34:58.693root 11241100x8000000000000000542496Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:58.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.018dee942f1722132021-12-21 11:34:58.693root 11241100x8000000000000000542497Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:58.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.61bc47e40e3ebb772021-12-21 11:34:58.693root 11241100x8000000000000000542498Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:58.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5abb2f174abeb3ea2021-12-21 11:34:58.693root 11241100x8000000000000000542499Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:58.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.191748119c104fd62021-12-21 11:34:58.693root 11241100x8000000000000000542500Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:58.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.78c4d4b76aff373d2021-12-21 11:34:58.694root 11241100x8000000000000000542501Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:58.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4b79a5d579164d682021-12-21 11:34:58.694root 11241100x8000000000000000542502Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:58.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8f5da576d37f9d6d2021-12-21 11:34:58.694root 11241100x8000000000000000542503Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:58.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6f7456885fc46b522021-12-21 11:34:58.694root 11241100x8000000000000000542504Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:58.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4d94f3bb4091b57e2021-12-21 11:34:58.694root 11241100x8000000000000000542505Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:58.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e99da4765bf4aa3f2021-12-21 11:34:58.694root 11241100x8000000000000000542506Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:59.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.38386add29b53afe2021-12-21 11:34:59.193root 11241100x8000000000000000542507Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:59.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a8b3b71f70f7ba4f2021-12-21 11:34:59.193root 11241100x8000000000000000542508Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:59.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.fe64ec6dffeff3b92021-12-21 11:34:59.193root 11241100x8000000000000000542509Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:59.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5fd7d15dc7053bf62021-12-21 11:34:59.193root 11241100x8000000000000000542510Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:59.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ea27a3b4d03d66f82021-12-21 11:34:59.193root 11241100x8000000000000000542511Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:59.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a02036a73555e4802021-12-21 11:34:59.193root 11241100x8000000000000000542512Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:59.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ae25d6bc0567a6782021-12-21 11:34:59.193root 11241100x8000000000000000542513Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:59.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a5ed1f814b2168992021-12-21 11:34:59.193root 11241100x8000000000000000542514Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:59.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f183a1025016d20c2021-12-21 11:34:59.193root 11241100x8000000000000000542515Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:59.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.90a1fc5103a41dd42021-12-21 11:34:59.193root 11241100x8000000000000000542516Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:59.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.441815725bb68f792021-12-21 11:34:59.194root 11241100x8000000000000000542517Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:59.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8718c143208836db2021-12-21 11:34:59.194root 11241100x8000000000000000542518Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:59.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d50c8002de16c4ab2021-12-21 11:34:59.194root 11241100x8000000000000000542519Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:59.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7d07f46c38a411ff2021-12-21 11:34:59.194root 11241100x8000000000000000542520Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:59.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.512e92f7cff122522021-12-21 11:34:59.194root 11241100x8000000000000000542521Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:59.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b59d6495f7a8afdb2021-12-21 11:34:59.693root 11241100x8000000000000000542522Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:59.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f8fb6f0985832d962021-12-21 11:34:59.693root 11241100x8000000000000000542523Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:59.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7127a72df201b3ca2021-12-21 11:34:59.693root 11241100x8000000000000000542524Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:59.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9f3de773f625004c2021-12-21 11:34:59.693root 11241100x8000000000000000542525Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:59.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d7c9457eb6b990e62021-12-21 11:34:59.693root 11241100x8000000000000000542526Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:59.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0fc149d2e6d766642021-12-21 11:34:59.693root 11241100x8000000000000000542527Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:59.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e48863137bbc144e2021-12-21 11:34:59.694root 11241100x8000000000000000542528Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:59.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.27230f3c718d6ebe2021-12-21 11:34:59.694root 11241100x8000000000000000542529Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:59.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.bacf6d53610dd8fc2021-12-21 11:34:59.694root 11241100x8000000000000000542530Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:59.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ed44556476121e002021-12-21 11:34:59.694root 11241100x8000000000000000542531Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:59.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.57ca639e224b71232021-12-21 11:34:59.694root 11241100x8000000000000000542532Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:59.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6b0e895a109989a02021-12-21 11:34:59.694root 11241100x8000000000000000542533Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:59.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2955c5247ed4b6702021-12-21 11:34:59.694root 11241100x8000000000000000542534Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:59.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1f0e2e75467ae7d32021-12-21 11:34:59.694root 11241100x8000000000000000542535Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:34:59.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f8c3787ce165195d2021-12-21 11:34:59.694root 11241100x8000000000000000542536Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:00.192{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.98d74acd3baad0082021-12-21 11:35:00.192root 11241100x8000000000000000542537Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:00.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a90e4e2acde7cada2021-12-21 11:35:00.193root 11241100x8000000000000000542538Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:00.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e2c04eb0b2f5e63c2021-12-21 11:35:00.193root 11241100x8000000000000000542539Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:00.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e7c88adc186b63652021-12-21 11:35:00.193root 11241100x8000000000000000542540Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:00.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.04822a80ed4b9a332021-12-21 11:35:00.193root 11241100x8000000000000000542541Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:00.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.70ee0a655379ed582021-12-21 11:35:00.193root 11241100x8000000000000000542542Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:00.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.02c9ce343ed907ca2021-12-21 11:35:00.193root 11241100x8000000000000000542543Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:00.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7be7299fb6772fc42021-12-21 11:35:00.193root 11241100x8000000000000000542544Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:00.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7b592f4cc2860cca2021-12-21 11:35:00.193root 11241100x8000000000000000542545Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:00.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b083dde4207aa2012021-12-21 11:35:00.193root 11241100x8000000000000000542546Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:00.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ae4e6338532873142021-12-21 11:35:00.193root 11241100x8000000000000000542547Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:00.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ee21de3da3405fec2021-12-21 11:35:00.193root 11241100x8000000000000000542548Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:00.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e98a87e122a1e71b2021-12-21 11:35:00.193root 11241100x8000000000000000542549Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:00.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2f63443c8f8158de2021-12-21 11:35:00.194root 11241100x8000000000000000542550Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:00.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ac32a8d201d79f2f2021-12-21 11:35:00.194root 354300x8000000000000000542551Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:00.246{ec2b6afe-95d9-61c1-5175-3a0400000000}5346/opt/splunkforwarder/etc/apps/Splunk_TA_stream/linux_x86_64/bin/streamfwdroottcptruefalse10.0.1.25-48754-false10.0.1.12-8000- 11241100x8000000000000000542552Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:00.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7bb41b4d9d4b2be42021-12-21 11:35:00.693root 11241100x8000000000000000542553Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:00.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d260c82c0c9c67a52021-12-21 11:35:00.693root 11241100x8000000000000000542554Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:00.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3ef85317c02d2ff52021-12-21 11:35:00.693root 11241100x8000000000000000542555Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:00.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f01bd8724ba103e42021-12-21 11:35:00.693root 11241100x8000000000000000542556Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:00.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.80f87c02b2202eaf2021-12-21 11:35:00.694root 11241100x8000000000000000542557Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:00.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7b2747eaf150e6992021-12-21 11:35:00.694root 11241100x8000000000000000542558Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:00.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.93959e8c0bd75ffa2021-12-21 11:35:00.694root 11241100x8000000000000000542559Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:00.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.bf32a904bad3b8372021-12-21 11:35:00.694root 11241100x8000000000000000542560Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:00.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.851ead2632feae882021-12-21 11:35:00.694root 11241100x8000000000000000542561Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:00.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.45e9eb4623a386052021-12-21 11:35:00.694root 11241100x8000000000000000542562Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:00.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.46d91959b277bd2f2021-12-21 11:35:00.694root 11241100x8000000000000000542563Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:00.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1d5920e7dcbbe89d2021-12-21 11:35:00.694root 11241100x8000000000000000542564Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:00.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.81efd8f480af6f6e2021-12-21 11:35:00.694root 11241100x8000000000000000542565Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:00.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.536f8e2474c323282021-12-21 11:35:00.694root 11241100x8000000000000000542566Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:00.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8b845ba6546b2b652021-12-21 11:35:00.694root 11241100x8000000000000000542567Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:00.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.17b7f0090a1823c62021-12-21 11:35:00.694root 11241100x8000000000000000542568Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:01.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.96dfb5a7743e0f2d2021-12-21 11:35:01.193root 11241100x8000000000000000542569Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:01.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.be50bc223be2e83c2021-12-21 11:35:01.193root 11241100x8000000000000000542570Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:01.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c80a0dd3e4fcbec12021-12-21 11:35:01.193root 11241100x8000000000000000542571Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:01.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.457c416a5b98e1212021-12-21 11:35:01.193root 11241100x8000000000000000542572Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:01.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b7aae2b8621e044c2021-12-21 11:35:01.193root 11241100x8000000000000000542573Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:01.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.17714a46ad01804a2021-12-21 11:35:01.193root 11241100x8000000000000000542574Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:01.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6d96d96f396a97102021-12-21 11:35:01.194root 11241100x8000000000000000542575Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:01.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2896d7b6eb7c08db2021-12-21 11:35:01.194root 11241100x8000000000000000542576Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:01.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.630310d303e532ec2021-12-21 11:35:01.194root 11241100x8000000000000000542577Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:01.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.56f3e3a6f10bea4c2021-12-21 11:35:01.194root 11241100x8000000000000000542578Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:01.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7490be0deb0be60e2021-12-21 11:35:01.194root 11241100x8000000000000000542579Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:01.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.46b47a6a3a37e0b22021-12-21 11:35:01.194root 11241100x8000000000000000542580Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:01.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.80e557cb0a71ef552021-12-21 11:35:01.194root 11241100x8000000000000000542581Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:01.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.01a191d82b2f8b9c2021-12-21 11:35:01.194root 11241100x8000000000000000542582Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:01.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6b8f6dcf3834202e2021-12-21 11:35:01.194root 11241100x8000000000000000542583Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:01.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a1b079a5cfe589d42021-12-21 11:35:01.194root 11241100x8000000000000000542584Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:01.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ad9ee6ff93ca69fd2021-12-21 11:35:01.693root 11241100x8000000000000000542585Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:01.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.bc62928901b98e0a2021-12-21 11:35:01.693root 11241100x8000000000000000542586Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:01.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.08b1cb120929c19b2021-12-21 11:35:01.693root 11241100x8000000000000000542587Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:01.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.fe7b0d721d065d092021-12-21 11:35:01.693root 11241100x8000000000000000542588Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:01.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.94fd77621643a9272021-12-21 11:35:01.693root 11241100x8000000000000000542589Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:01.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ccb2bfe55e54252f2021-12-21 11:35:01.693root 11241100x8000000000000000542590Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:01.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.69bd7407727235aa2021-12-21 11:35:01.694root 11241100x8000000000000000542591Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:01.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e1423b176af6d4142021-12-21 11:35:01.694root 11241100x8000000000000000542592Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:01.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.243b224976205c942021-12-21 11:35:01.694root 11241100x8000000000000000542593Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:01.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3857d1b2915c543b2021-12-21 11:35:01.694root 11241100x8000000000000000542594Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:01.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3f35da6c794cd9252021-12-21 11:35:01.694root 11241100x8000000000000000542595Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:01.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.59f5d17a3480b9b22021-12-21 11:35:01.694root 11241100x8000000000000000542596Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:01.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c3a0a43913c0be122021-12-21 11:35:01.694root 11241100x8000000000000000542597Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:01.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.79c3edd28b5c56e32021-12-21 11:35:01.694root 11241100x8000000000000000542598Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:01.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.fb0d14365c4348542021-12-21 11:35:01.694root 11241100x8000000000000000542599Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:01.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1d79c86af454ba762021-12-21 11:35:01.694root 11241100x8000000000000000542600Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:02.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a9f0e0169ddb42672021-12-21 11:35:02.193root 11241100x8000000000000000542601Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:02.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9bc1b1a9cc69ea5a2021-12-21 11:35:02.193root 11241100x8000000000000000542602Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:02.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.cf07eb46610bb7622021-12-21 11:35:02.193root 11241100x8000000000000000542603Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:02.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0de690b9d1d523c32021-12-21 11:35:02.193root 11241100x8000000000000000542604Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:02.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.45a6929016dc4ae72021-12-21 11:35:02.193root 11241100x8000000000000000542605Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:02.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8ff4773f6acea7b92021-12-21 11:35:02.193root 11241100x8000000000000000542606Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:02.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3f9e62fc51a6336c2021-12-21 11:35:02.193root 11241100x8000000000000000542607Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:02.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6546129582fb9e1d2021-12-21 11:35:02.193root 11241100x8000000000000000542608Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:02.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e2821f3e841c4a702021-12-21 11:35:02.193root 11241100x8000000000000000542609Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:02.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.204ad7173369b34b2021-12-21 11:35:02.194root 11241100x8000000000000000542610Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:02.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f30cd11663a310672021-12-21 11:35:02.194root 11241100x8000000000000000542611Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:02.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.abcc7dfbd5fd72942021-12-21 11:35:02.194root 11241100x8000000000000000542612Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:02.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b0df132c0507b49e2021-12-21 11:35:02.194root 11241100x8000000000000000542613Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:02.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6019c819240308e12021-12-21 11:35:02.194root 11241100x8000000000000000542614Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:02.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5f0272195f1a73592021-12-21 11:35:02.194root 11241100x8000000000000000542615Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:02.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.38e10459322a3b3b2021-12-21 11:35:02.194root 11241100x8000000000000000542616Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:02.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.85aebcbcd887d1072021-12-21 11:35:02.693root 11241100x8000000000000000542617Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:02.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b84e7c940e13111d2021-12-21 11:35:02.693root 11241100x8000000000000000542618Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:02.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.838731e6b9e01cac2021-12-21 11:35:02.693root 11241100x8000000000000000542619Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:02.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.178930575ed86f162021-12-21 11:35:02.693root 11241100x8000000000000000542620Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:02.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c0ee4f9edb83de1d2021-12-21 11:35:02.693root 11241100x8000000000000000542621Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:02.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1e32a3a05a08bfe52021-12-21 11:35:02.693root 11241100x8000000000000000542622Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:02.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.757bd0b0eaac7a3b2021-12-21 11:35:02.694root 11241100x8000000000000000542623Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:02.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d36c9ab3ad3624ba2021-12-21 11:35:02.694root 11241100x8000000000000000542624Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:02.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c51ab931006586d12021-12-21 11:35:02.694root 11241100x8000000000000000542625Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:02.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.02a954bc3a085d8f2021-12-21 11:35:02.694root 11241100x8000000000000000542626Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:02.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.16e4827c63b062a92021-12-21 11:35:02.694root 11241100x8000000000000000542627Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:02.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.58336c36e86fabb92021-12-21 11:35:02.694root 11241100x8000000000000000542628Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:02.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1801b4d852b891d72021-12-21 11:35:02.694root 11241100x8000000000000000542629Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:02.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5e9036cded70464d2021-12-21 11:35:02.694root 11241100x8000000000000000542630Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:02.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6fcb06850aa310c32021-12-21 11:35:02.694root 11241100x8000000000000000542631Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:02.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.bfc3a64534b7b0072021-12-21 11:35:02.694root 11241100x8000000000000000542632Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:03.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.04f7f822e3b92e0c2021-12-21 11:35:03.193root 11241100x8000000000000000542633Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:03.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.258bc0ee95dc43642021-12-21 11:35:03.193root 11241100x8000000000000000542634Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:03.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c92cffbc848e7acc2021-12-21 11:35:03.193root 11241100x8000000000000000542635Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:03.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1333cd6f200c9a122021-12-21 11:35:03.193root 11241100x8000000000000000542636Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:03.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ba043a48751be0b62021-12-21 11:35:03.193root 11241100x8000000000000000542637Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:03.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c046275d533e18e22021-12-21 11:35:03.193root 11241100x8000000000000000542638Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:03.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c726bbfb145cd6352021-12-21 11:35:03.194root 11241100x8000000000000000542639Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:03.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d2ffb3d5b6fe71392021-12-21 11:35:03.194root 11241100x8000000000000000542640Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:03.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f32274dfabd9f9c62021-12-21 11:35:03.194root 11241100x8000000000000000542641Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:03.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ebabb9eb818af38c2021-12-21 11:35:03.194root 11241100x8000000000000000542642Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:03.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b8aead7ec57cb0e52021-12-21 11:35:03.194root 11241100x8000000000000000542643Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:03.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d9fa05ff67e7809e2021-12-21 11:35:03.194root 11241100x8000000000000000542644Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:03.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8a4a55d2fbad93462021-12-21 11:35:03.194root 11241100x8000000000000000542645Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:03.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.512971568b414b092021-12-21 11:35:03.194root 11241100x8000000000000000542646Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:03.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3a8c2103cadc3f7e2021-12-21 11:35:03.194root 11241100x8000000000000000542647Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:03.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.33a5459c6640a8e72021-12-21 11:35:03.194root 11241100x8000000000000000542648Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:03.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a8e7f027438ecd2d2021-12-21 11:35:03.693root 11241100x8000000000000000542649Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:03.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9e92501fdc9f180c2021-12-21 11:35:03.693root 11241100x8000000000000000542650Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:03.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2e4b0c5cfbbdd8612021-12-21 11:35:03.693root 11241100x8000000000000000542651Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:03.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.10776473ee9a4b812021-12-21 11:35:03.694root 11241100x8000000000000000542652Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:03.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.22cb75d9152138aa2021-12-21 11:35:03.694root 11241100x8000000000000000542653Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:03.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.de6745a7e005a2042021-12-21 11:35:03.694root 11241100x8000000000000000542654Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:03.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.bc22075a192a7d5a2021-12-21 11:35:03.694root 11241100x8000000000000000542655Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:03.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.51579b0ffbec64742021-12-21 11:35:03.694root 11241100x8000000000000000542656Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:03.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.dab33e125a8fa7b52021-12-21 11:35:03.694root 11241100x8000000000000000542657Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:03.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.06d8776f0b3f5d8c2021-12-21 11:35:03.694root 11241100x8000000000000000542658Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:03.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c76f16fa31b80f802021-12-21 11:35:03.694root 11241100x8000000000000000542659Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:03.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.131dd9faadbdcce92021-12-21 11:35:03.694root 11241100x8000000000000000542660Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:03.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c167744e464133072021-12-21 11:35:03.694root 11241100x8000000000000000542661Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:03.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3cbc497cf52a4aa92021-12-21 11:35:03.694root 11241100x8000000000000000542662Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:03.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.86a97d9c119a1c2a2021-12-21 11:35:03.694root 11241100x8000000000000000542663Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:03.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d9d41cf314f939212021-12-21 11:35:03.694root 11241100x8000000000000000542664Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:04.192{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d9e530ad563c43192021-12-21 11:35:04.192root 11241100x8000000000000000542665Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:04.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9fbad75cdda027b52021-12-21 11:35:04.193root 11241100x8000000000000000542666Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:04.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.15893ad7916abbe72021-12-21 11:35:04.193root 11241100x8000000000000000542667Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:04.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2a39bf77e40837122021-12-21 11:35:04.193root 11241100x8000000000000000542668Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:04.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.550ea87da2e652812021-12-21 11:35:04.193root 11241100x8000000000000000542669Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:04.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9c88de6de9dbc2092021-12-21 11:35:04.193root 11241100x8000000000000000542670Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:04.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9bd3a979275a45422021-12-21 11:35:04.193root 11241100x8000000000000000542671Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:04.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.814276a1ab8dadbc2021-12-21 11:35:04.193root 11241100x8000000000000000542672Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:04.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.81434e746af226802021-12-21 11:35:04.193root 11241100x8000000000000000542673Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:04.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e80886cdf64015c62021-12-21 11:35:04.193root 11241100x8000000000000000542674Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:04.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.659ee1954337df002021-12-21 11:35:04.194root 11241100x8000000000000000542675Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:04.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c9155410ae5c58842021-12-21 11:35:04.194root 11241100x8000000000000000542676Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:04.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2563ae48ad19022d2021-12-21 11:35:04.194root 11241100x8000000000000000542677Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:04.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.08289b807a66c98d2021-12-21 11:35:04.194root 11241100x8000000000000000542678Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:04.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.12a97c6f3e6ee4132021-12-21 11:35:04.194root 11241100x8000000000000000542679Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:04.195{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ec05f94ed18e3af32021-12-21 11:35:04.195root 11241100x8000000000000000542680Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:04.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4ddb96b3a128a35a2021-12-21 11:35:04.693root 11241100x8000000000000000542681Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:04.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.08058cea113abfba2021-12-21 11:35:04.693root 11241100x8000000000000000542682Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:04.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3e656941bdcab4ad2021-12-21 11:35:04.693root 11241100x8000000000000000542683Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:04.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1192a90d4a124eee2021-12-21 11:35:04.693root 11241100x8000000000000000542684Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:04.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.584070d45ef5af922021-12-21 11:35:04.693root 11241100x8000000000000000542685Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:04.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c6156814bf8d45f12021-12-21 11:35:04.693root 11241100x8000000000000000542686Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:04.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d86bc89a5cf6dc3d2021-12-21 11:35:04.693root 11241100x8000000000000000542687Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:04.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.785bfe9668345e8b2021-12-21 11:35:04.693root 11241100x8000000000000000542688Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:04.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3e33d40b98e890752021-12-21 11:35:04.693root 11241100x8000000000000000542689Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:04.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0b364bdd24b6b0cb2021-12-21 11:35:04.693root 11241100x8000000000000000542690Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:04.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.414b56424b8b46fc2021-12-21 11:35:04.694root 11241100x8000000000000000542691Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:04.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3111166cd7d11a682021-12-21 11:35:04.694root 11241100x8000000000000000542692Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:04.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2ec936cc5b38e6a32021-12-21 11:35:04.694root 11241100x8000000000000000542693Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:04.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.bbeff10d687a83f12021-12-21 11:35:04.694root 11241100x8000000000000000542694Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:04.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.340de0a6da0c31892021-12-21 11:35:04.694root 11241100x8000000000000000542695Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:04.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a870688918fb9fb62021-12-21 11:35:04.694root 11241100x8000000000000000542696Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:05.192{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4e6aac1c6c2475732021-12-21 11:35:05.192root 11241100x8000000000000000542697Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:05.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4d2b126af53721722021-12-21 11:35:05.193root 11241100x8000000000000000542698Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:05.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7187b53aec6056ef2021-12-21 11:35:05.193root 11241100x8000000000000000542699Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:05.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.03fb435f2dccbaa32021-12-21 11:35:05.193root 11241100x8000000000000000542700Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:05.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.545b780972c060922021-12-21 11:35:05.193root 11241100x8000000000000000542701Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:05.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7ffe3c48b91ac8162021-12-21 11:35:05.193root 11241100x8000000000000000542702Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:05.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.72f41eb461605f562021-12-21 11:35:05.193root 11241100x8000000000000000542703Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:05.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.825c41bef953878d2021-12-21 11:35:05.193root 11241100x8000000000000000542704Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:05.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.906edb7fe35792162021-12-21 11:35:05.193root 11241100x8000000000000000542705Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:05.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1d099331ba49d9342021-12-21 11:35:05.194root 11241100x8000000000000000542706Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:05.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b6a230e67e8a30472021-12-21 11:35:05.194root 11241100x8000000000000000542707Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:05.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.213b2279ef49a39e2021-12-21 11:35:05.194root 11241100x8000000000000000542708Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:05.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0fb199dee265bee52021-12-21 11:35:05.194root 11241100x8000000000000000542709Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:05.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.69557e05079463a42021-12-21 11:35:05.194root 11241100x8000000000000000542710Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:05.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.21840e0e33513c342021-12-21 11:35:05.194root 11241100x8000000000000000542711Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:05.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.bf15d9a984b6d01b2021-12-21 11:35:05.194root 11241100x8000000000000000542712Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:05.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7358ced86e133b9f2021-12-21 11:35:05.693root 11241100x8000000000000000542713Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:05.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.65c85530073c60792021-12-21 11:35:05.693root 11241100x8000000000000000542714Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:05.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.90812a92c836cc652021-12-21 11:35:05.693root 11241100x8000000000000000542715Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:05.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.36c0d74ef1d599982021-12-21 11:35:05.693root 11241100x8000000000000000542716Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:05.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c1da9ae195967ef42021-12-21 11:35:05.693root 11241100x8000000000000000542717Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:05.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4bed0588856c9bac2021-12-21 11:35:05.693root 11241100x8000000000000000542718Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:05.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a76e6ee382a12c482021-12-21 11:35:05.694root 11241100x8000000000000000542719Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:05.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f9e42841024fd30d2021-12-21 11:35:05.694root 11241100x8000000000000000542720Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:05.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ef39d4852393bd7e2021-12-21 11:35:05.694root 11241100x8000000000000000542721Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:05.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.faef1f67418213ee2021-12-21 11:35:05.694root 11241100x8000000000000000542722Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:05.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.da4c6e1c378ffd532021-12-21 11:35:05.694root 11241100x8000000000000000542723Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:05.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.dec0f5f0f52cbf6a2021-12-21 11:35:05.694root 11241100x8000000000000000542724Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:05.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c186eba6266cc4e92021-12-21 11:35:05.694root 11241100x8000000000000000542725Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:05.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b4bb3612635b3e972021-12-21 11:35:05.694root 11241100x8000000000000000542726Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:05.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c7cac609cebb81192021-12-21 11:35:05.694root 11241100x8000000000000000542727Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:05.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ef0fb9e479861e1e2021-12-21 11:35:05.694root 354300x8000000000000000542728Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:06.115{ec2b6afe-95d9-61c1-5175-3a0400000000}5346/opt/splunkforwarder/etc/apps/Splunk_TA_stream/linux_x86_64/bin/streamfwdroottcptruefalse10.0.1.25-48756-false10.0.1.12-8000- 11241100x8000000000000000542729Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:06.116{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8d1d8eb5beaf1d4d2021-12-21 11:35:06.116root 11241100x8000000000000000542730Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:06.116{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.10398ea987bdad9d2021-12-21 11:35:06.116root 11241100x8000000000000000542731Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:06.116{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.553a0b5bbe76c71c2021-12-21 11:35:06.116root 11241100x8000000000000000542732Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:06.116{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.533ffccf5458cad12021-12-21 11:35:06.116root 11241100x8000000000000000542733Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:06.117{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.836f05c4b8b0a1bd2021-12-21 11:35:06.117root 11241100x8000000000000000542734Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:06.117{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3f8d622fefecf3eb2021-12-21 11:35:06.117root 11241100x8000000000000000542735Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:06.117{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.dd9a97d57475e0082021-12-21 11:35:06.117root 11241100x8000000000000000542736Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:06.117{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9982e035fe2fe3ee2021-12-21 11:35:06.117root 11241100x8000000000000000542737Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:06.117{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.168293b26a3e91222021-12-21 11:35:06.117root 11241100x8000000000000000542738Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:06.117{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9942830fc9e6824e2021-12-21 11:35:06.117root 11241100x8000000000000000542739Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:06.117{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6cfa6e9e2352adc32021-12-21 11:35:06.117root 11241100x8000000000000000542740Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:06.117{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.68dc4c8e2c1f79f42021-12-21 11:35:06.117root 11241100x8000000000000000542741Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:06.117{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.87a33e88bc5478f92021-12-21 11:35:06.117root 11241100x8000000000000000542742Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:06.117{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.cfe017cbe8cd12612021-12-21 11:35:06.117root 11241100x8000000000000000542743Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:06.117{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.566d68281b9304352021-12-21 11:35:06.117root 11241100x8000000000000000542744Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:06.118{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3eff46f6d5ed626c2021-12-21 11:35:06.118root 11241100x8000000000000000542745Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:06.118{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.76018bf09031f9c72021-12-21 11:35:06.118root 11241100x8000000000000000542746Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:06.118{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.83e5a823af5c73522021-12-21 11:35:06.118root 11241100x8000000000000000542747Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:06.118{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0ea3b2c15f2c13302021-12-21 11:35:06.118root 11241100x8000000000000000542748Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:06.118{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.faf30f41f5df72232021-12-21 11:35:06.118root 11241100x8000000000000000542749Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:06.118{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.abfaa69db5879d152021-12-21 11:35:06.118root 11241100x8000000000000000542750Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:06.325{ec2b6afe-95d2-61c1-3038-b84203560000}5272/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/spool/splunk/tracker.log2021-12-21 11:35:06.325root 11241100x8000000000000000542751Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:06.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e44efa131bbcbe1e2021-12-21 11:35:06.443root 11241100x8000000000000000542752Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:06.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e2a4ed85f4686c7f2021-12-21 11:35:06.443root 11241100x8000000000000000542753Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:06.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.edf4be134387a8ce2021-12-21 11:35:06.443root 11241100x8000000000000000542754Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:06.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.008d3d13e110c40c2021-12-21 11:35:06.443root 11241100x8000000000000000542755Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:06.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c3cbebf2c348eeaa2021-12-21 11:35:06.443root 11241100x8000000000000000542756Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:06.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3113f4d2e4f5bda32021-12-21 11:35:06.444root 11241100x8000000000000000542757Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:06.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.92efe7aaf2db7a202021-12-21 11:35:06.444root 11241100x8000000000000000542758Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:06.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.29453cab931b53a92021-12-21 11:35:06.444root 11241100x8000000000000000542759Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:06.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ebce88892364bbe92021-12-21 11:35:06.444root 11241100x8000000000000000542760Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:06.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5adab9985ccea3bb2021-12-21 11:35:06.444root 11241100x8000000000000000542761Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:06.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.57922ad65010b3a12021-12-21 11:35:06.444root 11241100x8000000000000000542762Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:06.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0367a2f497a440d72021-12-21 11:35:06.444root 11241100x8000000000000000542763Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:06.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.61b7684c21a7a0a92021-12-21 11:35:06.444root 11241100x8000000000000000542764Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:06.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.66a69f0420bbe4252021-12-21 11:35:06.444root 11241100x8000000000000000542765Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:06.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.bbbc9154448cb7112021-12-21 11:35:06.444root 11241100x8000000000000000542766Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:06.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5424e05c9e8ec35f2021-12-21 11:35:06.444root 11241100x8000000000000000542767Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:06.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.50ef14d05ad82dab2021-12-21 11:35:06.444root 11241100x8000000000000000542768Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:06.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7c7b95162df0319b2021-12-21 11:35:06.444root 11241100x8000000000000000542769Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:06.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9d1a78b31a50933a2021-12-21 11:35:06.943root 11241100x8000000000000000542770Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:06.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0f31387043686bd42021-12-21 11:35:06.943root 11241100x8000000000000000542771Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:06.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.431c56d6a1c5aa352021-12-21 11:35:06.943root 11241100x8000000000000000542772Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:06.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4f80e8cd53da5c622021-12-21 11:35:06.943root 11241100x8000000000000000542773Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:06.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7a79bf2b5ddf67732021-12-21 11:35:06.943root 11241100x8000000000000000542774Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:06.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.996cd61e9be8634e2021-12-21 11:35:06.944root 11241100x8000000000000000542775Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:06.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7fa3040a29ed934c2021-12-21 11:35:06.944root 11241100x8000000000000000542776Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:06.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b012efb083a12f3d2021-12-21 11:35:06.944root 11241100x8000000000000000542777Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:06.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c186e05433b0e01f2021-12-21 11:35:06.944root 11241100x8000000000000000542778Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:06.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0d45b6073d4bc3082021-12-21 11:35:06.944root 11241100x8000000000000000542779Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:06.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.288d124638008ffd2021-12-21 11:35:06.944root 11241100x8000000000000000542780Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:06.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7007431c5e13fe9b2021-12-21 11:35:06.944root 11241100x8000000000000000542781Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:06.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.22006abe1463c2642021-12-21 11:35:06.944root 11241100x8000000000000000542782Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:06.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ead12bda4c1e6d5f2021-12-21 11:35:06.944root 11241100x8000000000000000542783Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:06.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c8943f04a695f3e42021-12-21 11:35:06.944root 11241100x8000000000000000542784Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:06.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7fb229aa4245423a2021-12-21 11:35:06.944root 11241100x8000000000000000542785Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:06.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.720012fcb68a196d2021-12-21 11:35:06.944root 11241100x8000000000000000542786Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:06.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2d58af57d0ab85a12021-12-21 11:35:06.944root 11241100x8000000000000000542787Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:07.442{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0dd1d02574da3b5d2021-12-21 11:35:07.442root 11241100x8000000000000000542788Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:07.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.171ae2ea572efd4c2021-12-21 11:35:07.443root 11241100x8000000000000000542789Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:07.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.46e58586372db8c62021-12-21 11:35:07.443root 11241100x8000000000000000542790Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:07.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d22f7a4bf4d4ab172021-12-21 11:35:07.443root 11241100x8000000000000000542791Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:07.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a740954002e682cc2021-12-21 11:35:07.443root 11241100x8000000000000000542792Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:07.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7de4c46afc391caa2021-12-21 11:35:07.443root 11241100x8000000000000000542793Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:07.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.bdfe53e73794605b2021-12-21 11:35:07.443root 11241100x8000000000000000542794Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:07.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6acc5028ef81ca442021-12-21 11:35:07.443root 11241100x8000000000000000542795Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:07.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.783f1d233493e4802021-12-21 11:35:07.443root 11241100x8000000000000000542796Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:07.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d695320f5f896d6c2021-12-21 11:35:07.443root 11241100x8000000000000000542797Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:07.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d045b11634de2f392021-12-21 11:35:07.443root 11241100x8000000000000000542798Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:07.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a2fa6d3df72e50622021-12-21 11:35:07.444root 11241100x8000000000000000542799Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:07.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3bb31dc6bed020a22021-12-21 11:35:07.444root 11241100x8000000000000000542800Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:07.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8e82203f9408afe02021-12-21 11:35:07.444root 11241100x8000000000000000542801Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:07.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6c2c68a753d0e36f2021-12-21 11:35:07.444root 11241100x8000000000000000542802Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:07.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8ccbebf3f83c7d4b2021-12-21 11:35:07.444root 11241100x8000000000000000542803Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:07.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.06b0ae012686ac482021-12-21 11:35:07.444root 11241100x8000000000000000542804Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:07.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.00a63f950a34c4c92021-12-21 11:35:07.444root 11241100x8000000000000000542805Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:07.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e49c273afae89b892021-12-21 11:35:07.943root 11241100x8000000000000000542806Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:07.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.41c1c1e01b39910c2021-12-21 11:35:07.943root 11241100x8000000000000000542807Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:07.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.594b194801ccc8182021-12-21 11:35:07.943root 11241100x8000000000000000542808Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:07.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f15a026a029429a32021-12-21 11:35:07.943root 11241100x8000000000000000542809Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:07.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1ed8752fde9f074a2021-12-21 11:35:07.943root 11241100x8000000000000000542810Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:07.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3b0d28349a668ae52021-12-21 11:35:07.944root 11241100x8000000000000000542811Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:07.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.64392730b6b1f0262021-12-21 11:35:07.944root 11241100x8000000000000000542812Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:07.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7d1a57da61ad0c1f2021-12-21 11:35:07.944root 11241100x8000000000000000542813Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:07.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.bafb507f6d0ce1b92021-12-21 11:35:07.944root 11241100x8000000000000000542814Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:07.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.06025b4d5374777d2021-12-21 11:35:07.944root 11241100x8000000000000000542815Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:07.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c40430741842ded62021-12-21 11:35:07.944root 11241100x8000000000000000542816Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:07.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.81ae6c605932f7f92021-12-21 11:35:07.944root 11241100x8000000000000000542817Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:07.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b8c036fd9e075e1f2021-12-21 11:35:07.944root 11241100x8000000000000000542818Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:07.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ba78786668ca77402021-12-21 11:35:07.944root 11241100x8000000000000000542819Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:07.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d134f9ec9cf35df22021-12-21 11:35:07.944root 11241100x8000000000000000542820Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:07.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1bd0e842a39f23542021-12-21 11:35:07.944root 11241100x8000000000000000542821Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:07.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a1eb5c1c1d8fa8022021-12-21 11:35:07.944root 11241100x8000000000000000542822Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:07.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1b7da3fd6971f94f2021-12-21 11:35:07.944root 11241100x8000000000000000542823Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:08.442{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.62f56581279aba5a2021-12-21 11:35:08.442root 11241100x8000000000000000542824Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:08.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4d38b140728b66e32021-12-21 11:35:08.443root 11241100x8000000000000000542825Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:08.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.67c73b5be72d0c962021-12-21 11:35:08.443root 11241100x8000000000000000542826Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:08.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4d39b9b744d327822021-12-21 11:35:08.443root 11241100x8000000000000000542827Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:08.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d92b3bdefce727bf2021-12-21 11:35:08.443root 11241100x8000000000000000542828Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:08.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4490f1cab292a4b02021-12-21 11:35:08.443root 11241100x8000000000000000542829Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:08.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.cd0829c1050a5eff2021-12-21 11:35:08.443root 11241100x8000000000000000542830Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:08.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6432b54bf4daa5d52021-12-21 11:35:08.443root 11241100x8000000000000000542831Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:08.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7e87dbc5fe10a74e2021-12-21 11:35:08.443root 11241100x8000000000000000542832Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:08.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8d11be6bb79a59612021-12-21 11:35:08.444root 11241100x8000000000000000542833Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:08.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f128bf9b80b28b832021-12-21 11:35:08.444root 11241100x8000000000000000542834Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:08.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.abd3af44794302322021-12-21 11:35:08.444root 11241100x8000000000000000542835Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:08.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1863c297abcb2c7e2021-12-21 11:35:08.444root 11241100x8000000000000000542836Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:08.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e211747e9e8a9b322021-12-21 11:35:08.444root 11241100x8000000000000000542837Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:08.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.cc4a8e528da093ff2021-12-21 11:35:08.444root 11241100x8000000000000000542838Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:08.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9eae9521f1165e1a2021-12-21 11:35:08.444root 11241100x8000000000000000542839Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:08.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9e8db16d084916902021-12-21 11:35:08.444root 11241100x8000000000000000542840Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:08.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9020dce255567f8b2021-12-21 11:35:08.444root 11241100x8000000000000000542841Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:08.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5d051d4fcc8795832021-12-21 11:35:08.943root 11241100x8000000000000000542842Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:08.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4f652b04dfc110592021-12-21 11:35:08.943root 11241100x8000000000000000542843Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:08.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ebf90d29b3e169282021-12-21 11:35:08.943root 11241100x8000000000000000542844Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:08.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.587b1ad7468cab922021-12-21 11:35:08.943root 11241100x8000000000000000542845Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:08.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ac8913662be74f082021-12-21 11:35:08.943root 11241100x8000000000000000542846Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:08.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8f105aab5f2834be2021-12-21 11:35:08.943root 11241100x8000000000000000542847Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:08.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.430f713b63af4ed12021-12-21 11:35:08.944root 11241100x8000000000000000542848Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:08.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.41e0ae0e202d03632021-12-21 11:35:08.944root 11241100x8000000000000000542849Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:08.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.438d0d9a20af214f2021-12-21 11:35:08.944root 11241100x8000000000000000542850Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:08.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a66db9fe9da8dfb62021-12-21 11:35:08.944root 11241100x8000000000000000542851Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:08.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.de868b17f02097bb2021-12-21 11:35:08.944root 11241100x8000000000000000542852Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:08.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b169bc0029dd7c632021-12-21 11:35:08.944root 11241100x8000000000000000542853Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:08.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c67c3abfacc9f8d72021-12-21 11:35:08.944root 11241100x8000000000000000542854Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:08.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.38509614a92307c02021-12-21 11:35:08.944root 11241100x8000000000000000542855Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:08.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5605e22f48d7d35c2021-12-21 11:35:08.944root 11241100x8000000000000000542856Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:08.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e53ca6566baca9222021-12-21 11:35:08.944root 11241100x8000000000000000542857Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:08.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2a78a4fa3677d9c72021-12-21 11:35:08.944root 11241100x8000000000000000542858Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:08.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f344aa9f9cf779a02021-12-21 11:35:08.944root 23542300x8000000000000000542859Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:09.194{ec2b6afe-95d2-61c1-3038-b84203560000}5272root/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/spool/splunk/tracker.log--- 11241100x8000000000000000542860Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:09.196{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b766c5d92185067b2021-12-21 11:35:09.196root 11241100x8000000000000000542861Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:09.196{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.697e457a683f5dc72021-12-21 11:35:09.196root 11241100x8000000000000000542862Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:09.196{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7de35fa896b9d2072021-12-21 11:35:09.196root 11241100x8000000000000000542863Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:09.196{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ad897afd74ffda032021-12-21 11:35:09.196root 11241100x8000000000000000542864Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:09.196{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3ea16d69e50260cf2021-12-21 11:35:09.196root 11241100x8000000000000000542865Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:09.197{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.196b44b1084e8e712021-12-21 11:35:09.197root 11241100x8000000000000000542866Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:09.197{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.df6b5c3fc7884feb2021-12-21 11:35:09.197root 11241100x8000000000000000542867Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:09.197{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c491125a7a511f332021-12-21 11:35:09.197root 11241100x8000000000000000542868Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:09.197{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.79d186c8507073ce2021-12-21 11:35:09.197root 11241100x8000000000000000542869Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:09.197{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7703512e524576df2021-12-21 11:35:09.197root 11241100x8000000000000000542870Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:09.197{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4cf02f816b96f8ab2021-12-21 11:35:09.197root 11241100x8000000000000000542871Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:09.197{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5ac72169db3fd9c92021-12-21 11:35:09.197root 11241100x8000000000000000542872Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:09.197{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e78982027923539d2021-12-21 11:35:09.197root 11241100x8000000000000000542873Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:09.197{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.407481f3ef60978a2021-12-21 11:35:09.197root 11241100x8000000000000000542874Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:09.197{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.02544fab504880f02021-12-21 11:35:09.197root 11241100x8000000000000000542875Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:09.198{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b4bbba46e00c00ec2021-12-21 11:35:09.198root 11241100x8000000000000000542876Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:09.198{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.cf78a32cda459a7e2021-12-21 11:35:09.198root 11241100x8000000000000000542877Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:09.198{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a958588a99b79e842021-12-21 11:35:09.198root 11241100x8000000000000000542878Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:09.198{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8bbf780f1681799b2021-12-21 11:35:09.198root 11241100x8000000000000000542879Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:09.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d03a85f3830f31df2021-12-21 11:35:09.693root 11241100x8000000000000000542880Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:09.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3ae9d9ae819bbe6e2021-12-21 11:35:09.693root 11241100x8000000000000000542881Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:09.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.70bc9465f685a6ce2021-12-21 11:35:09.693root 11241100x8000000000000000542882Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:09.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.75ddd9cb160a0c0a2021-12-21 11:35:09.693root 11241100x8000000000000000542883Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:09.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9bf398e6b8c14f022021-12-21 11:35:09.693root 11241100x8000000000000000542884Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:09.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.106d3c56e5ddca182021-12-21 11:35:09.693root 11241100x8000000000000000542885Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:09.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.675315b7e5ea977c2021-12-21 11:35:09.694root 11241100x8000000000000000542886Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:09.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c5bb57d57d8370cc2021-12-21 11:35:09.694root 11241100x8000000000000000542887Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:09.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.63ff2fa3a54e3c052021-12-21 11:35:09.694root 11241100x8000000000000000542888Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:09.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3fb52971088f68fe2021-12-21 11:35:09.694root 11241100x8000000000000000542889Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:09.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4ff72b3f620f4f892021-12-21 11:35:09.694root 11241100x8000000000000000542890Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:09.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8b39962466e0cf612021-12-21 11:35:09.694root 11241100x8000000000000000542891Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:09.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1b47f709c0ec2ed72021-12-21 11:35:09.694root 11241100x8000000000000000542892Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:09.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e7a7447974756ea82021-12-21 11:35:09.694root 11241100x8000000000000000542893Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:09.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1d5d99cbcc28d3a22021-12-21 11:35:09.694root 11241100x8000000000000000542894Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:09.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.127e657131ac74e92021-12-21 11:35:09.694root 11241100x8000000000000000542895Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:09.695{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c334c89600514e5d2021-12-21 11:35:09.695root 11241100x8000000000000000542896Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:09.695{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f48b46498fccdb5d2021-12-21 11:35:09.695root 11241100x8000000000000000542897Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:09.695{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b728a784d6258c4e2021-12-21 11:35:09.695root 11241100x8000000000000000542898Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:10.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8af71372c8334c0e2021-12-21 11:35:10.193root 11241100x8000000000000000542899Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:10.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a93878cf93029a912021-12-21 11:35:10.193root 11241100x8000000000000000542900Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:10.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.072d48cec6055cb22021-12-21 11:35:10.194root 11241100x8000000000000000542901Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:10.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9eecef94e822fae52021-12-21 11:35:10.194root 11241100x8000000000000000542902Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:10.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2b6b36bae48210962021-12-21 11:35:10.194root 11241100x8000000000000000542903Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:10.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.320d7092a529cadf2021-12-21 11:35:10.194root 11241100x8000000000000000542904Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:10.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.73ce44cbd056c4152021-12-21 11:35:10.194root 11241100x8000000000000000542905Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:10.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.340d271cdabe4fa02021-12-21 11:35:10.194root 11241100x8000000000000000542906Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:10.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4b4d830f17099ee82021-12-21 11:35:10.194root 11241100x8000000000000000542907Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:10.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2a5978f7d389722e2021-12-21 11:35:10.194root 11241100x8000000000000000542908Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:10.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8becf47c89450ddf2021-12-21 11:35:10.194root 11241100x8000000000000000542909Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:10.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.61de6367942752002021-12-21 11:35:10.194root 11241100x8000000000000000542910Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:10.195{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.639b0dbbecc219f52021-12-21 11:35:10.195root 11241100x8000000000000000542911Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:10.195{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.eadc747da31d93d62021-12-21 11:35:10.195root 11241100x8000000000000000542912Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:10.195{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e9f4b6bcf3ab12c42021-12-21 11:35:10.195root 11241100x8000000000000000542913Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:10.195{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8f08a98eaf1f35242021-12-21 11:35:10.195root 11241100x8000000000000000542914Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:10.195{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9715501892edcf8b2021-12-21 11:35:10.195root 11241100x8000000000000000542915Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:10.195{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1e104bbf475b6e952021-12-21 11:35:10.195root 11241100x8000000000000000542916Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:10.195{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.65c9838d7d58e7032021-12-21 11:35:10.195root 11241100x8000000000000000542917Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:10.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.64657f6b41d34c182021-12-21 11:35:10.693root 11241100x8000000000000000542918Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:10.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.75454a3d2b3763872021-12-21 11:35:10.693root 11241100x8000000000000000542919Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:10.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.98974521b21503ef2021-12-21 11:35:10.693root 11241100x8000000000000000542920Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:10.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3446189bb4b945352021-12-21 11:35:10.693root 11241100x8000000000000000542921Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:10.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f94598b42e4b07cc2021-12-21 11:35:10.693root 11241100x8000000000000000542922Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:10.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.77eeb136cab8a40e2021-12-21 11:35:10.693root 11241100x8000000000000000542923Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:10.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9a3fdede9233117c2021-12-21 11:35:10.693root 11241100x8000000000000000542924Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:10.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.58bf347d2adeda952021-12-21 11:35:10.693root 11241100x8000000000000000542925Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:10.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.33e4a995cf2757642021-12-21 11:35:10.693root 11241100x8000000000000000542926Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:10.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c8c00c5853412b712021-12-21 11:35:10.693root 11241100x8000000000000000542927Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:10.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a4dad13b7db32e962021-12-21 11:35:10.693root 11241100x8000000000000000542928Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:10.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d903916965fb30ce2021-12-21 11:35:10.693root 11241100x8000000000000000542929Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:10.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.321181280f4e27022021-12-21 11:35:10.693root 11241100x8000000000000000542930Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:10.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.99f32f8fa74ca62e2021-12-21 11:35:10.693root 11241100x8000000000000000542931Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:10.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e584be382bc112162021-12-21 11:35:10.694root 11241100x8000000000000000542932Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:10.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.02e22196a500fc272021-12-21 11:35:10.694root 11241100x8000000000000000542933Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:10.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.418a2e6a33aaf5702021-12-21 11:35:10.694root 11241100x8000000000000000542934Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:10.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4e85d95443cdc4ed2021-12-21 11:35:10.694root 11241100x8000000000000000542935Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:10.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.326d8925bd779bfd2021-12-21 11:35:10.694root 11241100x8000000000000000542936Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:11.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.fa6a95a700c237db2021-12-21 11:35:11.193root 11241100x8000000000000000542937Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:11.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9fdf68a99389b9702021-12-21 11:35:11.193root 11241100x8000000000000000542938Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:11.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6a51b3f8b0e01d2f2021-12-21 11:35:11.193root 11241100x8000000000000000542939Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:11.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8ea9946bc456b44e2021-12-21 11:35:11.193root 11241100x8000000000000000542940Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:11.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2df6f60fadf1fc8a2021-12-21 11:35:11.193root 11241100x8000000000000000542941Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:11.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.31974f0cabd1dc6a2021-12-21 11:35:11.193root 11241100x8000000000000000542942Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:11.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f78646719416e5c82021-12-21 11:35:11.193root 11241100x8000000000000000542943Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:11.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.50f6b0aed508c38a2021-12-21 11:35:11.193root 11241100x8000000000000000542944Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:11.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ccecb1cb5a0824112021-12-21 11:35:11.194root 11241100x8000000000000000542945Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:11.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3ca89a0d83ba93342021-12-21 11:35:11.194root 11241100x8000000000000000542946Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:11.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.630a960a391106082021-12-21 11:35:11.194root 11241100x8000000000000000542947Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:11.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f4c56e5a68938f8c2021-12-21 11:35:11.194root 11241100x8000000000000000542948Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:11.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6ed8f060baba16c92021-12-21 11:35:11.194root 11241100x8000000000000000542949Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:11.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.71ebdb10d6d7736d2021-12-21 11:35:11.194root 11241100x8000000000000000542950Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:11.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f8993b35488c4bf62021-12-21 11:35:11.194root 11241100x8000000000000000542951Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:11.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.93cc7a11ba09a9032021-12-21 11:35:11.194root 11241100x8000000000000000542952Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:11.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.fe855fa9f8d6e89f2021-12-21 11:35:11.194root 11241100x8000000000000000542953Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:11.195{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c44449c0db9280462021-12-21 11:35:11.195root 11241100x8000000000000000542954Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:11.195{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.57c481b2b8f86d632021-12-21 11:35:11.195root 11241100x8000000000000000542955Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:11.195{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b0358fb3d2b22a4c2021-12-21 11:35:11.195root 11241100x8000000000000000542956Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:11.195{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d19525df39231e0b2021-12-21 11:35:11.195root 11241100x8000000000000000542957Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:11.195{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e67b78b83e63b7df2021-12-21 11:35:11.195root 11241100x8000000000000000542958Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:11.195{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.76cc25c9268decad2021-12-21 11:35:11.195root 11241100x8000000000000000542959Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:11.195{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.92e21839ede8f2182021-12-21 11:35:11.195root 354300x8000000000000000542960Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:11.207{ec2b6afe-95d9-61c1-5175-3a0400000000}5346/opt/splunkforwarder/etc/apps/Splunk_TA_stream/linux_x86_64/bin/streamfwdroottcptruefalse10.0.1.25-48758-false10.0.1.12-8000- 11241100x8000000000000000542961Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:11.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9af1e6b6fb87a61d2021-12-21 11:35:11.693root 11241100x8000000000000000542962Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:11.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.017c493639ad1d3b2021-12-21 11:35:11.693root 11241100x8000000000000000542963Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:11.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.477dab74a61328f32021-12-21 11:35:11.693root 11241100x8000000000000000542964Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:11.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b9b5814431906beb2021-12-21 11:35:11.693root 11241100x8000000000000000542965Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:11.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.19f092b41c833cbe2021-12-21 11:35:11.693root 11241100x8000000000000000542966Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:11.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.90c25c9cb11093da2021-12-21 11:35:11.693root 11241100x8000000000000000542967Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:11.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0bb7ba9816d537112021-12-21 11:35:11.693root 11241100x8000000000000000542968Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:11.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5aededdfb390ff052021-12-21 11:35:11.693root 11241100x8000000000000000542969Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:11.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.12e77dc264b123682021-12-21 11:35:11.693root 11241100x8000000000000000542970Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:11.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b2a6cb651fcdb00c2021-12-21 11:35:11.694root 11241100x8000000000000000542971Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:11.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8d34a65545f62ea72021-12-21 11:35:11.694root 11241100x8000000000000000542972Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:11.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ee1ad8dd144a1e5b2021-12-21 11:35:11.694root 11241100x8000000000000000542973Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:11.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.963698b3de44d0a12021-12-21 11:35:11.694root 11241100x8000000000000000542974Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:11.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1d199e3aa96ae7df2021-12-21 11:35:11.694root 11241100x8000000000000000542975Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:11.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2db93964e78b6cb02021-12-21 11:35:11.694root 11241100x8000000000000000542976Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:11.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d774005039d829fb2021-12-21 11:35:11.694root 11241100x8000000000000000542977Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:11.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.334e138a95c05b7b2021-12-21 11:35:11.694root 11241100x8000000000000000542978Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:11.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2242d908146f5b6c2021-12-21 11:35:11.694root 11241100x8000000000000000542979Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:11.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.60ff0799284c43212021-12-21 11:35:11.694root 11241100x8000000000000000542980Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:11.695{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a297a045f719e88e2021-12-21 11:35:11.695root 11241100x8000000000000000542981Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:12.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.fd64b4403fddd8682021-12-21 11:35:12.193root 11241100x8000000000000000542982Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:12.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e5e2aa5fffe3cf702021-12-21 11:35:12.194root 11241100x8000000000000000542983Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:12.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.43a8049d54a094fd2021-12-21 11:35:12.194root 11241100x8000000000000000542984Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:12.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0edd6aceccb472f92021-12-21 11:35:12.194root 11241100x8000000000000000542985Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:12.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5243105bc697fcac2021-12-21 11:35:12.194root 11241100x8000000000000000542986Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:12.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7968751da38708272021-12-21 11:35:12.194root 11241100x8000000000000000542987Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:12.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.289ac75987e7c0282021-12-21 11:35:12.194root 11241100x8000000000000000542988Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:12.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.30596e250c090e032021-12-21 11:35:12.194root 11241100x8000000000000000542989Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:12.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c8ad47a314eafef72021-12-21 11:35:12.194root 11241100x8000000000000000542990Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:12.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e8cb14bb88beed3b2021-12-21 11:35:12.194root 11241100x8000000000000000542991Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:12.195{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7a4f46e0aefa11912021-12-21 11:35:12.195root 11241100x8000000000000000542992Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:12.195{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.18bbc8db083a0dc22021-12-21 11:35:12.195root 11241100x8000000000000000542993Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:12.195{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4cfcb8f3f5b8dfb62021-12-21 11:35:12.195root 11241100x8000000000000000542994Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:12.195{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.559545ee27b9606a2021-12-21 11:35:12.195root 11241100x8000000000000000542995Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:12.195{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e2b552a780eb47d52021-12-21 11:35:12.195root 11241100x8000000000000000542996Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:12.195{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8abd8e4f8cd66cd82021-12-21 11:35:12.195root 11241100x8000000000000000542997Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:12.195{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5ad6d254036732792021-12-21 11:35:12.195root 11241100x8000000000000000542998Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:12.195{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.79227fa6c3fbc0022021-12-21 11:35:12.195root 11241100x8000000000000000542999Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:12.195{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4e67a953b9d4f3a92021-12-21 11:35:12.195root 11241100x8000000000000000543000Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:12.195{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7205de7ffa7d9e462021-12-21 11:35:12.195root 11241100x8000000000000000543001Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:12.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.770250f97adfd2042021-12-21 11:35:12.693root 11241100x8000000000000000543002Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:12.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7bb99d34a8687bdd2021-12-21 11:35:12.693root 11241100x8000000000000000543003Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:12.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.57bee231ab60d7e42021-12-21 11:35:12.693root 11241100x8000000000000000543004Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:12.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.346380afdbbb0cb32021-12-21 11:35:12.693root 11241100x8000000000000000543005Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:12.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3e4279909fe774f22021-12-21 11:35:12.693root 11241100x8000000000000000543006Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:12.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3aaa84849b79f5632021-12-21 11:35:12.693root 11241100x8000000000000000543007Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:12.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.12346d3cf8e653cd2021-12-21 11:35:12.693root 11241100x8000000000000000543008Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:12.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b4aa6db97ece05d52021-12-21 11:35:12.693root 11241100x8000000000000000543009Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:12.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f404b25ebb0a4e1a2021-12-21 11:35:12.693root 11241100x8000000000000000543010Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:12.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.103cd8b9f62faab32021-12-21 11:35:12.693root 11241100x8000000000000000543011Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:12.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6f42fdaa54dfbffe2021-12-21 11:35:12.694root 11241100x8000000000000000543012Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:12.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b1e40cb3cbcfa6872021-12-21 11:35:12.694root 11241100x8000000000000000543013Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:12.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.28986e681bbc346a2021-12-21 11:35:12.694root 11241100x8000000000000000543014Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:12.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2a885c7fd6076c8d2021-12-21 11:35:12.694root 11241100x8000000000000000543015Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:12.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b335eac87e267bf92021-12-21 11:35:12.694root 11241100x8000000000000000543016Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:12.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9795e54307bd1e542021-12-21 11:35:12.694root 11241100x8000000000000000543017Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:12.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.27a82cfdb85229492021-12-21 11:35:12.694root 11241100x8000000000000000543018Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:12.695{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.afd47cb9f88323542021-12-21 11:35:12.695root 11241100x8000000000000000543019Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:12.695{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.80cc6163a48fbac42021-12-21 11:35:12.695root 11241100x8000000000000000543020Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:12.695{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d18008f189630fc92021-12-21 11:35:12.695root 11241100x8000000000000000543021Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:12.695{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.968f6837e9a248eb2021-12-21 11:35:12.695root 11241100x8000000000000000543022Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:13.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7e3e66d0765b45082021-12-21 11:35:13.193root 11241100x8000000000000000543023Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:13.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4a2fad31015c03b52021-12-21 11:35:13.193root 11241100x8000000000000000543024Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:13.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.480e75882117e3242021-12-21 11:35:13.194root 11241100x8000000000000000543025Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:13.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0eaa0133c1086eb02021-12-21 11:35:13.194root 11241100x8000000000000000543026Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:13.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.49d5bade20c612602021-12-21 11:35:13.194root 11241100x8000000000000000543027Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:13.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.860a6fc5b67d4cb32021-12-21 11:35:13.194root 11241100x8000000000000000543028Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:13.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5d59d0e96fd1aa5b2021-12-21 11:35:13.194root 11241100x8000000000000000543029Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:13.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8e540fc9f1c0ddeb2021-12-21 11:35:13.194root 11241100x8000000000000000543030Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:13.195{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.081109d24ab7db4d2021-12-21 11:35:13.195root 11241100x8000000000000000543031Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:13.195{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2f07723e78306a0c2021-12-21 11:35:13.195root 11241100x8000000000000000543032Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:13.195{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5f47f854dbfc6e4a2021-12-21 11:35:13.195root 11241100x8000000000000000543033Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:13.195{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7b3764116cfa26cd2021-12-21 11:35:13.195root 11241100x8000000000000000543034Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:13.195{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b109bccf4c1e8ab12021-12-21 11:35:13.195root 11241100x8000000000000000543035Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:13.195{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.882b9e3e192173412021-12-21 11:35:13.195root 11241100x8000000000000000543036Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:13.195{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.408271ef3beca04e2021-12-21 11:35:13.195root 11241100x8000000000000000543037Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:13.195{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6c5a66c7199725f62021-12-21 11:35:13.195root 11241100x8000000000000000543038Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:13.195{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.cff6b99198a0bbd52021-12-21 11:35:13.195root 11241100x8000000000000000543039Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:13.195{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.30b1e0519084923a2021-12-21 11:35:13.195root 11241100x8000000000000000543040Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:13.195{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1cae9340cd5891902021-12-21 11:35:13.195root 11241100x8000000000000000543041Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:13.195{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4a43671c4c605b472021-12-21 11:35:13.195root 11241100x8000000000000000543042Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:13.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.44ac5fb44fd6a2c72021-12-21 11:35:13.693root 11241100x8000000000000000543043Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:13.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.fb6d04e350bd95452021-12-21 11:35:13.693root 11241100x8000000000000000543044Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:13.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2c49b74ef453f21c2021-12-21 11:35:13.693root 11241100x8000000000000000543045Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:13.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1e90950767a136872021-12-21 11:35:13.694root 11241100x8000000000000000543046Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:13.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a20e09fd084cef992021-12-21 11:35:13.694root 11241100x8000000000000000543047Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:13.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.382e9261b258f12e2021-12-21 11:35:13.694root 11241100x8000000000000000543048Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:13.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0e2dc99853f5c3c82021-12-21 11:35:13.694root 11241100x8000000000000000543049Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:13.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f512f95a5d37b4a32021-12-21 11:35:13.694root 11241100x8000000000000000543050Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:13.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6f0e6f74421cc9642021-12-21 11:35:13.694root 11241100x8000000000000000543051Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:13.695{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.00f8e531e6bf1c692021-12-21 11:35:13.695root 11241100x8000000000000000543052Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:13.695{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5c81fc8b6275ee532021-12-21 11:35:13.695root 11241100x8000000000000000543053Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:13.695{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b627eb086b1d77972021-12-21 11:35:13.695root 11241100x8000000000000000543054Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:13.695{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3ac64c5b5259dc852021-12-21 11:35:13.695root 11241100x8000000000000000543055Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:13.695{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4e32bc0879de6e0d2021-12-21 11:35:13.695root 11241100x8000000000000000543056Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:13.695{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0228e7924a74ef782021-12-21 11:35:13.695root 11241100x8000000000000000543057Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:13.696{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.64cfb0657cc2a3302021-12-21 11:35:13.696root 11241100x8000000000000000543058Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:13.696{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1301e004ba277c132021-12-21 11:35:13.696root 11241100x8000000000000000543059Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:13.696{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.fa008ecb4e8e9a062021-12-21 11:35:13.696root 11241100x8000000000000000543060Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:13.696{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4ac833d19cba468a2021-12-21 11:35:13.696root 11241100x8000000000000000543061Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:13.696{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.cc32c73f470d9a602021-12-21 11:35:13.696root 11241100x8000000000000000543062Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:14.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d842c6af93a1f3a42021-12-21 11:35:14.193root 11241100x8000000000000000543063Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:14.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e8b97797b29c14622021-12-21 11:35:14.193root 11241100x8000000000000000543064Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:14.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c04cbccd1e1c59e72021-12-21 11:35:14.194root 11241100x8000000000000000543065Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:14.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.cee0917367b85fb92021-12-21 11:35:14.194root 11241100x8000000000000000543066Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:14.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5fb5bdf1365bf7922021-12-21 11:35:14.194root 11241100x8000000000000000543067Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:14.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2106b55a0d9851fb2021-12-21 11:35:14.194root 11241100x8000000000000000543068Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:14.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.be9d57c02ad9225b2021-12-21 11:35:14.194root 11241100x8000000000000000543069Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:14.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.815cf156b53b09762021-12-21 11:35:14.194root 11241100x8000000000000000543070Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:14.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ae16ef31c3fb2e092021-12-21 11:35:14.194root 11241100x8000000000000000543071Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:14.195{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.498413b53c298de12021-12-21 11:35:14.195root 11241100x8000000000000000543072Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:14.195{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d830ac57e97ea1ab2021-12-21 11:35:14.195root 11241100x8000000000000000543073Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:14.195{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.809dad5d2152bc292021-12-21 11:35:14.195root 11241100x8000000000000000543074Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:14.195{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.84b02e8b20fdd5fd2021-12-21 11:35:14.195root 11241100x8000000000000000543075Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:14.195{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e12a75dc10a196e62021-12-21 11:35:14.195root 11241100x8000000000000000543076Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:14.195{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3af2ed979d8455b82021-12-21 11:35:14.195root 11241100x8000000000000000543077Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:14.196{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.832d31bf8c8f70752021-12-21 11:35:14.196root 11241100x8000000000000000543078Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:14.196{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3ae353ce4529b7d72021-12-21 11:35:14.196root 11241100x8000000000000000543079Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:14.196{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9ede2169f7b652b12021-12-21 11:35:14.196root 11241100x8000000000000000543080Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:14.196{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.af060d2480f571bf2021-12-21 11:35:14.196root 11241100x8000000000000000543081Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:14.196{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3319114ff75a302a2021-12-21 11:35:14.196root 11241100x8000000000000000543082Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:14.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.734a2d7e5be26f952021-12-21 11:35:14.693root 11241100x8000000000000000543083Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:14.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.bbf3889cef26b4d52021-12-21 11:35:14.693root 11241100x8000000000000000543084Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:14.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.432c0969e43837252021-12-21 11:35:14.693root 11241100x8000000000000000543085Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:14.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.cef8cce862635bce2021-12-21 11:35:14.693root 11241100x8000000000000000543086Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:14.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.75bf55f9fc99a7c22021-12-21 11:35:14.693root 11241100x8000000000000000543087Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:14.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7b72932f9d95362a2021-12-21 11:35:14.693root 11241100x8000000000000000543088Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:14.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0c6ac8211d884b962021-12-21 11:35:14.693root 11241100x8000000000000000543089Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:14.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8bc2530c8fd9f20f2021-12-21 11:35:14.693root 11241100x8000000000000000543090Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:14.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.81a235d656a5efbc2021-12-21 11:35:14.693root 11241100x8000000000000000543091Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:14.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7cfb30af669c8bc62021-12-21 11:35:14.693root 11241100x8000000000000000543092Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:14.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6f4eb4fbbdb2a5af2021-12-21 11:35:14.693root 11241100x8000000000000000543093Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:14.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3b0c980a6af1b5cb2021-12-21 11:35:14.694root 11241100x8000000000000000543094Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:14.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c8cb0fdef6b97d112021-12-21 11:35:14.694root 11241100x8000000000000000543095Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:14.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8804b5a6bb0cdde02021-12-21 11:35:14.694root 11241100x8000000000000000543096Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:14.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a4dab4c1c643b0592021-12-21 11:35:14.694root 11241100x8000000000000000543097Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:14.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.118d50d2b08362102021-12-21 11:35:14.694root 11241100x8000000000000000543098Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:14.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f7623d072362d4452021-12-21 11:35:14.694root 11241100x8000000000000000543099Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:14.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f1e982a545fa50652021-12-21 11:35:14.694root 11241100x8000000000000000543100Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:14.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ba5bab7164605dd92021-12-21 11:35:14.694root 11241100x8000000000000000543101Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:14.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8e1f10e0b1fecc892021-12-21 11:35:14.694root 11241100x8000000000000000543102Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:14.695{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a3eea05f0639c3312021-12-21 11:35:14.695root 11241100x8000000000000000543103Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:14.695{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f06abb4ce1abf4ee2021-12-21 11:35:14.695root 11241100x8000000000000000543104Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:15.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b3760fd305131e172021-12-21 11:35:15.193root 11241100x8000000000000000543105Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:15.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ad3f0685c488f8422021-12-21 11:35:15.193root 11241100x8000000000000000543106Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:15.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8ee52b23175dcc2e2021-12-21 11:35:15.193root 11241100x8000000000000000543107Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:15.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5e1a55501258e2652021-12-21 11:35:15.193root 11241100x8000000000000000543108Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:15.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.92272790735771f22021-12-21 11:35:15.193root 11241100x8000000000000000543109Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:15.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9a743784d17a3da12021-12-21 11:35:15.193root 11241100x8000000000000000543110Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:15.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ba58a9a170c5888c2021-12-21 11:35:15.193root 11241100x8000000000000000543111Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:15.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.da6892feb21057462021-12-21 11:35:15.193root 11241100x8000000000000000543112Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:15.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.13e3ac11b18a38232021-12-21 11:35:15.193root 11241100x8000000000000000543113Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:15.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.03a16893ee5f18332021-12-21 11:35:15.194root 11241100x8000000000000000543114Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:15.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.852bc25ac0967b732021-12-21 11:35:15.194root 11241100x8000000000000000543115Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:15.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.468288a887f070182021-12-21 11:35:15.194root 11241100x8000000000000000543116Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:15.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6a1e2e8664f763612021-12-21 11:35:15.194root 11241100x8000000000000000543117Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:15.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7c0246bd483a65822021-12-21 11:35:15.194root 11241100x8000000000000000543118Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:15.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.55ccf98ea05f04702021-12-21 11:35:15.194root 11241100x8000000000000000543119Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:15.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.324e2a68906166942021-12-21 11:35:15.194root 11241100x8000000000000000543120Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:15.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.fe7b62db281ac22b2021-12-21 11:35:15.194root 11241100x8000000000000000543121Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:15.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f93b7fc9c4cfb4102021-12-21 11:35:15.194root 11241100x8000000000000000543122Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:15.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c836a507c22b4b0f2021-12-21 11:35:15.194root 11241100x8000000000000000543123Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:15.195{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.23535f4297a709e52021-12-21 11:35:15.195root 11241100x8000000000000000543124Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:15.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.518f429c9e209c762021-12-21 11:35:15.693root 11241100x8000000000000000543125Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:15.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e5e0842847f49f122021-12-21 11:35:15.693root 11241100x8000000000000000543126Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:15.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.50b3409aa5a048262021-12-21 11:35:15.693root 11241100x8000000000000000543127Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:15.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c9ead6aec2a520e02021-12-21 11:35:15.693root 11241100x8000000000000000543128Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:15.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.61dfb63bfca464362021-12-21 11:35:15.693root 11241100x8000000000000000543129Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:15.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ddf790438fadedd72021-12-21 11:35:15.693root 11241100x8000000000000000543130Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:15.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c229cb94bfe30fd32021-12-21 11:35:15.694root 11241100x8000000000000000543131Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:15.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.fa75de51d892e2602021-12-21 11:35:15.694root 11241100x8000000000000000543132Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:15.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0b7464090ce297bc2021-12-21 11:35:15.694root 11241100x8000000000000000543133Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:15.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.12c65c9c8100a6ca2021-12-21 11:35:15.694root 11241100x8000000000000000543134Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:15.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1f4690e85c39bec52021-12-21 11:35:15.694root 11241100x8000000000000000543135Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:15.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.60b5159aeb5b9d4a2021-12-21 11:35:15.694root 11241100x8000000000000000543136Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:15.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f2d35abf68352c742021-12-21 11:35:15.694root 11241100x8000000000000000543137Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:15.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.fd5019b6eeea93802021-12-21 11:35:15.694root 11241100x8000000000000000543138Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:15.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6018899df295fdfd2021-12-21 11:35:15.694root 11241100x8000000000000000543139Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:15.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.682bdadcaf89df372021-12-21 11:35:15.694root 11241100x8000000000000000543140Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:15.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3526ab5b8815b6de2021-12-21 11:35:15.694root 11241100x8000000000000000543141Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:15.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.972944c7b57509bd2021-12-21 11:35:15.694root 11241100x8000000000000000543142Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:15.695{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6a9f54b0747c3c0a2021-12-21 11:35:15.695root 11241100x8000000000000000543143Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:15.695{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.495ddca9c1888ca62021-12-21 11:35:15.695root 11241100x8000000000000000543144Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:16.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f02828a4f98091252021-12-21 11:35:16.193root 11241100x8000000000000000543145Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:16.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.feff9a2fcea49ffe2021-12-21 11:35:16.193root 11241100x8000000000000000543146Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:16.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f09b7ca8648c66352021-12-21 11:35:16.193root 11241100x8000000000000000543147Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:16.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.66faf431d2951fc52021-12-21 11:35:16.193root 11241100x8000000000000000543148Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:16.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.58cc1f23217be4252021-12-21 11:35:16.193root 11241100x8000000000000000543149Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:16.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.48f6217e286248652021-12-21 11:35:16.193root 11241100x8000000000000000543150Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:16.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d196041c8f8f80932021-12-21 11:35:16.194root 11241100x8000000000000000543151Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:16.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2c41ce5c5e0a2f642021-12-21 11:35:16.194root 11241100x8000000000000000543152Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:16.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3cdfc4dcd9864aa82021-12-21 11:35:16.194root 11241100x8000000000000000543153Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:16.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.49ba6d9dd0068aae2021-12-21 11:35:16.194root 11241100x8000000000000000543154Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:16.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a1d6eae2962aeb582021-12-21 11:35:16.194root 11241100x8000000000000000543155Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:16.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4dbf294471da55bf2021-12-21 11:35:16.194root 11241100x8000000000000000543156Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:16.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.fd24d1c67c101b332021-12-21 11:35:16.194root 11241100x8000000000000000543157Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:16.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.69af6c57c5e2b4e12021-12-21 11:35:16.194root 11241100x8000000000000000543158Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:16.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a5185e1964ad589f2021-12-21 11:35:16.194root 11241100x8000000000000000543159Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:16.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.42e98ebe8533c0a42021-12-21 11:35:16.194root 11241100x8000000000000000543160Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:16.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.16e9bfd5202df1152021-12-21 11:35:16.194root 11241100x8000000000000000543161Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:16.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.55b720729c5e8ccb2021-12-21 11:35:16.194root 11241100x8000000000000000543162Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:16.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.64f090165ba860382021-12-21 11:35:16.194root 11241100x8000000000000000543163Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:16.195{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c986c56665b722ee2021-12-21 11:35:16.195root 11241100x8000000000000000543164Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:16.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.42b126f9450fe12e2021-12-21 11:35:16.693root 11241100x8000000000000000543165Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:16.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b75c38adf66ffe1b2021-12-21 11:35:16.693root 11241100x8000000000000000543166Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:16.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.628e9edaeebde2962021-12-21 11:35:16.693root 11241100x8000000000000000543167Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:16.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5f5b974cc65c5c282021-12-21 11:35:16.693root 11241100x8000000000000000543168Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:16.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a8da9672e6e31c912021-12-21 11:35:16.693root 11241100x8000000000000000543169Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:16.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e9be09bfb971341a2021-12-21 11:35:16.693root 11241100x8000000000000000543170Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:16.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.24a0182334fcbe582021-12-21 11:35:16.693root 11241100x8000000000000000543171Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:16.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1e0b2e36951ab2d92021-12-21 11:35:16.694root 11241100x8000000000000000543172Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:16.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b03c27ed08d225d42021-12-21 11:35:16.694root 11241100x8000000000000000543173Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:16.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.fc77657cca69b9ea2021-12-21 11:35:16.694root 11241100x8000000000000000543174Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:16.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.55df5614f21110f62021-12-21 11:35:16.694root 11241100x8000000000000000543175Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:16.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2d60838612c5344b2021-12-21 11:35:16.694root 11241100x8000000000000000543176Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:16.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.76fd36c6ee784f212021-12-21 11:35:16.694root 11241100x8000000000000000543177Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:16.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f93d455be27127fa2021-12-21 11:35:16.694root 11241100x8000000000000000543178Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:16.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.11f4a057e1705ea12021-12-21 11:35:16.694root 11241100x8000000000000000543179Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:16.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.280730bda15aa30c2021-12-21 11:35:16.694root 11241100x8000000000000000543180Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:16.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.169fb8d4243742e52021-12-21 11:35:16.694root 11241100x8000000000000000543181Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:16.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4b7ae1cbf009f3f72021-12-21 11:35:16.694root 11241100x8000000000000000543182Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:16.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.66a33572f79d4d0d2021-12-21 11:35:16.694root 11241100x8000000000000000543183Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:16.695{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.66e05edd467e8eb62021-12-21 11:35:16.695root 354300x8000000000000000543184Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:17.150{ec2b6afe-95d9-61c1-5175-3a0400000000}5346/opt/splunkforwarder/etc/apps/Splunk_TA_stream/linux_x86_64/bin/streamfwdroottcptruefalse10.0.1.25-48760-false10.0.1.12-8000- 11241100x8000000000000000543185Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:17.152{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f35b0ed8a0ff20522021-12-21 11:35:17.152root 11241100x8000000000000000543186Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:17.152{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.40b364d8e864dc402021-12-21 11:35:17.152root 11241100x8000000000000000543187Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:17.152{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6846409bc8d2d4ab2021-12-21 11:35:17.152root 11241100x8000000000000000543188Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:17.152{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.248984849fe708392021-12-21 11:35:17.152root 11241100x8000000000000000543189Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:17.152{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.12ebe4246f5214462021-12-21 11:35:17.152root 11241100x8000000000000000543190Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:17.153{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.da8034322a93caf92021-12-21 11:35:17.153root 11241100x8000000000000000543191Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:17.153{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.01adb549367f96852021-12-21 11:35:17.153root 11241100x8000000000000000543192Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:17.153{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1dc4135ee4701ba72021-12-21 11:35:17.153root 11241100x8000000000000000543193Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:17.153{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f3f48bdb73fc5c212021-12-21 11:35:17.153root 11241100x8000000000000000543194Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:17.153{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c7ff9547c3ee2b862021-12-21 11:35:17.153root 11241100x8000000000000000543195Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:17.153{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.599467dd37ab54552021-12-21 11:35:17.153root 11241100x8000000000000000543196Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:17.153{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.063f17962deb2fb62021-12-21 11:35:17.153root 11241100x8000000000000000543197Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:17.153{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6b5d6c61eae763d22021-12-21 11:35:17.153root 11241100x8000000000000000543198Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:17.153{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f8dba0789383dd6e2021-12-21 11:35:17.153root 11241100x8000000000000000543199Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:17.153{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b9c61a9f2bcfaeaa2021-12-21 11:35:17.153root 11241100x8000000000000000543200Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:17.153{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.af3db320022106e92021-12-21 11:35:17.153root 11241100x8000000000000000543201Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:17.153{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.eb3fd7b4710df5b92021-12-21 11:35:17.153root 11241100x8000000000000000543202Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:17.153{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4c3244ef78748d592021-12-21 11:35:17.153root 11241100x8000000000000000543203Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:17.153{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1b14adf1c13ef32b2021-12-21 11:35:17.153root 11241100x8000000000000000543204Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:17.154{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.90c281fc680b5d9b2021-12-21 11:35:17.154root 11241100x8000000000000000543205Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:17.154{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5555a0ccc217d9ce2021-12-21 11:35:17.154root 11241100x8000000000000000543206Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:17.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.cb5d04cc070bc35c2021-12-21 11:35:17.443root 11241100x8000000000000000543207Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:17.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e065be1caeb50dd82021-12-21 11:35:17.443root 11241100x8000000000000000543208Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:17.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.062e4ca6c3e667622021-12-21 11:35:17.443root 11241100x8000000000000000543209Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:17.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.16b593bfab8674b92021-12-21 11:35:17.443root 11241100x8000000000000000543210Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:17.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.85b2fd8ee0b6d3972021-12-21 11:35:17.443root 11241100x8000000000000000543211Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:17.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.54899e3db64f4c4f2021-12-21 11:35:17.443root 11241100x8000000000000000543212Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:17.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.123b7c3b139683082021-12-21 11:35:17.443root 11241100x8000000000000000543213Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:17.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e6fcc5964e1035a62021-12-21 11:35:17.443root 11241100x8000000000000000543214Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:17.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b7606e0b356514f42021-12-21 11:35:17.443root 11241100x8000000000000000543215Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:17.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f906a2072acae7702021-12-21 11:35:17.443root 11241100x8000000000000000543216Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:17.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b400ae57e6ee2e2a2021-12-21 11:35:17.443root 11241100x8000000000000000543217Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:17.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ceb1cbb5daa159af2021-12-21 11:35:17.443root 11241100x8000000000000000543218Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:17.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7ad139d2f2f7f0452021-12-21 11:35:17.444root 11241100x8000000000000000543219Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:17.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ce4cf986448b9c3a2021-12-21 11:35:17.444root 11241100x8000000000000000543220Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:17.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.de07ce61633b044f2021-12-21 11:35:17.444root 11241100x8000000000000000543221Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:17.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e19c2b5e2cfb1bb02021-12-21 11:35:17.444root 11241100x8000000000000000543222Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:17.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1f30e655c3a520a32021-12-21 11:35:17.444root 11241100x8000000000000000543223Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:17.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.312f83b043622d582021-12-21 11:35:17.444root 11241100x8000000000000000543224Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:17.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e89454ea6fbe03e72021-12-21 11:35:17.444root 11241100x8000000000000000543225Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:17.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8dacb7259811fa822021-12-21 11:35:17.444root 11241100x8000000000000000543226Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:17.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f5165c0d29876a492021-12-21 11:35:17.444root 11241100x8000000000000000543227Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:17.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0142565ad83c07162021-12-21 11:35:17.444root 11241100x8000000000000000543228Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:17.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.fd9842f710680dc22021-12-21 11:35:17.943root 11241100x8000000000000000543229Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:17.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.fcc1f9374e91b01e2021-12-21 11:35:17.943root 11241100x8000000000000000543230Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:17.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b898d0d9be5dc87d2021-12-21 11:35:17.943root 11241100x8000000000000000543231Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:17.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5cd530448d3b82152021-12-21 11:35:17.943root 11241100x8000000000000000543232Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:17.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.87fa809d0013ebe52021-12-21 11:35:17.943root 11241100x8000000000000000543233Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:17.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6df1ae6fa938a44b2021-12-21 11:35:17.943root 11241100x8000000000000000543234Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:17.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.551f7709e44f5a042021-12-21 11:35:17.943root 11241100x8000000000000000543235Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:17.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d63e6fe317e019652021-12-21 11:35:17.943root 11241100x8000000000000000543236Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:17.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.133588c00fc7b88d2021-12-21 11:35:17.944root 11241100x8000000000000000543237Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:17.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3ad32cbb3aab36972021-12-21 11:35:17.944root 11241100x8000000000000000543238Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:17.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.47cb24cbd0478bca2021-12-21 11:35:17.944root 11241100x8000000000000000543239Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:17.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.342ea15296b0ffe62021-12-21 11:35:17.944root 11241100x8000000000000000543240Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:17.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3b77770c380e6d0e2021-12-21 11:35:17.944root 11241100x8000000000000000543241Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:17.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9e0059372d61ac402021-12-21 11:35:17.944root 11241100x8000000000000000543242Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:17.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.281b51b9542476ba2021-12-21 11:35:17.944root 11241100x8000000000000000543243Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:17.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.af09c97782003d2e2021-12-21 11:35:17.944root 11241100x8000000000000000543244Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:17.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.118d5a0cf9f2262a2021-12-21 11:35:17.944root 11241100x8000000000000000543245Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:17.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.09abfd0fab69050c2021-12-21 11:35:17.944root 11241100x8000000000000000543246Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:17.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.12d3522e3810cbeb2021-12-21 11:35:17.945root 11241100x8000000000000000543247Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:17.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a6a8665f6b3ee9632021-12-21 11:35:17.945root 11241100x8000000000000000543248Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:17.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0ce4e349b71e23012021-12-21 11:35:17.945root 11241100x8000000000000000543249Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:18.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6e4e09d876e2c8e12021-12-21 11:35:18.443root 11241100x8000000000000000543250Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:18.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.16e7652243fefa6c2021-12-21 11:35:18.443root 11241100x8000000000000000543251Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:18.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8509dbcef85be7e82021-12-21 11:35:18.445root 11241100x8000000000000000543252Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:18.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3b8cae02272f233b2021-12-21 11:35:18.445root 11241100x8000000000000000543253Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:18.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1be91669173016032021-12-21 11:35:18.445root 11241100x8000000000000000543254Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:18.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9e0f6d08415a150e2021-12-21 11:35:18.445root 11241100x8000000000000000543255Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:18.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.fae148738fbeea1e2021-12-21 11:35:18.445root 11241100x8000000000000000543256Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:18.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4ebb794ded4a70f32021-12-21 11:35:18.445root 11241100x8000000000000000543257Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:18.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e134c799dc8a85fc2021-12-21 11:35:18.445root 11241100x8000000000000000543258Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:18.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.82a85cb1c12a347f2021-12-21 11:35:18.445root 11241100x8000000000000000543259Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:18.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.90472c5db8ce9bf42021-12-21 11:35:18.445root 11241100x8000000000000000543260Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:18.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a98cf4b63457bb8d2021-12-21 11:35:18.445root 11241100x8000000000000000543261Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:18.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.fe0400e96ade8cd02021-12-21 11:35:18.445root 11241100x8000000000000000543262Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:18.446{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.91347e5c5db7ff6a2021-12-21 11:35:18.446root 11241100x8000000000000000543263Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:18.446{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.fbddc47501ca2e3a2021-12-21 11:35:18.446root 11241100x8000000000000000543264Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:18.446{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3bfe0cb4219c4d132021-12-21 11:35:18.446root 11241100x8000000000000000543265Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:18.446{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.93b629f4f06c8a592021-12-21 11:35:18.446root 11241100x8000000000000000543266Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:18.446{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9dfeb17fd91b3a532021-12-21 11:35:18.446root 11241100x8000000000000000543267Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:18.446{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f6b34ec746e917e62021-12-21 11:35:18.446root 11241100x8000000000000000543268Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:18.446{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.40ecfba401eaa8ed2021-12-21 11:35:18.446root 11241100x8000000000000000543269Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:18.447{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7c2afe934997b0932021-12-21 11:35:18.447root 11241100x8000000000000000543270Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:18.447{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5118c9bb355aebbd2021-12-21 11:35:18.447root 11241100x8000000000000000543271Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:18.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2e33038a2dced54e2021-12-21 11:35:18.943root 11241100x8000000000000000543272Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:18.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.01076ee88e80d71f2021-12-21 11:35:18.943root 11241100x8000000000000000543273Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:18.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.47b59ae093a486a92021-12-21 11:35:18.943root 11241100x8000000000000000543274Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:18.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e719eea098049a3c2021-12-21 11:35:18.943root 11241100x8000000000000000543275Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:18.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8535e8ca71e11d4f2021-12-21 11:35:18.943root 11241100x8000000000000000543276Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:18.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5f34f09e4af9f4a92021-12-21 11:35:18.944root 11241100x8000000000000000543277Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:18.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2a015bd8b8e13e3a2021-12-21 11:35:18.944root 11241100x8000000000000000543278Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:18.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.636b0aced2c1b56c2021-12-21 11:35:18.944root 11241100x8000000000000000543279Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:18.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0b012933cead2a832021-12-21 11:35:18.944root 11241100x8000000000000000543280Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:18.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ef78bfc29ed05cd12021-12-21 11:35:18.944root 11241100x8000000000000000543281Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:18.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.01cb9bb6c0a293712021-12-21 11:35:18.944root 11241100x8000000000000000543282Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:18.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a62f2960edc00c402021-12-21 11:35:18.944root 11241100x8000000000000000543283Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:18.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.cb7aa14874d34d762021-12-21 11:35:18.944root 11241100x8000000000000000543284Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:18.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a0f0a4c496c7646e2021-12-21 11:35:18.944root 11241100x8000000000000000543285Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:18.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.139ddce89f5c54942021-12-21 11:35:18.944root 11241100x8000000000000000543286Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:18.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.16e0e84f52c288592021-12-21 11:35:18.944root 11241100x8000000000000000543287Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:18.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4b6d5016e959befd2021-12-21 11:35:18.944root 11241100x8000000000000000543288Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:18.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8e58f5e2d65c534d2021-12-21 11:35:18.944root 11241100x8000000000000000543289Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:18.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.87f6bf99fa4d02822021-12-21 11:35:18.944root 11241100x8000000000000000543290Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:18.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.654a8e3291dd7eda2021-12-21 11:35:18.944root 11241100x8000000000000000543291Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:18.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3c158f41ae839d352021-12-21 11:35:18.945root 11241100x8000000000000000543292Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:19.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c9f4b1b3d12b01d42021-12-21 11:35:19.443root 11241100x8000000000000000543293Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:19.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3db3ce954eb8c22d2021-12-21 11:35:19.443root 11241100x8000000000000000543294Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:19.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.cdad8ab9655a2df82021-12-21 11:35:19.444root 11241100x8000000000000000543295Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:19.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.fbd3cc8a09363e1f2021-12-21 11:35:19.444root 11241100x8000000000000000543296Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:19.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f45987352d9494a12021-12-21 11:35:19.444root 11241100x8000000000000000543297Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:19.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7f1cf714bf792d182021-12-21 11:35:19.444root 11241100x8000000000000000543298Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:19.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a48a0c6cea2d590c2021-12-21 11:35:19.444root 11241100x8000000000000000543299Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:19.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.afb1010d35b019af2021-12-21 11:35:19.444root 11241100x8000000000000000543300Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:19.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8733932d005e5e732021-12-21 11:35:19.445root 11241100x8000000000000000543301Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:19.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3c2551df865f03a02021-12-21 11:35:19.445root 11241100x8000000000000000543302Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:19.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.88edae309c39898d2021-12-21 11:35:19.445root 11241100x8000000000000000543303Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:19.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.364eab799aed3e802021-12-21 11:35:19.445root 11241100x8000000000000000543304Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:19.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.07225ec1775bdb4e2021-12-21 11:35:19.445root 11241100x8000000000000000543305Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:19.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2d519c634f9b4e4e2021-12-21 11:35:19.445root 11241100x8000000000000000543306Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:19.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.48bbba17f1696d4a2021-12-21 11:35:19.445root 11241100x8000000000000000543307Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:19.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4d52adec42126f802021-12-21 11:35:19.445root 11241100x8000000000000000543308Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:19.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a5607a29ea1361d82021-12-21 11:35:19.445root 11241100x8000000000000000543309Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:19.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a71a972f50a507352021-12-21 11:35:19.445root 11241100x8000000000000000543310Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:19.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c22e88edebdbdbc52021-12-21 11:35:19.445root 11241100x8000000000000000543311Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:19.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a356d8f15a75bb072021-12-21 11:35:19.445root 11241100x8000000000000000543312Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:19.446{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b709adf0c516fd832021-12-21 11:35:19.446root 11241100x8000000000000000543313Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:19.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.df8ceaa0656656362021-12-21 11:35:19.943root 11241100x8000000000000000543314Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:19.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b6948dc508d0ab3b2021-12-21 11:35:19.943root 11241100x8000000000000000543315Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:19.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a17968691e9b434c2021-12-21 11:35:19.943root 11241100x8000000000000000543316Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:19.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.27e63db55a3d70ba2021-12-21 11:35:19.943root 11241100x8000000000000000543317Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:19.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c0792e0df0ec5fe32021-12-21 11:35:19.944root 11241100x8000000000000000543318Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:19.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a13d3151440a0fe62021-12-21 11:35:19.944root 11241100x8000000000000000543319Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:19.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.aae38e44a9331ecc2021-12-21 11:35:19.944root 11241100x8000000000000000543320Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:19.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.256dd5f5d5fef5632021-12-21 11:35:19.945root 11241100x8000000000000000543321Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:19.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5801ac96def93c8f2021-12-21 11:35:19.945root 11241100x8000000000000000543322Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:19.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.fea0ffc076fcc77d2021-12-21 11:35:19.945root 11241100x8000000000000000543323Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:19.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a2194dc38273020b2021-12-21 11:35:19.945root 11241100x8000000000000000543324Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:19.947{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7dfdb4a358222abd2021-12-21 11:35:19.947root 11241100x8000000000000000543325Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:19.948{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.58fc3eb849c250772021-12-21 11:35:19.948root 11241100x8000000000000000543326Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:19.948{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.41145e8fb14a814d2021-12-21 11:35:19.948root 11241100x8000000000000000543327Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:19.948{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9b43e695fb68da302021-12-21 11:35:19.948root 11241100x8000000000000000543328Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:19.948{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.629f4715512637292021-12-21 11:35:19.948root 11241100x8000000000000000543329Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:19.949{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c0e4b06a6d47cf172021-12-21 11:35:19.949root 11241100x8000000000000000543330Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:19.949{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0d365f9dc5cfbc962021-12-21 11:35:19.949root 11241100x8000000000000000543331Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:19.949{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4af068e1d1b64c9a2021-12-21 11:35:19.949root 11241100x8000000000000000543332Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:19.949{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9df56bcba9d04a9e2021-12-21 11:35:19.949root 11241100x8000000000000000543333Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:19.950{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7c997a5b420e1d252021-12-21 11:35:19.950root 11241100x8000000000000000543334Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:20.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d502f3f1459140562021-12-21 11:35:20.443root 11241100x8000000000000000543335Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:20.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b346fc6c9406fc5e2021-12-21 11:35:20.443root 11241100x8000000000000000543336Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:20.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0a529e50519372b22021-12-21 11:35:20.443root 11241100x8000000000000000543337Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:20.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e5b415d1c6ce03912021-12-21 11:35:20.443root 11241100x8000000000000000543338Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:20.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.14efa0bed6c6505f2021-12-21 11:35:20.443root 11241100x8000000000000000543339Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:20.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4e869a9b539e2cf92021-12-21 11:35:20.443root 11241100x8000000000000000543340Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:20.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3280ca089b5c7cd92021-12-21 11:35:20.443root 11241100x8000000000000000543341Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:20.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.21de72dcb091e9e52021-12-21 11:35:20.443root 11241100x8000000000000000543342Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:20.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.add5e311165c9da02021-12-21 11:35:20.443root 11241100x8000000000000000543343Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:20.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0215ccf2a788cf692021-12-21 11:35:20.444root 11241100x8000000000000000543344Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:20.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e49e8fbe318ac1ab2021-12-21 11:35:20.444root 11241100x8000000000000000543345Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:20.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.05aaa0cbccd55b032021-12-21 11:35:20.444root 11241100x8000000000000000543346Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:20.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3448f0a8f73aa9292021-12-21 11:35:20.444root 11241100x8000000000000000543347Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:20.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a2686b4d34c0dc582021-12-21 11:35:20.444root 11241100x8000000000000000543348Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:20.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b09ee6dfec1ffc672021-12-21 11:35:20.444root 11241100x8000000000000000543349Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:20.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d55518769943974a2021-12-21 11:35:20.444root 11241100x8000000000000000543350Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:20.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.88b8836f2e27bf442021-12-21 11:35:20.444root 11241100x8000000000000000543351Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:20.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.24ebbf30734f633f2021-12-21 11:35:20.444root 11241100x8000000000000000543352Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:20.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.64cc6202d809f7d82021-12-21 11:35:20.444root 11241100x8000000000000000543353Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:20.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e0d5c656ad28f33a2021-12-21 11:35:20.444root 11241100x8000000000000000543354Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:20.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8eea44ae02f23ecf2021-12-21 11:35:20.444root 11241100x8000000000000000543355Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:20.942{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.51dfa08a1c66335f2021-12-21 11:35:20.942root 11241100x8000000000000000543356Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:20.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d131d0a3c4fa0a332021-12-21 11:35:20.943root 11241100x8000000000000000543357Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:20.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e634ed290fbe8ef32021-12-21 11:35:20.943root 11241100x8000000000000000543358Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:20.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.813308655c94656d2021-12-21 11:35:20.943root 11241100x8000000000000000543359Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:20.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.26fb90d4fe5bffce2021-12-21 11:35:20.943root 11241100x8000000000000000543360Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:20.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.37244e6e01abb5ef2021-12-21 11:35:20.943root 11241100x8000000000000000543361Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:20.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e9839f9a690d6f0a2021-12-21 11:35:20.943root 11241100x8000000000000000543362Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:20.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.104b94cf8aac43f42021-12-21 11:35:20.943root 11241100x8000000000000000543363Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:20.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d2e720b2aaed748f2021-12-21 11:35:20.943root 11241100x8000000000000000543364Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:20.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.cd0237e46e89f24a2021-12-21 11:35:20.943root 11241100x8000000000000000543365Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:20.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.71e682232b90d2d92021-12-21 11:35:20.943root 11241100x8000000000000000543366Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:20.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2ee4b3bfec332f832021-12-21 11:35:20.944root 11241100x8000000000000000543367Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:20.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b5abf9e7cecde09b2021-12-21 11:35:20.944root 11241100x8000000000000000543368Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:20.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f6a5c991da5653382021-12-21 11:35:20.944root 11241100x8000000000000000543369Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:20.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.130e929e6848fac62021-12-21 11:35:20.944root 11241100x8000000000000000543370Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:20.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.22fe9d006104f4052021-12-21 11:35:20.944root 11241100x8000000000000000543371Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:20.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f395e2a9572395432021-12-21 11:35:20.944root 11241100x8000000000000000543372Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:20.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d66def46001fc9f82021-12-21 11:35:20.944root 11241100x8000000000000000543373Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:20.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.48b340f6ff2700502021-12-21 11:35:20.944root 11241100x8000000000000000543374Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:20.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.daa2e480c14502982021-12-21 11:35:20.945root 11241100x8000000000000000543375Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:20.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.240f79799c49cc302021-12-21 11:35:20.945root 11241100x8000000000000000543376Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:20.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.19cda754ee5a15352021-12-21 11:35:20.945root 11241100x8000000000000000543377Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:20.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d6fbc57040f20cd72021-12-21 11:35:20.945root 11241100x8000000000000000543378Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:20.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ad925924752b693c2021-12-21 11:35:20.945root 11241100x8000000000000000543379Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:20.946{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3caa42e33eb9f74f2021-12-21 11:35:20.946root 11241100x8000000000000000543380Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:20.946{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1100022c9f21ce2d2021-12-21 11:35:20.946root 11241100x8000000000000000543381Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:20.946{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3fe09ea46151291c2021-12-21 11:35:20.946root 11241100x8000000000000000543382Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:20.946{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6b53a15075bc62e32021-12-21 11:35:20.946root 11241100x8000000000000000543383Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:20.946{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.63c53864e32e64712021-12-21 11:35:20.946root 11241100x8000000000000000543384Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:20.946{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2bdef2ba81b369a22021-12-21 11:35:20.946root 11241100x8000000000000000543385Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:20.946{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8103ec61be2fd50d2021-12-21 11:35:20.946root 11241100x8000000000000000543386Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:20.946{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ece7e56040beb4f92021-12-21 11:35:20.946root 11241100x8000000000000000543387Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:20.946{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f0d6fcdf582ea32e2021-12-21 11:35:20.946root 11241100x8000000000000000543388Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:20.946{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.17603cd82dfed7062021-12-21 11:35:20.946root 11241100x8000000000000000543389Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:20.946{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.382bd66c734aeac22021-12-21 11:35:20.946root 11241100x8000000000000000543390Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:20.946{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1dffc9a7a31900482021-12-21 11:35:20.946root 11241100x8000000000000000543391Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:20.946{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.50b2e6878c8b2d762021-12-21 11:35:20.946root 11241100x8000000000000000543392Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:20.946{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.66665492220e29dc2021-12-21 11:35:20.946root 11241100x8000000000000000543393Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:20.946{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.dcbe60946ea78b422021-12-21 11:35:20.946root 11241100x8000000000000000543394Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:20.947{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.304ecb0c0bd99b3b2021-12-21 11:35:20.947root 11241100x8000000000000000543395Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:21.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.36454e805d3ce7c02021-12-21 11:35:21.443root 11241100x8000000000000000543396Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:21.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e81ead52c02d39cb2021-12-21 11:35:21.443root 11241100x8000000000000000543397Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:21.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c2ca22215fbd50c22021-12-21 11:35:21.443root 11241100x8000000000000000543398Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:21.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2280cda9e8a9c77e2021-12-21 11:35:21.443root 11241100x8000000000000000543399Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:21.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f93efb068ca1e3612021-12-21 11:35:21.444root 11241100x8000000000000000543400Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:21.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.51d9c50d1afb77a92021-12-21 11:35:21.444root 11241100x8000000000000000543401Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:21.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.747b1ad6967d3e1b2021-12-21 11:35:21.444root 11241100x8000000000000000543402Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:21.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a7d49ed2d2a70af02021-12-21 11:35:21.444root 11241100x8000000000000000543403Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:21.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5cd25013b9d03d362021-12-21 11:35:21.444root 11241100x8000000000000000543404Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:21.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.edb98fae837eb0192021-12-21 11:35:21.444root 11241100x8000000000000000543405Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:21.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c27f062271930c6c2021-12-21 11:35:21.444root 11241100x8000000000000000543406Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:21.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0c000e57a2f95b412021-12-21 11:35:21.444root 11241100x8000000000000000543407Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:21.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.63eb370e25cac9ae2021-12-21 11:35:21.444root 11241100x8000000000000000543408Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:21.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2d19aea598d13e332021-12-21 11:35:21.445root 11241100x8000000000000000543409Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:21.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.cdd4693ec91ad5cd2021-12-21 11:35:21.445root 11241100x8000000000000000543410Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:21.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1825db3ea05365a22021-12-21 11:35:21.445root 11241100x8000000000000000543411Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:21.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ca34ef157c3574ec2021-12-21 11:35:21.445root 11241100x8000000000000000543412Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:21.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.75d144a3818821b32021-12-21 11:35:21.445root 11241100x8000000000000000543413Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:21.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.67e66a8c08568b052021-12-21 11:35:21.445root 11241100x8000000000000000543414Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:21.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.940548955aa3d73c2021-12-21 11:35:21.445root 11241100x8000000000000000543415Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:21.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.41d4b52ac050df292021-12-21 11:35:21.445root 11241100x8000000000000000543416Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:21.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.de992646d21a4be02021-12-21 11:35:21.445root 11241100x8000000000000000543417Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:21.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3329414c262fb4532021-12-21 11:35:21.445root 11241100x8000000000000000543418Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:21.446{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.20bf8cc3ba9f40552021-12-21 11:35:21.446root 11241100x8000000000000000543419Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:21.446{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5cc98fcf6b9449182021-12-21 11:35:21.446root 11241100x8000000000000000543420Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:21.446{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a92daae168c3a5b32021-12-21 11:35:21.446root 11241100x8000000000000000543421Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:21.446{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c9a64c2b4bc99f8c2021-12-21 11:35:21.446root 11241100x8000000000000000543422Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:21.446{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.fca58076b0c422c62021-12-21 11:35:21.446root 11241100x8000000000000000543423Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:21.447{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a0b4c2cc404b89a22021-12-21 11:35:21.447root 11241100x8000000000000000543424Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:21.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.856cad8681c062352021-12-21 11:35:21.943root 11241100x8000000000000000543425Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:21.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.49bf8c6e573d99492021-12-21 11:35:21.943root 11241100x8000000000000000543426Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:21.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.56970159497b044d2021-12-21 11:35:21.943root 11241100x8000000000000000543427Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:21.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.619ee2a42fe4d0c02021-12-21 11:35:21.943root 11241100x8000000000000000543428Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:21.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b81775df13ad7c1b2021-12-21 11:35:21.943root 11241100x8000000000000000543429Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:21.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b828ff50885404922021-12-21 11:35:21.943root 11241100x8000000000000000543430Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:21.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4a1c4080ffebd1942021-12-21 11:35:21.943root 11241100x8000000000000000543431Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:21.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.db11fed0b6f6e7f32021-12-21 11:35:21.944root 11241100x8000000000000000543432Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:21.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.894473b7d0d694292021-12-21 11:35:21.944root 11241100x8000000000000000543433Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:21.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.840ef08023fa2e0b2021-12-21 11:35:21.944root 11241100x8000000000000000543434Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:21.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a6b37502786d9ae02021-12-21 11:35:21.944root 11241100x8000000000000000543435Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:21.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.882a3c7b3e9dfcf62021-12-21 11:35:21.944root 11241100x8000000000000000543436Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:21.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a66f9ea88dea25d22021-12-21 11:35:21.944root 11241100x8000000000000000543437Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:21.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.821995ba97aa2a902021-12-21 11:35:21.944root 11241100x8000000000000000543438Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:21.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.66de6574c2b7d0722021-12-21 11:35:21.945root 11241100x8000000000000000543439Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:21.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.fb9f7af2ec69534e2021-12-21 11:35:21.945root 11241100x8000000000000000543440Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:21.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c270962f627e9a182021-12-21 11:35:21.945root 11241100x8000000000000000543441Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:21.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.615f6a5974c4631f2021-12-21 11:35:21.945root 11241100x8000000000000000543442Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:21.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d9ee8f10f646cd952021-12-21 11:35:21.945root 11241100x8000000000000000543443Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:21.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9d97afbb7ba938042021-12-21 11:35:21.945root 11241100x8000000000000000543444Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:21.946{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.92a214888fd8a4bc2021-12-21 11:35:21.946root 11241100x8000000000000000543445Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:21.946{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.02c328d85afa29fe2021-12-21 11:35:21.946root 11241100x8000000000000000543446Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:21.947{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.aeb4fa9d04ee56fd2021-12-21 11:35:21.947root 11241100x8000000000000000543447Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:21.947{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0638cf276b4d4ace2021-12-21 11:35:21.947root 11241100x8000000000000000543448Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:21.947{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4a73c8e9113e7b512021-12-21 11:35:21.947root 11241100x8000000000000000543449Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:21.947{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a121c019e2162a862021-12-21 11:35:21.947root 11241100x8000000000000000543450Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:21.948{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3116f2cd5a0581dc2021-12-21 11:35:21.948root 11241100x8000000000000000543451Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:21.948{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4c7263bce6bbb9982021-12-21 11:35:21.948root 354300x8000000000000000543452Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:22.249{ec2b6afe-95d9-61c1-5175-3a0400000000}5346/opt/splunkforwarder/etc/apps/Splunk_TA_stream/linux_x86_64/bin/streamfwdroottcptruefalse10.0.1.25-48762-false10.0.1.12-8000- 11241100x8000000000000000543453Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:22.251{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.26b3ff71380ffdfb2021-12-21 11:35:22.251root 11241100x8000000000000000543454Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:22.251{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.34148210cb977bf42021-12-21 11:35:22.251root 11241100x8000000000000000543455Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:22.251{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ab2c3731a9246b852021-12-21 11:35:22.251root 11241100x8000000000000000543456Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:22.251{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0aa11f8689aa72ab2021-12-21 11:35:22.251root 11241100x8000000000000000543457Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:22.251{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5fdbcf21ea59554a2021-12-21 11:35:22.251root 11241100x8000000000000000543458Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:22.251{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.88a1684c7b6b07cf2021-12-21 11:35:22.251root 11241100x8000000000000000543459Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:22.251{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d17c356b68e5cb572021-12-21 11:35:22.251root 11241100x8000000000000000543460Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:22.251{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2fe0a891c037dfef2021-12-21 11:35:22.251root 11241100x8000000000000000543461Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:22.251{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.19e569829abfdfeb2021-12-21 11:35:22.251root 11241100x8000000000000000543462Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:22.252{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d6d90aac871d5c982021-12-21 11:35:22.252root 11241100x8000000000000000543463Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:22.252{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b39c7fc7babaa0882021-12-21 11:35:22.252root 11241100x8000000000000000543464Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:22.252{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.dba7256bad503ed42021-12-21 11:35:22.252root 11241100x8000000000000000543465Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:22.252{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.cd93943a414594c72021-12-21 11:35:22.252root 11241100x8000000000000000543466Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:22.252{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5ec72636c5b4b61b2021-12-21 11:35:22.252root 11241100x8000000000000000543467Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:22.252{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.05f1cb2a9f1c73932021-12-21 11:35:22.252root 11241100x8000000000000000543468Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:22.252{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8e0c91163b5251682021-12-21 11:35:22.252root 11241100x8000000000000000543469Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:22.252{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3177447e2d8fb50a2021-12-21 11:35:22.252root 11241100x8000000000000000543470Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:22.252{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6ce5e3c68b6cb5472021-12-21 11:35:22.252root 11241100x8000000000000000543471Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:22.252{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3e6784fd3bda15f12021-12-21 11:35:22.252root 11241100x8000000000000000543472Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:22.252{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5b55f5c429fcf7f82021-12-21 11:35:22.252root 11241100x8000000000000000543473Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:22.252{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d0281e3cd32408d42021-12-21 11:35:22.252root 11241100x8000000000000000543474Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:22.252{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e191de35b19ca43e2021-12-21 11:35:22.252root 11241100x8000000000000000543475Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:22.252{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.093fd906aabec04a2021-12-21 11:35:22.252root 11241100x8000000000000000543476Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:22.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.29f9d4da758942772021-12-21 11:35:22.693root 11241100x8000000000000000543477Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:22.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4a733440bf9178172021-12-21 11:35:22.693root 11241100x8000000000000000543478Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:22.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f34ae1fdc0d89b4f2021-12-21 11:35:22.694root 11241100x8000000000000000543479Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:22.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.958ad17370fce6202021-12-21 11:35:22.694root 11241100x8000000000000000543480Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:22.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.464579d5123a5e0e2021-12-21 11:35:22.694root 11241100x8000000000000000543481Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:22.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.85fcfcf7024db1f72021-12-21 11:35:22.694root 11241100x8000000000000000543482Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:22.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.03e322e8fbcb20462021-12-21 11:35:22.694root 11241100x8000000000000000543483Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:22.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.10afcee40b30c1f12021-12-21 11:35:22.694root 11241100x8000000000000000543484Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:22.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.925fd9507c5db0282021-12-21 11:35:22.694root 11241100x8000000000000000543485Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:22.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.345afcfcbe1572452021-12-21 11:35:22.694root 11241100x8000000000000000543486Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:22.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3a38fa14dbf55c912021-12-21 11:35:22.694root 11241100x8000000000000000543487Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:22.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5eeb24a6013f55132021-12-21 11:35:22.694root 11241100x8000000000000000543488Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:22.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.fea4b09eaeca6da52021-12-21 11:35:22.694root 11241100x8000000000000000543489Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:22.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ee17f94f7b0d84242021-12-21 11:35:22.694root 11241100x8000000000000000543490Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:22.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6f4ce3fba02675c62021-12-21 11:35:22.694root 11241100x8000000000000000543491Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:22.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.071250970491784c2021-12-21 11:35:22.694root 11241100x8000000000000000543492Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:22.695{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c31aa406fd9ae65b2021-12-21 11:35:22.695root 11241100x8000000000000000543493Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:22.695{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4a53206ccc8f2eab2021-12-21 11:35:22.695root 11241100x8000000000000000543494Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:22.695{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.05ecad51e42f70052021-12-21 11:35:22.695root 11241100x8000000000000000543495Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:22.695{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.94ab21ddaaa01ce42021-12-21 11:35:22.695root 11241100x8000000000000000543496Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:22.695{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f43b925c60ee98c72021-12-21 11:35:22.695root 11241100x8000000000000000543497Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:22.695{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b901052b6a864ed92021-12-21 11:35:22.695root 11241100x8000000000000000543498Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:23.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a1586d1e3a7153fb2021-12-21 11:35:23.193root 11241100x8000000000000000543499Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:23.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7f2bb8bbfcc5634b2021-12-21 11:35:23.194root 11241100x8000000000000000543500Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:23.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2153efad5e4ee8212021-12-21 11:35:23.194root 11241100x8000000000000000543501Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:23.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2181768f22e65d462021-12-21 11:35:23.194root 11241100x8000000000000000543502Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:23.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f768f16e54ec072e2021-12-21 11:35:23.194root 11241100x8000000000000000543503Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:23.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f023c5e0c9fc5a732021-12-21 11:35:23.194root 11241100x8000000000000000543504Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:23.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8155673bdf1bc24d2021-12-21 11:35:23.194root 11241100x8000000000000000543505Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:23.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0fe444f98b88b5b92021-12-21 11:35:23.194root 11241100x8000000000000000543506Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:23.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e2941ebab52e5fa62021-12-21 11:35:23.194root 11241100x8000000000000000543507Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:23.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a153d497c2a8e0172021-12-21 11:35:23.194root 11241100x8000000000000000543508Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:23.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.878193d49acbebfc2021-12-21 11:35:23.194root 11241100x8000000000000000543509Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:23.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.afaf61f3eca662f52021-12-21 11:35:23.194root 11241100x8000000000000000543510Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:23.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0e15e1ed0e8601052021-12-21 11:35:23.194root 11241100x8000000000000000543511Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:23.195{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.bb9445225d4f8a802021-12-21 11:35:23.195root 11241100x8000000000000000543512Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:23.195{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.eca33a5c6c5002d82021-12-21 11:35:23.195root 11241100x8000000000000000543513Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:23.195{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1e700efc949d4d7c2021-12-21 11:35:23.195root 11241100x8000000000000000543514Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:23.195{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.821219fc6218cec62021-12-21 11:35:23.195root 11241100x8000000000000000543515Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:23.195{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.bd304198cc94c27b2021-12-21 11:35:23.195root 11241100x8000000000000000543516Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:23.195{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3c535d63cdcf2bfb2021-12-21 11:35:23.195root 11241100x8000000000000000543517Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:23.195{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.035c5a612d403c3a2021-12-21 11:35:23.195root 11241100x8000000000000000543518Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:23.195{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e82ce3d4456b7f962021-12-21 11:35:23.195root 11241100x8000000000000000543519Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:23.195{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9cc18422fe8d18502021-12-21 11:35:23.195root 11241100x8000000000000000543520Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:23.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0667067e64cda3a02021-12-21 11:35:23.693root 11241100x8000000000000000543521Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:23.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4fc4a444ebb432c02021-12-21 11:35:23.693root 11241100x8000000000000000543522Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:23.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.173ea31a1c9073af2021-12-21 11:35:23.693root 11241100x8000000000000000543523Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:23.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3f1135e58eac32932021-12-21 11:35:23.693root 11241100x8000000000000000543524Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:23.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.49ba8cde45e79e262021-12-21 11:35:23.693root 11241100x8000000000000000543525Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:23.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9bec8e803baa6a232021-12-21 11:35:23.694root 11241100x8000000000000000543526Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:23.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.00bd4df5914dc6002021-12-21 11:35:23.694root 11241100x8000000000000000543527Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:23.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0c187026c34823e82021-12-21 11:35:23.694root 11241100x8000000000000000543528Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:23.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d373ec57e8c292e92021-12-21 11:35:23.694root 11241100x8000000000000000543529Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:23.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.950d7fc4e564357a2021-12-21 11:35:23.694root 11241100x8000000000000000543530Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:23.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.23ccce2b4d38d9b32021-12-21 11:35:23.694root 11241100x8000000000000000543531Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:23.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f8a1871ac3a472e22021-12-21 11:35:23.694root 11241100x8000000000000000543532Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:23.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.21a9ea8f2d427d5b2021-12-21 11:35:23.694root 11241100x8000000000000000543533Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:23.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b55011437fb34ce52021-12-21 11:35:23.694root 11241100x8000000000000000543534Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:23.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e549842debc5e2b52021-12-21 11:35:23.694root 11241100x8000000000000000543535Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:23.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2e9aefff6682b4762021-12-21 11:35:23.694root 11241100x8000000000000000543536Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:23.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.dcd1109fdfb1836c2021-12-21 11:35:23.694root 11241100x8000000000000000543537Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:23.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.fe51d8579b9bd5552021-12-21 11:35:23.694root 11241100x8000000000000000543538Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:23.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7704826ded2093e62021-12-21 11:35:23.694root 11241100x8000000000000000543539Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:23.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.277eabb7349b94a32021-12-21 11:35:23.694root 11241100x8000000000000000543540Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:23.695{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.98185c40e9fc06132021-12-21 11:35:23.695root 11241100x8000000000000000543541Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:23.695{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9c1f47828940cfcd2021-12-21 11:35:23.695root 154100x8000000000000000543542Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:24.012{ec2b6afe-bbfc-61c1-6814-cb7915560000}9892/bin/ps-----ps -e -o pid,ppid,state,command/var/snap/amazon-ssm-agent/4046root{ec2b6afe-0000-0000-0000-000000000000}04294967295no level-{00000000-0000-0000-0000-000000000000}2319--- 11241100x8000000000000000543543Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:24.014{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f720abb3fa3af9b82021-12-21 11:35:24.014root 11241100x8000000000000000543544Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:24.014{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.687d949a826a2d0c2021-12-21 11:35:24.014root 11241100x8000000000000000543545Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:24.015{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5475ad3c7b2d5e382021-12-21 11:35:24.015root 11241100x8000000000000000543546Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:24.015{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c7e9744979dc5d412021-12-21 11:35:24.015root 11241100x8000000000000000543547Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:24.015{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.40cdf992693f10322021-12-21 11:35:24.015root 11241100x8000000000000000543548Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:24.015{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0c61402d07152c5d2021-12-21 11:35:24.015root 11241100x8000000000000000543549Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:24.015{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0842f1b450a2e9d62021-12-21 11:35:24.015root 11241100x8000000000000000543550Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:24.015{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ca6fb5fef78fb3952021-12-21 11:35:24.015root 11241100x8000000000000000543551Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:24.015{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5439705c173f0f942021-12-21 11:35:24.015root 11241100x8000000000000000543552Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:24.016{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.526c62c233deb7d42021-12-21 11:35:24.016root 11241100x8000000000000000543553Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:24.016{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.554ff59dd6a97a9b2021-12-21 11:35:24.016root 11241100x8000000000000000543554Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:24.016{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.fcd2c8c4c6501e2f2021-12-21 11:35:24.016root 11241100x8000000000000000543555Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:24.016{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.84945a2a08d916af2021-12-21 11:35:24.016root 11241100x8000000000000000543556Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:24.016{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1d206eba7bdce07a2021-12-21 11:35:24.016root 11241100x8000000000000000543557Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:24.016{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a12a68e4d678b0622021-12-21 11:35:24.016root 11241100x8000000000000000543558Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:24.016{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c3692ffffff65e9d2021-12-21 11:35:24.016root 11241100x8000000000000000543559Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:24.016{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e5a5380d6203d0592021-12-21 11:35:24.016root 11241100x8000000000000000543560Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:24.017{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.94dd257590ddf68a2021-12-21 11:35:24.017root 11241100x8000000000000000543561Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:24.017{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6837409dc0c502d12021-12-21 11:35:24.017root 11241100x8000000000000000543562Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:24.017{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.cd32d0831bb60a002021-12-21 11:35:24.017root 11241100x8000000000000000543563Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:24.017{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6ea7729d2ea287442021-12-21 11:35:24.017root 11241100x8000000000000000543564Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:24.017{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c365f1d0d42f65122021-12-21 11:35:24.017root 11241100x8000000000000000543565Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:24.017{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a9dcdf902e9e288a2021-12-21 11:35:24.017root 534500x8000000000000000543566Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:24.034{ec2b6afe-bbfc-61c1-6814-cb7915560000}9892/bin/psroot 11241100x8000000000000000543567Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:24.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.60a9bbefbcba0ac02021-12-21 11:35:24.443root 11241100x8000000000000000543568Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:24.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9d68618fc305ad502021-12-21 11:35:24.443root 11241100x8000000000000000543569Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:24.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2588ba99c00f52a92021-12-21 11:35:24.443root 11241100x8000000000000000543570Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:24.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.45089be6639796b02021-12-21 11:35:24.443root 11241100x8000000000000000543571Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:24.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5ee85e32757f75082021-12-21 11:35:24.443root 11241100x8000000000000000543572Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:24.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ab56256fc0537b1c2021-12-21 11:35:24.443root 11241100x8000000000000000543573Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:24.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3aec37972dee04a52021-12-21 11:35:24.443root 11241100x8000000000000000543574Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:24.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.bfdeda23a5d26b672021-12-21 11:35:24.444root 11241100x8000000000000000543575Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:24.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a7ca276cedf53b162021-12-21 11:35:24.444root 11241100x8000000000000000543576Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:24.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ee78735503dc47d52021-12-21 11:35:24.444root 11241100x8000000000000000543577Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:24.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8761444ca72a14652021-12-21 11:35:24.444root 11241100x8000000000000000543578Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:24.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.498cb47eb0ea692d2021-12-21 11:35:24.444root 11241100x8000000000000000543579Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:24.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e436a1aa4f1dcf332021-12-21 11:35:24.444root 11241100x8000000000000000543580Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:24.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8ecb228cae8d05dc2021-12-21 11:35:24.445root 11241100x8000000000000000543581Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:24.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2bfcc1ec9a7ff0862021-12-21 11:35:24.445root 11241100x8000000000000000543582Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:24.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6829061717d91de72021-12-21 11:35:24.445root 11241100x8000000000000000543583Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:24.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c9e355652a999ca32021-12-21 11:35:24.445root 11241100x8000000000000000543584Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:24.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.25b86a19214219c12021-12-21 11:35:24.445root 11241100x8000000000000000543585Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:24.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.29c960cd0aa56c182021-12-21 11:35:24.445root 11241100x8000000000000000543586Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:24.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a529bb8ba8e3dd562021-12-21 11:35:24.445root 11241100x8000000000000000543587Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:24.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.110380df5ccea4482021-12-21 11:35:24.445root 11241100x8000000000000000543588Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:24.446{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.51797f9b9820c3d62021-12-21 11:35:24.446root 11241100x8000000000000000543589Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:24.446{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ae8a17b81d92db052021-12-21 11:35:24.446root 11241100x8000000000000000543590Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:24.447{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b300426b2c790b742021-12-21 11:35:24.447root 11241100x8000000000000000543591Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:24.447{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e7e2603fc667ae402021-12-21 11:35:24.447root 11241100x8000000000000000543592Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:24.447{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7841cd475e25eebc2021-12-21 11:35:24.447root 11241100x8000000000000000543593Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:24.447{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1a6a1e22ad9d62992021-12-21 11:35:24.447root 11241100x8000000000000000543594Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:24.447{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0e46b4087a3b21dd2021-12-21 11:35:24.447root 11241100x8000000000000000543595Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:24.447{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.48a9860b12f71c622021-12-21 11:35:24.447root 11241100x8000000000000000543596Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:24.447{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.abb15b01084434552021-12-21 11:35:24.447root 11241100x8000000000000000543597Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:24.447{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.eb8144f9ad887c202021-12-21 11:35:24.447root 11241100x8000000000000000543598Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:24.447{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.65020901232259852021-12-21 11:35:24.447root 11241100x8000000000000000543599Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:24.447{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.45a78b1ee901acef2021-12-21 11:35:24.447root 11241100x8000000000000000543600Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:24.447{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1e47ab30249230b02021-12-21 11:35:24.447root 11241100x8000000000000000543601Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:24.447{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0c5ee141549a55722021-12-21 11:35:24.447root 11241100x8000000000000000543602Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:24.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6df3e5253f451ef02021-12-21 11:35:24.943root 11241100x8000000000000000543603Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:24.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.bc12e55af1aed8772021-12-21 11:35:24.943root 11241100x8000000000000000543604Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:24.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.fb6f6a2d4dede12d2021-12-21 11:35:24.943root 11241100x8000000000000000543605Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:24.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e0896cf9bc905af72021-12-21 11:35:24.943root 11241100x8000000000000000543606Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:24.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.debebbad1fec4db32021-12-21 11:35:24.943root 11241100x8000000000000000543607Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:24.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d7d5aef304cc4f9b2021-12-21 11:35:24.944root 11241100x8000000000000000543608Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:24.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.cf7cb353e721a4f42021-12-21 11:35:24.944root 11241100x8000000000000000543609Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:24.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3a945165b994504a2021-12-21 11:35:24.944root 11241100x8000000000000000543610Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:24.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.182d24f8e623c25d2021-12-21 11:35:24.944root 11241100x8000000000000000543611Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:24.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.31b721205da8ccfe2021-12-21 11:35:24.944root 11241100x8000000000000000543612Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:24.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d201c8152a131e0b2021-12-21 11:35:24.944root 11241100x8000000000000000543613Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:24.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a71a54736a00ba372021-12-21 11:35:24.944root 11241100x8000000000000000543614Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:24.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.65de564b51983d4d2021-12-21 11:35:24.944root 11241100x8000000000000000543615Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:24.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0702f26d6f752c062021-12-21 11:35:24.944root 11241100x8000000000000000543616Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:24.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3eef81f5d411fef62021-12-21 11:35:24.944root 11241100x8000000000000000543617Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:24.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.07c9c8e70b9efe622021-12-21 11:35:24.944root 11241100x8000000000000000543618Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:24.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a462f3734ee1c8db2021-12-21 11:35:24.944root 11241100x8000000000000000543619Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:24.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0740b145c599b8312021-12-21 11:35:24.944root 11241100x8000000000000000543620Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:24.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0bf4643a887c009e2021-12-21 11:35:24.945root 11241100x8000000000000000543621Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:24.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.bca8925020e434682021-12-21 11:35:24.945root 11241100x8000000000000000543622Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:24.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.75cfd6f708ad91552021-12-21 11:35:24.945root 11241100x8000000000000000543623Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:24.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a80e04c329f3887f2021-12-21 11:35:24.945root 11241100x8000000000000000543624Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:24.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.98aafca7a1db250f2021-12-21 11:35:24.945root 11241100x8000000000000000543625Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:24.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.dd3d26785a68865b2021-12-21 11:35:24.945root 11241100x8000000000000000543626Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:24.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e0c81308f42d0cfa2021-12-21 11:35:24.945root 11241100x8000000000000000543627Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:25.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d4b7b6791ad09d362021-12-21 11:35:25.443root 11241100x8000000000000000543628Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:25.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6be4632041a204592021-12-21 11:35:25.443root 11241100x8000000000000000543629Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:25.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4c93df35e4c5651e2021-12-21 11:35:25.443root 11241100x8000000000000000543630Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:25.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d9ce6d65dce691cc2021-12-21 11:35:25.443root 11241100x8000000000000000543631Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:25.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.444cf82dbf4430f82021-12-21 11:35:25.444root 11241100x8000000000000000543632Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:25.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.763c610570b68d202021-12-21 11:35:25.444root 11241100x8000000000000000543633Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:25.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a2d84401f954c8ca2021-12-21 11:35:25.444root 11241100x8000000000000000543634Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:25.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.56c75acc312801582021-12-21 11:35:25.444root 11241100x8000000000000000543635Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:25.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.96c0213f5c9116092021-12-21 11:35:25.444root 11241100x8000000000000000543636Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:25.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.eae54ce3b72129672021-12-21 11:35:25.444root 11241100x8000000000000000543637Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:25.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1fad669efe1b3fef2021-12-21 11:35:25.444root 11241100x8000000000000000543638Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:25.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.22c9dbfe5b98e97b2021-12-21 11:35:25.444root 11241100x8000000000000000543639Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:25.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e1eeded9f296127c2021-12-21 11:35:25.444root 11241100x8000000000000000543640Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:25.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.41641ac81e4e7bd72021-12-21 11:35:25.444root 11241100x8000000000000000543641Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:25.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4b174b169c52d88f2021-12-21 11:35:25.445root 11241100x8000000000000000543642Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:25.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7c6654a81d5338b72021-12-21 11:35:25.445root 11241100x8000000000000000543643Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:25.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d02008de6c209bc32021-12-21 11:35:25.445root 11241100x8000000000000000543644Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:25.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b6e5969824fe40d82021-12-21 11:35:25.445root 11241100x8000000000000000543645Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:25.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a52bcc56b0f6216a2021-12-21 11:35:25.445root 11241100x8000000000000000543646Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:25.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ffb92a615da8247e2021-12-21 11:35:25.445root 11241100x8000000000000000543647Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:25.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.590e37b90af3dd2b2021-12-21 11:35:25.445root 11241100x8000000000000000543648Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:25.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.cf8c21f91b3a1e032021-12-21 11:35:25.445root 11241100x8000000000000000543649Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:25.446{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4ef525ad14b2b6f82021-12-21 11:35:25.446root 11241100x8000000000000000543650Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:25.446{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0a97bbb77230d05b2021-12-21 11:35:25.446root 354300x8000000000000000543651Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:25.502{ec2b6afe-95d2-61c1-3038-b84203560000}5272/opt/splunkforwarder/bin/splunkdroottcptruefalse10.0.1.25-35828-false10.0.1.12-8089- 11241100x8000000000000000543652Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:25.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2c4d5872ca7d32c02021-12-21 11:35:25.943root 11241100x8000000000000000543653Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:25.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f35cf9fd4f64afb02021-12-21 11:35:25.943root 11241100x8000000000000000543654Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:25.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.baa00957963abf7f2021-12-21 11:35:25.943root 11241100x8000000000000000543655Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:25.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6ec40cec8920fdc02021-12-21 11:35:25.943root 11241100x8000000000000000543656Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:25.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.81ba48d1535f4bca2021-12-21 11:35:25.943root 11241100x8000000000000000543657Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:25.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.057adbd49b44d30c2021-12-21 11:35:25.944root 11241100x8000000000000000543658Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:25.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b7bbd2899972c9552021-12-21 11:35:25.944root 11241100x8000000000000000543659Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:25.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b616fdad90ae55d32021-12-21 11:35:25.944root 11241100x8000000000000000543660Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:25.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.529ab86489ca9fe62021-12-21 11:35:25.944root 11241100x8000000000000000543661Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:25.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.39669f9ff03e0ad92021-12-21 11:35:25.944root 11241100x8000000000000000543662Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:25.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.752a4d07241422e72021-12-21 11:35:25.944root 11241100x8000000000000000543663Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:25.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.04e479f9c35b6d812021-12-21 11:35:25.944root 11241100x8000000000000000543664Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:25.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.204885fe37b801ca2021-12-21 11:35:25.944root 11241100x8000000000000000543665Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:25.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8bde11f98036bcbc2021-12-21 11:35:25.944root 11241100x8000000000000000543666Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:25.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6b994b3233a99e512021-12-21 11:35:25.944root 11241100x8000000000000000543667Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:25.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.fd67026e4844fe912021-12-21 11:35:25.944root 11241100x8000000000000000543668Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:25.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.367d501505e511f72021-12-21 11:35:25.944root 11241100x8000000000000000543669Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:25.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2383dbc30e2e77e72021-12-21 11:35:25.944root 11241100x8000000000000000543670Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:25.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.44f8faa60f951e392021-12-21 11:35:25.944root 11241100x8000000000000000543671Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:25.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.68696a8e0e65a0a92021-12-21 11:35:25.944root 11241100x8000000000000000543672Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:25.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5298f24590880d5f2021-12-21 11:35:25.944root 11241100x8000000000000000543673Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:25.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b5f8a2c6edfc9aaf2021-12-21 11:35:25.945root 11241100x8000000000000000543674Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:25.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4f4d17c0d509c8b12021-12-21 11:35:25.945root 11241100x8000000000000000543675Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:25.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c31cc8a2db70de932021-12-21 11:35:25.945root 11241100x8000000000000000543676Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:25.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6da8c3296a46c8aa2021-12-21 11:35:25.945root 11241100x8000000000000000543677Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:25.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c115efc51ac4178b2021-12-21 11:35:25.945root 11241100x8000000000000000543678Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:25.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.94b4fcf6a84784612021-12-21 11:35:25.945root 11241100x8000000000000000543679Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:25.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f7a8b41849dd2b782021-12-21 11:35:25.945root 11241100x8000000000000000543680Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:25.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b80e83d795fcb5642021-12-21 11:35:25.945root 11241100x8000000000000000543681Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:25.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d404dc17681c8fed2021-12-21 11:35:25.945root 11241100x8000000000000000543682Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:25.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.476855b70b97240b2021-12-21 11:35:25.945root 11241100x8000000000000000543683Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:26.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c2a802bfc88b1dfb2021-12-21 11:35:26.443root 11241100x8000000000000000543684Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:26.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d8558ad82ccad2882021-12-21 11:35:26.443root 11241100x8000000000000000543685Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:26.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f7b08ea58f9ee42b2021-12-21 11:35:26.443root 11241100x8000000000000000543686Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:26.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b5ea27f1504830642021-12-21 11:35:26.443root 11241100x8000000000000000543687Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:26.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e7a3f0e30989ca582021-12-21 11:35:26.443root 11241100x8000000000000000543688Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:26.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.dca0ae2d4881a0ce2021-12-21 11:35:26.443root 11241100x8000000000000000543689Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:26.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.aeddd3ef0c046a092021-12-21 11:35:26.443root 11241100x8000000000000000543690Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:26.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f4592d2d31ca396f2021-12-21 11:35:26.443root 11241100x8000000000000000543691Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:26.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.58217ef35c0bb13c2021-12-21 11:35:26.443root 11241100x8000000000000000543692Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:26.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d63367bcd9b5bcc42021-12-21 11:35:26.443root 11241100x8000000000000000543693Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:26.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.899932516394cef02021-12-21 11:35:26.443root 11241100x8000000000000000543694Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:26.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b6923ee8938a27112021-12-21 11:35:26.443root 11241100x8000000000000000543695Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:26.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7ae7b579b776e4f12021-12-21 11:35:26.443root 11241100x8000000000000000543696Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:26.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.45dd5777bf3b02432021-12-21 11:35:26.444root 11241100x8000000000000000543697Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:26.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f54b7ae9a7a1e2002021-12-21 11:35:26.444root 11241100x8000000000000000543698Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:26.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.34070a6982a9f4ed2021-12-21 11:35:26.444root 11241100x8000000000000000543699Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:26.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.afd1234ba90188a82021-12-21 11:35:26.444root 11241100x8000000000000000543700Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:26.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1d5a8a3626e0c5062021-12-21 11:35:26.444root 11241100x8000000000000000543701Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:26.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.188ac3af56bafa9e2021-12-21 11:35:26.444root 11241100x8000000000000000543702Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:26.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.94e497d2b8891cde2021-12-21 11:35:26.444root 11241100x8000000000000000543703Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:26.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.aed225abdf26197b2021-12-21 11:35:26.444root 11241100x8000000000000000543704Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:26.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.20ca74928ff321b12021-12-21 11:35:26.444root 11241100x8000000000000000543705Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:26.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.61c28746f34da36a2021-12-21 11:35:26.444root 11241100x8000000000000000543706Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:26.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.fd0a2a8d4e653cb72021-12-21 11:35:26.444root 11241100x8000000000000000543707Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:26.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.862a6dbb754b89682021-12-21 11:35:26.444root 11241100x8000000000000000543708Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:26.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0a787cebe3b650ae2021-12-21 11:35:26.444root 11241100x8000000000000000543709Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:26.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.71cb79612539e08d2021-12-21 11:35:26.444root 11241100x8000000000000000543710Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:26.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4b1eedea129eb3c02021-12-21 11:35:26.444root 11241100x8000000000000000543711Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:26.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.64ad996c198d51522021-12-21 11:35:26.444root 11241100x8000000000000000543712Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:26.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c3e20a3d2f216fbb2021-12-21 11:35:26.943root 11241100x8000000000000000543713Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:26.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.62ce078a69c81d232021-12-21 11:35:26.943root 11241100x8000000000000000543714Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:26.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0e303bbd3422503c2021-12-21 11:35:26.943root 11241100x8000000000000000543715Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:26.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.dea2e2582c80286b2021-12-21 11:35:26.943root 11241100x8000000000000000543716Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:26.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e4452e679ae6ab5d2021-12-21 11:35:26.944root 11241100x8000000000000000543717Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:26.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.97f3c8dfbafd52c62021-12-21 11:35:26.944root 11241100x8000000000000000543718Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:26.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7e1f918298b3f5902021-12-21 11:35:26.944root 11241100x8000000000000000543719Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:26.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e160f3541569efb82021-12-21 11:35:26.944root 11241100x8000000000000000543720Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:26.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6fe37ae71676817e2021-12-21 11:35:26.944root 11241100x8000000000000000543721Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:26.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7afb2fbaff3bd2692021-12-21 11:35:26.944root 11241100x8000000000000000543722Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:26.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4bf37e86590f775b2021-12-21 11:35:26.944root 11241100x8000000000000000543723Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:26.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c57d16950c716c092021-12-21 11:35:26.944root 11241100x8000000000000000543724Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:26.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a81dbfac499fbbc62021-12-21 11:35:26.944root 11241100x8000000000000000543725Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:26.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.18ca5e2055995bf72021-12-21 11:35:26.944root 11241100x8000000000000000543726Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:26.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.794e3d8e08b0177d2021-12-21 11:35:26.944root 11241100x8000000000000000543727Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:26.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d9f863a071653bdd2021-12-21 11:35:26.944root 11241100x8000000000000000543728Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:26.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f623ebf47d0833362021-12-21 11:35:26.944root 11241100x8000000000000000543729Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:26.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9692c9cb8d32e0bc2021-12-21 11:35:26.944root 11241100x8000000000000000543730Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:26.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.62c41bbb7c6f68612021-12-21 11:35:26.944root 11241100x8000000000000000543731Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:26.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b5cf0d135b51312a2021-12-21 11:35:26.945root 11241100x8000000000000000543732Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:26.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c5d975e15e19fb4b2021-12-21 11:35:26.945root 11241100x8000000000000000543733Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:26.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1347224e88e7fde92021-12-21 11:35:26.945root 11241100x8000000000000000543734Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:26.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.829a2818c96c95722021-12-21 11:35:26.945root 11241100x8000000000000000543735Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:26.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4d01cc03b7ecfbfa2021-12-21 11:35:26.945root 11241100x8000000000000000543736Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:26.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.bc0755b8385481af2021-12-21 11:35:26.945root 11241100x8000000000000000543737Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:27.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b4c5cae3ed7dc3312021-12-21 11:35:27.443root 11241100x8000000000000000543738Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:27.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8cfdefe5b27d875b2021-12-21 11:35:27.443root 11241100x8000000000000000543739Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:27.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3bf0f673b71febdc2021-12-21 11:35:27.443root 11241100x8000000000000000543740Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:27.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.30fdfbffd540c7cc2021-12-21 11:35:27.443root 11241100x8000000000000000543741Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:27.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b5e331dab21d288c2021-12-21 11:35:27.444root 11241100x8000000000000000543742Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:27.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9bac7143788dc4f02021-12-21 11:35:27.444root 11241100x8000000000000000543743Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:27.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e3b229a7a96cf5ed2021-12-21 11:35:27.444root 11241100x8000000000000000543744Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:27.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d88de1b0134575692021-12-21 11:35:27.444root 11241100x8000000000000000543745Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:27.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f4f1baff97283ee32021-12-21 11:35:27.444root 11241100x8000000000000000543746Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:27.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7a733f87597cf8c22021-12-21 11:35:27.444root 11241100x8000000000000000543747Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:27.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2d854c66ae9e8df12021-12-21 11:35:27.444root 11241100x8000000000000000543748Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:27.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.89a95a864f30d6572021-12-21 11:35:27.445root 11241100x8000000000000000543749Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:27.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.60c79571495d46222021-12-21 11:35:27.445root 11241100x8000000000000000543750Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:27.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e5c8b1f9e849818e2021-12-21 11:35:27.445root 11241100x8000000000000000543751Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:27.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.fc67b490ec98f1982021-12-21 11:35:27.445root 11241100x8000000000000000543752Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:27.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d134ced3f98b07402021-12-21 11:35:27.445root 11241100x8000000000000000543753Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:27.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.dcb0cc291c17f3f12021-12-21 11:35:27.445root 11241100x8000000000000000543754Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:27.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7d7a27276ef22caa2021-12-21 11:35:27.445root 11241100x8000000000000000543755Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:27.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3bec48a761fdcf332021-12-21 11:35:27.445root 11241100x8000000000000000543756Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:27.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.cc7daf2b4b3f5e092021-12-21 11:35:27.445root 11241100x8000000000000000543757Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:27.446{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4b212af15f7881ae2021-12-21 11:35:27.446root 11241100x8000000000000000543758Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:27.446{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.688b4bdbabc5dc552021-12-21 11:35:27.446root 11241100x8000000000000000543759Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:27.446{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.369e6164b373ce082021-12-21 11:35:27.446root 11241100x8000000000000000543760Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:27.446{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.996348759e9407862021-12-21 11:35:27.446root 11241100x8000000000000000543761Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:27.446{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.089b89934c9f4b202021-12-21 11:35:27.446root 11241100x8000000000000000543762Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:27.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.836316a30f445e9e2021-12-21 11:35:27.943root 11241100x8000000000000000543763Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:27.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.29258193a3295cfe2021-12-21 11:35:27.943root 11241100x8000000000000000543764Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:27.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f353674f2cc750092021-12-21 11:35:27.943root 11241100x8000000000000000543765Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:27.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4d8ac7ae231be5f62021-12-21 11:35:27.943root 11241100x8000000000000000543766Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:27.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f61b86a7f57c82972021-12-21 11:35:27.943root 11241100x8000000000000000543767Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:27.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.85cb7d6ba596dfa22021-12-21 11:35:27.943root 11241100x8000000000000000543768Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:27.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8ffb568d732afdad2021-12-21 11:35:27.943root 11241100x8000000000000000543769Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:27.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2bea2e40ba828ac02021-12-21 11:35:27.943root 11241100x8000000000000000543770Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:27.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d1ba63144a703ec22021-12-21 11:35:27.943root 11241100x8000000000000000543771Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:27.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.bc575ad3ef8b8f582021-12-21 11:35:27.943root 11241100x8000000000000000543772Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:27.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.86c2f09bc8516c722021-12-21 11:35:27.943root 11241100x8000000000000000543773Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:27.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.05d3252559f0041c2021-12-21 11:35:27.943root 11241100x8000000000000000543774Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:27.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ec4b6387680d78922021-12-21 11:35:27.943root 11241100x8000000000000000543775Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:27.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6d9799c983b13e122021-12-21 11:35:27.944root 11241100x8000000000000000543776Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:27.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a0fbdb9a0b037b8a2021-12-21 11:35:27.944root 11241100x8000000000000000543777Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:27.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9eac3e0ffea921db2021-12-21 11:35:27.944root 11241100x8000000000000000543778Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:27.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a7c5346b5dd05ddc2021-12-21 11:35:27.944root 11241100x8000000000000000543779Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:27.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f037672ff646c8082021-12-21 11:35:27.944root 11241100x8000000000000000543780Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:27.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.53b8b6d9db0804db2021-12-21 11:35:27.944root 11241100x8000000000000000543781Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:27.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1bd193d6331a45f82021-12-21 11:35:27.944root 11241100x8000000000000000543782Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:27.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8141849ee73ddc892021-12-21 11:35:27.944root 11241100x8000000000000000543783Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:27.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.58402cdce3e57ec62021-12-21 11:35:27.944root 11241100x8000000000000000543784Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:27.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.542210518d9ff5032021-12-21 11:35:27.944root 11241100x8000000000000000543785Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:27.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f69e3132efdff1ff2021-12-21 11:35:27.944root 11241100x8000000000000000543786Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:27.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0b2b021bc76758552021-12-21 11:35:27.945root 11241100x8000000000000000543787Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:27.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3703c46e1667b4da2021-12-21 11:35:27.945root 11241100x8000000000000000543788Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:27.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f318c5e30f52e6412021-12-21 11:35:27.945root 11241100x8000000000000000543789Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:27.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ba1e72cdc5c4434d2021-12-21 11:35:27.945root 11241100x8000000000000000543790Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:27.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8e64236daa2e22e32021-12-21 11:35:27.945root 11241100x8000000000000000543791Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:27.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8b99d2cab39c83682021-12-21 11:35:27.945root 11241100x8000000000000000543792Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:27.946{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.467c54982783c2d32021-12-21 11:35:27.946root 11241100x8000000000000000543793Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:27.946{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.182fa6c18da86cd02021-12-21 11:35:27.946root 11241100x8000000000000000543794Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:27.946{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.cb7bc792095682ac2021-12-21 11:35:27.946root 11241100x8000000000000000543795Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:27.946{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8832190040031ff02021-12-21 11:35:27.946root 11241100x8000000000000000543796Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:27.946{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.784419f838a2ef832021-12-21 11:35:27.946root 11241100x8000000000000000543797Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:27.946{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.53ac9ae0c8fa0dc42021-12-21 11:35:27.946root 11241100x8000000000000000543798Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:27.946{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3d72cd96395379a72021-12-21 11:35:27.946root 11241100x8000000000000000543799Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:27.946{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8b1efd7dff1c0ffb2021-12-21 11:35:27.946root 11241100x8000000000000000543800Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:27.947{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9b73934b775202822021-12-21 11:35:27.947root 11241100x8000000000000000543801Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:27.947{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.460c249bb2269bf92021-12-21 11:35:27.947root 11241100x8000000000000000543802Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:27.947{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2f106e403d84023d2021-12-21 11:35:27.947root 11241100x8000000000000000543803Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:27.948{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.90f524a8c2297d8e2021-12-21 11:35:27.948root 11241100x8000000000000000543804Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:27.948{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.008e32f380e714d32021-12-21 11:35:27.948root 11241100x8000000000000000543805Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:27.948{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3e1a4661126defa42021-12-21 11:35:27.948root 11241100x8000000000000000543806Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:27.948{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.372663d9a7e80b802021-12-21 11:35:27.948root 11241100x8000000000000000543807Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:27.949{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.68f82a588d4373d02021-12-21 11:35:27.949root 11241100x8000000000000000543808Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:27.949{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.04a2d9b12e61cae72021-12-21 11:35:27.949root 11241100x8000000000000000543809Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:27.949{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e4fd57517c83175b2021-12-21 11:35:27.949root 11241100x8000000000000000543810Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:27.949{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.aa924cc7c7ba110f2021-12-21 11:35:27.949root 11241100x8000000000000000543811Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:27.949{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.34b3b80ed30399f42021-12-21 11:35:27.949root 11241100x8000000000000000543812Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:27.949{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a12c02df28b7df0f2021-12-21 11:35:27.949root 11241100x8000000000000000543813Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:27.949{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0c4fe6a2a141784a2021-12-21 11:35:27.949root 11241100x8000000000000000543814Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:27.949{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.39e75c60257ce2b92021-12-21 11:35:27.949root 11241100x8000000000000000543815Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:27.950{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.80687e1f3decd09a2021-12-21 11:35:27.950root 11241100x8000000000000000543816Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:27.950{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a43e0635db4bfcf42021-12-21 11:35:27.950root 11241100x8000000000000000543817Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:27.950{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.940bed580edb3a8e2021-12-21 11:35:27.950root 11241100x8000000000000000543818Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:27.950{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5b07882db3fc28e42021-12-21 11:35:27.950root 11241100x8000000000000000543819Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:27.950{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.02dd83c0b9ae2e092021-12-21 11:35:27.950root 11241100x8000000000000000543820Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:27.950{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2a7f2911ba447b052021-12-21 11:35:27.950root 11241100x8000000000000000543821Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:27.950{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.110ea0004f8c35f02021-12-21 11:35:27.950root 11241100x8000000000000000543822Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:27.950{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.beceb50bddb24f772021-12-21 11:35:27.950root 354300x8000000000000000543823Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:28.142{ec2b6afe-95d9-61c1-5175-3a0400000000}5346/opt/splunkforwarder/etc/apps/Splunk_TA_stream/linux_x86_64/bin/streamfwdroottcptruefalse10.0.1.25-48766-false10.0.1.12-8000- 11241100x8000000000000000543824Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:28.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.719cda4ad0958e842021-12-21 11:35:28.443root 11241100x8000000000000000543825Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:28.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.bd2e0e2aa90e55292021-12-21 11:35:28.443root 11241100x8000000000000000543826Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:28.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.29da397bc24567492021-12-21 11:35:28.443root 11241100x8000000000000000543827Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:28.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.cd8b0cf0d9e3ec0d2021-12-21 11:35:28.444root 11241100x8000000000000000543828Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:28.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7333e77be75f1d322021-12-21 11:35:28.444root 11241100x8000000000000000543829Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:28.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1d0c89493c9272de2021-12-21 11:35:28.444root 11241100x8000000000000000543830Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:28.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e91e6276a37e3c0a2021-12-21 11:35:28.444root 11241100x8000000000000000543831Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:28.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.09811d0ceb9ae1ae2021-12-21 11:35:28.444root 11241100x8000000000000000543832Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:28.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.681e05b3cb1034e42021-12-21 11:35:28.444root 11241100x8000000000000000543833Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:28.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.558c65e88317bc732021-12-21 11:35:28.444root 11241100x8000000000000000543834Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:28.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ee9ac2adc84c26b82021-12-21 11:35:28.444root 11241100x8000000000000000543835Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:28.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5b3e379c7bd6b6ee2021-12-21 11:35:28.444root 11241100x8000000000000000543836Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:28.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0145d57f1811c8672021-12-21 11:35:28.445root 11241100x8000000000000000543837Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:28.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.834fd359f3a81e702021-12-21 11:35:28.445root 11241100x8000000000000000543838Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:28.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f076a339111f869e2021-12-21 11:35:28.445root 11241100x8000000000000000543839Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:28.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f2a364d423b5cdda2021-12-21 11:35:28.445root 11241100x8000000000000000543840Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:28.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f6854c540e369bd42021-12-21 11:35:28.445root 11241100x8000000000000000543841Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:28.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9548c4150d63f8ca2021-12-21 11:35:28.445root 11241100x8000000000000000543842Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:28.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.40ebc4070ecfa0f32021-12-21 11:35:28.445root 11241100x8000000000000000543843Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:28.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7a9ce93972f3b2552021-12-21 11:35:28.445root 11241100x8000000000000000543844Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:28.446{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4c4213243742ffde2021-12-21 11:35:28.446root 11241100x8000000000000000543845Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:28.446{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2a6b96cf06ab71d72021-12-21 11:35:28.446root 11241100x8000000000000000543846Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:28.446{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.fd00d47bb05840002021-12-21 11:35:28.446root 11241100x8000000000000000543847Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:28.446{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.14eae2fc76e407822021-12-21 11:35:28.446root 11241100x8000000000000000543848Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:28.446{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.40fbabede5bc88272021-12-21 11:35:28.446root 11241100x8000000000000000543849Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:28.446{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.83a05f8b09eac8202021-12-21 11:35:28.446root 11241100x8000000000000000543850Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:28.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d6d6c88d44774ebc2021-12-21 11:35:28.943root 11241100x8000000000000000543851Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:28.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.94fe9f796541e08f2021-12-21 11:35:28.943root 11241100x8000000000000000543852Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:28.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4a24a93a57df2ed82021-12-21 11:35:28.943root 11241100x8000000000000000543853Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:28.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.63804c6044e1aba32021-12-21 11:35:28.944root 11241100x8000000000000000543854Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:28.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7ec8254b9a3cd8ec2021-12-21 11:35:28.944root 11241100x8000000000000000543855Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:28.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.cd0c10475864d7bc2021-12-21 11:35:28.944root 11241100x8000000000000000543856Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:28.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.77c6e11dea56909d2021-12-21 11:35:28.944root 11241100x8000000000000000543857Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:28.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.eda8ce3bc7b6bb352021-12-21 11:35:28.944root 11241100x8000000000000000543858Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:28.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3a5732e270e2edad2021-12-21 11:35:28.944root 11241100x8000000000000000543859Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:28.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.298a7c73e99cef082021-12-21 11:35:28.944root 11241100x8000000000000000543860Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:28.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5983564b523c0e3a2021-12-21 11:35:28.944root 11241100x8000000000000000543861Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:28.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c366fa6cc59aa2a02021-12-21 11:35:28.944root 11241100x8000000000000000543862Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:28.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5884920f6cd18eb52021-12-21 11:35:28.944root 11241100x8000000000000000543863Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:28.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.35e4c1cf637b578f2021-12-21 11:35:28.944root 11241100x8000000000000000543864Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:28.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6bc8744d8fbc09512021-12-21 11:35:28.944root 11241100x8000000000000000543865Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:28.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d7b5db03ffef590d2021-12-21 11:35:28.944root 11241100x8000000000000000543866Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:28.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8978c4fae97fbc542021-12-21 11:35:28.944root 11241100x8000000000000000543867Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:28.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4375b03a1ac634092021-12-21 11:35:28.944root 11241100x8000000000000000543868Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:28.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f08a40d5629d630c2021-12-21 11:35:28.945root 11241100x8000000000000000543869Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:28.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f2cf097146c6c7242021-12-21 11:35:28.945root 11241100x8000000000000000543870Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:28.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.facba5e4ab38dab72021-12-21 11:35:28.945root 11241100x8000000000000000543871Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:28.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3501249ca2d4ec1e2021-12-21 11:35:28.945root 11241100x8000000000000000543872Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:28.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c19d80ab03b0e6fb2021-12-21 11:35:28.945root 11241100x8000000000000000543873Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:28.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b715402bb2dd758c2021-12-21 11:35:28.945root 11241100x8000000000000000543874Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:28.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d62addf00760cffa2021-12-21 11:35:28.945root 11241100x8000000000000000543875Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:28.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.450b82bfcba79fae2021-12-21 11:35:28.945root 11241100x8000000000000000543876Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:28.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.bf9e6a9db46ed9e42021-12-21 11:35:28.945root 11241100x8000000000000000543877Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:29.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9e90a088264824022021-12-21 11:35:29.443root 11241100x8000000000000000543878Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:29.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.053c11d5eff95dd92021-12-21 11:35:29.443root 354300x8000000000000000543909Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:44.235{ec2b6afe-95d9-61c1-5175-3a0400000000}5346/opt/splunkforwarder/etc/apps/Splunk_TA_stream/linux_x86_64/bin/streamfwdroottcptruefalse10.0.1.25-48772-false10.0.1.12-8000- 11241100x8000000000000000543910Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:44.692{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7fbcec30446b61342021-12-21 11:35:44.692root 11241100x8000000000000000543911Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:45.192{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3326ffbd4c2951332021-12-21 11:35:45.192root 11241100x8000000000000000543912Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:45.692{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.217e2f47cfdebddf2021-12-21 11:35:45.692root 11241100x8000000000000000543913Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:46.192{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d7944ade50f0ffbc2021-12-21 11:35:46.192root 11241100x8000000000000000543914Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:46.692{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3bad310dcb4a23072021-12-21 11:35:46.692root 11241100x8000000000000000543915Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:47.192{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9a93cbe47ea6e3b82021-12-21 11:35:47.192root 11241100x8000000000000000543916Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:47.692{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.dbe2869d8c904c7a2021-12-21 11:35:47.692root 11241100x8000000000000000543917Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:48.192{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d08efe0a425e194f2021-12-21 11:35:48.192root 11241100x8000000000000000543918Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:48.692{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2e3df892452e84cb2021-12-21 11:35:48.692root 11241100x8000000000000000543919Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:49.192{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3cb3802f7f09e30f2021-12-21 11:35:49.192root 11241100x8000000000000000543920Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:49.692{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f1b35a48c85a04752021-12-21 11:35:49.692root 354300x8000000000000000543921Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:50.132{ec2b6afe-95d9-61c1-5175-3a0400000000}5346/opt/splunkforwarder/etc/apps/Splunk_TA_stream/linux_x86_64/bin/streamfwdroottcptruefalse10.0.1.25-48774-false10.0.1.12-8000- 11241100x8000000000000000543922Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:50.133{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c9d0c92a39f35c7d2021-12-21 11:35:50.133root 11241100x8000000000000000543923Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:50.442{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f9dbf7cd729d74c52021-12-21 11:35:50.442root 11241100x8000000000000000543924Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:50.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.de93d9835764daa92021-12-21 11:35:50.443root 11241100x8000000000000000543925Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:50.942{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7cb1a2e20bc7ecb02021-12-21 11:35:50.942root 11241100x8000000000000000543926Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:50.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ffce95c0382e25432021-12-21 11:35:50.943root 11241100x8000000000000000543927Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:51.442{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.23d1f3b104ffc9842021-12-21 11:35:51.442root 11241100x8000000000000000543928Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:51.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c9298cd3cc588d222021-12-21 11:35:51.443root 11241100x8000000000000000543929Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:51.942{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.558d8f0de129b7f82021-12-21 11:35:51.942root 11241100x8000000000000000543930Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:51.942{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6c6eb4fd5bd690932021-12-21 11:35:51.942root 11241100x8000000000000000543931Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:52.442{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8907363dad47c3022021-12-21 11:35:52.442root 11241100x8000000000000000543932Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:52.442{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2c0d308508f100212021-12-21 11:35:52.442root 11241100x8000000000000000543933Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:52.942{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.fecfbd78ca45b32c2021-12-21 11:35:52.942root 11241100x8000000000000000543934Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:52.942{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.40f127e8656c8e612021-12-21 11:35:52.942root 11241100x8000000000000000543935Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:53.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0be43f8766af20072021-12-21 11:35:53.443root 11241100x8000000000000000543936Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:53.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0cb8d8e2da1a82e42021-12-21 11:35:53.443root 11241100x8000000000000000543937Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:53.942{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1c58891d3be255112021-12-21 11:35:53.942root 11241100x8000000000000000543938Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:53.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ac39f2c2a4481fe52021-12-21 11:35:53.943root 11241100x8000000000000000543939Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:54.442{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2da104e878c7ab182021-12-21 11:35:54.442root 11241100x8000000000000000543940Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:54.442{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1deb06402ecb68112021-12-21 11:35:54.442root 11241100x8000000000000000543941Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:54.942{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.14a17dc8a109030c2021-12-21 11:35:54.942root 11241100x8000000000000000543942Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:54.942{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.23cf88c43c22c44c2021-12-21 11:35:54.942root 11241100x8000000000000000543943Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:55.442{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f089beddb3b43ce32021-12-21 11:35:55.442root 11241100x8000000000000000543944Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:55.442{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.89227a3785880c562021-12-21 11:35:55.442root 11241100x8000000000000000543945Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:55.942{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9758113204af9be02021-12-21 11:35:55.942root 11241100x8000000000000000543946Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:55.942{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.36080a9232f4b1ff2021-12-21 11:35:55.942root 354300x8000000000000000543947Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:56.107{ec2b6afe-95d9-61c1-5175-3a0400000000}5346/opt/splunkforwarder/etc/apps/Splunk_TA_stream/linux_x86_64/bin/streamfwdroottcptruefalse10.0.1.25-48776-false10.0.1.12-8000- 11241100x8000000000000000543948Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:56.442{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.479fc57f2087d91b2021-12-21 11:35:56.442root 11241100x8000000000000000543949Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:56.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.257e27f86a33732f2021-12-21 11:35:56.443root 11241100x8000000000000000543950Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:56.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f4615d78e97ad5f72021-12-21 11:35:56.443root 11241100x8000000000000000543951Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:56.942{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0dbe4ef9440f75a82021-12-21 11:35:56.942root 11241100x8000000000000000543952Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:56.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.caaae4d4f2d80be62021-12-21 11:35:56.943root 11241100x8000000000000000543953Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:56.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.289a856395c4378c2021-12-21 11:35:56.943root 11241100x8000000000000000543954Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:57.442{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.33b9c7782084b6f32021-12-21 11:35:57.442root 11241100x8000000000000000543955Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:57.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.cef75b18e18487da2021-12-21 11:35:57.443root 11241100x8000000000000000543956Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:57.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0b1aa3e44714681f2021-12-21 11:35:57.443root 11241100x8000000000000000543957Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:57.942{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.907c594640eef5d82021-12-21 11:35:57.942root 11241100x8000000000000000543958Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:57.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7b3d7d2e84ca75602021-12-21 11:35:57.943root 11241100x8000000000000000543959Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:57.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5774f8b5c19efbf32021-12-21 11:35:57.943root 11241100x8000000000000000543960Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:58.442{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.307f6e406f5caa512021-12-21 11:35:58.442root 11241100x8000000000000000543961Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:58.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b2fef68aa74fea052021-12-21 11:35:58.443root 11241100x8000000000000000543962Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:58.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9250368f44c65ee02021-12-21 11:35:58.443root 11241100x8000000000000000543963Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:58.942{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e8f7582a502442f22021-12-21 11:35:58.942root 11241100x8000000000000000543964Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:58.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.01f5781e9c9aab382021-12-21 11:35:58.943root 11241100x8000000000000000543965Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:58.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c08230b7785bf59e2021-12-21 11:35:58.943root 11241100x8000000000000000543966Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:59.442{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9f1171c2c8d65f9b2021-12-21 11:35:59.442root 11241100x8000000000000000543967Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:59.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.076b0219d7fcfc9e2021-12-21 11:35:59.443root 11241100x8000000000000000543968Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:59.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.17480d535f4e379b2021-12-21 11:35:59.443root 11241100x8000000000000000543969Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:59.942{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.057a82bb52d25e892021-12-21 11:35:59.942root 11241100x8000000000000000543970Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:59.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a68950d477370c592021-12-21 11:35:59.943root 11241100x8000000000000000543971Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:35:59.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a467c189ef8094e32021-12-21 11:35:59.943root 11241100x8000000000000000543972Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:00.442{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c6d353de16240d242021-12-21 11:36:00.442root 11241100x8000000000000000543973Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:00.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.bc97126899c13f972021-12-21 11:36:00.443root 11241100x8000000000000000543974Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:00.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.cd4651c3de435ccb2021-12-21 11:36:00.443root 11241100x8000000000000000543975Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:00.942{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.99c19f5853c018a92021-12-21 11:36:00.942root 11241100x8000000000000000543976Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:00.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b01807bedc5559392021-12-21 11:36:00.943root 11241100x8000000000000000543977Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:00.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.39467f991713117b2021-12-21 11:36:00.943root 354300x8000000000000000543978Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:01.150{ec2b6afe-95d9-61c1-5175-3a0400000000}5346/opt/splunkforwarder/etc/apps/Splunk_TA_stream/linux_x86_64/bin/streamfwdroottcptruefalse10.0.1.25-48778-false10.0.1.12-8000- 11241100x8000000000000000543979Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:01.442{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.363eb0615613c94f2021-12-21 11:36:01.442root 11241100x8000000000000000543980Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:01.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c1fd3f9ba2ca1ded2021-12-21 11:36:01.443root 11241100x8000000000000000543981Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:01.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b2c6a19177508a642021-12-21 11:36:01.443root 11241100x8000000000000000543982Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:01.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5901ce11cd00a08e2021-12-21 11:36:01.443root 11241100x8000000000000000543983Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:01.942{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.92e80741338e07812021-12-21 11:36:01.942root 11241100x8000000000000000543984Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:01.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.326c5ff9af8c6a862021-12-21 11:36:01.943root 11241100x8000000000000000543985Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:01.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6fcdafb8eaaa86e32021-12-21 11:36:01.943root 11241100x8000000000000000543986Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:01.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6eb0e1daf5fcffbe2021-12-21 11:36:01.943root 11241100x8000000000000000543987Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:02.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2c31ec3c83b1b1592021-12-21 11:36:02.443root 11241100x8000000000000000543988Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:02.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1c97a37c59316bfd2021-12-21 11:36:02.443root 11241100x8000000000000000543989Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:02.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f7a466896fc9b2c72021-12-21 11:36:02.443root 11241100x8000000000000000543990Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:02.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2956489d74aaa8342021-12-21 11:36:02.443root 11241100x8000000000000000543991Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:02.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a885c708b23810862021-12-21 11:36:02.943root 11241100x8000000000000000543992Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:02.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ca5f7abdbfc651f32021-12-21 11:36:02.943root 11241100x8000000000000000543993Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:02.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.40deb305ba089f2a2021-12-21 11:36:02.943root 11241100x8000000000000000543994Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:02.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.358c0c03a8e014eb2021-12-21 11:36:02.943root 11241100x8000000000000000543995Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:03.442{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8711a22c831c6fff2021-12-21 11:36:03.442root 11241100x8000000000000000543996Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:03.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.148cc6e2c80b8c922021-12-21 11:36:03.443root 11241100x8000000000000000543997Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:03.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c0131dd6967acb822021-12-21 11:36:03.443root 11241100x8000000000000000543998Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:03.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.31c3123ba3a2eabb2021-12-21 11:36:03.443root 11241100x8000000000000000543999Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:03.942{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.bfc3eb836a43ede42021-12-21 11:36:03.942root 11241100x8000000000000000544000Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:03.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a7afd56056a691652021-12-21 11:36:03.943root 11241100x8000000000000000544001Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:03.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6ea94ba12cee68742021-12-21 11:36:03.943root 11241100x8000000000000000544002Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:03.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2370dfe4d8a388b62021-12-21 11:36:03.943root 11241100x8000000000000000544003Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:04.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8f59533cdc2944632021-12-21 11:36:04.443root 11241100x8000000000000000544004Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:04.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.970265a0753e41542021-12-21 11:36:04.443root 11241100x8000000000000000544005Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:04.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8591b8b892ba7ef52021-12-21 11:36:04.443root 11241100x8000000000000000544006Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:04.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3cce5e70cdcce4bb2021-12-21 11:36:04.443root 11241100x8000000000000000544007Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:04.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a4032479fcf440fe2021-12-21 11:36:04.943root 11241100x8000000000000000544008Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:04.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9e74e0ef94a70d022021-12-21 11:36:04.943root 11241100x8000000000000000544009Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:04.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9c4538c1fbb812ba2021-12-21 11:36:04.943root 11241100x8000000000000000544010Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:04.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.aa6d202f58510edb2021-12-21 11:36:04.943root 11241100x8000000000000000544011Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:05.442{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.cbf1b2f1bf4ab3222021-12-21 11:36:05.442root 11241100x8000000000000000544012Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:05.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7b7654115ca15eb12021-12-21 11:36:05.443root 11241100x8000000000000000544013Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:05.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0958cf98789a4de02021-12-21 11:36:05.443root 11241100x8000000000000000544014Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:05.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.24b512d01dfdc4492021-12-21 11:36:05.443root 11241100x8000000000000000544015Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:05.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a3e2cc4a10a62a582021-12-21 11:36:05.943root 11241100x8000000000000000544016Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:05.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ba41429f5ab9894b2021-12-21 11:36:05.943root 11241100x8000000000000000544017Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:05.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.29ff3f44658965b12021-12-21 11:36:05.943root 11241100x8000000000000000544018Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:05.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9e7bde469d511ca02021-12-21 11:36:05.943root 11241100x8000000000000000544019Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:06.325{ec2b6afe-95d2-61c1-3038-b84203560000}5272/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/spool/splunk/tracker.log2021-12-21 11:36:06.325root 11241100x8000000000000000544020Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:06.326{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.23313be4f7b2b5cb2021-12-21 11:36:06.326root 11241100x8000000000000000544021Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:06.326{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.466856680ae9f51f2021-12-21 11:36:06.326root 11241100x8000000000000000544022Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:06.326{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d2a520ebe2c1c25a2021-12-21 11:36:06.326root 11241100x8000000000000000544023Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:06.327{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.83fa7b0130b57f602021-12-21 11:36:06.327root 11241100x8000000000000000544024Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:06.327{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.cb50b1fce8d8f14c2021-12-21 11:36:06.327root 11241100x8000000000000000544025Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:06.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6e5b089665f436802021-12-21 11:36:06.693root 11241100x8000000000000000544026Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:06.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4494d550e87a53632021-12-21 11:36:06.693root 11241100x8000000000000000544027Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:06.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.caf99673bfa29d752021-12-21 11:36:06.693root 11241100x8000000000000000544028Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:06.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.bef1100030e191122021-12-21 11:36:06.693root 11241100x8000000000000000544029Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:06.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8de193c0d90309a42021-12-21 11:36:06.693root 354300x8000000000000000544030Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:07.101{ec2b6afe-95d9-61c1-5175-3a0400000000}5346/opt/splunkforwarder/etc/apps/Splunk_TA_stream/linux_x86_64/bin/streamfwdroottcptruefalse10.0.1.25-48780-false10.0.1.12-8000- 11241100x8000000000000000544031Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:07.101{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e5fe81783c926f202021-12-21 11:36:07.101root 11241100x8000000000000000544032Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:07.102{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d531cee73f403d342021-12-21 11:36:07.102root 11241100x8000000000000000544033Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:07.102{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9b4f276c0b4f8da32021-12-21 11:36:07.102root 11241100x8000000000000000544034Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:07.102{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.11da12a477bf18892021-12-21 11:36:07.102root 11241100x8000000000000000544035Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:07.103{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8f4889f347c37d262021-12-21 11:36:07.103root 11241100x8000000000000000544036Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:07.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.99cd2a691a6c321b2021-12-21 11:36:07.443root 11241100x8000000000000000544037Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:07.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1c7101ab96459a752021-12-21 11:36:07.443root 11241100x8000000000000000544038Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:07.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3db6694aa360fed22021-12-21 11:36:07.443root 11241100x8000000000000000544039Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:07.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.506809b6e95e14062021-12-21 11:36:07.443root 11241100x8000000000000000544040Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:07.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b6731f4f7a51214c2021-12-21 11:36:07.443root 11241100x8000000000000000544041Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:07.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7f5e1a802d5232a32021-12-21 11:36:07.443root 11241100x8000000000000000544042Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:07.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c2c289147c9ef8a02021-12-21 11:36:07.943root 11241100x8000000000000000544043Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:07.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.fdcb6b4fc179950a2021-12-21 11:36:07.943root 11241100x8000000000000000544044Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:07.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.fac002e3a9c04d362021-12-21 11:36:07.943root 11241100x8000000000000000544045Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:07.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1ff029ebc030febe2021-12-21 11:36:07.943root 11241100x8000000000000000544046Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:07.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.161abaa5ef7991e62021-12-21 11:36:07.943root 11241100x8000000000000000544047Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:07.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a568cd5351bd4ba42021-12-21 11:36:07.944root 11241100x8000000000000000544048Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:08.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.754000860e9607032021-12-21 11:36:08.443root 11241100x8000000000000000544049Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:08.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3a4b2ca24c10090c2021-12-21 11:36:08.443root 11241100x8000000000000000544050Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:08.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f3bcea0a2b30c3a72021-12-21 11:36:08.443root 11241100x8000000000000000544051Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:08.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f3473ae31f5051142021-12-21 11:36:08.443root 11241100x8000000000000000544052Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:08.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4f18f8aafb6a92f02021-12-21 11:36:08.443root 11241100x8000000000000000544053Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:08.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.fce2d55b0f722dbe2021-12-21 11:36:08.443root 11241100x8000000000000000544054Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:08.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c8b8a979d28998632021-12-21 11:36:08.943root 11241100x8000000000000000544055Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:08.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d4a398b12f3b38d92021-12-21 11:36:08.943root 11241100x8000000000000000544056Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:08.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8f7eeaff60b442d62021-12-21 11:36:08.943root 11241100x8000000000000000544057Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:08.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.af80cf7fda2dda522021-12-21 11:36:08.943root 11241100x8000000000000000544058Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:08.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.826da62d1ab1f3b42021-12-21 11:36:08.943root 11241100x8000000000000000544059Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:08.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.751cc323d00416c72021-12-21 11:36:08.943root 23542300x8000000000000000544060Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:09.327{ec2b6afe-95d2-61c1-3038-b84203560000}5272root/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/spool/splunk/tracker.log--- 11241100x8000000000000000544061Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:09.328{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1dece6e95f2587a72021-12-21 11:36:09.328root 11241100x8000000000000000544062Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:09.328{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.579b94ac95b010fb2021-12-21 11:36:09.328root 11241100x8000000000000000544063Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:09.328{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f360f55030a6eae22021-12-21 11:36:09.328root 11241100x8000000000000000544064Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:09.328{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b0911d62796e33952021-12-21 11:36:09.328root 11241100x8000000000000000544065Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:09.329{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3a0f7e39bae6d50c2021-12-21 11:36:09.329root 11241100x8000000000000000544066Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:09.329{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.59b18e3d09cbd9572021-12-21 11:36:09.329root 11241100x8000000000000000544067Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:09.329{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.fd9f59cfa2ae6ca22021-12-21 11:36:09.329root 11241100x8000000000000000544068Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:09.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e8b83451fa89064c2021-12-21 11:36:09.693root 11241100x8000000000000000544069Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:09.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6f9d4d2af96e400e2021-12-21 11:36:09.693root 11241100x8000000000000000544070Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:09.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.66d7f595d24ab1d62021-12-21 11:36:09.693root 11241100x8000000000000000544071Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:09.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.78201e1f454dd8092021-12-21 11:36:09.693root 11241100x8000000000000000544072Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:09.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5b5ab4bb182066ec2021-12-21 11:36:09.693root 11241100x8000000000000000544073Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:09.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.755414356976d8e32021-12-21 11:36:09.693root 11241100x8000000000000000544074Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:09.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a636d645767411dc2021-12-21 11:36:09.693root 11241100x8000000000000000544075Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:10.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.de3a6e7831f0fbe32021-12-21 11:36:10.193root 11241100x8000000000000000544076Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:10.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.78b33288dfa864de2021-12-21 11:36:10.193root 11241100x8000000000000000544077Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:10.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.535b1656caf3764b2021-12-21 11:36:10.193root 11241100x8000000000000000544078Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:10.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8959f1387b2a70f52021-12-21 11:36:10.193root 11241100x8000000000000000544079Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:10.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f3173742ac4f4be42021-12-21 11:36:10.193root 11241100x8000000000000000544080Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:10.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e5e28fdf95ba33ba2021-12-21 11:36:10.193root 11241100x8000000000000000544081Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:10.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8fe4d173708f3a792021-12-21 11:36:10.194root 11241100x8000000000000000544082Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:10.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4b0fb674f76203982021-12-21 11:36:10.693root 11241100x8000000000000000544083Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:10.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0a530c2939eb95d42021-12-21 11:36:10.693root 11241100x8000000000000000544084Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:10.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.446b28b236b777db2021-12-21 11:36:10.693root 11241100x8000000000000000544085Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:10.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.61a9fb8dc8eb042d2021-12-21 11:36:10.693root 11241100x8000000000000000544086Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:10.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.757a212bfd005e582021-12-21 11:36:10.693root 11241100x8000000000000000544087Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:10.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d05712f83ed9bfb92021-12-21 11:36:10.694root 11241100x8000000000000000544088Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:10.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e18b93cc70b1b1a92021-12-21 11:36:10.694root 11241100x8000000000000000544089Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:11.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2c47ef4115f75e272021-12-21 11:36:11.193root 11241100x8000000000000000544090Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:11.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2fe6263ee258dfe42021-12-21 11:36:11.193root 11241100x8000000000000000544091Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:11.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.dc002a85a6deedeb2021-12-21 11:36:11.193root 11241100x8000000000000000544092Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:11.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f4a33ea17cb7be972021-12-21 11:36:11.193root 11241100x8000000000000000544093Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:11.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.303107f4a1cb12d92021-12-21 11:36:11.193root 11241100x8000000000000000544094Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:11.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c9445f5d2c1d3eeb2021-12-21 11:36:11.194root 11241100x8000000000000000544095Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:11.195{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9dbf2a0a78d4b6a72021-12-21 11:36:11.195root 11241100x8000000000000000544096Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:11.195{ec2b6afe-9233-61c1-c81a-006eee550000}454/lib/systemd/systemd-journald/var/log/journal/ec2b6afe52f9882cff7bf7f0661ea563/system.journal2021-12-21 11:36:11.195root 11241100x8000000000000000544097Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:11.203{ec2b6afe-9233-61c1-c81a-006eee550000}454/lib/systemd/systemd-journald/var/log/journal/ec2b6afe52f9882cff7bf7f0661ea563/user-1000.journal2021-12-21 11:36:11.203root 23542300x8000000000000000544098Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:11.212{ec2b6afe-9233-61c1-c81a-006eee550000}454root/lib/systemd/systemd-journald/var/log/journal/ec2b6afe52f9882cff7bf7f0661ea563/user-1000@23a4030a05c14f4487fe6448e1318b5d-0000000000000000-0000000000000000.journal--- 23542300x8000000000000000544099Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:11.212{ec2b6afe-9233-61c1-c81a-006eee550000}454root/lib/systemd/systemd-journald/var/log/journal/ec2b6afe52f9882cff7bf7f0661ea563/system@4af434efcfd14cd9a23dd2a5a29b6b88-0000000000000001-0005d3a3e90cd1f7.journal--- 11241100x8000000000000000544100Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:11.238{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.25df51ffe3c7ad562021-12-21 11:36:11.238root 11241100x8000000000000000544101Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:11.239{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7183600382609b172021-12-21 11:36:11.239root 11241100x8000000000000000544102Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:11.239{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f162ec4fe8342a272021-12-21 11:36:11.239root 11241100x8000000000000000544103Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:11.239{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ed0d550c19056eec2021-12-21 11:36:11.239root 11241100x8000000000000000544104Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:11.239{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.59ce5334989d51402021-12-21 11:36:11.239root 11241100x8000000000000000544105Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:11.239{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4d95e01864e64a912021-12-21 11:36:11.239root 11241100x8000000000000000544106Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:11.239{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e2b778316c57860f2021-12-21 11:36:11.239root 11241100x8000000000000000544107Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:11.239{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9875398c70c81a472021-12-21 11:36:11.239root 11241100x8000000000000000544108Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:11.240{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f3fb81b12674053a2021-12-21 11:36:11.240root 11241100x8000000000000000544109Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:11.240{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.bca51f63965bf1282021-12-21 11:36:11.240root 11241100x8000000000000000544110Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:11.240{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.35cce56979ead6e22021-12-21 11:36:11.240root 534500x8000000000000000544111Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:11.241{ec2b6afe-9233-61c1-c81a-006eee550000}454/lib/systemd/systemd-journaldroot 11241100x8000000000000000544112Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:11.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8b1986e9be2005222021-12-21 11:36:11.693root 11241100x8000000000000000544113Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:11.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0ad9b5f1a7a5d23b2021-12-21 11:36:11.693root 11241100x8000000000000000544114Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:11.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3aad8c081fb2ba012021-12-21 11:36:11.693root 11241100x8000000000000000544115Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:11.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0e445ff8e95945b02021-12-21 11:36:11.693root 11241100x8000000000000000544116Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:11.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3803d9991074fbda2021-12-21 11:36:11.693root 11241100x8000000000000000544117Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:11.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c7590f28508be4182021-12-21 11:36:11.693root 11241100x8000000000000000544118Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:11.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.339c5f59b1c9f8b72021-12-21 11:36:11.693root 11241100x8000000000000000544119Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:11.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.af4d18186ccd8cd82021-12-21 11:36:11.693root 11241100x8000000000000000544120Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:11.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.73211d3d0c9a51042021-12-21 11:36:11.693root 11241100x8000000000000000544121Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:11.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f41220acd8d038e62021-12-21 11:36:11.693root 11241100x8000000000000000544122Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:11.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7c1a73a7f6a334d82021-12-21 11:36:11.694root 11241100x8000000000000000544123Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:11.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2fb60c042a7a83462021-12-21 11:36:11.694root 11241100x8000000000000000544124Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:12.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.cb8e8bd7029b24e72021-12-21 11:36:12.193root 11241100x8000000000000000544125Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:12.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.88a4b30c8acda1802021-12-21 11:36:12.193root 11241100x8000000000000000544126Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:12.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0b4f82aeab5539ec2021-12-21 11:36:12.193root 11241100x8000000000000000544127Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:12.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.99f97593b7dc41c12021-12-21 11:36:12.193root 11241100x8000000000000000544128Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:12.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.579e113a06a06f022021-12-21 11:36:12.193root 11241100x8000000000000000544129Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:12.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2ab7767a93f5eb002021-12-21 11:36:12.193root 11241100x8000000000000000544130Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:12.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.290d2d20e7ecdb882021-12-21 11:36:12.193root 11241100x8000000000000000544131Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:12.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4441f5404261996e2021-12-21 11:36:12.194root 11241100x8000000000000000544132Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:12.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ddd9d0a8bce3166e2021-12-21 11:36:12.194root 11241100x8000000000000000544133Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:12.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8a101b7766bab2122021-12-21 11:36:12.194root 11241100x8000000000000000544134Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:12.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b0a593d104ac12f02021-12-21 11:36:12.194root 11241100x8000000000000000544135Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:12.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.971f13029340d2632021-12-21 11:36:12.194root 354300x8000000000000000544136Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:12.236{ec2b6afe-95d9-61c1-5175-3a0400000000}5346/opt/splunkforwarder/etc/apps/Splunk_TA_stream/linux_x86_64/bin/streamfwdroottcptruefalse10.0.1.25-48782-false10.0.1.12-8000- 11241100x8000000000000000544137Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:12.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7317481c94f44fa32021-12-21 11:36:12.693root 11241100x8000000000000000544138Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:12.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.45dba862481ab2c22021-12-21 11:36:12.693root 11241100x8000000000000000544139Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:12.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.616a6b12e4bcc78e2021-12-21 11:36:12.693root 11241100x8000000000000000544140Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:12.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.75e5888337e2784e2021-12-21 11:36:12.693root 11241100x8000000000000000544141Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:12.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7526bad20c29da9a2021-12-21 11:36:12.693root 11241100x8000000000000000544142Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:12.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ca9156827754acbc2021-12-21 11:36:12.693root 11241100x8000000000000000544143Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:12.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7beda17128f8d1522021-12-21 11:36:12.693root 11241100x8000000000000000544144Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:12.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5db0ce6d281a017d2021-12-21 11:36:12.693root 11241100x8000000000000000544145Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:12.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b956b2d82e22fffd2021-12-21 11:36:12.693root 11241100x8000000000000000544146Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:12.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.690a9c002d2876ee2021-12-21 11:36:12.693root 11241100x8000000000000000544147Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:12.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7b3a5f2f24ec56db2021-12-21 11:36:12.694root 11241100x8000000000000000544148Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:12.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b6ae8cb6b91590112021-12-21 11:36:12.694root 11241100x8000000000000000544149Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:12.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f6a82aca98bf359a2021-12-21 11:36:12.694root 11241100x8000000000000000544150Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:13.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.982846e842d2ed782021-12-21 11:36:13.193root 11241100x8000000000000000544151Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:13.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.34f0fb4653193e962021-12-21 11:36:13.193root 11241100x8000000000000000544152Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:13.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.43e5014eb77b53172021-12-21 11:36:13.193root 11241100x8000000000000000544153Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:13.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b74f06eac0fb16722021-12-21 11:36:13.193root 11241100x8000000000000000544154Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:13.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.15aa4f79e4820fc32021-12-21 11:36:13.193root 11241100x8000000000000000544155Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:13.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1a14d1ce527f192e2021-12-21 11:36:13.193root 11241100x8000000000000000544156Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:13.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.44401d10f811ca422021-12-21 11:36:13.193root 11241100x8000000000000000544157Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:13.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b6b7b65d868807fc2021-12-21 11:36:13.193root 11241100x8000000000000000544158Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:13.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ed59a40c243708c92021-12-21 11:36:13.194root 11241100x8000000000000000544159Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:13.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a2b29d457ebbe4702021-12-21 11:36:13.194root 11241100x8000000000000000544160Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:13.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e6fb0ec97e2725362021-12-21 11:36:13.194root 11241100x8000000000000000544161Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:13.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c180d4d90c37fd702021-12-21 11:36:13.194root 11241100x8000000000000000544162Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:13.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e1695f2858dddef72021-12-21 11:36:13.194root 11241100x8000000000000000544163Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:13.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b2b102b1ff4610de2021-12-21 11:36:13.693root 11241100x8000000000000000544164Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:13.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.bbb9c31aeb0263fe2021-12-21 11:36:13.693root 11241100x8000000000000000544165Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:13.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e5f7f0fe7c3848602021-12-21 11:36:13.693root 11241100x8000000000000000544166Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:13.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f54531195cae4dd22021-12-21 11:36:13.693root 11241100x8000000000000000544167Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:13.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0fd47751af80ef5d2021-12-21 11:36:13.693root 11241100x8000000000000000544168Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:13.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a3d0ec14b4af0c132021-12-21 11:36:13.693root 11241100x8000000000000000544169Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:13.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.676a37ce5f89f8b32021-12-21 11:36:13.693root 11241100x8000000000000000544170Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:13.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.52bd6ba0ef16fcf22021-12-21 11:36:13.693root 11241100x8000000000000000544171Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:13.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7b0b75db12a50e022021-12-21 11:36:13.693root 11241100x8000000000000000544172Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:13.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b5796a70f05b4efc2021-12-21 11:36:13.693root 11241100x8000000000000000544173Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:13.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e0ffb93d862e68a72021-12-21 11:36:13.694root 11241100x8000000000000000544174Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:13.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e7704b9f2119e2e22021-12-21 11:36:13.694root 11241100x8000000000000000544175Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:13.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.cd36b90c1e261c2a2021-12-21 11:36:13.694root 534500x8000000000000000544176Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:14.190{00000000-0000-0000-0000-000000000000}9894<unknown process>ubuntu 11241100x8000000000000000544177Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:14.192{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.dd36bc15b17342cf2021-12-21 11:36:14.192root 11241100x8000000000000000544178Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:14.192{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d8e6b170ac87dcbe2021-12-21 11:36:14.192root 11241100x8000000000000000544179Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:14.192{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0d4927e830445b762021-12-21 11:36:14.192root 11241100x8000000000000000544180Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:14.192{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a2297d7f31cd28912021-12-21 11:36:14.192root 11241100x8000000000000000544181Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:14.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0b25410ab9ee020b2021-12-21 11:36:14.193root 534500x8000000000000000544182Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:14.192{00000000-0000-0000-0000-000000000000}9895<unknown process>ubuntu 11241100x8000000000000000544183Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:14.193{ec2b6afe-aacb-61c1-0834-fdd63c560000}5677/bin/bash/tmp/sh-thd.eOjh1v2021-12-21 11:36:14.193ubuntu 23542300x8000000000000000544184Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:14.193{ec2b6afe-aacb-61c1-0834-fdd63c560000}5677ubuntu/bin/bash/tmp/sh-thd.eOjh1v--- 11241100x8000000000000000544185Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:14.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.039ac3a2ec4843ed2021-12-21 11:36:14.193root 11241100x8000000000000000544186Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:14.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.571b5199ab0fdff82021-12-21 11:36:14.193root 11241100x8000000000000000544187Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:14.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2dca8b5338a5eac62021-12-21 11:36:14.193root 11241100x8000000000000000544188Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:14.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5f6b55e5015a2bec2021-12-21 11:36:14.193root 11241100x8000000000000000544189Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:14.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9d684a0b3210d0c02021-12-21 11:36:14.193root 11241100x8000000000000000544190Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:14.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e51f0a022edb284b2021-12-21 11:36:14.193root 11241100x8000000000000000544191Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:14.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.af509bc53e5668972021-12-21 11:36:14.193root 11241100x8000000000000000544192Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:14.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.293b8a75f45954912021-12-21 11:36:14.193root 11241100x8000000000000000544193Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:14.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.daef5885eb97df262021-12-21 11:36:14.193root 11241100x8000000000000000544194Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:14.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f1972e5d09b462312021-12-21 11:36:14.443root 11241100x8000000000000000544195Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:14.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.badd70c240f4f7462021-12-21 11:36:14.443root 11241100x8000000000000000544196Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:14.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.72ce864ac1ec62482021-12-21 11:36:14.443root 11241100x8000000000000000544197Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:14.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e2a6badb5b68352d2021-12-21 11:36:14.443root 11241100x8000000000000000544198Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:14.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.afd6af11ff0be7212021-12-21 11:36:14.443root 11241100x8000000000000000544199Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:14.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d53121a5677266ca2021-12-21 11:36:14.443root 11241100x8000000000000000544200Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:14.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ca7f29bb10762c292021-12-21 11:36:14.444root 11241100x8000000000000000544201Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:14.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.53a10b94a156a8752021-12-21 11:36:14.444root 11241100x8000000000000000544202Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:14.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b5c3c6d9afa8ed622021-12-21 11:36:14.444root 11241100x8000000000000000544203Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:14.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0aaee6da0ead45252021-12-21 11:36:14.444root 11241100x8000000000000000544204Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:14.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e6b28f1d442825c42021-12-21 11:36:14.444root 11241100x8000000000000000544205Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:14.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e389ac09bc69c7052021-12-21 11:36:14.444root 11241100x8000000000000000544206Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:14.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ade881dcc2e0dd8e2021-12-21 11:36:14.444root 11241100x8000000000000000544207Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:14.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.150c87214d2658802021-12-21 11:36:14.444root 11241100x8000000000000000544208Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:14.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5b6177ff154acfc12021-12-21 11:36:14.444root 11241100x8000000000000000544209Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:14.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2458aff1cc15186f2021-12-21 11:36:14.444root 11241100x8000000000000000544210Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:14.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.06b67223056dcc5b2021-12-21 11:36:14.444root 11241100x8000000000000000544211Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:14.942{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8693b9c86a015b1f2021-12-21 11:36:14.942root 11241100x8000000000000000544212Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:14.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.25546ce1511ea97a2021-12-21 11:36:14.943root 11241100x8000000000000000544213Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:14.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f0cf7d390c5271712021-12-21 11:36:14.943root 11241100x8000000000000000544214Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:14.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.85d3d8e414fd01632021-12-21 11:36:14.943root 11241100x8000000000000000544215Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:14.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b738aa6411a9a6642021-12-21 11:36:14.943root 11241100x8000000000000000544216Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:14.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8e2eee31d13be3c82021-12-21 11:36:14.943root 11241100x8000000000000000544217Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:14.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4cad7731b7e986e22021-12-21 11:36:14.943root 11241100x8000000000000000544218Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:14.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.92aba80b2066a74d2021-12-21 11:36:14.944root 11241100x8000000000000000544219Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:14.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.18533916402407dc2021-12-21 11:36:14.944root 11241100x8000000000000000544220Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:14.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.279a9c20dcf105b92021-12-21 11:36:14.944root 11241100x8000000000000000544221Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:14.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1af80aa34bd200072021-12-21 11:36:14.944root 11241100x8000000000000000544222Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:14.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.19e805f3a6953d382021-12-21 11:36:14.944root 11241100x8000000000000000544223Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:14.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.449962059fa430d82021-12-21 11:36:14.944root 11241100x8000000000000000544224Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:14.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4a8421da5e5ddb002021-12-21 11:36:14.944root 11241100x8000000000000000544225Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:14.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e6ae4c01edbd74922021-12-21 11:36:14.944root 11241100x8000000000000000544226Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:14.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7e5d40cabac157f42021-12-21 11:36:14.944root 11241100x8000000000000000544227Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:14.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.dadbd6a82a95978e2021-12-21 11:36:14.944root 11241100x8000000000000000544228Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:15.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0a3ea7958448ac702021-12-21 11:36:15.443root 11241100x8000000000000000544229Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:15.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.db9a8dce9126a9f22021-12-21 11:36:15.443root 11241100x8000000000000000544230Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:15.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.56771443ccb198702021-12-21 11:36:15.443root 11241100x8000000000000000544231Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:15.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.cb2fcfc70d2bebb92021-12-21 11:36:15.443root 11241100x8000000000000000544232Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:15.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7806938952b76e1f2021-12-21 11:36:15.443root 11241100x8000000000000000544233Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:15.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8236e9a91d39919a2021-12-21 11:36:15.443root 11241100x8000000000000000544234Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:15.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9ed4e6cfa76f93162021-12-21 11:36:15.443root 11241100x8000000000000000544235Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:15.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.dbd2d0f49ae42c502021-12-21 11:36:15.443root 11241100x8000000000000000544236Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:15.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.acd2a3e8f7c4ea452021-12-21 11:36:15.443root 11241100x8000000000000000544237Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:15.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a5b118b5f0a2fb512021-12-21 11:36:15.443root 11241100x8000000000000000544238Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:15.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2b47b8de6d3403962021-12-21 11:36:15.443root 11241100x8000000000000000544239Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:15.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0c795851f5906faf2021-12-21 11:36:15.443root 11241100x8000000000000000544240Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:15.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5a10de166321da642021-12-21 11:36:15.443root 11241100x8000000000000000544241Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:15.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2d2e0538a8df90252021-12-21 11:36:15.444root 11241100x8000000000000000544242Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:15.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.32fbde5b8ced9c5f2021-12-21 11:36:15.444root 11241100x8000000000000000544243Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:15.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0c8a680e969b9ee82021-12-21 11:36:15.444root 11241100x8000000000000000544244Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:15.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2addedb38356595e2021-12-21 11:36:15.444root 534500x8000000000000000544245Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:15.720{00000000-0000-0000-0000-000000000000}9896<unknown process>ubuntu 11241100x8000000000000000544246Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:15.721{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.34b29432a23292672021-12-21 11:36:15.721root 11241100x8000000000000000544247Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:15.721{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2477ffebe62b9d052021-12-21 11:36:15.721root 11241100x8000000000000000544248Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:15.721{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.80c6d8b6eecfff5e2021-12-21 11:36:15.721root 534500x8000000000000000544249Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:15.722{ec2b6afe-9233-61c1-c81a-006eee550000}9897-ubuntu 11241100x8000000000000000544250Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:15.722{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ebc354b62ee3e3442021-12-21 11:36:15.722root 11241100x8000000000000000544251Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:15.722{ec2b6afe-aacb-61c1-0834-fdd63c560000}5677/bin/bash/tmp/sh-thd.lgEWe72021-12-21 11:36:15.722ubuntu 23542300x8000000000000000544252Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:15.722{ec2b6afe-aacb-61c1-0834-fdd63c560000}5677ubuntu/bin/bash/tmp/sh-thd.lgEWe7--- 11241100x8000000000000000544253Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:15.722{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3be357fd9d372dbf2021-12-21 11:36:15.722root 11241100x8000000000000000544254Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:15.723{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.aa4d36a681ad49be2021-12-21 11:36:15.723root 11241100x8000000000000000544255Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:15.723{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.12d5ba15d5f5437b2021-12-21 11:36:15.723root 11241100x8000000000000000544256Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:15.723{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5750eb054fd25ea02021-12-21 11:36:15.723root 11241100x8000000000000000544257Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:15.723{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.07fdd77e24d58d0a2021-12-21 11:36:15.723root 11241100x8000000000000000544258Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:15.723{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.bbcdd57d68790b652021-12-21 11:36:15.723root 11241100x8000000000000000544259Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:15.723{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6a96dc82d90091252021-12-21 11:36:15.723root 11241100x8000000000000000544260Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:15.723{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.33d473cd023add042021-12-21 11:36:15.723root 11241100x8000000000000000544261Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:15.723{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.252a9cec07cecbff2021-12-21 11:36:15.723root 11241100x8000000000000000544262Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:15.723{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a7505ae9688e1a2b2021-12-21 11:36:15.723root 11241100x8000000000000000544263Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:15.723{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b63ecb86852067602021-12-21 11:36:15.723root 11241100x8000000000000000544264Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:15.723{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a5ce796b8574983b2021-12-21 11:36:15.723root 11241100x8000000000000000544265Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:15.724{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.092aa2ae38ac49cc2021-12-21 11:36:15.724root 11241100x8000000000000000544266Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:15.724{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a4da1688ef8a8c182021-12-21 11:36:15.724root 11241100x8000000000000000544267Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:15.724{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.690b865be4dd075e2021-12-21 11:36:15.724root 11241100x8000000000000000544268Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:15.724{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.62e8983bf80ed1882021-12-21 11:36:15.724root 11241100x8000000000000000544269Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:15.724{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.86c9d648440a90232021-12-21 11:36:15.724root 11241100x8000000000000000544270Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:15.724{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3d07311554ed559e2021-12-21 11:36:15.724root 11241100x8000000000000000544271Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:15.724{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.837c1b7f2dfdb0cc2021-12-21 11:36:15.724root 11241100x8000000000000000544272Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:15.724{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.25e8da10b813e23c2021-12-21 11:36:15.724root 11241100x8000000000000000544273Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:16.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a294cf46672b3eb62021-12-21 11:36:16.193root 11241100x8000000000000000544274Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:16.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.85a5b4354523f0ee2021-12-21 11:36:16.193root 11241100x8000000000000000544275Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:16.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.48fa78d3960e53c52021-12-21 11:36:16.193root 11241100x8000000000000000544276Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:16.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4f730a16be89776a2021-12-21 11:36:16.193root 11241100x8000000000000000544277Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:16.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b5465e775deb78682021-12-21 11:36:16.194root 11241100x8000000000000000544278Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:16.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f8deda824b7f839e2021-12-21 11:36:16.194root 11241100x8000000000000000544279Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:16.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.369fe583f1290cab2021-12-21 11:36:16.194root 11241100x8000000000000000544280Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:16.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b13661d6d847567a2021-12-21 11:36:16.194root 11241100x8000000000000000544281Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:16.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9e327e91897292f12021-12-21 11:36:16.194root 11241100x8000000000000000544282Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:16.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0ba0dc3f6f70afc22021-12-21 11:36:16.194root 11241100x8000000000000000544283Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:16.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.355752464bd2b3292021-12-21 11:36:16.194root 11241100x8000000000000000544284Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:16.195{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.caf769b57fbfa22e2021-12-21 11:36:16.195root 11241100x8000000000000000544285Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:16.195{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e54eb803735e89ea2021-12-21 11:36:16.195root 11241100x8000000000000000544286Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:16.195{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0598de649049716b2021-12-21 11:36:16.195root 11241100x8000000000000000544287Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:16.195{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0474b36048947c422021-12-21 11:36:16.195root 11241100x8000000000000000544288Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:16.195{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f99d6be754fc74142021-12-21 11:36:16.195root 11241100x8000000000000000544289Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:16.195{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.fa4b7451db3b855e2021-12-21 11:36:16.195root 11241100x8000000000000000544290Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:16.195{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.cc6a9d761e0352442021-12-21 11:36:16.195root 11241100x8000000000000000544291Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:16.195{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7b4bff6e36d365162021-12-21 11:36:16.195root 11241100x8000000000000000544292Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:16.195{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2241f5542fff2ac92021-12-21 11:36:16.195root 11241100x8000000000000000544293Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:16.195{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.708718b14467030d2021-12-21 11:36:16.195root 11241100x8000000000000000544294Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:16.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.096bac800c2797632021-12-21 11:36:16.693root 11241100x8000000000000000544295Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:16.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.180d30dcb78e73262021-12-21 11:36:16.693root 11241100x8000000000000000544296Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:16.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.be20456157de05e12021-12-21 11:36:16.693root 11241100x8000000000000000544297Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:16.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.bc3830b9cccd69e32021-12-21 11:36:16.693root 11241100x8000000000000000544298Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:16.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.341a8b83883875eb2021-12-21 11:36:16.693root 11241100x8000000000000000544299Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:16.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8ef0a7545d69a9a62021-12-21 11:36:16.693root 11241100x8000000000000000544300Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:16.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a246abf88cf6ec1d2021-12-21 11:36:16.693root 11241100x8000000000000000544301Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:16.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d402a2fc1ff48d2c2021-12-21 11:36:16.693root 11241100x8000000000000000544302Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:16.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ff867e42cb1219a12021-12-21 11:36:16.693root 11241100x8000000000000000544303Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:16.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1da5a6159cb2acd52021-12-21 11:36:16.693root 11241100x8000000000000000544304Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:16.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d1163d737fa85f172021-12-21 11:36:16.694root 11241100x8000000000000000544305Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:16.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9a8906e4516996c92021-12-21 11:36:16.694root 11241100x8000000000000000544306Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:16.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.bc8bd30aea5ee1b72021-12-21 11:36:16.694root 11241100x8000000000000000544307Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:16.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.df2449942b49a2da2021-12-21 11:36:16.694root 11241100x8000000000000000544308Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:16.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f65a985645e81a712021-12-21 11:36:16.694root 11241100x8000000000000000544309Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:16.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1abdfaf68a7678b82021-12-21 11:36:16.694root 11241100x8000000000000000544310Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:16.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ec0bc32b862542172021-12-21 11:36:16.694root 11241100x8000000000000000544311Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:16.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.dcbc7c3b167f17a72021-12-21 11:36:16.694root 11241100x8000000000000000544312Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:16.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8cc4aed5c2020af82021-12-21 11:36:16.694root 11241100x8000000000000000544313Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:16.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e91bb3dcc78f85fc2021-12-21 11:36:16.694root 11241100x8000000000000000544314Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:16.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.03749b8d3c0255c22021-12-21 11:36:16.694root 11241100x8000000000000000544315Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:16.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.520e21a170256e652021-12-21 11:36:16.694root 11241100x8000000000000000544316Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:17.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.af4d3a8a47ed819c2021-12-21 11:36:17.193root 11241100x8000000000000000544317Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:17.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2e7c10dcba91fd6d2021-12-21 11:36:17.193root 11241100x8000000000000000544318Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:17.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.af88c498a843affb2021-12-21 11:36:17.193root 11241100x8000000000000000544319Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:17.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9576eda9ea44f49e2021-12-21 11:36:17.193root 11241100x8000000000000000544320Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:17.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.52bf79f9e438d9fa2021-12-21 11:36:17.193root 11241100x8000000000000000544321Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:17.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ef9e6d9d26b5698d2021-12-21 11:36:17.193root 11241100x8000000000000000544322Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:17.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2584f2bce45f703d2021-12-21 11:36:17.193root 11241100x8000000000000000544323Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:17.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9684731af74d6bf62021-12-21 11:36:17.193root 11241100x8000000000000000544324Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:17.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3b115a89aa54a8a52021-12-21 11:36:17.193root 11241100x8000000000000000544325Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:17.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6e73b2864f77db082021-12-21 11:36:17.194root 11241100x8000000000000000544326Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:17.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a657dd95d7ccdbf42021-12-21 11:36:17.194root 11241100x8000000000000000544327Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:17.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.29a800b0784840b22021-12-21 11:36:17.194root 11241100x8000000000000000544328Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:17.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.05053b1aa4c8f9e22021-12-21 11:36:17.194root 11241100x8000000000000000544329Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:17.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6bdcbf0ac320f63a2021-12-21 11:36:17.194root 11241100x8000000000000000544330Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:17.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f6d09e8c868009442021-12-21 11:36:17.194root 11241100x8000000000000000544331Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:17.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.dbc3485a6bc663f72021-12-21 11:36:17.194root 11241100x8000000000000000544332Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:17.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.25724f60c407f0b92021-12-21 11:36:17.194root 11241100x8000000000000000544333Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:17.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2b67939de01462f72021-12-21 11:36:17.194root 11241100x8000000000000000544334Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:17.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.befce32fbec397152021-12-21 11:36:17.194root 11241100x8000000000000000544335Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:17.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.fb565b5374523f762021-12-21 11:36:17.194root 11241100x8000000000000000544336Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:17.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.abb31b08e88d8e072021-12-21 11:36:17.194root 11241100x8000000000000000544337Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:17.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.adea19c197ff30a72021-12-21 11:36:17.693root 11241100x8000000000000000544338Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:17.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5af74d979f7c05552021-12-21 11:36:17.693root 11241100x8000000000000000544339Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:17.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.799f5c24f2e69b262021-12-21 11:36:17.693root 11241100x8000000000000000544340Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:17.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5b3f2db916a49c602021-12-21 11:36:17.693root 11241100x8000000000000000544341Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:17.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b5069d94a7355df12021-12-21 11:36:17.693root 11241100x8000000000000000544342Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:17.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7468b735316bfa482021-12-21 11:36:17.694root 11241100x8000000000000000544343Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:17.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9c7ab064de0b848e2021-12-21 11:36:17.694root 11241100x8000000000000000544344Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:17.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4569f67517060f5f2021-12-21 11:36:17.694root 11241100x8000000000000000544345Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:17.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1f106ab0eb0b57ad2021-12-21 11:36:17.694root 11241100x8000000000000000544346Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:17.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.050a0f90fa0688c22021-12-21 11:36:17.694root 11241100x8000000000000000544347Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:17.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0687e9f554794dda2021-12-21 11:36:17.694root 11241100x8000000000000000544348Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:17.695{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8d5e60ef5bf544d02021-12-21 11:36:17.695root 11241100x8000000000000000544349Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:17.695{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.803335b8a768f3d12021-12-21 11:36:17.695root 11241100x8000000000000000544350Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:17.695{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7ead7784549f976b2021-12-21 11:36:17.695root 11241100x8000000000000000544351Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:17.695{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.84e65b30f8a3e75f2021-12-21 11:36:17.695root 11241100x8000000000000000544352Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:17.696{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8abded775e3938de2021-12-21 11:36:17.696root 11241100x8000000000000000544353Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:17.696{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ca8a5bb6ecdf769b2021-12-21 11:36:17.696root 11241100x8000000000000000544354Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:17.696{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9727ec51fd7fb8e02021-12-21 11:36:17.696root 11241100x8000000000000000544355Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:17.697{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a61d18c5fa45a3b42021-12-21 11:36:17.697root 11241100x8000000000000000544356Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:17.697{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d47f7f06ad132b8c2021-12-21 11:36:17.697root 11241100x8000000000000000544357Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:17.697{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a8ce4f4f25ba09262021-12-21 11:36:17.697root 354300x8000000000000000544358Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:18.160{ec2b6afe-95d9-61c1-5175-3a0400000000}5346/opt/splunkforwarder/etc/apps/Splunk_TA_stream/linux_x86_64/bin/streamfwdroottcptruefalse10.0.1.25-48784-false10.0.1.12-8000- 11241100x8000000000000000544359Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:18.161{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.44e9f0030b608a412021-12-21 11:36:18.161root 11241100x8000000000000000544360Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:18.161{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c56b694d0abfac3c2021-12-21 11:36:18.161root 11241100x8000000000000000544361Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:18.161{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9d720994bdcc86b02021-12-21 11:36:18.161root 11241100x8000000000000000544362Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:18.161{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.210831960d64b26b2021-12-21 11:36:18.161root 11241100x8000000000000000544363Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:18.161{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.725a8862c8ecc3332021-12-21 11:36:18.161root 11241100x8000000000000000544364Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:18.161{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.685f494291ce5ad62021-12-21 11:36:18.161root 11241100x8000000000000000544365Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:18.161{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8eb2a87e18a4f21f2021-12-21 11:36:18.161root 11241100x8000000000000000544366Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:18.161{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e8a9ae4cea563b0d2021-12-21 11:36:18.161root 11241100x8000000000000000544367Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:18.161{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5d99c8f4ecc66c092021-12-21 11:36:18.161root 11241100x8000000000000000544368Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:18.161{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8aa4a504976b13232021-12-21 11:36:18.161root 11241100x8000000000000000544369Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:18.161{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5ede43ec538db0242021-12-21 11:36:18.161root 11241100x8000000000000000544370Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:18.162{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e01a7f62f95cfcee2021-12-21 11:36:18.162root 11241100x8000000000000000544371Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:18.162{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0f97325f9b2b617d2021-12-21 11:36:18.162root 11241100x8000000000000000544372Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:18.162{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.38057c27ffa906d22021-12-21 11:36:18.162root 11241100x8000000000000000544373Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:18.162{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7fff29049a04a8f52021-12-21 11:36:18.162root 11241100x8000000000000000544374Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:18.162{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.152bb2b19e9675012021-12-21 11:36:18.162root 11241100x8000000000000000544375Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:18.162{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4ec89b1f76eecf7c2021-12-21 11:36:18.162root 11241100x8000000000000000544376Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:18.162{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f91cdb1e11be06ee2021-12-21 11:36:18.162root 11241100x8000000000000000544377Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:18.162{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.cb2aec146ee0b1862021-12-21 11:36:18.162root 11241100x8000000000000000544378Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:18.162{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7ae882f27fe70adf2021-12-21 11:36:18.162root 11241100x8000000000000000544379Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:18.162{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.978d841e267652892021-12-21 11:36:18.162root 11241100x8000000000000000544380Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:18.163{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.201e3fc43e600a722021-12-21 11:36:18.163root 11241100x8000000000000000544381Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:18.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0c9831690214ea432021-12-21 11:36:18.443root 11241100x8000000000000000544382Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:18.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8929ab61d93354382021-12-21 11:36:18.443root 11241100x8000000000000000544383Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:18.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d0a985d6dfc014e62021-12-21 11:36:18.443root 11241100x8000000000000000544384Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:18.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.08121509e69d5d532021-12-21 11:36:18.443root 11241100x8000000000000000544385Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:18.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e9f8cebdfdbc5a322021-12-21 11:36:18.443root 11241100x8000000000000000544386Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:18.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.487ad61924fca9fb2021-12-21 11:36:18.443root 11241100x8000000000000000544387Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:18.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ff4c619cb3f8162e2021-12-21 11:36:18.443root 11241100x8000000000000000544388Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:18.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b5fce3c5fc9e17242021-12-21 11:36:18.443root 11241100x8000000000000000544389Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:18.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.20eb06d814f285262021-12-21 11:36:18.443root 11241100x8000000000000000544390Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:18.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7ce883197b7ae15f2021-12-21 11:36:18.444root 11241100x8000000000000000544391Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:18.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f54b0de1469dc57a2021-12-21 11:36:18.444root 11241100x8000000000000000544392Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:18.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b1e4cf08a4d1b6462021-12-21 11:36:18.444root 11241100x8000000000000000544393Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:18.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.89bbbc2812baaa9b2021-12-21 11:36:18.444root 11241100x8000000000000000544394Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:18.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7d9094580272673c2021-12-21 11:36:18.444root 11241100x8000000000000000544395Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:18.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6b6d4ea7b3c6f8752021-12-21 11:36:18.444root 11241100x8000000000000000544396Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:18.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1dd9b0fbd0a64c0f2021-12-21 11:36:18.444root 11241100x8000000000000000544397Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:18.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7e93721cc2da62d02021-12-21 11:36:18.444root 11241100x8000000000000000544398Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:18.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d3f38c0cbcf9d1632021-12-21 11:36:18.444root 11241100x8000000000000000544399Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:18.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.08f4000bac0fd9242021-12-21 11:36:18.444root 11241100x8000000000000000544400Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:18.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.50672a9c219364f22021-12-21 11:36:18.444root 11241100x8000000000000000544401Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:18.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e450bd70d00069df2021-12-21 11:36:18.445root 11241100x8000000000000000544402Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:18.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.44d75743a1cbb87f2021-12-21 11:36:18.445root 11241100x8000000000000000544403Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:18.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f9d5b6ec921596282021-12-21 11:36:18.943root 11241100x8000000000000000544404Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:18.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f1b2285f098230e22021-12-21 11:36:18.943root 11241100x8000000000000000544405Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:18.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.384d4a7751420c582021-12-21 11:36:18.943root 11241100x8000000000000000544406Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:18.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b319c4344c765e0a2021-12-21 11:36:18.943root 11241100x8000000000000000544407Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:18.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a6cd73c9bef0abe52021-12-21 11:36:18.943root 11241100x8000000000000000544408Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:18.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.08eb159d985d2a132021-12-21 11:36:18.943root 11241100x8000000000000000544409Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:18.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4acd925d711df5e12021-12-21 11:36:18.944root 11241100x8000000000000000544410Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:18.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0df0fcb95e46f1db2021-12-21 11:36:18.944root 11241100x8000000000000000544411Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:18.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1131d39fcf9a44502021-12-21 11:36:18.944root 11241100x8000000000000000544412Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:18.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3fbc51413fe3f2882021-12-21 11:36:18.944root 11241100x8000000000000000544413Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:18.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.738b60ba5a1628ba2021-12-21 11:36:18.944root 11241100x8000000000000000544414Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:18.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5d3657658eb651ff2021-12-21 11:36:18.944root 11241100x8000000000000000544415Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:18.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.226c26d8ca5834082021-12-21 11:36:18.944root 11241100x8000000000000000544416Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:18.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ee878daea32c5c2d2021-12-21 11:36:18.944root 11241100x8000000000000000544417Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:18.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.af0572b140ca5a442021-12-21 11:36:18.944root 11241100x8000000000000000544418Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:18.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9bef0e94dbc69d072021-12-21 11:36:18.944root 11241100x8000000000000000544419Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:18.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.28f5ff5921006a052021-12-21 11:36:18.945root 11241100x8000000000000000544420Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:18.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b238056f4021513e2021-12-21 11:36:18.945root 11241100x8000000000000000544421Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:18.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0a3de8512c40f3632021-12-21 11:36:18.945root 11241100x8000000000000000544422Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:18.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b49e666ef7cc79c02021-12-21 11:36:18.945root 11241100x8000000000000000544423Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:18.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2c96bad3ef2cee5a2021-12-21 11:36:18.945root 11241100x8000000000000000544424Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:18.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.da557f66cf5c66a92021-12-21 11:36:18.945root 11241100x8000000000000000544425Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:19.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c63b334399174a202021-12-21 11:36:19.443root 11241100x8000000000000000544426Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:19.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4b130f2f7e2de8632021-12-21 11:36:19.443root 11241100x8000000000000000544427Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:19.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8f793c3401c426782021-12-21 11:36:19.444root 11241100x8000000000000000544428Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:19.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a0ae4435b590bd282021-12-21 11:36:19.444root 11241100x8000000000000000544429Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:19.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.48cac619977cc66c2021-12-21 11:36:19.444root 11241100x8000000000000000544430Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:19.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d2f098ae355e311d2021-12-21 11:36:19.444root 11241100x8000000000000000544431Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:19.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ed965690e0767b5b2021-12-21 11:36:19.444root 11241100x8000000000000000544432Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:19.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5687b474c7e2430b2021-12-21 11:36:19.445root 11241100x8000000000000000544433Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:19.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1470ac31d5ebc9712021-12-21 11:36:19.445root 11241100x8000000000000000544434Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:19.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ae8fc9893da79a012021-12-21 11:36:19.445root 11241100x8000000000000000544435Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:19.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0780e0067a5b34632021-12-21 11:36:19.445root 11241100x8000000000000000544436Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:19.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b227b68d769989152021-12-21 11:36:19.445root 11241100x8000000000000000544437Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:19.446{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.736f7b2adc98e4372021-12-21 11:36:19.446root 11241100x8000000000000000544438Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:19.446{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.30e4c2b32bceab0b2021-12-21 11:36:19.446root 11241100x8000000000000000544439Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:19.446{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.48ddb9455efc21f02021-12-21 11:36:19.446root 11241100x8000000000000000544440Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:19.447{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.caabf7a8dcf68a592021-12-21 11:36:19.447root 11241100x8000000000000000544441Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:19.447{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9518cd082a59747f2021-12-21 11:36:19.447root 11241100x8000000000000000544442Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:19.447{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3c8885029b8242b52021-12-21 11:36:19.447root 11241100x8000000000000000544443Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:19.448{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.32ee13e46bff8c262021-12-21 11:36:19.448root 11241100x8000000000000000544444Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:19.448{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.44bb86ea3fe40ecb2021-12-21 11:36:19.448root 11241100x8000000000000000544445Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:19.448{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4a0cb2ae5db2b02d2021-12-21 11:36:19.448root 11241100x8000000000000000544446Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:19.449{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4c78cbfea53ab2062021-12-21 11:36:19.449root 11241100x8000000000000000544447Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:19.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.69d1f2aa5a0cd8272021-12-21 11:36:19.943root 11241100x8000000000000000544448Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:19.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4d23541b8cc6124a2021-12-21 11:36:19.943root 11241100x8000000000000000544449Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:19.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6351a34ffefa63322021-12-21 11:36:19.943root 11241100x8000000000000000544450Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:19.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2b3dbdff51e722c02021-12-21 11:36:19.944root 11241100x8000000000000000544451Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:19.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.45415d055c1bf53e2021-12-21 11:36:19.944root 11241100x8000000000000000544452Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:19.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.fdc1c8b395a316a92021-12-21 11:36:19.944root 11241100x8000000000000000544453Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:19.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.450d714ec76cc7a02021-12-21 11:36:19.944root 11241100x8000000000000000544454Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:19.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a4ed0c6ec07d6a6a2021-12-21 11:36:19.944root 11241100x8000000000000000544455Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:19.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b4d7fae08a0d53072021-12-21 11:36:19.944root 11241100x8000000000000000544456Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:19.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.80aa5e53608a09992021-12-21 11:36:19.944root 11241100x8000000000000000544457Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:19.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2eb21ac5fc5e8fa32021-12-21 11:36:19.944root 11241100x8000000000000000544458Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:19.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.584759a856fbb94c2021-12-21 11:36:19.944root 11241100x8000000000000000544459Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:19.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.39274b5f0ef054242021-12-21 11:36:19.944root 11241100x8000000000000000544460Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:19.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3e525c0e3a61d0372021-12-21 11:36:19.944root 11241100x8000000000000000544461Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:19.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b1b3b164d7ec6ebf2021-12-21 11:36:19.944root 11241100x8000000000000000544462Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:19.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.fcdd69e0679b4e332021-12-21 11:36:19.944root 11241100x8000000000000000544463Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:19.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.85311b59ebe260212021-12-21 11:36:19.944root 11241100x8000000000000000544464Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:19.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3ec4a3d34876ae392021-12-21 11:36:19.945root 11241100x8000000000000000544465Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:19.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4621ee5c269300c52021-12-21 11:36:19.945root 11241100x8000000000000000544466Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:19.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7cf9196b220e7a992021-12-21 11:36:19.945root 11241100x8000000000000000544467Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:19.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.15fbc9f43d4ea8ed2021-12-21 11:36:19.945root 11241100x8000000000000000544468Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:19.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c122c290cbdd2cf52021-12-21 11:36:19.945root 11241100x8000000000000000544469Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:20.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8962d3039b562f402021-12-21 11:36:20.443root 11241100x8000000000000000544470Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:20.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d6b257f77432783a2021-12-21 11:36:20.443root 11241100x8000000000000000544471Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:20.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e1781b1aa4075a192021-12-21 11:36:20.443root 11241100x8000000000000000544472Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:20.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e53b7b3ff00e98652021-12-21 11:36:20.443root 11241100x8000000000000000544473Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:20.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.20a16f83fcb195432021-12-21 11:36:20.444root 11241100x8000000000000000544474Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:20.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.671ee33edd617b192021-12-21 11:36:20.444root 11241100x8000000000000000544475Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:20.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f7ae21d58ed54c142021-12-21 11:36:20.444root 11241100x8000000000000000544476Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:20.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a92d6432c039aa9e2021-12-21 11:36:20.444root 11241100x8000000000000000544477Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:20.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.24611aca18171fbb2021-12-21 11:36:20.444root 11241100x8000000000000000544478Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:20.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.665e040199b42fe32021-12-21 11:36:20.444root 11241100x8000000000000000544479Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:20.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c0eb1a2874e3cfc82021-12-21 11:36:20.444root 11241100x8000000000000000544480Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:20.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0d3e31017c7e1a8c2021-12-21 11:36:20.444root 11241100x8000000000000000544481Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:20.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.fd1e4e670514e0c12021-12-21 11:36:20.445root 11241100x8000000000000000544482Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:20.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4375b7b4e12397d02021-12-21 11:36:20.445root 11241100x8000000000000000544483Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:20.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e4490d96a41f70702021-12-21 11:36:20.445root 11241100x8000000000000000544484Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:20.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a2978b2b19fd57572021-12-21 11:36:20.445root 11241100x8000000000000000544485Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:20.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f68686d219d06a532021-12-21 11:36:20.445root 11241100x8000000000000000544486Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:20.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4dcf9a6266d094bc2021-12-21 11:36:20.445root 11241100x8000000000000000544487Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:20.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3ac0dd32da4ff9be2021-12-21 11:36:20.445root 11241100x8000000000000000544488Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:20.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0c117757bb39c53f2021-12-21 11:36:20.445root 11241100x8000000000000000544489Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:20.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0e78aca9cc2e32992021-12-21 11:36:20.445root 11241100x8000000000000000544490Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:20.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3913e3e041043a1e2021-12-21 11:36:20.445root 11241100x8000000000000000544491Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:20.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8a5d09ac92cd583d2021-12-21 11:36:20.445root 11241100x8000000000000000544492Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:20.446{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d8545230be2dee682021-12-21 11:36:20.446root 11241100x8000000000000000544493Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:20.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b898a7bfee953dd32021-12-21 11:36:20.943root 11241100x8000000000000000544494Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:20.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.117f155dd88810342021-12-21 11:36:20.943root 11241100x8000000000000000544495Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:20.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.215d74a4b42535612021-12-21 11:36:20.943root 11241100x8000000000000000544496Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:20.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.52802f3f2dc7a3392021-12-21 11:36:20.943root 11241100x8000000000000000544497Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:20.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.abd4ee4371d4771a2021-12-21 11:36:20.944root 11241100x8000000000000000544498Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:20.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.bf8c6011bbc101f82021-12-21 11:36:20.944root 11241100x8000000000000000544499Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:20.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.586041d581ef3f872021-12-21 11:36:20.944root 11241100x8000000000000000544500Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:20.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2840e119371f6e8b2021-12-21 11:36:20.944root 11241100x8000000000000000544501Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:20.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2161118073d6ac912021-12-21 11:36:20.944root 11241100x8000000000000000544502Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:20.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.73995635ff05eaec2021-12-21 11:36:20.944root 11241100x8000000000000000544503Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:20.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ee000cacafc2b8842021-12-21 11:36:20.944root 11241100x8000000000000000544504Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:20.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1788268939763a372021-12-21 11:36:20.944root 11241100x8000000000000000544505Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:20.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ec3fd2d90ddbd07d2021-12-21 11:36:20.944root 11241100x8000000000000000544506Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:20.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0e4bc31a6728ab2c2021-12-21 11:36:20.944root 11241100x8000000000000000544507Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:20.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9f1a9cfd069e4f9e2021-12-21 11:36:20.944root 11241100x8000000000000000544508Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:20.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e8dcc722726180f72021-12-21 11:36:20.944root 11241100x8000000000000000544509Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:20.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.abb68c4b8570b78c2021-12-21 11:36:20.944root 11241100x8000000000000000544510Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:20.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9776c762d3d977f22021-12-21 11:36:20.944root 11241100x8000000000000000544511Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:20.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.479d0da6a70b10582021-12-21 11:36:20.944root 11241100x8000000000000000544512Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:20.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e8f67e90422e7ff52021-12-21 11:36:20.944root 11241100x8000000000000000544513Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:20.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.123e4633380520492021-12-21 11:36:20.945root 11241100x8000000000000000544514Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:20.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4e55be69ae15c0652021-12-21 11:36:20.945root 154100x8000000000000000544515Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:21.229{ec2b6afe-bc35-61c1-f4a8-4f0000000000}9898/usr/bin/x86_64-linux-gnu-gcc-7-----gcc evil_bin.c -o evil2_bin/home/ubuntuubuntu{ec2b6afe-aacb-61c1-e803-000000000000}10006no level-{ec2b6afe-aacb-61c1-0834-fdd63c560000}5677/bin/bash-bashubuntu 11241100x8000000000000000544516Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:21.231{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1ff16c72201d385e2021-12-21 11:36:21.231root 11241100x8000000000000000544517Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:21.231{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9c21ae732477f8352021-12-21 11:36:21.231root 11241100x8000000000000000544518Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:21.231{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.46379939dfbba8222021-12-21 11:36:21.231root 11241100x8000000000000000544519Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:21.231{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9cc8ca81b02eed142021-12-21 11:36:21.231root 11241100x8000000000000000544520Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:21.231{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.01cf50a578cac3332021-12-21 11:36:21.231root 11241100x8000000000000000544521Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:21.231{ec2b6afe-bc35-61c1-f4a8-4f0000000000}9898/usr/bin/x86_64-linux-gnu-gcc-7/tmp/ccbsSjze.s2021-12-21 11:36:21.231ubuntu 11241100x8000000000000000544522Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:21.231{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c1e1e07ff227ec6f2021-12-21 11:36:21.231root 11241100x8000000000000000544523Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:21.231{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d53e5f800f3d4b862021-12-21 11:36:21.231root 11241100x8000000000000000544524Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:21.231{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7695c20f35eec6582021-12-21 11:36:21.231root 11241100x8000000000000000544525Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:21.231{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.534ac6ef9b78e5b02021-12-21 11:36:21.231root 154100x8000000000000000544526Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:21.231{ec2b6afe-bc35-61c1-7ca6-a50100000000}9899/usr/lib/gcc/x86_64-linux-gnu/7/cc1-----/usr/lib/gcc/x86_64-linux-gnu/7/cc1 -quiet -imultiarch x86_64-linux-gnu evil_bin.c -quiet -dumpbase evil_bin.c -mtune=generic -march=x86-64 -auxbase evil_bin -fstack-protector-strong -Wformat -Wformat-security -o /tmp/ccbsSjze.s/home/ubuntuubuntu{ec2b6afe-aacb-61c1-e803-000000000000}10006no level-{ec2b6afe-bc35-61c1-f4a8-4f0000000000}9898/usr/bin/x86_64-linux-gnu-gcc-7gccubuntu 11241100x8000000000000000544527Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:21.232{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1e20822e1b0c6cd92021-12-21 11:36:21.232root 11241100x8000000000000000544528Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:21.232{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8170ca2e5c78e7a62021-12-21 11:36:21.232root 11241100x8000000000000000544529Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:21.232{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.448d4e57eaab86b12021-12-21 11:36:21.232root 11241100x8000000000000000544530Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:21.232{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a1e8832ef3721cf62021-12-21 11:36:21.232root 11241100x8000000000000000544531Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:21.232{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e771b1bf239a3bd22021-12-21 11:36:21.232root 11241100x8000000000000000544532Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:21.232{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.897a2d792d9870c52021-12-21 11:36:21.232root 11241100x8000000000000000544533Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:21.232{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6c248941bf04d59e2021-12-21 11:36:21.232root 11241100x8000000000000000544534Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:21.232{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5368e014ea6c6d612021-12-21 11:36:21.232root 11241100x8000000000000000544535Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:21.232{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.df14f39f17b741c12021-12-21 11:36:21.232root 11241100x8000000000000000544536Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:21.232{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f1b8df066c4d8b9b2021-12-21 11:36:21.232root 11241100x8000000000000000544537Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:21.232{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7f5f8a8c6d050cd42021-12-21 11:36:21.232root 11241100x8000000000000000544538Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:21.233{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4927295a0fa5d1212021-12-21 11:36:21.233root 11241100x8000000000000000544539Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:21.233{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.fc9996aa9784c45d2021-12-21 11:36:21.233root 11241100x8000000000000000544540Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:21.233{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1d864ba13a21a10c2021-12-21 11:36:21.233root 11241100x8000000000000000544541Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:21.233{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4fa234945d58bd332021-12-21 11:36:21.233root 11241100x8000000000000000544542Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:21.233{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e6fd55beda9e7cdf2021-12-21 11:36:21.233root 11241100x8000000000000000544543Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:21.233{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.81eb90272f22e1c92021-12-21 11:36:21.233root 534500x8000000000000000544544Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:21.253{ec2b6afe-bc35-61c1-7ca6-a50100000000}9899/usr/lib/gcc/x86_64-linux-gnu/7/cc1ubuntu 11241100x8000000000000000544545Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:21.253{ec2b6afe-bc35-61c1-f4a8-4f0000000000}9898/usr/bin/x86_64-linux-gnu-gcc-7/tmp/cct7qKS4.o2021-12-21 11:36:21.253ubuntu 154100x8000000000000000544546Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:21.253{ec2b6afe-bc35-61c1-28ab-390185550000}9900/usr/bin/x86_64-linux-gnu-as-----as --64 -o /tmp/cct7qKS4.o /tmp/ccbsSjze.s/home/ubuntuubuntu{ec2b6afe-aacb-61c1-e803-000000000000}10006no level-{ec2b6afe-bc35-61c1-f4a8-4f0000000000}9898/usr/bin/x86_64-linux-gnu-gcc-7gccubuntu 534500x8000000000000000544547Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:21.260{ec2b6afe-bc35-61c1-28ab-390185550000}9900/usr/bin/x86_64-linux-gnu-asubuntu 11241100x8000000000000000544548Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:21.260{ec2b6afe-bc35-61c1-f4a8-4f0000000000}9898/usr/bin/x86_64-linux-gnu-gcc-7/tmp/cctdYmdV.res2021-12-21 11:36:21.260ubuntu 154100x8000000000000000544549Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:21.260{ec2b6afe-bc35-61c1-5ca1-480000000000}9901/usr/lib/gcc/x86_64-linux-gnu/7/collect2-----/usr/lib/gcc/x86_64-linux-gnu/7/collect2 -plugin /usr/lib/gcc/x86_64-linux-gnu/7/liblto_plugin.so -plugin-opt=/usr/lib/gcc/x86_64-linux-gnu/7/lto-wrapper -plugin-opt=-fresolution=/tmp/cctdYmdV.res -plugin-opt=-pass-through=-lgcc -plugin-opt=-pass-through=-lgcc_s -plugin-opt=-pass-through=-lc -plugin-opt=-pass-through=-lgcc -plugin-opt=-pass-through=-lgcc_s --build-id --eh-frame-hdr -m elf_x86_64 --hash-style=gnu --as-needed -dynamic-linker /lib64/ld-linux-x86-64.so.2 -pie -z now -z relro -o evil2_bin /usr/lib/gcc/x86_64-linux-gnu/7/../../../x86_64-linux-gnu/Scrt1.o /usr/lib/gcc/x86_64-linux-gnu/7/../../../x86_64-linux-gnu/crti.o /usr/lib/gcc/x86_64-linux-gnu/7/crtbeginS.o -L/usr/lib/gcc/x86_64-linux-gnu/7 -L/usr/lib/gcc/x86_64-linux-gnu/7/../../../x86_64-linux-gnu -L/usr/lib/gcc/x86_64-linux-gnu/7/../../../../lib -L/lib/x86_64-linux-gnu -L/lib/../lib -L/usr/lib/x86_64-linux-gnu -L/usr/lib/../lib -L/usr/lib/gcc/x86_64-linux-gnu/7/../../.. /tmp/cct7qKS4.o -lgcc --push-state --as-needed -lgcc_s --pop-state -lc -lgcc --push-state --as-needed -lgcc_s --pop-state /usr/lib/gcc/x86_64-linux-gnu/7/crtendS.o /usr/lib/gcc/x86_64-linux-gnu/7/../../../x86_64-linux-gnu/crtn.o/home/ubuntuubuntu{ec2b6afe-aacb-61c1-e803-000000000000}10006no level-{ec2b6afe-bc35-61c1-f4a8-4f0000000000}9898/usr/bin/x86_64-linux-gnu-gcc-7gccubuntu 11241100x8000000000000000544550Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:21.261{ec2b6afe-bc35-61c1-5ca1-480000000000}9901/usr/lib/gcc/x86_64-linux-gnu/7/collect2/tmp/ccu6peYh.c2021-12-21 11:36:21.261ubuntu 11241100x8000000000000000544551Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:21.261{ec2b6afe-bc35-61c1-5ca1-480000000000}9901/usr/lib/gcc/x86_64-linux-gnu/7/collect2/tmp/cclCI5i8.o2021-12-21 11:36:21.261ubuntu 11241100x8000000000000000544552Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:21.261{ec2b6afe-bc35-61c1-5ca1-480000000000}9901/usr/lib/gcc/x86_64-linux-gnu/7/collect2/tmp/cc6ZvXDY.ld2021-12-21 11:36:21.261ubuntu 11241100x8000000000000000544553Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:21.261{ec2b6afe-bc35-61c1-5ca1-480000000000}9901/usr/lib/gcc/x86_64-linux-gnu/7/collect2/tmp/ccvzvPYO.le2021-12-21 11:36:21.261ubuntu 11241100x8000000000000000544554Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:21.261{ec2b6afe-bc35-61c1-5ca1-480000000000}9901/usr/lib/gcc/x86_64-linux-gnu/7/collect2/tmp/cc6ZvXDY.ld2021-12-21 11:36:21.261ubuntu 11241100x8000000000000000544555Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:21.261{ec2b6afe-bc35-61c1-5ca1-480000000000}9901/usr/lib/gcc/x86_64-linux-gnu/7/collect2/tmp/ccvzvPYO.le2021-12-21 11:36:21.261ubuntu 154100x8000000000000000544556Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:21.261{ec2b6afe-bc35-61c1-101b-c4117a550000}9902/usr/bin/x86_64-linux-gnu-ld.bfd-----/usr/bin/ld -plugin /usr/lib/gcc/x86_64-linux-gnu/7/liblto_plugin.so -plugin-opt=/usr/lib/gcc/x86_64-linux-gnu/7/lto-wrapper -plugin-opt=-fresolution=/tmp/cctdYmdV.res -plugin-opt=-pass-through=-lgcc -plugin-opt=-pass-through=-lgcc_s -plugin-opt=-pass-through=-lc -plugin-opt=-pass-through=-lgcc -plugin-opt=-pass-through=-lgcc_s --build-id --eh-frame-hdr -m elf_x86_64 --hash-style=gnu --as-needed -dynamic-linker /lib64/ld-linux-x86-64.so.2 -pie -z now -z relro -o evil2_bin /usr/lib/gcc/x86_64-linux-gnu/7/../../../x86_64-linux-gnu/Scrt1.o /usr/lib/gcc/x86_64-linux-gnu/7/../../../x86_64-linux-gnu/crti.o /usr/lib/gcc/x86_64-linux-gnu/7/crtbeginS.o -L/usr/lib/gcc/x86_64-linux-gnu/7 -L/usr/lib/gcc/x86_64-linux-gnu/7/../../../x86_64-linux-gnu -L/usr/lib/gcc/x86_64-linux-gnu/7/../../../../lib -L/lib/x86_64-linux-gnu -L/lib/../lib -L/usr/lib/x86_64-linux-gnu -L/usr/lib/../lib -L/usr/lib/gcc/x86_64-linux-gnu/7/../../.. /tmp/cct7qKS4.o -lgcc --push-state --as-needed -lgcc_s --pop-state -lc -lgcc --push-state --as-needed -lgcc_s --pop-state /usr/lib/gcc/x86_64-linux-gnu/7/crtendS.o /usr/lib/gcc/x86_64-linux-gnu/7/../../../x86_64-linux-gnu/crtn.o/home/ubuntuubuntu{ec2b6afe-aacb-61c1-e803-000000000000}10006no level-{ec2b6afe-bc35-61c1-5ca1-480000000000}9901/usr/lib/gcc/x86_64-linux-gnu/7/collect2/usr/lib/gcc/x86_64-linux-gnu/7/collect2ubuntu 11241100x8000000000000000544557Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:21.263{ec2b6afe-bc35-61c1-101b-c4117a550000}9902/usr/bin/x86_64-linux-gnu-ld.bfd/home/ubuntu/evil2_bin2021-12-21 11:36:21.263ubuntu 534500x8000000000000000544558Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:21.289{ec2b6afe-bc35-61c1-101b-c4117a550000}9902/usr/bin/x86_64-linux-gnu-ld.bfdubuntu 23542300x8000000000000000544559Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:21.289{ec2b6afe-bc35-61c1-5ca1-480000000000}9901ubuntu/usr/lib/gcc/x86_64-linux-gnu/7/collect2/tmp/cc6ZvXDY.ld--- 23542300x8000000000000000544560Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:21.289{ec2b6afe-bc35-61c1-5ca1-480000000000}9901ubuntu/usr/lib/gcc/x86_64-linux-gnu/7/collect2/tmp/ccvzvPYO.le--- 23542300x8000000000000000544561Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:21.289{ec2b6afe-bc35-61c1-5ca1-480000000000}9901ubuntu/usr/lib/gcc/x86_64-linux-gnu/7/collect2/tmp/ccu6peYh.c--- 23542300x8000000000000000544562Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:21.289{ec2b6afe-bc35-61c1-5ca1-480000000000}9901ubuntu/usr/lib/gcc/x86_64-linux-gnu/7/collect2/tmp/cclCI5i8.o--- 534500x8000000000000000544563Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:21.289{ec2b6afe-bc35-61c1-5ca1-480000000000}9901/usr/lib/gcc/x86_64-linux-gnu/7/collect2ubuntu 23542300x8000000000000000544564Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:21.289{ec2b6afe-bc35-61c1-f4a8-4f0000000000}9898ubuntu/usr/bin/x86_64-linux-gnu-gcc-7/tmp/cctdYmdV.res--- 23542300x8000000000000000544565Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:21.289{ec2b6afe-bc35-61c1-f4a8-4f0000000000}9898ubuntu/usr/bin/x86_64-linux-gnu-gcc-7/tmp/cct7qKS4.o--- 23542300x8000000000000000544566Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:21.289{ec2b6afe-bc35-61c1-f4a8-4f0000000000}9898ubuntu/usr/bin/x86_64-linux-gnu-gcc-7/tmp/ccbsSjze.s--- 534500x8000000000000000544567Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:21.289{ec2b6afe-bc35-61c1-f4a8-4f0000000000}9898/usr/bin/x86_64-linux-gnu-gcc-7ubuntu 11241100x8000000000000000544568Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:21.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ab0735e1dc99eb562021-12-21 11:36:21.693root 11241100x8000000000000000544569Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:21.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c50db855ee1bd36d2021-12-21 11:36:21.693root 11241100x8000000000000000544570Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:21.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0334db1952a41d092021-12-21 11:36:21.693root 11241100x8000000000000000544571Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:21.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.201753cf1ed349e72021-12-21 11:36:21.693root 11241100x8000000000000000544572Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:21.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b5608703724920b02021-12-21 11:36:21.693root 11241100x8000000000000000544573Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:21.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.819140c9d57f8a752021-12-21 11:36:21.693root 11241100x8000000000000000544574Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:21.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3428a4ed45b4b4502021-12-21 11:36:21.693root 11241100x8000000000000000544575Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:21.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.db6ea58f64be4ad02021-12-21 11:36:21.693root 11241100x8000000000000000544576Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:21.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d2c157530f72762c2021-12-21 11:36:21.694root 11241100x8000000000000000544577Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:21.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d12c9e381dc6ded72021-12-21 11:36:21.694root 11241100x8000000000000000544578Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:21.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4017dc79c6c374e72021-12-21 11:36:21.694root 11241100x8000000000000000544579Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:21.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d4505011541768462021-12-21 11:36:21.694root 11241100x8000000000000000544580Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:21.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e52e935e76d11d732021-12-21 11:36:21.694root 11241100x8000000000000000544581Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:21.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ed968c290d5b3b2f2021-12-21 11:36:21.694root 11241100x8000000000000000544582Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:21.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.78253caab7f317812021-12-21 11:36:21.694root 11241100x8000000000000000544583Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:21.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4ab348fb1b15cc142021-12-21 11:36:21.694root 11241100x8000000000000000544584Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:21.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0a5c7274c524045c2021-12-21 11:36:21.694root 11241100x8000000000000000544585Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:21.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7f83b421bf151a752021-12-21 11:36:21.694root 11241100x8000000000000000544586Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:21.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.902fee882488fabf2021-12-21 11:36:21.694root 11241100x8000000000000000544587Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:21.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.cdb5ff2f028307b32021-12-21 11:36:21.694root 11241100x8000000000000000544588Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:21.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6704d329496faffe2021-12-21 11:36:21.694root 11241100x8000000000000000544589Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:21.695{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.66cfa5476a8834b62021-12-21 11:36:21.695root 11241100x8000000000000000544590Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:21.695{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.232fc6dea3e2a2d22021-12-21 11:36:21.695root 11241100x8000000000000000544591Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:21.695{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.14239248b30ee2782021-12-21 11:36:21.695root 11241100x8000000000000000544592Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:21.695{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.afc639f411b9d53c2021-12-21 11:36:21.695root 11241100x8000000000000000544593Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:21.695{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9a484b91dd7040c62021-12-21 11:36:21.695root 11241100x8000000000000000544594Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:21.695{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1a727d70c49263f22021-12-21 11:36:21.695root 11241100x8000000000000000544595Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:21.695{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6fd801ea6920c26c2021-12-21 11:36:21.695root 11241100x8000000000000000544596Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:21.695{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3b7761deb78eceb62021-12-21 11:36:21.695root 11241100x8000000000000000544597Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:21.695{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5a154a13c99084ab2021-12-21 11:36:21.695root 11241100x8000000000000000544598Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:21.695{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7bc7960ee1e8cd572021-12-21 11:36:21.695root 11241100x8000000000000000544599Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:21.695{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.15f491c1bd8b8a4d2021-12-21 11:36:21.695root 11241100x8000000000000000544600Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:21.696{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.23a127db86ca283f2021-12-21 11:36:21.696root 11241100x8000000000000000544601Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:21.696{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b1585e48501ef5a32021-12-21 11:36:21.696root 11241100x8000000000000000544602Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:21.696{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a206adc0a6129d272021-12-21 11:36:21.696root 11241100x8000000000000000544603Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:21.696{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0eff0c2e87e799052021-12-21 11:36:21.696root 11241100x8000000000000000544604Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:21.696{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.fb370bbb7989baa32021-12-21 11:36:21.696root 11241100x8000000000000000544605Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:21.696{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.28d8d0ce64bc87e12021-12-21 11:36:21.696root 11241100x8000000000000000544606Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:21.696{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.74312a9f1755dc5f2021-12-21 11:36:21.696root 11241100x8000000000000000544607Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:21.696{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9e1af05aeb727b552021-12-21 11:36:21.696root 11241100x8000000000000000544608Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:21.696{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f803e4f842b745722021-12-21 11:36:21.696root 11241100x8000000000000000544609Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:21.696{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9d341a352a2da0a02021-12-21 11:36:21.696root 11241100x8000000000000000544610Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:21.696{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.dd9df5009483e9af2021-12-21 11:36:21.696root 11241100x8000000000000000544611Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:21.697{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.329a9c4a2ef5e0052021-12-21 11:36:21.697root 11241100x8000000000000000544612Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:21.697{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.172a1b9b352f4e8c2021-12-21 11:36:21.697root 11241100x8000000000000000544613Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:21.697{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.24fac220eabee8442021-12-21 11:36:21.697root 11241100x8000000000000000544614Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:21.697{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b67effe025eaffd02021-12-21 11:36:21.697root 11241100x8000000000000000544615Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:21.697{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.92d8c63bc220bc172021-12-21 11:36:21.697root 11241100x8000000000000000544616Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:21.697{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c1745391b97e5b5a2021-12-21 11:36:21.697root 11241100x8000000000000000544617Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:21.697{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e5da4707be9635312021-12-21 11:36:21.697root 11241100x8000000000000000544618Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:21.697{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0a6cb5e140b9e73c2021-12-21 11:36:21.697root 11241100x8000000000000000544619Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:21.697{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a69bfabc7e7056ec2021-12-21 11:36:21.697root 11241100x8000000000000000544620Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:21.698{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.020d031a3b76f5f72021-12-21 11:36:21.698root 11241100x8000000000000000544621Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:21.698{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b4873986ffb404542021-12-21 11:36:21.698root 11241100x8000000000000000544622Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:21.698{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d096fbea42f926722021-12-21 11:36:21.698root 11241100x8000000000000000544623Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:21.698{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.66470349a6683e542021-12-21 11:36:21.698root 11241100x8000000000000000544624Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:21.698{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.404ca330c576530e2021-12-21 11:36:21.698root 11241100x8000000000000000544625Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:21.698{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.31b35c343ae16c952021-12-21 11:36:21.698root 11241100x8000000000000000544626Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:21.698{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.49e8db03d303eb482021-12-21 11:36:21.698root 11241100x8000000000000000544627Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:21.698{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b3008bd6fc21e00f2021-12-21 11:36:21.698root 11241100x8000000000000000544628Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:21.698{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1ca3444cbeec8c052021-12-21 11:36:21.698root 11241100x8000000000000000544629Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:21.698{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4dd97a18f416731d2021-12-21 11:36:21.698root 11241100x8000000000000000544630Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:21.699{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.da3e50fb5be21b1f2021-12-21 11:36:21.699root 11241100x8000000000000000544631Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:21.699{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8ddfd43668e8195e2021-12-21 11:36:21.699root 11241100x8000000000000000544632Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:21.699{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e156283a0bebe90e2021-12-21 11:36:21.699root 11241100x8000000000000000544633Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:21.699{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e1689f0cd438d4e72021-12-21 11:36:21.699root 11241100x8000000000000000544634Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:21.699{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.13c094cd778de7ce2021-12-21 11:36:21.699root 11241100x8000000000000000544635Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:21.699{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.de6b6c7d4acd386e2021-12-21 11:36:21.699root 11241100x8000000000000000544636Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:21.699{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2798197b7c87b2dd2021-12-21 11:36:21.699root 11241100x8000000000000000544637Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:21.699{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.bacda20289aadc5d2021-12-21 11:36:21.699root 11241100x8000000000000000544638Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:21.699{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1016a3601ef0d2782021-12-21 11:36:21.699root 11241100x8000000000000000544639Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:21.699{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a4a182e03d7759c92021-12-21 11:36:21.699root 11241100x8000000000000000544640Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:21.699{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.65a30bb94a1dbf5d2021-12-21 11:36:21.699root 11241100x8000000000000000544641Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:21.699{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.41ed5ecb92953ebb2021-12-21 11:36:21.699root 11241100x8000000000000000544642Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:21.700{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7e29d9d5072bad5b2021-12-21 11:36:21.700root 11241100x8000000000000000544643Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:21.700{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9dd74a50081849bc2021-12-21 11:36:21.700root 11241100x8000000000000000544644Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:21.700{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.277ebe67929ebf582021-12-21 11:36:21.700root 11241100x8000000000000000544645Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:21.700{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.687bed4dab2d12f42021-12-21 11:36:21.700root 11241100x8000000000000000544646Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:21.700{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5a4855c1624c5a6c2021-12-21 11:36:21.700root 11241100x8000000000000000544647Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:21.700{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ee0a493aba968b482021-12-21 11:36:21.700root 11241100x8000000000000000544648Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:21.700{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7c7630bcf4e6337e2021-12-21 11:36:21.700root 11241100x8000000000000000544649Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:22.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.475a31691c9b6cfb2021-12-21 11:36:22.193root 11241100x8000000000000000544650Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:22.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3c96bbe0a312e9962021-12-21 11:36:22.193root 11241100x8000000000000000544651Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:22.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.48069b109915c9f82021-12-21 11:36:22.193root 11241100x8000000000000000544652Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:22.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a018421510a6d4642021-12-21 11:36:22.193root 11241100x8000000000000000544653Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:22.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2c886efcdee9694a2021-12-21 11:36:22.193root 11241100x8000000000000000544654Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:22.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1fc6beea7755721b2021-12-21 11:36:22.193root 11241100x8000000000000000544655Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:22.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4a174b460c88b1c72021-12-21 11:36:22.194root 11241100x8000000000000000544656Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:22.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8c4fa874b932b8a42021-12-21 11:36:22.194root 11241100x8000000000000000544657Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:22.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.121b1cfe06bf650e2021-12-21 11:36:22.194root 11241100x8000000000000000544658Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:22.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.fd64047583c082482021-12-21 11:36:22.194root 11241100x8000000000000000544659Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:22.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f096e6fdbbd32ea22021-12-21 11:36:22.194root 11241100x8000000000000000544660Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:22.195{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.eb0822e452816bef2021-12-21 11:36:22.195root 11241100x8000000000000000544661Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:22.195{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.64015ca9091d66de2021-12-21 11:36:22.195root 11241100x8000000000000000544662Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:22.195{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.bd225d15b3cfbcd32021-12-21 11:36:22.195root 11241100x8000000000000000544663Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:22.195{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.01b910dff2ce08172021-12-21 11:36:22.195root 11241100x8000000000000000544664Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:22.195{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.286a950ec31093652021-12-21 11:36:22.195root 11241100x8000000000000000544665Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:22.195{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.90ed7b1ef8a2c49a2021-12-21 11:36:22.195root 11241100x8000000000000000544666Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:22.195{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.504eafb357986dc12021-12-21 11:36:22.195root 11241100x8000000000000000544667Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:22.196{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c44d15f4de6347752021-12-21 11:36:22.196root 11241100x8000000000000000544668Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:22.196{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1b58ec2ec742ab162021-12-21 11:36:22.196root 11241100x8000000000000000544669Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:22.196{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.569094715de20d812021-12-21 11:36:22.196root 11241100x8000000000000000544670Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:22.196{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3cbcc83e952a357b2021-12-21 11:36:22.196root 11241100x8000000000000000544671Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:22.196{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6727c5a4ee7125b62021-12-21 11:36:22.196root 11241100x8000000000000000544672Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:22.196{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.085a90161f18eb7d2021-12-21 11:36:22.196root 11241100x8000000000000000544673Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:22.196{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f0c4c566d27bdeac2021-12-21 11:36:22.196root 11241100x8000000000000000544674Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:22.197{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ed6ff5bd6d499af72021-12-21 11:36:22.197root 11241100x8000000000000000544675Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:22.197{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6843f5d6b664f1db2021-12-21 11:36:22.197root 11241100x8000000000000000544676Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:22.197{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c50b700205ec10502021-12-21 11:36:22.197root 11241100x8000000000000000544677Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:22.197{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.121596cb686c8b942021-12-21 11:36:22.197root 11241100x8000000000000000544678Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:22.197{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1f32ef02c67860be2021-12-21 11:36:22.197root 11241100x8000000000000000544679Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:22.197{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d05f7a0fa8fa10ad2021-12-21 11:36:22.197root 11241100x8000000000000000544680Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:22.197{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.bc54a945771201222021-12-21 11:36:22.197root 11241100x8000000000000000544681Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:22.197{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.04f4028636f000b22021-12-21 11:36:22.197root 11241100x8000000000000000544682Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:22.197{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4340c8f1871cca9e2021-12-21 11:36:22.197root 11241100x8000000000000000544683Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:22.197{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.545e12e4f057d1f82021-12-21 11:36:22.197root 11241100x8000000000000000544684Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:22.197{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.bceae3d0420ea59c2021-12-21 11:36:22.197root 11241100x8000000000000000544685Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:22.198{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ce5f9fa3266cff122021-12-21 11:36:22.198root 11241100x8000000000000000544686Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:22.198{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9b3e5ec7ec2cc62d2021-12-21 11:36:22.198root 11241100x8000000000000000544687Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:22.198{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e43e948bb878dd4e2021-12-21 11:36:22.198root 11241100x8000000000000000544688Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:22.198{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.537dcc5a422fa0b82021-12-21 11:36:22.198root 11241100x8000000000000000544689Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:22.198{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.704ae7054ff307be2021-12-21 11:36:22.198root 11241100x8000000000000000544690Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:22.198{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f99335f9b1c0b62f2021-12-21 11:36:22.198root 11241100x8000000000000000544691Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:22.198{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.733b84dd18b3e0962021-12-21 11:36:22.198root 11241100x8000000000000000544692Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:22.198{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.79a2b3b7592f2fcf2021-12-21 11:36:22.198root 11241100x8000000000000000544693Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:22.198{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5f5c8e35d1ab7c992021-12-21 11:36:22.198root 11241100x8000000000000000544694Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:22.198{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f083be88092640432021-12-21 11:36:22.198root 11241100x8000000000000000544695Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:22.198{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.286f66b655f284cc2021-12-21 11:36:22.198root 11241100x8000000000000000544696Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:22.199{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.aa1df75af58bd6812021-12-21 11:36:22.199root 11241100x8000000000000000544697Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:22.199{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.44b3716b1eae1afb2021-12-21 11:36:22.199root 11241100x8000000000000000544698Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:22.199{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0abf068d37f930762021-12-21 11:36:22.199root 11241100x8000000000000000544699Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:22.199{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.427ce3ef82d530d12021-12-21 11:36:22.199root 11241100x8000000000000000544700Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:22.199{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c73a939bf4203cc12021-12-21 11:36:22.199root 11241100x8000000000000000544701Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:22.199{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4b2f7b9925bb48532021-12-21 11:36:22.199root 11241100x8000000000000000544702Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:22.199{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5c5fce9be494fadd2021-12-21 11:36:22.199root 11241100x8000000000000000544703Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:22.199{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d348a4de4605458e2021-12-21 11:36:22.199root 11241100x8000000000000000544704Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:22.199{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c3beb90b863cbb942021-12-21 11:36:22.199root 11241100x8000000000000000544705Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:22.199{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.32f537a9afa2d43e2021-12-21 11:36:22.199root 11241100x8000000000000000544706Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:22.199{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2b208026fb1dca9e2021-12-21 11:36:22.199root 11241100x8000000000000000544707Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:22.200{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a4958b1128e6e0202021-12-21 11:36:22.200root 11241100x8000000000000000544708Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:22.200{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0a5f74a5cabfdf3b2021-12-21 11:36:22.200root 11241100x8000000000000000544709Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:22.200{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3cab9ac71ad00af32021-12-21 11:36:22.200root 11241100x8000000000000000544710Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:22.200{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e8a94e144cac7fd32021-12-21 11:36:22.200root 11241100x8000000000000000544711Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:22.200{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.44f1ac03fa04cd262021-12-21 11:36:22.200root 154100x8000000000000000544712Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:22.535{ec2b6afe-bc36-61c1-e866-dca924560000}9903/bin/ls-----ls --color=auto -l/home/ubuntuubuntu{ec2b6afe-aacb-61c1-e803-000000000000}10006no level-{ec2b6afe-aacb-61c1-0834-fdd63c560000}5677/bin/bash-bashubuntu 11241100x8000000000000000544713Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:22.537{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f4b394f0ca223ee82021-12-21 11:36:22.537root 11241100x8000000000000000544714Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:22.537{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.83dd26b845c645c32021-12-21 11:36:22.537root 11241100x8000000000000000544715Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:22.538{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.bb955c4f0d6d04492021-12-21 11:36:22.538root 534500x8000000000000000544716Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:22.538{ec2b6afe-bc36-61c1-e866-dca924560000}9903/bin/lsubuntu 11241100x8000000000000000544717Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:22.539{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5ba359dbd528335e2021-12-21 11:36:22.539root 11241100x8000000000000000544718Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:22.539{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6bb40466717e0dff2021-12-21 11:36:22.539root 11241100x8000000000000000544719Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:22.540{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.85100e1f42ddd22b2021-12-21 11:36:22.540root 11241100x8000000000000000544720Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:22.540{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b0be951d7cef69322021-12-21 11:36:22.540root 11241100x8000000000000000544721Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:22.540{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f69306f87e3291ca2021-12-21 11:36:22.540root 11241100x8000000000000000544722Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:22.540{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3db1a66d97fa50a12021-12-21 11:36:22.540root 11241100x8000000000000000544723Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:22.540{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.67ac64f2977016982021-12-21 11:36:22.540root 11241100x8000000000000000544724Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:22.541{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ce97e33bffb003472021-12-21 11:36:22.541root 11241100x8000000000000000544725Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:22.541{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ba6743dbb49e62c42021-12-21 11:36:22.541root 11241100x8000000000000000544726Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:22.541{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1124076bb13065622021-12-21 11:36:22.541root 11241100x8000000000000000544727Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:22.541{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c982b686774416592021-12-21 11:36:22.541root 11241100x8000000000000000544728Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:22.541{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8903ccb40cc5994c2021-12-21 11:36:22.541root 11241100x8000000000000000544729Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:22.541{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.89f0ec1591ff7a902021-12-21 11:36:22.541root 11241100x8000000000000000544730Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:22.542{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.55c30eff4164e0c22021-12-21 11:36:22.542root 11241100x8000000000000000544731Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:22.542{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8280dcd7a405981e2021-12-21 11:36:22.542root 11241100x8000000000000000544732Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:22.542{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.531b87ef0e015b002021-12-21 11:36:22.542root 11241100x8000000000000000544733Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:22.542{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1ad34263c643a7782021-12-21 11:36:22.542root 11241100x8000000000000000544734Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:22.542{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.bdbb68b974699fd82021-12-21 11:36:22.542root 11241100x8000000000000000544735Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:22.542{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.641341069ff439282021-12-21 11:36:22.542root 11241100x8000000000000000544736Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:22.542{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e2ce6e84c3ceeed92021-12-21 11:36:22.542root 11241100x8000000000000000544737Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:22.542{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6915e94c395652222021-12-21 11:36:22.542root 11241100x8000000000000000544738Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:22.543{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7d1835a2d275c7022021-12-21 11:36:22.543root 11241100x8000000000000000544739Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:22.543{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1767f2f0ed0658af2021-12-21 11:36:22.543root 11241100x8000000000000000544740Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:22.543{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.bddddeadcb7e96f92021-12-21 11:36:22.543root 11241100x8000000000000000544741Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:22.543{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c8f26e4aef3112452021-12-21 11:36:22.543root 11241100x8000000000000000544742Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:22.543{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e4dfc5ef1aa846ab2021-12-21 11:36:22.543root 11241100x8000000000000000544743Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:22.543{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.016eb34a264a03e52021-12-21 11:36:22.543root 11241100x8000000000000000544744Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:22.543{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b3a79a3ce1117e9d2021-12-21 11:36:22.543root 11241100x8000000000000000544745Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:22.543{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e40df2ad102ee1a92021-12-21 11:36:22.543root 11241100x8000000000000000544746Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:22.544{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.41f0ce0b5184f8c42021-12-21 11:36:22.544root 11241100x8000000000000000544747Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:22.544{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.97d6fa2da5ceff862021-12-21 11:36:22.544root 11241100x8000000000000000544748Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:22.544{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e1c7aae9f9f3d3d62021-12-21 11:36:22.544root 11241100x8000000000000000544749Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:22.544{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d6c395501d3659a42021-12-21 11:36:22.544root 11241100x8000000000000000544750Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:22.544{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.77910a3513955ab12021-12-21 11:36:22.544root 11241100x8000000000000000544751Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:22.544{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8e85553513adb7ae2021-12-21 11:36:22.544root 11241100x8000000000000000544752Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:22.544{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.bfdc644a05b1786d2021-12-21 11:36:22.544root 11241100x8000000000000000544753Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:22.545{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1a65976293c967e22021-12-21 11:36:22.545root 11241100x8000000000000000544754Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:22.545{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5a160017b27b8e6b2021-12-21 11:36:22.545root 11241100x8000000000000000544755Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:22.545{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.11b08ee2d9411d052021-12-21 11:36:22.545root 11241100x8000000000000000544756Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:22.545{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4d7ed0d0c2a7655b2021-12-21 11:36:22.545root 11241100x8000000000000000544757Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:22.545{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e4916d5175f4803a2021-12-21 11:36:22.545root 11241100x8000000000000000544758Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:22.545{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.78ab170d93abb38b2021-12-21 11:36:22.545root 11241100x8000000000000000544759Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:22.545{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d3d956e16948ac742021-12-21 11:36:22.545root 11241100x8000000000000000544760Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:22.545{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6339c2aa03f437892021-12-21 11:36:22.545root 11241100x8000000000000000544761Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:22.545{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.044a54d8b30e3fb02021-12-21 11:36:22.545root 11241100x8000000000000000544762Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:22.545{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.88d81a6a6087cd5e2021-12-21 11:36:22.545root 11241100x8000000000000000544763Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:22.546{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.94990c69d62ef7592021-12-21 11:36:22.546root 11241100x8000000000000000544764Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:22.546{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.65fd3f3327b867392021-12-21 11:36:22.546root 11241100x8000000000000000544765Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:22.546{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.09b9f1b86861194a2021-12-21 11:36:22.546root 11241100x8000000000000000544766Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:22.546{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4c0171d70e285e482021-12-21 11:36:22.546root 11241100x8000000000000000544767Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:22.546{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e672ab453471c1042021-12-21 11:36:22.546root 11241100x8000000000000000544768Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:22.546{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.09feff81a4f0011e2021-12-21 11:36:22.546root 11241100x8000000000000000544769Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:22.546{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c1455cc4ceb8a2e52021-12-21 11:36:22.546root 11241100x8000000000000000544770Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:22.546{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.91dc596456fb3c892021-12-21 11:36:22.546root 11241100x8000000000000000544771Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:22.546{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e7e27dbec78059202021-12-21 11:36:22.546root 11241100x8000000000000000544772Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:22.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.792a47d2f66d51432021-12-21 11:36:22.943root 11241100x8000000000000000544773Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:22.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f89007ef644b36162021-12-21 11:36:22.943root 11241100x8000000000000000544774Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:22.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5874dbb535b5dd372021-12-21 11:36:22.943root 11241100x8000000000000000544775Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:22.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.dd39c1fa4f421bb52021-12-21 11:36:22.943root 11241100x8000000000000000544776Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:22.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5170693d76ac9d282021-12-21 11:36:22.943root 11241100x8000000000000000544777Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:22.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2287e015b46bf6a62021-12-21 11:36:22.943root 11241100x8000000000000000544778Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:22.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.89c0d87b5b4a07432021-12-21 11:36:22.943root 11241100x8000000000000000544779Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:22.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5475b13baeeb2af32021-12-21 11:36:22.943root 11241100x8000000000000000544780Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:22.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7753162e1181549b2021-12-21 11:36:22.944root 11241100x8000000000000000544781Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:22.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a3bf5d9f3a14976e2021-12-21 11:36:22.944root 11241100x8000000000000000544782Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:22.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.eb9115b9bfa33f902021-12-21 11:36:22.944root 11241100x8000000000000000544783Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:22.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.20f1349de78e14a72021-12-21 11:36:22.944root 11241100x8000000000000000544784Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:22.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.dd470db381f8ad742021-12-21 11:36:22.944root 11241100x8000000000000000544785Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:22.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.57b4a7cf69f720a12021-12-21 11:36:22.944root 11241100x8000000000000000544786Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:22.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.10ba6bb481e105cb2021-12-21 11:36:22.944root 11241100x8000000000000000544787Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:22.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c58b8eadcb2d6ba62021-12-21 11:36:22.944root 11241100x8000000000000000544788Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:22.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.baeb2d2c254042b62021-12-21 11:36:22.944root 11241100x8000000000000000544789Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:22.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4c915b9be1ca5cff2021-12-21 11:36:22.944root 11241100x8000000000000000544790Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:22.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.135e36b5f0cc77db2021-12-21 11:36:22.945root 11241100x8000000000000000544791Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:22.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.dda8380590ad3b2f2021-12-21 11:36:22.945root 11241100x8000000000000000544792Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:22.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7fb54091229647d42021-12-21 11:36:22.945root 11241100x8000000000000000544793Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:22.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1b297a26bb574c8f2021-12-21 11:36:22.945root 11241100x8000000000000000544794Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:22.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.31dcd7168aee02a32021-12-21 11:36:22.945root 11241100x8000000000000000544795Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:22.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ff43a056855a3d392021-12-21 11:36:22.945root 11241100x8000000000000000544796Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:22.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.54478a6f92d88a772021-12-21 11:36:22.945root 11241100x8000000000000000544797Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:22.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c2776ffc79d458002021-12-21 11:36:22.945root 11241100x8000000000000000544798Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:22.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.beda73813d3218fb2021-12-21 11:36:22.945root 11241100x8000000000000000544799Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:22.946{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5fa07e4370d137832021-12-21 11:36:22.946root 11241100x8000000000000000544800Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:22.946{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2e761999b17b2e862021-12-21 11:36:22.946root 11241100x8000000000000000544801Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:22.946{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.478f0667342560eb2021-12-21 11:36:22.946root 11241100x8000000000000000544802Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:22.946{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.52630283fe7800f62021-12-21 11:36:22.946root 11241100x8000000000000000544803Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:22.946{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.34bda668100e8c2f2021-12-21 11:36:22.946root 11241100x8000000000000000544804Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:22.946{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6aaeb3ac8e545a162021-12-21 11:36:22.946root 11241100x8000000000000000544805Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:22.946{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a77dfe467cac913b2021-12-21 11:36:22.946root 11241100x8000000000000000544806Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:22.947{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d1da289a0bec79dd2021-12-21 11:36:22.947root 11241100x8000000000000000544807Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:22.947{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.204c73b2edf2b2e02021-12-21 11:36:22.947root 11241100x8000000000000000544808Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:22.947{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1d8977c0abeccb842021-12-21 11:36:22.947root 11241100x8000000000000000544809Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:22.947{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.37f1799d62d3dc902021-12-21 11:36:22.947root 11241100x8000000000000000544810Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:22.947{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1fd6629b877160ee2021-12-21 11:36:22.947root 11241100x8000000000000000544811Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:22.947{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c9206414e49ccb222021-12-21 11:36:22.947root 11241100x8000000000000000544812Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:22.947{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.cd2d39398e665bbb2021-12-21 11:36:22.947root 11241100x8000000000000000544813Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:22.948{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.196f5cf849ee90af2021-12-21 11:36:22.948root 11241100x8000000000000000544814Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:22.948{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.72a9cb4ddea0ecac2021-12-21 11:36:22.948root 11241100x8000000000000000544815Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:22.948{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c184f426229c18032021-12-21 11:36:22.948root 11241100x8000000000000000544816Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:22.948{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f7766013c41415852021-12-21 11:36:22.948root 11241100x8000000000000000544817Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:22.948{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2e8ed460ea39ae042021-12-21 11:36:22.948root 11241100x8000000000000000544818Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:22.948{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.691b9f9430ceb9a32021-12-21 11:36:22.948root 11241100x8000000000000000544819Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:22.948{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9931efb4fa4535282021-12-21 11:36:22.948root 11241100x8000000000000000544820Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:22.948{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1010b2b78231edf62021-12-21 11:36:22.948root 11241100x8000000000000000544821Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:22.949{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.10749591f680bbe22021-12-21 11:36:22.949root 11241100x8000000000000000544822Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:22.949{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9c32e4ecd54bee012021-12-21 11:36:22.949root 11241100x8000000000000000544823Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:22.949{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.70dc2ff76f8f03952021-12-21 11:36:22.949root 11241100x8000000000000000544824Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:22.949{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.957082332711ca422021-12-21 11:36:22.949root 11241100x8000000000000000544825Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:22.949{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.44d2b0ea2cc8d72c2021-12-21 11:36:22.949root 11241100x8000000000000000544826Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:22.949{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d621e27a69abef9b2021-12-21 11:36:22.949root 11241100x8000000000000000544827Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:22.949{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.dd3ff4b874421dfc2021-12-21 11:36:22.949root 11241100x8000000000000000544828Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:22.950{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b616a75a414b6afc2021-12-21 11:36:22.950root 11241100x8000000000000000544829Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:22.950{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.710c5c8590adb7b62021-12-21 11:36:22.950root 11241100x8000000000000000544830Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:22.950{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1517edcea43f72202021-12-21 11:36:22.950root 11241100x8000000000000000544831Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:22.950{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6046aba2867b2e772021-12-21 11:36:22.950root 11241100x8000000000000000544832Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:22.950{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5c90dd60a5f6321d2021-12-21 11:36:22.950root 11241100x8000000000000000544833Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:22.950{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e0a391f482e1b90b2021-12-21 11:36:22.950root 11241100x8000000000000000544834Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:22.951{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ce79a437ee154a762021-12-21 11:36:22.951root 11241100x8000000000000000544835Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:22.951{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.93c6991941ee2ab82021-12-21 11:36:22.951root 11241100x8000000000000000544836Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:22.951{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ab6d07a083a586d42021-12-21 11:36:22.951root 11241100x8000000000000000544837Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:22.951{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.469ec5cddcc03b282021-12-21 11:36:22.951root 11241100x8000000000000000544838Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:22.951{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7dc9fe4e067fb1202021-12-21 11:36:22.951root 11241100x8000000000000000544839Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:22.952{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4c11a7badf73982d2021-12-21 11:36:22.952root 11241100x8000000000000000544840Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:22.952{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.949a847d1df99a6b2021-12-21 11:36:22.952root 11241100x8000000000000000544841Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:22.952{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.468b3085ee4387e82021-12-21 11:36:22.952root 11241100x8000000000000000544842Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:22.952{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.03a14505d9281e122021-12-21 11:36:22.952root 11241100x8000000000000000544843Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:22.953{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3445a129c8bbe89c2021-12-21 11:36:22.953root 11241100x8000000000000000544844Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:22.953{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.dfc4c561c77283352021-12-21 11:36:22.953root 11241100x8000000000000000544845Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:22.953{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f0c917cb82e302222021-12-21 11:36:22.953root 11241100x8000000000000000544846Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:22.953{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a18d3e382cc5b7832021-12-21 11:36:22.953root 11241100x8000000000000000544847Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:22.953{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.feb5fbec3ce30ffd2021-12-21 11:36:22.953root 11241100x8000000000000000544848Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:22.953{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7b834bc52a0d34732021-12-21 11:36:22.953root 11241100x8000000000000000544849Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:22.953{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.75eea63482428b3e2021-12-21 11:36:22.953root 11241100x8000000000000000544850Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:22.954{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6cfe8445dbda368b2021-12-21 11:36:22.954root 11241100x8000000000000000544851Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:22.954{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ea65d586fceaedf02021-12-21 11:36:22.954root 11241100x8000000000000000544852Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:22.954{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b3a3ae794668f8f12021-12-21 11:36:22.954root 11241100x8000000000000000544853Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:22.955{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.314cfd459005e0a32021-12-21 11:36:22.955root 11241100x8000000000000000544854Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:22.955{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8685427f8550f1c82021-12-21 11:36:22.955root 11241100x8000000000000000544855Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:22.955{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5af23cf4bbf531992021-12-21 11:36:22.955root 11241100x8000000000000000544856Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:22.955{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.87e420bfc260cf272021-12-21 11:36:22.955root 11241100x8000000000000000544857Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:22.956{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.bcbbc75c5f94904e2021-12-21 11:36:22.956root 11241100x8000000000000000544858Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:22.956{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ce1a3f0e2e0deacb2021-12-21 11:36:22.956root 11241100x8000000000000000544859Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:22.956{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d3019b978b8badbe2021-12-21 11:36:22.956root 11241100x8000000000000000544860Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:22.956{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6acb5921c42619ed2021-12-21 11:36:22.956root 11241100x8000000000000000544861Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:22.956{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.36831137af80abde2021-12-21 11:36:22.956root 11241100x8000000000000000544862Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:22.956{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ce22973ac5c4d2792021-12-21 11:36:22.956root 11241100x8000000000000000544863Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:22.957{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.02daa2670c9aa2b02021-12-21 11:36:22.957root 11241100x8000000000000000544864Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:22.957{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1b054337027b29212021-12-21 11:36:22.957root 11241100x8000000000000000544865Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:22.957{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4d92c4fe32dd263f2021-12-21 11:36:22.957root 11241100x8000000000000000544866Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:22.957{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.89b11ffd63a2c3782021-12-21 11:36:22.957root 11241100x8000000000000000544867Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:22.957{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e9b5f5ae301680252021-12-21 11:36:22.957root 11241100x8000000000000000544868Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:22.958{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.fcca70269050ada12021-12-21 11:36:22.958root 11241100x8000000000000000544869Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:22.958{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.cd701fb633f5d3312021-12-21 11:36:22.958root 11241100x8000000000000000544870Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:22.958{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5ea55fc37d7d26652021-12-21 11:36:22.958root 11241100x8000000000000000544871Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:22.958{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a4537dec52f92f8d2021-12-21 11:36:22.958root 11241100x8000000000000000544872Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:22.959{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8bef82eb59ec71d22021-12-21 11:36:22.959root 11241100x8000000000000000544873Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:22.959{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.679d148c576ac4c02021-12-21 11:36:22.959root 11241100x8000000000000000544874Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:22.959{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.65c37b6b3f4c6b162021-12-21 11:36:22.959root 11241100x8000000000000000544875Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:22.959{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.93b8a092dcc0787e2021-12-21 11:36:22.959root 11241100x8000000000000000544876Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:22.959{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0de909a6e7bd6cf12021-12-21 11:36:22.959root 11241100x8000000000000000544877Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:22.959{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.bc4bcf80ec9f67242021-12-21 11:36:22.959root 11241100x8000000000000000544878Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:22.959{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.cdd5e8e1ee5b9ad52021-12-21 11:36:22.959root 11241100x8000000000000000544879Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:22.960{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.40d9ad385111d5472021-12-21 11:36:22.960root 11241100x8000000000000000544880Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:22.960{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.af3be7eaf2f4613b2021-12-21 11:36:22.960root 11241100x8000000000000000544881Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:22.960{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1721c4244d3bb8bd2021-12-21 11:36:22.960root 11241100x8000000000000000544882Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:22.960{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.caa63fe28a5b7dc02021-12-21 11:36:22.960root 11241100x8000000000000000544883Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:22.960{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e55a5675c41d24c92021-12-21 11:36:22.960root 11241100x8000000000000000544884Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:22.960{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.086e68a82fdbeb992021-12-21 11:36:22.960root 11241100x8000000000000000544885Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:22.960{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.cda71fce228b60c92021-12-21 11:36:22.960root 11241100x8000000000000000544886Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:22.960{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.76937e46d0eff28a2021-12-21 11:36:22.960root 11241100x8000000000000000544887Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:22.960{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2173d72c5c46de862021-12-21 11:36:22.960root 11241100x8000000000000000544888Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:22.960{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3d6f95362c7414342021-12-21 11:36:22.960root 11241100x8000000000000000544889Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:22.961{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b3aeb097c521a73a2021-12-21 11:36:22.961root 11241100x8000000000000000544890Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:22.961{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.40512ceb5838ec0d2021-12-21 11:36:22.961root 11241100x8000000000000000544891Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:22.961{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.fb242b0b846601322021-12-21 11:36:22.961root 11241100x8000000000000000544892Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:22.961{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2efa76e25b0c2e4a2021-12-21 11:36:22.961root 11241100x8000000000000000544893Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:22.961{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d4955ceb635706e32021-12-21 11:36:22.961root 11241100x8000000000000000544894Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:22.961{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5b4ea755ec1ddc7b2021-12-21 11:36:22.961root 11241100x8000000000000000544895Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:22.961{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b8cbd8ecad3916412021-12-21 11:36:22.961root 11241100x8000000000000000544896Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:22.961{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ae6bf01aae4984f42021-12-21 11:36:22.961root 11241100x8000000000000000544897Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:22.961{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c16aa918e3fb15d52021-12-21 11:36:22.961root 11241100x8000000000000000544898Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:22.961{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c4da4634e8c8953c2021-12-21 11:36:22.961root 11241100x8000000000000000544899Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:22.961{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.96239e6e2b5664a92021-12-21 11:36:22.961root 11241100x8000000000000000544900Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:22.962{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.923c59a77281e3482021-12-21 11:36:22.962root 11241100x8000000000000000544901Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:22.962{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5dd9c5764a65828a2021-12-21 11:36:22.962root 11241100x8000000000000000544902Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:22.962{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1e5a514864e999342021-12-21 11:36:22.962root 11241100x8000000000000000544903Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:22.962{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.da0a3fd184e649c22021-12-21 11:36:22.962root 11241100x8000000000000000544904Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:22.962{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.63d8825dab0905ea2021-12-21 11:36:22.962root 11241100x8000000000000000544905Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:22.962{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.392ba8403c2f14662021-12-21 11:36:22.962root 11241100x8000000000000000544906Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:22.962{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.28b3399bc6d746c62021-12-21 11:36:22.962root 11241100x8000000000000000544907Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:22.962{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1958bcd94cbb6a9c2021-12-21 11:36:22.962root 11241100x8000000000000000544908Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:22.963{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e610feb8b6a9ac322021-12-21 11:36:22.963root 11241100x8000000000000000544909Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:22.963{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.adcb7450157be3dd2021-12-21 11:36:22.963root 11241100x8000000000000000544910Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:22.963{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.75f3595b32c42b112021-12-21 11:36:22.963root 11241100x8000000000000000544911Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:22.963{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8c03692869744b802021-12-21 11:36:22.963root 11241100x8000000000000000544912Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:22.963{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.64a5208729924c7d2021-12-21 11:36:22.963root 11241100x8000000000000000544913Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:22.963{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.126fc2b0cfde90d02021-12-21 11:36:22.963root 11241100x8000000000000000544914Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:22.963{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.222d6d81b7eff11a2021-12-21 11:36:22.963root 11241100x8000000000000000544915Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:22.964{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.cb71dad41643278e2021-12-21 11:36:22.964root 11241100x8000000000000000544916Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:22.964{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7cf402032a4012b12021-12-21 11:36:22.964root 11241100x8000000000000000544917Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:22.964{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b87da372fdbb97d52021-12-21 11:36:22.964root 11241100x8000000000000000544918Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:22.964{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f441663d65595a002021-12-21 11:36:22.964root 11241100x8000000000000000544919Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:23.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5550a4402bcfe3422021-12-21 11:36:23.443root 11241100x8000000000000000544920Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:23.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9e725c7b661da2832021-12-21 11:36:23.443root 11241100x8000000000000000544921Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:23.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a10e44fdba69e1772021-12-21 11:36:23.443root 11241100x8000000000000000544922Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:23.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.34e7f672e03de2ad2021-12-21 11:36:23.443root 11241100x8000000000000000544923Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:23.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c26e76c9a9ad37df2021-12-21 11:36:23.444root 11241100x8000000000000000544924Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:23.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a17b6b02339be4a62021-12-21 11:36:23.444root 11241100x8000000000000000544925Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:23.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d7892ab0743514132021-12-21 11:36:23.444root 11241100x8000000000000000544926Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:23.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4d5817335afab0572021-12-21 11:36:23.444root 11241100x8000000000000000544927Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:23.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2a6e4266bd0c94332021-12-21 11:36:23.444root 11241100x8000000000000000544928Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:23.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.281ce15c5de0011d2021-12-21 11:36:23.444root 11241100x8000000000000000544929Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:23.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ab5cfeda6fa938932021-12-21 11:36:23.444root 11241100x8000000000000000544930Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:23.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.39e9b9b606b6708b2021-12-21 11:36:23.444root 11241100x8000000000000000544931Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:23.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.380cc44a33b16c682021-12-21 11:36:23.444root 11241100x8000000000000000544932Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:23.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b9a437e3e69bb9a52021-12-21 11:36:23.444root 11241100x8000000000000000544933Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:23.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.58a6a300e1b532002021-12-21 11:36:23.444root 11241100x8000000000000000544934Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:23.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a453fadaea10b5632021-12-21 11:36:23.444root 11241100x8000000000000000544935Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:23.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.366b6465be451e802021-12-21 11:36:23.445root 11241100x8000000000000000544936Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:23.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e081d75fc26486f52021-12-21 11:36:23.445root 11241100x8000000000000000544937Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:23.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c3e567eab1f4b6ff2021-12-21 11:36:23.445root 11241100x8000000000000000544938Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:23.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.051446f11abe5cec2021-12-21 11:36:23.445root 11241100x8000000000000000544939Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:23.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1ed43bdd8ceb9c892021-12-21 11:36:23.445root 11241100x8000000000000000544940Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:23.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f692bd862a9a8d7e2021-12-21 11:36:23.445root 11241100x8000000000000000544941Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:23.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.bb4010c1f443b02e2021-12-21 11:36:23.445root 11241100x8000000000000000544942Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:23.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.444d3a79dbe50e272021-12-21 11:36:23.445root 11241100x8000000000000000544943Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:23.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.fb98b3576b245eaa2021-12-21 11:36:23.445root 11241100x8000000000000000544944Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:23.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e57cf31b04b645162021-12-21 11:36:23.445root 11241100x8000000000000000544945Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:23.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7e1f12b3ae0aca232021-12-21 11:36:23.445root 11241100x8000000000000000544946Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:23.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c59b41d8bdc2fe102021-12-21 11:36:23.445root 11241100x8000000000000000544947Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:23.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d20bda839de762362021-12-21 11:36:23.445root 11241100x8000000000000000544948Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:23.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9217b1f4dc21fcd12021-12-21 11:36:23.445root 11241100x8000000000000000544949Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:23.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a5051ac4a227c9b32021-12-21 11:36:23.445root 11241100x8000000000000000544950Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:23.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2ddef66ce791c5ae2021-12-21 11:36:23.445root 11241100x8000000000000000544951Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:23.446{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5a34f92901280a9c2021-12-21 11:36:23.446root 11241100x8000000000000000544952Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:23.446{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4539f4e688b5827c2021-12-21 11:36:23.446root 11241100x8000000000000000544953Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:23.446{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.496dc853a293343c2021-12-21 11:36:23.446root 11241100x8000000000000000544954Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:23.446{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9b25cd553dce74d72021-12-21 11:36:23.446root 11241100x8000000000000000544955Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:23.446{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.cb3a42cbc52f8fda2021-12-21 11:36:23.446root 11241100x8000000000000000544956Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:23.446{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f97bf8a0451f32502021-12-21 11:36:23.446root 11241100x8000000000000000544957Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:23.446{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7d3e3d16e9f5bbd02021-12-21 11:36:23.446root 11241100x8000000000000000544958Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:23.446{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2577972aa30a2feb2021-12-21 11:36:23.446root 11241100x8000000000000000544959Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:23.446{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.17893b6d583d20cf2021-12-21 11:36:23.446root 11241100x8000000000000000544960Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:23.446{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.bd5b7ed1173e32a22021-12-21 11:36:23.446root 11241100x8000000000000000544961Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:23.446{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.cf3b665034dfed8e2021-12-21 11:36:23.446root 11241100x8000000000000000544962Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:23.446{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c4b2435fa41171b72021-12-21 11:36:23.446root 11241100x8000000000000000544963Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:23.446{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c3d16b357924e8c22021-12-21 11:36:23.446root 11241100x8000000000000000544964Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:23.446{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c46cc3ea3723efaf2021-12-21 11:36:23.446root 11241100x8000000000000000544965Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:23.446{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f18f31b4190c8c692021-12-21 11:36:23.446root 11241100x8000000000000000544966Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:23.446{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5603c2c76ef2e4942021-12-21 11:36:23.446root 11241100x8000000000000000544967Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:23.447{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2d1c855bbd327ea52021-12-21 11:36:23.447root 11241100x8000000000000000544968Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:23.447{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2b6b05d06c6690c42021-12-21 11:36:23.447root 11241100x8000000000000000544969Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:23.447{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c50a3a6fd548a3bb2021-12-21 11:36:23.447root 11241100x8000000000000000544970Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:23.447{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f73f7c1c3ace2af22021-12-21 11:36:23.447root 11241100x8000000000000000544971Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:23.447{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a3a61dc41227d0102021-12-21 11:36:23.447root 11241100x8000000000000000544972Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:23.447{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.44d8372ca5d63c472021-12-21 11:36:23.447root 11241100x8000000000000000544973Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:23.447{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c1c651fa65cead142021-12-21 11:36:23.447root 11241100x8000000000000000544974Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:23.447{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.78f1dab5b3e678f72021-12-21 11:36:23.447root 11241100x8000000000000000544975Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:23.447{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f6eee38e446e49522021-12-21 11:36:23.447root 11241100x8000000000000000544976Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:23.447{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.32c2a1947fff9e1d2021-12-21 11:36:23.447root 11241100x8000000000000000544977Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:23.447{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9327d55a57e2e34b2021-12-21 11:36:23.447root 11241100x8000000000000000544978Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:23.447{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6775d809b85423c72021-12-21 11:36:23.447root 11241100x8000000000000000544979Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:23.447{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7c49e45138b756ee2021-12-21 11:36:23.447root 11241100x8000000000000000544980Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:23.447{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.69d97ca8db49d5072021-12-21 11:36:23.447root 11241100x8000000000000000544981Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:23.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.042d8ba52ca052382021-12-21 11:36:23.944root 11241100x8000000000000000544982Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:23.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ceb4f19e3ffb2d2d2021-12-21 11:36:23.944root 11241100x8000000000000000544983Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:23.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.966621b15149d34d2021-12-21 11:36:23.944root 11241100x8000000000000000544984Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:23.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1bf515efa1a2fec12021-12-21 11:36:23.944root 11241100x8000000000000000544985Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:23.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.aa607b5f1a9172702021-12-21 11:36:23.944root 11241100x8000000000000000544986Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:23.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8d8a2812b062d45f2021-12-21 11:36:23.944root 11241100x8000000000000000544987Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:23.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a8c9511930b90f612021-12-21 11:36:23.944root 11241100x8000000000000000544988Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:23.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c63ca927305557d72021-12-21 11:36:23.944root 11241100x8000000000000000544989Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:23.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c4271ab96dbee9c92021-12-21 11:36:23.945root 11241100x8000000000000000544990Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:23.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a804fdf8e3380d7f2021-12-21 11:36:23.945root 11241100x8000000000000000544991Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:23.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c14583eddca4bcdc2021-12-21 11:36:23.945root 11241100x8000000000000000544992Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:23.946{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.714535d875ef54c32021-12-21 11:36:23.946root 11241100x8000000000000000544993Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:23.946{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d7cc48e1718f25f22021-12-21 11:36:23.946root 11241100x8000000000000000544994Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:23.946{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a6c8fb74c79e91822021-12-21 11:36:23.946root 11241100x8000000000000000544995Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:23.946{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3c0944eac82e24862021-12-21 11:36:23.946root 11241100x8000000000000000544996Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:23.946{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7df89bb1d3eeef132021-12-21 11:36:23.946root 11241100x8000000000000000544997Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:23.946{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e32400a90f36765d2021-12-21 11:36:23.946root 11241100x8000000000000000544998Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:23.946{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4cb184cfa50d44ac2021-12-21 11:36:23.946root 11241100x8000000000000000544999Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:23.946{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.207db95eb395d89c2021-12-21 11:36:23.946root 11241100x8000000000000000545000Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:23.946{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a57a0254920c2bbf2021-12-21 11:36:23.946root 11241100x8000000000000000545001Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:23.947{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.17275d641ff2acb12021-12-21 11:36:23.947root 11241100x8000000000000000545002Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:23.947{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.476f6b5779bc23492021-12-21 11:36:23.947root 11241100x8000000000000000545003Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:23.947{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.926c6db8b8d59d312021-12-21 11:36:23.947root 11241100x8000000000000000545004Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:23.947{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.780199be94640faf2021-12-21 11:36:23.947root 11241100x8000000000000000545005Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:23.947{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.03c4ab20db3771542021-12-21 11:36:23.947root 11241100x8000000000000000545006Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:23.947{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d6e21fa93e994d342021-12-21 11:36:23.947root 11241100x8000000000000000545007Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:23.947{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.dc83eeb1a1d8e56c2021-12-21 11:36:23.947root 11241100x8000000000000000545008Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:23.947{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.504fb3f5323e019f2021-12-21 11:36:23.947root 11241100x8000000000000000545009Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:23.947{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2aff52f6effed63b2021-12-21 11:36:23.947root 11241100x8000000000000000545010Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:23.947{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.024debc3e7737cfe2021-12-21 11:36:23.947root 11241100x8000000000000000545011Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:23.947{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.42944428e50da65d2021-12-21 11:36:23.947root 11241100x8000000000000000545012Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:23.947{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b87f9512826e9ede2021-12-21 11:36:23.947root 11241100x8000000000000000545013Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:23.947{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d61efe9b449a91432021-12-21 11:36:23.947root 11241100x8000000000000000545014Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:23.947{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4707c8a802434c1e2021-12-21 11:36:23.947root 11241100x8000000000000000545015Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:23.947{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d441d5e9c1f0b1612021-12-21 11:36:23.947root 11241100x8000000000000000545016Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:23.948{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4ea7b628513331382021-12-21 11:36:23.948root 11241100x8000000000000000545017Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:23.948{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d34e146dc861ac052021-12-21 11:36:23.948root 11241100x8000000000000000545018Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:23.948{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8674486f60a0e8892021-12-21 11:36:23.948root 11241100x8000000000000000545019Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:23.948{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.331b5c6ecf0e892d2021-12-21 11:36:23.948root 11241100x8000000000000000545020Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:23.948{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e498aaddeb6bb5052021-12-21 11:36:23.948root 11241100x8000000000000000545021Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:23.948{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9cae81b4e67fe3202021-12-21 11:36:23.948root 11241100x8000000000000000545022Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:23.948{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e4fb127d184797d82021-12-21 11:36:23.948root 11241100x8000000000000000545023Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:23.948{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8b3f6cec51d2aee52021-12-21 11:36:23.948root 11241100x8000000000000000545024Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:23.948{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.59b4e9bff2e9bbc42021-12-21 11:36:23.948root 11241100x8000000000000000545025Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:23.948{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4ef42f39561e1de02021-12-21 11:36:23.948root 11241100x8000000000000000545026Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:23.948{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a8cc1fb69fcadaed2021-12-21 11:36:23.948root 11241100x8000000000000000545027Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:23.948{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c9315df83eec84722021-12-21 11:36:23.948root 11241100x8000000000000000545028Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:23.948{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2d8d38e33ae8d7a02021-12-21 11:36:23.948root 11241100x8000000000000000545029Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:23.948{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9cf845f9635823b82021-12-21 11:36:23.948root 11241100x8000000000000000545030Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:23.948{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f734b2f470e9330a2021-12-21 11:36:23.948root 11241100x8000000000000000545031Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:23.949{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3a937b78eb382afe2021-12-21 11:36:23.949root 354300x8000000000000000545032Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:24.128{ec2b6afe-95d9-61c1-5175-3a0400000000}5346/opt/splunkforwarder/etc/apps/Splunk_TA_stream/linux_x86_64/bin/streamfwdroottcptruefalse10.0.1.25-48786-false10.0.1.12-8000- 11241100x8000000000000000545033Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:24.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.282adb1be83b41da2021-12-21 11:36:24.443root 11241100x8000000000000000545034Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:24.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b25dbd8337904b882021-12-21 11:36:24.443root 11241100x8000000000000000545035Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:24.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0428233698a92ac22021-12-21 11:36:24.443root 11241100x8000000000000000545036Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:24.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.da48733ace481cf12021-12-21 11:36:24.443root 11241100x8000000000000000545037Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:24.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9621fcd57fa55d692021-12-21 11:36:24.444root 11241100x8000000000000000545038Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:24.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.01c034eaa602ff082021-12-21 11:36:24.444root 11241100x8000000000000000545039Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:24.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9ce01f19aa908e002021-12-21 11:36:24.444root 11241100x8000000000000000545040Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:24.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2c961001090808402021-12-21 11:36:24.444root 11241100x8000000000000000545041Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:24.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.be06c64789a244572021-12-21 11:36:24.444root 11241100x8000000000000000545042Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:24.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f87b811ffc25932c2021-12-21 11:36:24.444root 11241100x8000000000000000545043Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:24.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6970160a2fc5de0e2021-12-21 11:36:24.444root 11241100x8000000000000000545044Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:24.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e2489e1c730615072021-12-21 11:36:24.444root 11241100x8000000000000000545045Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:24.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.29aab3d9d7c186f12021-12-21 11:36:24.444root 11241100x8000000000000000545046Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:24.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8fe099aa7df955ae2021-12-21 11:36:24.444root 11241100x8000000000000000545047Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:24.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.61d8dd7eeca2b80a2021-12-21 11:36:24.444root 11241100x8000000000000000545048Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:24.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3006fe4dd6bb5fd62021-12-21 11:36:24.444root 11241100x8000000000000000545049Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:24.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.863b54c313d07eb42021-12-21 11:36:24.444root 11241100x8000000000000000545050Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:24.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.be8cf35997935e162021-12-21 11:36:24.445root 11241100x8000000000000000545051Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:24.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.105425604112d5ae2021-12-21 11:36:24.445root 11241100x8000000000000000545052Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:24.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a9d8da21f7a403b32021-12-21 11:36:24.445root 11241100x8000000000000000545053Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:24.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8b5c9fd6fea27ad52021-12-21 11:36:24.445root 11241100x8000000000000000545054Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:24.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5cf4eeecc66bbfd92021-12-21 11:36:24.445root 11241100x8000000000000000545055Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:24.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.595c1a880544684b2021-12-21 11:36:24.445root 11241100x8000000000000000545056Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:24.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3848ccd5db70d9672021-12-21 11:36:24.445root 11241100x8000000000000000545057Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:24.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8d29a0d2185915fd2021-12-21 11:36:24.445root 11241100x8000000000000000545058Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:24.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.71eac28d10f162572021-12-21 11:36:24.445root 11241100x8000000000000000545059Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:24.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5382ec4b0f6a2d322021-12-21 11:36:24.445root 11241100x8000000000000000545060Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:24.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.85ef2f05a8c25aca2021-12-21 11:36:24.445root 11241100x8000000000000000545061Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:24.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.26d47bbf2ffb75e42021-12-21 11:36:24.445root 11241100x8000000000000000545062Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:24.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.888239fe3f8b0dfa2021-12-21 11:36:24.445root 11241100x8000000000000000545063Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:24.446{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.bcbb22bab971042c2021-12-21 11:36:24.446root 11241100x8000000000000000545064Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:24.446{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e565709201ebef072021-12-21 11:36:24.446root 11241100x8000000000000000545065Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:24.446{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.44ff8f1f52e7b2b02021-12-21 11:36:24.446root 11241100x8000000000000000545066Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:24.447{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.63718c0c9fc0114d2021-12-21 11:36:24.447root 11241100x8000000000000000545067Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:24.447{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.41a204bea5ad8f522021-12-21 11:36:24.447root 11241100x8000000000000000545068Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:24.447{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d2b8682b03b437ee2021-12-21 11:36:24.447root 11241100x8000000000000000545069Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:24.447{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.bc3f2b8661a472522021-12-21 11:36:24.447root 11241100x8000000000000000545070Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:24.447{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3fbba3c535482ffd2021-12-21 11:36:24.447root 11241100x8000000000000000545071Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:24.447{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.92f91da3f1ab9e342021-12-21 11:36:24.447root 11241100x8000000000000000545072Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:24.447{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.609c03c8985770a32021-12-21 11:36:24.447root 11241100x8000000000000000545073Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:24.447{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2a78afab3012eb722021-12-21 11:36:24.447root 11241100x8000000000000000545074Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:24.447{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f7e01814070e80be2021-12-21 11:36:24.447root 11241100x8000000000000000545075Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:24.447{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a51ee53361cd866c2021-12-21 11:36:24.447root 11241100x8000000000000000545076Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:24.448{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.033ce3e1a1cde5242021-12-21 11:36:24.448root 11241100x8000000000000000545077Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:24.448{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9905c9f2cda7b3c12021-12-21 11:36:24.448root 11241100x8000000000000000545078Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:24.448{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.81a367b80f6f83dd2021-12-21 11:36:24.448root 11241100x8000000000000000545079Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:24.449{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.53ffd78216d0264b2021-12-21 11:36:24.449root 11241100x8000000000000000545080Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:24.449{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d987022a16792c872021-12-21 11:36:24.449root 11241100x8000000000000000545081Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:24.449{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6cb0f4fc4c5e79ec2021-12-21 11:36:24.449root 11241100x8000000000000000545082Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:24.450{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.94095544f70e1f292021-12-21 11:36:24.450root 11241100x8000000000000000545083Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:24.450{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0979132f8cafed172021-12-21 11:36:24.450root 11241100x8000000000000000545084Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:24.450{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.36c3d156551eb1d22021-12-21 11:36:24.450root 11241100x8000000000000000545085Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:24.450{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2fb1b971cfcf8dc82021-12-21 11:36:24.450root 11241100x8000000000000000545086Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:24.450{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a56df6c8f11564462021-12-21 11:36:24.450root 11241100x8000000000000000545087Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:24.450{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.734640bc8a8d5ea82021-12-21 11:36:24.450root 11241100x8000000000000000545088Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:24.450{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3ef808051775c2b12021-12-21 11:36:24.450root 11241100x8000000000000000545089Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:24.450{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.69e6eaa3877a42482021-12-21 11:36:24.450root 11241100x8000000000000000545090Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:24.451{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c2b5b844af7de85e2021-12-21 11:36:24.451root 11241100x8000000000000000545091Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:24.451{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.33504c24eea4e0e62021-12-21 11:36:24.451root 11241100x8000000000000000545092Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:24.451{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b4778d77d003eb292021-12-21 11:36:24.451root 11241100x8000000000000000545093Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:24.451{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2fa985b2527612362021-12-21 11:36:24.451root 11241100x8000000000000000545094Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:24.451{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0ae3270cd6fd5b9a2021-12-21 11:36:24.451root 11241100x8000000000000000545095Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:24.451{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0903b1053ace225e2021-12-21 11:36:24.451root 11241100x8000000000000000545096Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:24.451{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.608e5458fc963fc62021-12-21 11:36:24.451root 11241100x8000000000000000545097Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:24.451{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.08d8c18445b64dbd2021-12-21 11:36:24.451root 11241100x8000000000000000545098Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:24.451{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e61653d1bb3237222021-12-21 11:36:24.451root 11241100x8000000000000000545099Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:24.451{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7d80819736cc554d2021-12-21 11:36:24.451root 11241100x8000000000000000545100Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:24.451{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c5064c714bd422942021-12-21 11:36:24.451root 11241100x8000000000000000545101Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:24.451{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.879ad468c589faaa2021-12-21 11:36:24.451root 11241100x8000000000000000545102Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:24.451{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.accfe7f87354b5b42021-12-21 11:36:24.451root 11241100x8000000000000000545103Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:24.451{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.97b12f29ce4cf8e32021-12-21 11:36:24.451root 11241100x8000000000000000545104Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:24.451{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7a75c87e6fd9ba322021-12-21 11:36:24.451root 11241100x8000000000000000545105Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:24.452{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f772234079a2ef922021-12-21 11:36:24.452root 11241100x8000000000000000545106Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:24.452{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1e1363ecafed17112021-12-21 11:36:24.452root 11241100x8000000000000000545107Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:24.452{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.30458b3beb772c9e2021-12-21 11:36:24.452root 11241100x8000000000000000545108Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:24.452{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.44599cd5519017712021-12-21 11:36:24.452root 11241100x8000000000000000545109Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:24.452{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2e1a79ad45adc13e2021-12-21 11:36:24.452root 11241100x8000000000000000545110Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:24.452{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e832759c8831ea0f2021-12-21 11:36:24.452root 11241100x8000000000000000545111Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:24.452{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.40d189505105359e2021-12-21 11:36:24.452root 11241100x8000000000000000545112Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:24.452{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c0f4cd8dde037ff22021-12-21 11:36:24.452root 11241100x8000000000000000545113Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:24.453{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.bec45d7f3b45d68f2021-12-21 11:36:24.453root 11241100x8000000000000000545114Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:24.453{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.485edc8df15c14a42021-12-21 11:36:24.453root 11241100x8000000000000000545115Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:24.453{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.636fde71df2bf5702021-12-21 11:36:24.453root 11241100x8000000000000000545116Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:24.453{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.03429f0e51a77d322021-12-21 11:36:24.453root 11241100x8000000000000000545117Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:24.453{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b75d67bf476bc0ff2021-12-21 11:36:24.453root 11241100x8000000000000000545118Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:24.453{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.02181f05d7edb1ba2021-12-21 11:36:24.453root 11241100x8000000000000000545119Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:24.453{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c4d97a4580c81f872021-12-21 11:36:24.453root 11241100x8000000000000000545120Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:24.454{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d359bacd6198dea92021-12-21 11:36:24.454root 11241100x8000000000000000545121Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:24.454{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8f087898bce657122021-12-21 11:36:24.454root 11241100x8000000000000000545122Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:24.454{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e0a26a8b3fff84402021-12-21 11:36:24.454root 11241100x8000000000000000545123Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:24.454{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1094c8be5f33d48b2021-12-21 11:36:24.454root 11241100x8000000000000000545124Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:24.454{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.25a873aa877c0db82021-12-21 11:36:24.454root 11241100x8000000000000000545125Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:24.454{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7f1157c8503c9fc22021-12-21 11:36:24.454root 11241100x8000000000000000545126Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:24.454{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c89f4522e15d784c2021-12-21 11:36:24.454root 11241100x8000000000000000545127Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:24.454{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.66d886d5cc3d91c12021-12-21 11:36:24.454root 11241100x8000000000000000545128Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:24.454{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7cbfd73d94aa1a922021-12-21 11:36:24.454root 11241100x8000000000000000545129Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:24.454{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.106981e7e50fc32c2021-12-21 11:36:24.454root 11241100x8000000000000000545130Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:24.454{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7bd2199f9fef1b882021-12-21 11:36:24.454root 11241100x8000000000000000545131Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:24.454{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3a980085d5ab4e0e2021-12-21 11:36:24.454root 11241100x8000000000000000545132Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:24.454{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.95e2f23e0dae28962021-12-21 11:36:24.454root 11241100x8000000000000000545133Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:24.454{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e4f3b7965061fe202021-12-21 11:36:24.454root 11241100x8000000000000000545134Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:24.454{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7a64cc18598013852021-12-21 11:36:24.454root 11241100x8000000000000000545135Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:24.454{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.77c8b190a26831812021-12-21 11:36:24.454root 11241100x8000000000000000545136Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:24.455{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6b517d2119b875152021-12-21 11:36:24.455root 11241100x8000000000000000545137Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:24.458{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0fa008b80f8741922021-12-21 11:36:24.458root 11241100x8000000000000000545138Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:24.458{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b9675825b11ad61e2021-12-21 11:36:24.458root 11241100x8000000000000000545139Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:24.458{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4f15a7c482de16762021-12-21 11:36:24.458root 11241100x8000000000000000545140Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:24.458{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b5f39a20c32f93d32021-12-21 11:36:24.458root 11241100x8000000000000000545141Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:24.458{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2ae7bef99a09f7a62021-12-21 11:36:24.458root 11241100x8000000000000000545142Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:24.458{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e577c91119ab640a2021-12-21 11:36:24.458root 11241100x8000000000000000545143Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:24.458{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.42e7b8570657a9432021-12-21 11:36:24.458root 11241100x8000000000000000545144Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:24.459{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4025e38a628d48e52021-12-21 11:36:24.459root 11241100x8000000000000000545145Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:24.459{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5c213b7ae6ed1fd52021-12-21 11:36:24.459root 11241100x8000000000000000545146Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:24.459{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.bac3ead3abcf89452021-12-21 11:36:24.459root 11241100x8000000000000000545147Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:24.459{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7709c6c11ac1b3fb2021-12-21 11:36:24.459root 11241100x8000000000000000545148Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:24.460{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.121db4e715fc67932021-12-21 11:36:24.460root 11241100x8000000000000000545149Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:24.460{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.678139f6416155822021-12-21 11:36:24.460root 11241100x8000000000000000545150Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:24.460{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2db1780bd8cd938e2021-12-21 11:36:24.460root 11241100x8000000000000000545151Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:24.460{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f3e716513a6b3df72021-12-21 11:36:24.460root 11241100x8000000000000000545152Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:24.460{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ad5f75b2e93a817a2021-12-21 11:36:24.460root 11241100x8000000000000000545153Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:24.460{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a60e3b0608001ca62021-12-21 11:36:24.460root 11241100x8000000000000000545154Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:24.460{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5e3d291792c24a072021-12-21 11:36:24.460root 11241100x8000000000000000545155Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:24.461{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.54d85e891a7729ce2021-12-21 11:36:24.461root 11241100x8000000000000000545156Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:24.461{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.55a0f6fbb207238b2021-12-21 11:36:24.461root 11241100x8000000000000000545157Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:24.461{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.26fbd70cdfe2877b2021-12-21 11:36:24.461root 11241100x8000000000000000545158Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:24.463{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.74ca58d1a80b62702021-12-21 11:36:24.463root 11241100x8000000000000000545159Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:24.463{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9742165f614ad27f2021-12-21 11:36:24.463root 11241100x8000000000000000545160Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:24.463{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d09e37955538d5802021-12-21 11:36:24.463root 11241100x8000000000000000545161Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:24.464{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5d5204f4edaf46462021-12-21 11:36:24.464root 11241100x8000000000000000545162Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:24.464{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.13b3d55c4b877b122021-12-21 11:36:24.464root 11241100x8000000000000000545163Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:24.464{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.db15673c12431a372021-12-21 11:36:24.464root 11241100x8000000000000000545164Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:24.464{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.06d6c628eebef4232021-12-21 11:36:24.464root 11241100x8000000000000000545165Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:24.464{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6528c8b132ab98382021-12-21 11:36:24.464root 11241100x8000000000000000545166Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:24.464{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.45f162afbd5935392021-12-21 11:36:24.464root 11241100x8000000000000000545167Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:24.465{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.818eb24fd5d909c82021-12-21 11:36:24.465root 11241100x8000000000000000545168Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:24.465{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d568a05c05d67cf02021-12-21 11:36:24.465root 11241100x8000000000000000545169Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:24.465{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.be2077b80fd0d5352021-12-21 11:36:24.465root 11241100x8000000000000000545170Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:24.465{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4f85c29e4660bc2d2021-12-21 11:36:24.465root 11241100x8000000000000000545171Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:24.465{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d3a458368768b0a42021-12-21 11:36:24.465root 11241100x8000000000000000545172Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:24.465{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.72792a68a76da8ba2021-12-21 11:36:24.465root 11241100x8000000000000000545173Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:24.465{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.89650eff641a9a222021-12-21 11:36:24.465root 11241100x8000000000000000545174Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:24.465{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7eb2de9dc423c3ea2021-12-21 11:36:24.465root 11241100x8000000000000000545175Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:24.465{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.bbff5f441824bbd92021-12-21 11:36:24.465root 11241100x8000000000000000545176Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:24.466{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f372cd061c4fbbf62021-12-21 11:36:24.466root 11241100x8000000000000000545177Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:24.466{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ac63317606c14e262021-12-21 11:36:24.466root 11241100x8000000000000000545178Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:24.466{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5f392a1f80e1cd0e2021-12-21 11:36:24.466root 11241100x8000000000000000545179Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:24.467{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9a22dd26f807323f2021-12-21 11:36:24.467root 11241100x8000000000000000545180Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:24.467{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b7a514a2ebc3a0b12021-12-21 11:36:24.467root 11241100x8000000000000000545181Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:24.467{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3fb1fd41249c1d912021-12-21 11:36:24.467root 11241100x8000000000000000545182Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:24.467{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.cbb30f9ce9aeaf222021-12-21 11:36:24.467root 11241100x8000000000000000545183Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:24.467{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4a3bc605a69e01582021-12-21 11:36:24.467root 11241100x8000000000000000545184Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:24.468{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.66b27c2b6725a4302021-12-21 11:36:24.468root 11241100x8000000000000000545185Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:24.468{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.39ccc24493295b5d2021-12-21 11:36:24.468root 11241100x8000000000000000545186Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:24.468{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f7c06e34b93be6fd2021-12-21 11:36:24.468root 11241100x8000000000000000545187Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:24.468{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ea52a9fda517982e2021-12-21 11:36:24.468root 11241100x8000000000000000545188Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:24.468{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f9e529feb05200b12021-12-21 11:36:24.468root 11241100x8000000000000000545189Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:24.468{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4b3e410fa2ad6e392021-12-21 11:36:24.468root 11241100x8000000000000000545190Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:24.468{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1c87ba6a2c6f98162021-12-21 11:36:24.468root 11241100x8000000000000000545191Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:24.468{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c9ee8ed5b417462f2021-12-21 11:36:24.468root 11241100x8000000000000000545192Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:24.468{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3a78518bcce1d1d52021-12-21 11:36:24.468root 11241100x8000000000000000545193Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:24.469{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.49720128d208d5d62021-12-21 11:36:24.469root 11241100x8000000000000000545194Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:24.469{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.04a63a25d31ac1852021-12-21 11:36:24.469root 11241100x8000000000000000545195Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:24.469{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ce35e56b1e4fd9f62021-12-21 11:36:24.469root 11241100x8000000000000000545196Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:24.469{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5951b9a78a059ac72021-12-21 11:36:24.469root 11241100x8000000000000000545197Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:24.469{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.189a29c13a5f9d1e2021-12-21 11:36:24.469root 11241100x8000000000000000545198Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:24.469{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.aca55f1b970d9b822021-12-21 11:36:24.469root 11241100x8000000000000000545199Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:24.469{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c292a4e61ab434a42021-12-21 11:36:24.469root 11241100x8000000000000000545200Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:24.469{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a13cab2fa6aa16d92021-12-21 11:36:24.469root 11241100x8000000000000000545201Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:24.470{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8a2a195eab461d782021-12-21 11:36:24.470root 11241100x8000000000000000545202Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:24.470{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.cb75f4cfcca0e7462021-12-21 11:36:24.470root 11241100x8000000000000000545203Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:24.470{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e14dd2d7ab4363502021-12-21 11:36:24.470root 11241100x8000000000000000545204Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:24.471{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.23cb49cdc098223d2021-12-21 11:36:24.471root 11241100x8000000000000000545205Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:24.471{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2ac51962fe5445192021-12-21 11:36:24.471root 11241100x8000000000000000545206Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:24.471{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b8233b1336420d072021-12-21 11:36:24.471root 11241100x8000000000000000545207Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:24.471{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e0dacf68758361842021-12-21 11:36:24.471root 11241100x8000000000000000545208Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:24.471{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.39ba61efcb67fda72021-12-21 11:36:24.471root 11241100x8000000000000000545209Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:24.471{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b1c07fe43ad51cec2021-12-21 11:36:24.471root 11241100x8000000000000000545210Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:24.471{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2b44ff0be2b0fece2021-12-21 11:36:24.471root 11241100x8000000000000000545211Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:24.471{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b866eb27dd3e0a772021-12-21 11:36:24.471root 11241100x8000000000000000545212Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:24.471{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2e85dd3848df8f7b2021-12-21 11:36:24.471root 11241100x8000000000000000545213Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:24.472{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.68e794d5e4217e3e2021-12-21 11:36:24.472root 11241100x8000000000000000545214Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:24.472{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.dbbf2993ec2e89952021-12-21 11:36:24.472root 11241100x8000000000000000545215Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:24.472{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.dcfcde51ba1b39952021-12-21 11:36:24.472root 11241100x8000000000000000545216Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:24.473{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.36bd668ff902f7042021-12-21 11:36:24.473root 11241100x8000000000000000545217Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:24.473{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9f70143f3c88cf2c2021-12-21 11:36:24.473root 11241100x8000000000000000545218Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:24.473{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.53ee1459037365e02021-12-21 11:36:24.473root 11241100x8000000000000000545219Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:24.473{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.30118aa3d7e32a512021-12-21 11:36:24.473root 11241100x8000000000000000545220Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:24.476{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.838fb2ff5d661d2b2021-12-21 11:36:24.476root 11241100x8000000000000000545221Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:24.477{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ef093ed58b84ac782021-12-21 11:36:24.477root 11241100x8000000000000000545222Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:24.477{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.022202acc868aa6b2021-12-21 11:36:24.477root 11241100x8000000000000000545223Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:24.477{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b48960f0b539fd892021-12-21 11:36:24.477root 11241100x8000000000000000545224Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:24.478{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d0d10f6cbb29fd1e2021-12-21 11:36:24.478root 11241100x8000000000000000545225Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:24.478{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.60201bea667db5792021-12-21 11:36:24.478root 11241100x8000000000000000545226Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:24.478{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5dab5368cfee51f02021-12-21 11:36:24.478root 11241100x8000000000000000545227Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:24.479{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0983c3391e6cc4312021-12-21 11:36:24.479root 11241100x8000000000000000545228Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:24.480{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f8f4724d766486f42021-12-21 11:36:24.480root 11241100x8000000000000000545229Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:24.480{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.af929bdac3e01d0f2021-12-21 11:36:24.480root 11241100x8000000000000000545230Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:24.480{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c691c222b55000412021-12-21 11:36:24.480root 11241100x8000000000000000545231Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:24.481{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c1e31d1faca26b922021-12-21 11:36:24.481root 11241100x8000000000000000545232Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:24.481{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f1627f71e649d07f2021-12-21 11:36:24.481root 11241100x8000000000000000545233Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:24.481{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.42152be2ed68f18a2021-12-21 11:36:24.481root 11241100x8000000000000000545234Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:24.482{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.45a38ede957a2c8c2021-12-21 11:36:24.482root 11241100x8000000000000000545235Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:24.482{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1db3d0df54cea77a2021-12-21 11:36:24.482root 11241100x8000000000000000545236Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:24.482{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8182859881525bb12021-12-21 11:36:24.482root 11241100x8000000000000000545237Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:24.483{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.34e42b00f18330242021-12-21 11:36:24.483root 11241100x8000000000000000545238Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:24.483{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4fb4d25e189c12f62021-12-21 11:36:24.483root 11241100x8000000000000000545239Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:24.483{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7d655e0e25a82f492021-12-21 11:36:24.483root 11241100x8000000000000000545240Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:24.483{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.dea3a73082ec896c2021-12-21 11:36:24.483root 11241100x8000000000000000545241Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:24.483{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e029a4037bccc4a02021-12-21 11:36:24.483root 11241100x8000000000000000545242Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:24.484{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f69965de25ee5c982021-12-21 11:36:24.484root 11241100x8000000000000000545243Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:24.484{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5eb5a37679d2db992021-12-21 11:36:24.484root 11241100x8000000000000000545244Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:24.484{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.43829f7cd9e15d452021-12-21 11:36:24.484root 11241100x8000000000000000545245Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:24.484{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.339e0a5228bedc252021-12-21 11:36:24.484root 11241100x8000000000000000545246Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:24.484{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a1fc2ff4c1c6033b2021-12-21 11:36:24.484root 11241100x8000000000000000545247Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:24.485{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.19369b6694de86d82021-12-21 11:36:24.485root 11241100x8000000000000000545248Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:24.485{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.bc7442eb5cedcfbb2021-12-21 11:36:24.485root 11241100x8000000000000000545249Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:24.485{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ef83bd8134fb11792021-12-21 11:36:24.485root 11241100x8000000000000000545250Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:24.485{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.93d6727fb5b3a2762021-12-21 11:36:24.485root 11241100x8000000000000000545251Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:24.485{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.dacb6556de1b9d962021-12-21 11:36:24.485root 11241100x8000000000000000545252Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:24.486{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.33e3312f7914202f2021-12-21 11:36:24.486root 11241100x8000000000000000545253Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:24.486{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.79b7c79093efb1e12021-12-21 11:36:24.486root 11241100x8000000000000000545254Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:24.486{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a2a09eff7d789a922021-12-21 11:36:24.486root 11241100x8000000000000000545255Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:24.486{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e098a6501f4bd0692021-12-21 11:36:24.486root 11241100x8000000000000000545256Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:24.486{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d88f28001e1046ef2021-12-21 11:36:24.486root 11241100x8000000000000000545257Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:24.487{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4a43d69b389614a22021-12-21 11:36:24.487root 11241100x8000000000000000545258Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:24.487{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b5781c715687da082021-12-21 11:36:24.487root 11241100x8000000000000000545259Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:24.488{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f678afc1c5f143ca2021-12-21 11:36:24.488root 11241100x8000000000000000545260Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:24.488{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a6f80fa7bc6fd6bd2021-12-21 11:36:24.488root 11241100x8000000000000000545261Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:24.488{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f8f5f17b5bdbc67e2021-12-21 11:36:24.488root 11241100x8000000000000000545262Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:24.488{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.bef5c235993953142021-12-21 11:36:24.488root 11241100x8000000000000000545263Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:24.489{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.72950a70839571c22021-12-21 11:36:24.489root 11241100x8000000000000000545264Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:24.489{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b3756517a9db095a2021-12-21 11:36:24.489root 11241100x8000000000000000545265Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:24.490{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f5fec165fa58f95f2021-12-21 11:36:24.490root 11241100x8000000000000000545266Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:24.490{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3a5097b02998b79b2021-12-21 11:36:24.490root 11241100x8000000000000000545267Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:24.491{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.24563c5a5a7784cc2021-12-21 11:36:24.491root 11241100x8000000000000000545268Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:24.942{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.151156af045ff4ab2021-12-21 11:36:24.942root 11241100x8000000000000000545269Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:24.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.800b6977e5d61dd72021-12-21 11:36:24.943root 11241100x8000000000000000545270Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:24.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9a8ff665fff7ce922021-12-21 11:36:24.943root 11241100x8000000000000000545271Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:24.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.913d138ca42574382021-12-21 11:36:24.943root 11241100x8000000000000000545272Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:24.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.34e9dd0e0e8267ac2021-12-21 11:36:24.943root 11241100x8000000000000000545273Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:24.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.50dfbf6e5c430c1d2021-12-21 11:36:24.943root 11241100x8000000000000000545274Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:24.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.06abb9cc5fb58c382021-12-21 11:36:24.943root 11241100x8000000000000000545275Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:24.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.bd978aa3008e5ee22021-12-21 11:36:24.943root 11241100x8000000000000000545276Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:24.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ea5d8a4af726c71e2021-12-21 11:36:24.943root 11241100x8000000000000000545277Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:24.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.86e7d532d37784c62021-12-21 11:36:24.943root 11241100x8000000000000000545278Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:24.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3f9456d27bc3284e2021-12-21 11:36:24.943root 11241100x8000000000000000545279Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:24.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.516abff58b751cb62021-12-21 11:36:24.943root 11241100x8000000000000000545280Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:24.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5813b53e5c7bc5b62021-12-21 11:36:24.943root 11241100x8000000000000000545281Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:24.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7362d7acaf1f25b62021-12-21 11:36:24.943root 11241100x8000000000000000545282Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:24.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ffdb72d89a5525652021-12-21 11:36:24.943root 11241100x8000000000000000545283Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:24.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f7f4229a278801ce2021-12-21 11:36:24.943root 11241100x8000000000000000545284Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:24.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7abacf8b370b5e272021-12-21 11:36:24.944root 11241100x8000000000000000545285Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:24.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.43357ab547793b6a2021-12-21 11:36:24.944root 11241100x8000000000000000545286Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:24.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.449266cffb3ac6c02021-12-21 11:36:24.944root 11241100x8000000000000000545287Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:24.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6d0416576d6acf6e2021-12-21 11:36:24.944root 11241100x8000000000000000545288Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:24.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1e8d2151085865ab2021-12-21 11:36:24.944root 11241100x8000000000000000545289Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:24.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3e281230530915fb2021-12-21 11:36:24.944root 11241100x8000000000000000545290Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:24.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.989a5c8c61f93a362021-12-21 11:36:24.944root 11241100x8000000000000000545291Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:24.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.676b9cc9e59bc5942021-12-21 11:36:24.944root 11241100x8000000000000000545292Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:24.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.cccec910969b8ecb2021-12-21 11:36:24.944root 11241100x8000000000000000545293Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:24.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.37670475e7995ee12021-12-21 11:36:24.944root 11241100x8000000000000000545294Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:24.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ef4bc33accc1ada82021-12-21 11:36:24.944root 11241100x8000000000000000545295Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:24.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.334dd8a67ce736a42021-12-21 11:36:24.944root 11241100x8000000000000000545296Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:24.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9780a16fed9f0dfd2021-12-21 11:36:24.944root 11241100x8000000000000000545297Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:24.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.954457bd782501812021-12-21 11:36:24.945root 11241100x8000000000000000545298Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:24.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.147a0aaf976ed1b32021-12-21 11:36:24.945root 11241100x8000000000000000545299Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:24.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4c288d8e3149f6652021-12-21 11:36:24.945root 11241100x8000000000000000545300Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:24.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.044ec53d8a86d33f2021-12-21 11:36:24.945root 11241100x8000000000000000545301Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:24.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.61dd97d2d65ff44c2021-12-21 11:36:24.945root 11241100x8000000000000000545302Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:24.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e3778ff8641bb6d72021-12-21 11:36:24.945root 11241100x8000000000000000545303Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:24.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8b9532c01549c58b2021-12-21 11:36:24.945root 11241100x8000000000000000545304Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:24.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.02360f0b7f10b98b2021-12-21 11:36:24.945root 11241100x8000000000000000545305Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:24.946{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.38720b13f5285b212021-12-21 11:36:24.946root 11241100x8000000000000000545306Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:24.946{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.afc0ce440d45a6ea2021-12-21 11:36:24.946root 11241100x8000000000000000545307Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:24.946{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.13b62a3bac3d5ce22021-12-21 11:36:24.946root 11241100x8000000000000000545308Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:24.946{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8b06a1e41e4210342021-12-21 11:36:24.946root 11241100x8000000000000000545309Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:24.946{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f56bd31bfaab269d2021-12-21 11:36:24.946root 11241100x8000000000000000545310Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:24.946{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.49b94993c5675eec2021-12-21 11:36:24.946root 11241100x8000000000000000545311Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:24.946{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0bde98cad2f3e1bf2021-12-21 11:36:24.946root 11241100x8000000000000000545312Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:24.946{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.80d1e06ae2c244dc2021-12-21 11:36:24.946root 11241100x8000000000000000545313Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:24.946{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.95b5a73d44ca0fb72021-12-21 11:36:24.946root 11241100x8000000000000000545314Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:24.946{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.761e8cb254c7d8562021-12-21 11:36:24.946root 11241100x8000000000000000545315Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:24.947{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ef0b23e35b7fbc522021-12-21 11:36:24.947root 11241100x8000000000000000545316Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:24.947{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e3d962ace83c55cb2021-12-21 11:36:24.947root 11241100x8000000000000000545317Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:24.947{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3183039c6e1a86812021-12-21 11:36:24.947root 11241100x8000000000000000545318Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:24.947{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3b725d68953bc1962021-12-21 11:36:24.947root 11241100x8000000000000000545319Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:24.947{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ef07fc927dad0a762021-12-21 11:36:24.947root 11241100x8000000000000000545320Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:24.947{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.078ab8c8cf9b01a82021-12-21 11:36:24.947root 11241100x8000000000000000545321Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:24.947{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b4b172f43d8c9be32021-12-21 11:36:24.947root 11241100x8000000000000000545322Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:24.947{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3529fc35ca185fe02021-12-21 11:36:24.947root 11241100x8000000000000000545323Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:24.948{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.082477f034463fe72021-12-21 11:36:24.948root 11241100x8000000000000000545324Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:24.948{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.42ff782d936e49592021-12-21 11:36:24.948root 11241100x8000000000000000545325Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:24.948{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e919942894dad2f52021-12-21 11:36:24.948root 11241100x8000000000000000545326Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:24.948{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.971e317e224508bd2021-12-21 11:36:24.948root 11241100x8000000000000000545327Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:24.948{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.51920076840d08f72021-12-21 11:36:24.948root 11241100x8000000000000000545328Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:24.948{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2927db5feee9b0842021-12-21 11:36:24.948root 11241100x8000000000000000545329Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:24.948{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a6816094cca795e02021-12-21 11:36:24.948root 11241100x8000000000000000545330Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:24.948{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a91fd79b5e8051332021-12-21 11:36:24.948root 11241100x8000000000000000545331Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:24.948{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.aa65732f2b23b3932021-12-21 11:36:24.948root 11241100x8000000000000000545332Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:24.948{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.520a144ed7795fbb2021-12-21 11:36:24.948root 11241100x8000000000000000545333Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:24.948{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5121b001de4b03e82021-12-21 11:36:24.948root 11241100x8000000000000000545334Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:24.949{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.682cb104d056e5302021-12-21 11:36:24.949root 11241100x8000000000000000545335Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:24.949{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5828cb89d90529942021-12-21 11:36:24.949root 11241100x8000000000000000545336Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:24.949{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b1032a39e40711472021-12-21 11:36:24.949root 11241100x8000000000000000545337Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:24.949{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7c0335c5ff4b7ec62021-12-21 11:36:24.949root 11241100x8000000000000000545338Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:24.949{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.77ae5a0866d40fef2021-12-21 11:36:24.949root 11241100x8000000000000000545339Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:24.949{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.594671c0e4ef4dfb2021-12-21 11:36:24.949root 11241100x8000000000000000545340Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:24.949{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3dcfabddff8691512021-12-21 11:36:24.949root 11241100x8000000000000000545341Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:24.950{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0417801f50a690822021-12-21 11:36:24.950root 11241100x8000000000000000545342Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:24.950{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a63e980d07868c242021-12-21 11:36:24.950root 11241100x8000000000000000545343Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:24.950{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2cf60f74018fd60f2021-12-21 11:36:24.950root 11241100x8000000000000000545344Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:24.950{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7d94f8522e5cb5212021-12-21 11:36:24.950root 11241100x8000000000000000545345Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:24.950{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.78e40fffa27dbc712021-12-21 11:36:24.950root 154100x8000000000000000545346Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:25.036{ec2b6afe-bc39-61c1-6854-ae3ef2550000}9904/bin/ps-----ps -e -o pid,ppid,state,command/var/snap/amazon-ssm-agent/4046root{ec2b6afe-0000-0000-0000-000000000000}04294967295no level-{00000000-0000-0000-0000-000000000000}2319--- 534500x8000000000000000545347Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:25.049{ec2b6afe-bc39-61c1-6854-ae3ef2550000}9904/bin/psroot 11241100x8000000000000000545348Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:25.442{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.31d9919d61a3dac82021-12-21 11:36:25.442root 11241100x8000000000000000545349Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:25.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d44ae4cc841803b12021-12-21 11:36:25.443root 11241100x8000000000000000545350Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:25.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.fc155284d7c0c5532021-12-21 11:36:25.443root 11241100x8000000000000000545351Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:25.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c520b93bfea284652021-12-21 11:36:25.443root 11241100x8000000000000000545352Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:25.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4e4e674c6744388d2021-12-21 11:36:25.443root 11241100x8000000000000000545353Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:25.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.bf98700f86128f082021-12-21 11:36:25.444root 11241100x8000000000000000545354Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:25.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1901b3edad535ecd2021-12-21 11:36:25.444root 11241100x8000000000000000545355Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:25.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c1e6ce5b740ab2bf2021-12-21 11:36:25.444root 11241100x8000000000000000545356Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:25.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ce941e1b110d93d32021-12-21 11:36:25.444root 11241100x8000000000000000545357Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:25.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.096f15ffd2368f782021-12-21 11:36:25.444root 11241100x8000000000000000545358Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:25.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e67f05f15a6412712021-12-21 11:36:25.445root 11241100x8000000000000000545359Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:25.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.25c8f2c6118efb252021-12-21 11:36:25.445root 11241100x8000000000000000545360Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:25.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.636d09b288505f0d2021-12-21 11:36:25.445root 11241100x8000000000000000545361Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:25.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.31dd6fab199c6bb92021-12-21 11:36:25.445root 11241100x8000000000000000545362Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:25.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0c93b831b52f49f22021-12-21 11:36:25.445root 11241100x8000000000000000545363Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:25.446{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.56c0efb796ef74eb2021-12-21 11:36:25.446root 11241100x8000000000000000545364Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:25.446{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4abbf6a85834c5c32021-12-21 11:36:25.446root 11241100x8000000000000000545365Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:25.446{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b134420b6564f89f2021-12-21 11:36:25.446root 11241100x8000000000000000545366Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:25.446{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ab367179b63d34e62021-12-21 11:36:25.446root 11241100x8000000000000000545367Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:25.446{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3f6ceeb898bb6c2a2021-12-21 11:36:25.446root 11241100x8000000000000000545368Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:25.447{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ce55c26ca4ae74d42021-12-21 11:36:25.447root 11241100x8000000000000000545369Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:25.447{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4241553e488942272021-12-21 11:36:25.447root 11241100x8000000000000000545370Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:25.447{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.869a15b80075bd902021-12-21 11:36:25.447root 11241100x8000000000000000545371Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:25.447{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d8e574e9aa2c25612021-12-21 11:36:25.447root 11241100x8000000000000000545372Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:25.447{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.50b7987bbb2b26eb2021-12-21 11:36:25.447root 11241100x8000000000000000545373Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:25.447{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f91cfeab7310245e2021-12-21 11:36:25.447root 11241100x8000000000000000545374Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:25.447{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.440df549865baa402021-12-21 11:36:25.447root 11241100x8000000000000000545375Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:25.448{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b4138bf13d5189912021-12-21 11:36:25.448root 11241100x8000000000000000545376Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:25.448{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.60c0851bdb90f0262021-12-21 11:36:25.448root 11241100x8000000000000000545377Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:25.448{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9e8b582ec71f11c02021-12-21 11:36:25.448root 11241100x8000000000000000545378Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:25.448{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.14ce9d5786b7a1582021-12-21 11:36:25.448root 11241100x8000000000000000545379Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:25.448{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.221c95513e945e2b2021-12-21 11:36:25.448root 11241100x8000000000000000545380Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:25.448{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.974e20bbddbbcb5c2021-12-21 11:36:25.448root 11241100x8000000000000000545381Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:25.448{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.183174ca602381592021-12-21 11:36:25.448root 11241100x8000000000000000545382Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:25.449{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.790e199715502c1f2021-12-21 11:36:25.449root 11241100x8000000000000000545383Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:25.449{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.89813f049457b3662021-12-21 11:36:25.449root 11241100x8000000000000000545384Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:25.449{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d9d6c6111da965c12021-12-21 11:36:25.449root 11241100x8000000000000000545385Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:25.449{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.04a6c6a2263ce85c2021-12-21 11:36:25.449root 11241100x8000000000000000545386Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:25.449{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5c784ed8959ab0a42021-12-21 11:36:25.449root 11241100x8000000000000000545387Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:25.449{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2d359b8c6709dd8b2021-12-21 11:36:25.449root 11241100x8000000000000000545388Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:25.449{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2982dd4d529a3b642021-12-21 11:36:25.449root 11241100x8000000000000000545389Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:25.449{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.26a744febdd32d0f2021-12-21 11:36:25.449root 11241100x8000000000000000545390Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:25.449{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b07f9c657038d6782021-12-21 11:36:25.449root 11241100x8000000000000000545391Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:25.449{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0e354ca2825fe0352021-12-21 11:36:25.449root 11241100x8000000000000000545392Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:25.449{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a1ef937dd07d5da62021-12-21 11:36:25.449root 11241100x8000000000000000545393Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:25.449{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.103836c4c1af15562021-12-21 11:36:25.449root 11241100x8000000000000000545394Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:25.450{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.322ed815e3d701932021-12-21 11:36:25.450root 11241100x8000000000000000545395Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:25.450{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2b2ea4a014e7305c2021-12-21 11:36:25.450root 11241100x8000000000000000545396Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:25.450{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.298f2b83756754b22021-12-21 11:36:25.450root 11241100x8000000000000000545397Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:25.450{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.93ec5faf8176ab762021-12-21 11:36:25.450root 11241100x8000000000000000545398Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:25.450{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5751db9769c290502021-12-21 11:36:25.450root 11241100x8000000000000000545399Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:25.450{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4a1b649f53242b7a2021-12-21 11:36:25.450root 11241100x8000000000000000545400Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:25.450{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.64d8382308825a4f2021-12-21 11:36:25.450root 11241100x8000000000000000545401Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:25.450{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4405ba700a6d8b832021-12-21 11:36:25.450root 11241100x8000000000000000545402Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:25.450{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6469e092fa9b23302021-12-21 11:36:25.450root 11241100x8000000000000000545403Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:25.450{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.14afe92fe872e4762021-12-21 11:36:25.450root 11241100x8000000000000000545404Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:25.450{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.cf833ec134144c812021-12-21 11:36:25.450root 11241100x8000000000000000545405Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:25.450{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.881461ed3e111c992021-12-21 11:36:25.450root 11241100x8000000000000000545406Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:25.450{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4c9f80c73ce9eb3b2021-12-21 11:36:25.450root 11241100x8000000000000000545407Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:25.450{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0c833719a504bf342021-12-21 11:36:25.450root 11241100x8000000000000000545408Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:25.451{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1ed02e4889811bfc2021-12-21 11:36:25.451root 11241100x8000000000000000545409Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:25.451{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2de9157c01d0ce4c2021-12-21 11:36:25.451root 11241100x8000000000000000545410Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:25.451{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e54440ef6dca3f912021-12-21 11:36:25.451root 11241100x8000000000000000545411Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:25.451{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5ae5031b4feb35ec2021-12-21 11:36:25.451root 11241100x8000000000000000545412Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:25.451{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4a3bcd180dcc8b4f2021-12-21 11:36:25.451root 11241100x8000000000000000545413Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:25.451{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.66592bcba5a0aaaa2021-12-21 11:36:25.451root 11241100x8000000000000000545414Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:25.451{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e95dbaaf038a0e012021-12-21 11:36:25.451root 11241100x8000000000000000545415Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:25.451{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.01e544fdc9a78f412021-12-21 11:36:25.451root 11241100x8000000000000000545416Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:25.451{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0391d80b6a1419e12021-12-21 11:36:25.451root 11241100x8000000000000000545417Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:25.451{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.77b5416c86f067932021-12-21 11:36:25.451root 11241100x8000000000000000545418Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:25.451{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8ff87c196f82ad912021-12-21 11:36:25.451root 11241100x8000000000000000545419Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:25.452{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.83d47845ae87a7a42021-12-21 11:36:25.452root 11241100x8000000000000000545420Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:25.452{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.94a3544b6274cc272021-12-21 11:36:25.452root 11241100x8000000000000000545421Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:25.452{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d1ac534c04cb18b82021-12-21 11:36:25.452root 11241100x8000000000000000545422Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:25.452{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3c23cf1fd283e2b62021-12-21 11:36:25.452root 11241100x8000000000000000545423Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:25.452{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.bf7b17e979bf9caf2021-12-21 11:36:25.452root 11241100x8000000000000000545424Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:25.452{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.29a76550f2e5f1ef2021-12-21 11:36:25.452root 11241100x8000000000000000545425Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:25.452{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e1218930950c631f2021-12-21 11:36:25.452root 354300x8000000000000000545426Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:25.507{ec2b6afe-95d2-61c1-3038-b84203560000}5272/opt/splunkforwarder/bin/splunkdroottcptruefalse10.0.1.25-35852-false10.0.1.12-8089- 11241100x8000000000000000545427Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:25.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.95b7209d2b55bdcc2021-12-21 11:36:25.943root 11241100x8000000000000000545428Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:25.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.aade846f133f61d72021-12-21 11:36:25.943root 11241100x8000000000000000545429Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:25.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.aa2140004b4599f92021-12-21 11:36:25.943root 11241100x8000000000000000545430Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:25.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9e843706af51fa192021-12-21 11:36:25.943root 11241100x8000000000000000545431Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:25.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a299f99ea37c648e2021-12-21 11:36:25.944root 11241100x8000000000000000545432Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:25.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5e9e3172e951d4eb2021-12-21 11:36:25.944root 11241100x8000000000000000545433Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:25.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.51895aad88baca622021-12-21 11:36:25.944root 11241100x8000000000000000545434Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:25.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e1b6be1c8ea746f12021-12-21 11:36:25.944root 11241100x8000000000000000545435Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:25.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8f85eecf6c2516cb2021-12-21 11:36:25.944root 11241100x8000000000000000545436Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:25.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4bff1086dea79b1f2021-12-21 11:36:25.944root 11241100x8000000000000000545437Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:25.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4c8c4ad548004b522021-12-21 11:36:25.944root 11241100x8000000000000000545438Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:25.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c2ea88e2b89a337e2021-12-21 11:36:25.944root 11241100x8000000000000000545439Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:25.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.abb8be9fd9c0f47f2021-12-21 11:36:25.945root 11241100x8000000000000000545440Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:25.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9646961126aefc582021-12-21 11:36:25.945root 11241100x8000000000000000545441Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:25.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7bc2ffba543f65252021-12-21 11:36:25.945root 11241100x8000000000000000545442Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:25.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2437c111001ea8fd2021-12-21 11:36:25.945root 11241100x8000000000000000545443Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:25.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c68b78ded64ff33c2021-12-21 11:36:25.945root 11241100x8000000000000000545444Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:25.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9729f72b26e26c662021-12-21 11:36:25.945root 11241100x8000000000000000545445Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:25.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7d581f05045977a62021-12-21 11:36:25.945root 11241100x8000000000000000545446Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:25.946{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.df90234ab835aab52021-12-21 11:36:25.946root 11241100x8000000000000000545447Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:25.946{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4d9f4246d0d33fa82021-12-21 11:36:25.946root 11241100x8000000000000000545448Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:25.946{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7c744c48703738c42021-12-21 11:36:25.946root 11241100x8000000000000000545449Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:25.946{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7f3fb38fe96100522021-12-21 11:36:25.946root 11241100x8000000000000000545450Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:25.946{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.cf233e7fe676f7cf2021-12-21 11:36:25.946root 11241100x8000000000000000545451Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:25.946{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.33f134483e6f27fe2021-12-21 11:36:25.946root 11241100x8000000000000000545452Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:25.946{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d0a0615a8d865ce22021-12-21 11:36:25.946root 11241100x8000000000000000545453Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:25.946{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.abbe3805946376c02021-12-21 11:36:25.946root 11241100x8000000000000000545454Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:25.946{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.219aba123c46c0c82021-12-21 11:36:25.946root 11241100x8000000000000000545455Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:25.946{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c3f6422799771dfe2021-12-21 11:36:25.946root 11241100x8000000000000000545456Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:25.946{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4e9fb6280bf90a812021-12-21 11:36:25.946root 11241100x8000000000000000545457Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:25.947{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2757f9dad1eb5b9d2021-12-21 11:36:25.947root 11241100x8000000000000000545458Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:25.947{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.55260305c8f8d9632021-12-21 11:36:25.947root 11241100x8000000000000000545459Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:25.947{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e530b7d7eaa8af682021-12-21 11:36:25.947root 11241100x8000000000000000545460Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:25.947{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.796f5cc719b64f842021-12-21 11:36:25.947root 11241100x8000000000000000545461Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:25.947{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.37f964be952989742021-12-21 11:36:25.947root 11241100x8000000000000000545462Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:25.947{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6161f6c74afac7df2021-12-21 11:36:25.947root 11241100x8000000000000000545463Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:25.947{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.84b67a24e2c9b74a2021-12-21 11:36:25.947root 11241100x8000000000000000545464Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:25.947{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.40dca7de6844121e2021-12-21 11:36:25.947root 11241100x8000000000000000545465Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:25.947{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.df41f04bb4f7ae862021-12-21 11:36:25.947root 11241100x8000000000000000545466Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:25.947{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6f95ec4d02b419522021-12-21 11:36:25.947root 11241100x8000000000000000545467Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:25.947{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4d44855cfd605e402021-12-21 11:36:25.947root 11241100x8000000000000000545468Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:25.947{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.90c6939b476ac44a2021-12-21 11:36:25.947root 11241100x8000000000000000545469Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:25.947{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.91f2528c1158fed12021-12-21 11:36:25.947root 11241100x8000000000000000545470Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:25.947{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.da39ff0f510bb8c42021-12-21 11:36:25.947root 11241100x8000000000000000545471Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:25.948{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4c0eed64815b74b42021-12-21 11:36:25.948root 11241100x8000000000000000545472Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:25.948{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.df54817a9562b2f62021-12-21 11:36:25.948root 11241100x8000000000000000545473Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:25.948{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.515379b4ef6628d52021-12-21 11:36:25.948root 11241100x8000000000000000545474Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:25.948{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.412ff6faf36f5e1b2021-12-21 11:36:25.948root 11241100x8000000000000000545475Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:25.948{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ca185d2c9ac298732021-12-21 11:36:25.948root 11241100x8000000000000000545476Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:25.948{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.cb16496b99c619832021-12-21 11:36:25.948root 11241100x8000000000000000545477Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:25.948{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.276fb48b7f8449db2021-12-21 11:36:25.948root 11241100x8000000000000000545478Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:25.948{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.af198604570453bc2021-12-21 11:36:25.948root 11241100x8000000000000000545479Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:25.948{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.500094ec062fb37a2021-12-21 11:36:25.948root 11241100x8000000000000000545480Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:25.948{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a30e0b0529fe52e32021-12-21 11:36:25.948root 11241100x8000000000000000545481Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:25.948{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b30f71a39de15cdb2021-12-21 11:36:25.948root 11241100x8000000000000000545482Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:25.948{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f57f7637ecdd46b82021-12-21 11:36:25.948root 11241100x8000000000000000545483Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:25.948{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1f985724431cd3da2021-12-21 11:36:25.948root 11241100x8000000000000000545484Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:25.948{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f1626ca2269b27012021-12-21 11:36:25.948root 11241100x8000000000000000545485Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:25.948{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c4f59acada2950de2021-12-21 11:36:25.948root 11241100x8000000000000000545486Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:25.948{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.83cf63e86b6c5e1d2021-12-21 11:36:25.948root 11241100x8000000000000000545487Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:25.949{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.eb7cb5ae8788940e2021-12-21 11:36:25.949root 11241100x8000000000000000545488Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:25.949{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.337a32c8e7a962392021-12-21 11:36:25.949root 11241100x8000000000000000545489Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:25.949{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.81db2f75e0700afd2021-12-21 11:36:25.949root 11241100x8000000000000000545490Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:25.949{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3472e4f151fe01f62021-12-21 11:36:25.949root 11241100x8000000000000000545491Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:25.949{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.50a31f42e3d7a5262021-12-21 11:36:25.949root 11241100x8000000000000000545492Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:25.949{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.47566f883b395c9c2021-12-21 11:36:25.949root 11241100x8000000000000000545493Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:25.949{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.839323bae5dc30bb2021-12-21 11:36:25.949root 11241100x8000000000000000545494Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:25.949{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a716c1b6465ea02c2021-12-21 11:36:25.949root 11241100x8000000000000000545495Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:25.949{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5f6b24346928b5512021-12-21 11:36:25.949root 11241100x8000000000000000545496Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:25.949{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b88a0e0886e02fee2021-12-21 11:36:25.949root 11241100x8000000000000000545497Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:25.949{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.128d7d00a2e0f2b62021-12-21 11:36:25.949root 11241100x8000000000000000545498Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:25.949{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9bdc1e9fd605611e2021-12-21 11:36:25.949root 11241100x8000000000000000545499Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:25.950{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a254f94ddd7375fa2021-12-21 11:36:25.950root 11241100x8000000000000000545500Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:25.950{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b9584918c80c05d52021-12-21 11:36:25.950root 11241100x8000000000000000545501Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:25.950{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.68a11d52ad1483552021-12-21 11:36:25.950root 11241100x8000000000000000545502Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:25.950{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.078d5cec7b85f5392021-12-21 11:36:25.950root 11241100x8000000000000000545503Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:25.950{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.fa8fcf0498e698192021-12-21 11:36:25.950root 11241100x8000000000000000545504Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:25.950{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4bb128da8da7febb2021-12-21 11:36:25.950root 11241100x8000000000000000545505Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:25.950{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3cc7c643e165f32c2021-12-21 11:36:25.950root 11241100x8000000000000000545506Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:25.950{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.23c775a3763ac5022021-12-21 11:36:25.950root 11241100x8000000000000000545507Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:25.950{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.22eb8ea2b4804b8d2021-12-21 11:36:25.950root 11241100x8000000000000000545508Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:25.950{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0dbaa3af77e9a4352021-12-21 11:36:25.950root 11241100x8000000000000000545509Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:25.950{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4fe6b1cf19eabe8b2021-12-21 11:36:25.950root 11241100x8000000000000000545510Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:25.950{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.37182bf31b4caa6c2021-12-21 11:36:25.950root 11241100x8000000000000000545511Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:25.950{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b73a2c4c217a1dd12021-12-21 11:36:25.950root 11241100x8000000000000000545512Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:25.950{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f03ca6acb6ebf8d12021-12-21 11:36:25.950root 11241100x8000000000000000545513Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:25.950{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.08d94369728848a32021-12-21 11:36:25.950root 11241100x8000000000000000545514Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:25.950{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.da93b7fe748756292021-12-21 11:36:25.950root 11241100x8000000000000000545515Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:25.951{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8766d0ba058df6f32021-12-21 11:36:25.951root 11241100x8000000000000000545516Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:25.951{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c36ac278e81785c72021-12-21 11:36:25.951root 11241100x8000000000000000545517Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:25.951{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e1f95cb409c445422021-12-21 11:36:25.951root 11241100x8000000000000000545518Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:25.951{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c33efb82a486d3712021-12-21 11:36:25.951root 11241100x8000000000000000545519Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:25.951{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3598bc3ce4187bf42021-12-21 11:36:25.951root 11241100x8000000000000000545520Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:25.951{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ce5caf29b98db8322021-12-21 11:36:25.951root 11241100x8000000000000000545521Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:25.951{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5fe5f9cbdddca1492021-12-21 11:36:25.951root 11241100x8000000000000000545522Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:25.951{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.cd9fcf5751b6b63a2021-12-21 11:36:25.951root 11241100x8000000000000000545523Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:25.951{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.59eb8cc228be4b3c2021-12-21 11:36:25.951root 11241100x8000000000000000545524Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:25.951{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f893d22236cb66c62021-12-21 11:36:25.951root 11241100x8000000000000000545525Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:25.951{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.314ae03fb3f96e472021-12-21 11:36:25.951root 11241100x8000000000000000545526Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:25.951{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.659e52de818087d52021-12-21 11:36:25.951root 11241100x8000000000000000545527Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:26.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.40012e40faca92742021-12-21 11:36:26.443root 11241100x8000000000000000545528Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:26.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f973e374fa94808a2021-12-21 11:36:26.443root 11241100x8000000000000000545529Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:26.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.63cfab7f50b2aa972021-12-21 11:36:26.443root 11241100x8000000000000000545530Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:26.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.93016162a33d1d832021-12-21 11:36:26.443root 11241100x8000000000000000545531Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:26.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.55f8218042ad6e262021-12-21 11:36:26.443root 11241100x8000000000000000545532Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:26.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.be97d52048fb54eb2021-12-21 11:36:26.443root 11241100x8000000000000000545533Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:26.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.187f0d6c36f1d90c2021-12-21 11:36:26.443root 11241100x8000000000000000545534Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:26.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.41788b5e9270946c2021-12-21 11:36:26.444root 11241100x8000000000000000545535Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:26.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ea3ce4efe0c646672021-12-21 11:36:26.444root 11241100x8000000000000000545536Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:26.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0722bf6e283154ea2021-12-21 11:36:26.444root 11241100x8000000000000000545537Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:26.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ff066dbc516d5fcc2021-12-21 11:36:26.444root 11241100x8000000000000000545538Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:26.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5944e9077672e5c32021-12-21 11:36:26.444root 11241100x8000000000000000545539Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:26.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.410994003712ab882021-12-21 11:36:26.444root 11241100x8000000000000000545540Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:26.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.93f54f9090523dc92021-12-21 11:36:26.444root 11241100x8000000000000000545541Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:26.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7fdc3bfd507579672021-12-21 11:36:26.444root 11241100x8000000000000000545542Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:26.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.23815ebb461849742021-12-21 11:36:26.444root 11241100x8000000000000000545543Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:26.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.087b983dd1d8d50e2021-12-21 11:36:26.444root 11241100x8000000000000000545544Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:26.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.871d294f6c69a0e42021-12-21 11:36:26.445root 11241100x8000000000000000545545Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:26.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.23f7761408b0915c2021-12-21 11:36:26.445root 11241100x8000000000000000545546Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:26.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0aead1454c0daa002021-12-21 11:36:26.445root 11241100x8000000000000000545547Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:26.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.51b680c1a38b17a22021-12-21 11:36:26.445root 11241100x8000000000000000545548Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:26.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ebcfabc2891e4f592021-12-21 11:36:26.445root 11241100x8000000000000000545549Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:26.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ece89443b421ac052021-12-21 11:36:26.445root 11241100x8000000000000000545550Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:26.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5bd38479ef971aed2021-12-21 11:36:26.445root 11241100x8000000000000000545551Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:26.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.011e848f413442ca2021-12-21 11:36:26.445root 11241100x8000000000000000545552Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:26.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d8a651527b8212832021-12-21 11:36:26.445root 11241100x8000000000000000545553Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:26.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3a8af4500526527a2021-12-21 11:36:26.445root 11241100x8000000000000000545554Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:26.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b62b5a193506b4e72021-12-21 11:36:26.445root 11241100x8000000000000000545555Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:26.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.54905783d1b1b7442021-12-21 11:36:26.445root 11241100x8000000000000000545556Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:26.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d07a0a2fbe9e02f72021-12-21 11:36:26.445root 11241100x8000000000000000545557Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:26.446{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.bd8dbb73b0d3745d2021-12-21 11:36:26.446root 11241100x8000000000000000545558Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:26.446{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a297852a2ae987c92021-12-21 11:36:26.446root 11241100x8000000000000000545559Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:26.446{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3c15ed5a1578d2652021-12-21 11:36:26.446root 11241100x8000000000000000545560Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:26.446{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ca23cc016f3094912021-12-21 11:36:26.446root 11241100x8000000000000000545561Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:26.446{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a586cd51e14792da2021-12-21 11:36:26.446root 11241100x8000000000000000545562Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:26.446{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.501ca7f80dbc25ec2021-12-21 11:36:26.446root 11241100x8000000000000000545563Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:26.446{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1d383def91b702322021-12-21 11:36:26.446root 11241100x8000000000000000545564Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:26.446{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.feaffd4e0e0d64992021-12-21 11:36:26.446root 11241100x8000000000000000545565Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:26.446{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4188abf89c03da942021-12-21 11:36:26.446root 11241100x8000000000000000545566Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:26.446{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7231b4d3b3c9141b2021-12-21 11:36:26.446root 11241100x8000000000000000545567Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:26.447{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6820d4177e0101a42021-12-21 11:36:26.447root 11241100x8000000000000000545568Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:26.447{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5b8ae3db97b3c7582021-12-21 11:36:26.447root 11241100x8000000000000000545569Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:26.447{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.072695d23d80e95f2021-12-21 11:36:26.447root 11241100x8000000000000000545570Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:26.448{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7fceaa407826e5da2021-12-21 11:36:26.448root 11241100x8000000000000000545571Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:26.448{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d576c5b1f8ed1e4c2021-12-21 11:36:26.448root 11241100x8000000000000000545572Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:26.448{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2cd764badb9e091c2021-12-21 11:36:26.448root 11241100x8000000000000000545573Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:26.448{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3636eabc12e2ee162021-12-21 11:36:26.448root 11241100x8000000000000000545574Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:26.448{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f878f41cbd55444f2021-12-21 11:36:26.448root 11241100x8000000000000000545575Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:26.448{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c44a5eee09d0e2502021-12-21 11:36:26.448root 11241100x8000000000000000545576Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:26.448{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.55cade978da72efd2021-12-21 11:36:26.448root 11241100x8000000000000000545577Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:26.449{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.78c80ec1b5703e7e2021-12-21 11:36:26.449root 11241100x8000000000000000545578Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:26.449{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.22fdb1f80c010ded2021-12-21 11:36:26.449root 11241100x8000000000000000545579Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:26.449{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7b7089e68f71eeef2021-12-21 11:36:26.449root 11241100x8000000000000000545580Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:26.449{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ccd578b43309f3942021-12-21 11:36:26.449root 11241100x8000000000000000545581Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:26.449{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.fd753b10d0420ae82021-12-21 11:36:26.449root 11241100x8000000000000000545582Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:26.449{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c4654b88ccc960002021-12-21 11:36:26.449root 11241100x8000000000000000545583Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:26.449{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ea983081a115b8512021-12-21 11:36:26.449root 11241100x8000000000000000545584Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:26.449{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8c8168387e4b932f2021-12-21 11:36:26.449root 11241100x8000000000000000545585Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:26.449{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8c06b01e34be95512021-12-21 11:36:26.449root 11241100x8000000000000000545586Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:26.449{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3553dbed0e5559692021-12-21 11:36:26.449root 11241100x8000000000000000545587Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:26.449{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7249691ea2d632892021-12-21 11:36:26.449root 11241100x8000000000000000545588Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:26.450{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5e5b7924a5a6f37d2021-12-21 11:36:26.450root 11241100x8000000000000000545589Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:26.450{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f80e6f50cedc232b2021-12-21 11:36:26.450root 11241100x8000000000000000545590Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:26.450{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2d7eea75729f1eea2021-12-21 11:36:26.450root 11241100x8000000000000000545591Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:26.450{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1c8ea246f58dfeae2021-12-21 11:36:26.450root 11241100x8000000000000000545592Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:26.450{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.755b3a3703660add2021-12-21 11:36:26.450root 11241100x8000000000000000545593Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:26.450{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.851566cdd7fe081b2021-12-21 11:36:26.450root 11241100x8000000000000000545594Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:26.450{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.bab2436b5c6ae0a82021-12-21 11:36:26.450root 11241100x8000000000000000545595Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:26.450{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.32bb843c2af1e9142021-12-21 11:36:26.450root 11241100x8000000000000000545596Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:26.450{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d0e338a2e7b4f99a2021-12-21 11:36:26.450root 11241100x8000000000000000545597Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:26.450{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.623c9fb47fcd0b6c2021-12-21 11:36:26.450root 11241100x8000000000000000545598Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:26.450{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b7b95c4dada749a52021-12-21 11:36:26.450root 11241100x8000000000000000545599Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:26.450{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.14ce20283bbc5e882021-12-21 11:36:26.450root 11241100x8000000000000000545600Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:26.450{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f56a7a32ed82f6072021-12-21 11:36:26.450root 11241100x8000000000000000545601Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:26.451{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.86cd6ad063327f502021-12-21 11:36:26.451root 11241100x8000000000000000545602Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:26.451{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7d88b2a5f834bd6e2021-12-21 11:36:26.451root 11241100x8000000000000000545603Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:26.451{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3f948da23eb2e1842021-12-21 11:36:26.451root 11241100x8000000000000000545604Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:26.451{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2eeb01ab077ac8682021-12-21 11:36:26.451root 11241100x8000000000000000545605Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:26.451{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a67371febc13f9692021-12-21 11:36:26.451root 11241100x8000000000000000545606Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:26.451{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e5c2d15398b82c2c2021-12-21 11:36:26.451root 11241100x8000000000000000545607Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:26.451{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.245e95ce2fec03042021-12-21 11:36:26.451root 11241100x8000000000000000545608Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:26.451{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7fbd481ce21977e32021-12-21 11:36:26.451root 11241100x8000000000000000545609Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:26.451{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7c3f0d25378469952021-12-21 11:36:26.451root 11241100x8000000000000000545610Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:26.451{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.85409deee96d54b22021-12-21 11:36:26.451root 11241100x8000000000000000545611Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:26.451{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.00ea47c9816601722021-12-21 11:36:26.451root 11241100x8000000000000000545612Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:26.451{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d86e609ce24d48732021-12-21 11:36:26.451root 11241100x8000000000000000545613Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:26.452{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c97f580fcec623a02021-12-21 11:36:26.452root 11241100x8000000000000000545614Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:26.452{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1656827d6ee929dc2021-12-21 11:36:26.452root 11241100x8000000000000000545615Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:26.452{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.fbc96510d44d15682021-12-21 11:36:26.452root 11241100x8000000000000000545616Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:26.452{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f455b12f9ec2b7b02021-12-21 11:36:26.452root 11241100x8000000000000000545617Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:26.452{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7ead28346e7d23b22021-12-21 11:36:26.452root 11241100x8000000000000000545618Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:26.452{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0e1a8831a293f2bc2021-12-21 11:36:26.452root 11241100x8000000000000000545619Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:26.452{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ee4b24c6c250bb3c2021-12-21 11:36:26.452root 11241100x8000000000000000545620Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:26.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4c5b566aa5d1f5452021-12-21 11:36:26.943root 11241100x8000000000000000545621Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:26.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e10d23ee4a0c0d402021-12-21 11:36:26.943root 11241100x8000000000000000545622Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:26.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.999674dd4490c5b82021-12-21 11:36:26.943root 11241100x8000000000000000545623Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:26.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.bb8efe2ebd6d01d72021-12-21 11:36:26.944root 11241100x8000000000000000545624Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:26.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4a3436105f8bc7672021-12-21 11:36:26.944root 11241100x8000000000000000545625Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:26.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3a3b0d8c111cde292021-12-21 11:36:26.944root 11241100x8000000000000000545626Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:26.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.21255e202fca1c5f2021-12-21 11:36:26.944root 11241100x8000000000000000545627Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:26.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.eee5f4989dfde9272021-12-21 11:36:26.944root 11241100x8000000000000000545628Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:26.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ead36121dc9440592021-12-21 11:36:26.944root 11241100x8000000000000000545629Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:26.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5f6eb1264e86ee492021-12-21 11:36:26.944root 11241100x8000000000000000545630Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:26.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.fc1b34938aaf10fa2021-12-21 11:36:26.944root 11241100x8000000000000000545631Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:26.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3c10e28ce8476db32021-12-21 11:36:26.944root 11241100x8000000000000000545632Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:26.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.236daf2f390179182021-12-21 11:36:26.944root 11241100x8000000000000000545633Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:26.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.924f079a200072912021-12-21 11:36:26.945root 11241100x8000000000000000545634Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:26.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a248d45bc747b5892021-12-21 11:36:26.945root 11241100x8000000000000000545635Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:26.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.624d409bda17b1342021-12-21 11:36:26.945root 11241100x8000000000000000545636Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:26.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.97c71ade085552862021-12-21 11:36:26.945root 11241100x8000000000000000545637Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:26.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ae73159d34eef73f2021-12-21 11:36:26.945root 11241100x8000000000000000545638Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:26.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b4960c185ab1fb262021-12-21 11:36:26.945root 11241100x8000000000000000545639Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:26.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f340014487773f3a2021-12-21 11:36:26.945root 11241100x8000000000000000545640Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:26.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.85dcdf71dfae7b2d2021-12-21 11:36:26.945root 11241100x8000000000000000545641Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:26.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c1f66382f52fb8fe2021-12-21 11:36:26.945root 11241100x8000000000000000545642Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:26.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c503997ba1a0c4b82021-12-21 11:36:26.945root 11241100x8000000000000000545643Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:26.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5dd7b2422c5d02c22021-12-21 11:36:26.945root 11241100x8000000000000000545644Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:26.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a1d24c6d7fdcca3b2021-12-21 11:36:26.945root 11241100x8000000000000000545645Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:26.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c11f2ee81de14e382021-12-21 11:36:26.945root 11241100x8000000000000000545646Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:26.946{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.67758a2f6a3de3232021-12-21 11:36:26.946root 11241100x8000000000000000545647Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:26.946{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0b79b68a67fb1ce32021-12-21 11:36:26.946root 11241100x8000000000000000545648Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:26.946{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d0309183dc5dc9de2021-12-21 11:36:26.946root 11241100x8000000000000000545649Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:26.946{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9e6dfba95d40a2732021-12-21 11:36:26.946root 11241100x8000000000000000545650Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:26.946{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.48f4a10593d7a4932021-12-21 11:36:26.946root 11241100x8000000000000000545651Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:26.946{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.596f6d9fd97784412021-12-21 11:36:26.946root 11241100x8000000000000000545652Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:26.946{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9fb0ccdc875804d82021-12-21 11:36:26.946root 11241100x8000000000000000545653Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:26.946{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.feedf51df756e0742021-12-21 11:36:26.946root 11241100x8000000000000000545654Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:26.946{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.003523a1e5fa49bc2021-12-21 11:36:26.946root 11241100x8000000000000000545655Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:26.946{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6efceef75ce087f12021-12-21 11:36:26.946root 11241100x8000000000000000545656Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:26.946{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a95c6b73f1c9f9972021-12-21 11:36:26.946root 11241100x8000000000000000545657Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:26.946{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0cc251c3480341972021-12-21 11:36:26.946root 11241100x8000000000000000545658Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:26.946{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.10d1a80040a0ba472021-12-21 11:36:26.946root 11241100x8000000000000000545659Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:26.947{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b3a2627e09ad5d1d2021-12-21 11:36:26.947root 11241100x8000000000000000545660Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:26.947{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c1db1fd8b8ece20a2021-12-21 11:36:26.947root 11241100x8000000000000000545661Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:26.947{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.74f03a65d94a7bfc2021-12-21 11:36:26.947root 11241100x8000000000000000545662Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:26.947{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.211fdb8194a5a7592021-12-21 11:36:26.947root 11241100x8000000000000000545663Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:26.947{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.03f660f4626098802021-12-21 11:36:26.947root 11241100x8000000000000000545664Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:26.947{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.820b08216159afdd2021-12-21 11:36:26.947root 11241100x8000000000000000545665Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:26.947{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9113881351b850d22021-12-21 11:36:26.947root 11241100x8000000000000000545666Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:26.947{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.83b76fec72eb76d52021-12-21 11:36:26.947root 11241100x8000000000000000545667Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:26.947{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.fcf9e85bb895199b2021-12-21 11:36:26.947root 11241100x8000000000000000545668Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:26.948{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a09894197539872e2021-12-21 11:36:26.948root 11241100x8000000000000000545669Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:26.948{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0390e3435af0823a2021-12-21 11:36:26.948root 11241100x8000000000000000545670Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:26.948{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0eaa057b3319cf702021-12-21 11:36:26.948root 11241100x8000000000000000545671Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:26.948{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.590aca0f5feb67302021-12-21 11:36:26.948root 11241100x8000000000000000545672Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:26.948{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b986427f15cbf2222021-12-21 11:36:26.948root 11241100x8000000000000000545673Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:26.951{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.86224e93f6212e732021-12-21 11:36:26.951root 11241100x8000000000000000545674Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:26.951{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b6a5e2e16c5b47082021-12-21 11:36:26.951root 11241100x8000000000000000545675Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:26.951{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0975ace1763af9822021-12-21 11:36:26.951root 11241100x8000000000000000545676Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:26.952{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.adc92c8198bb1e522021-12-21 11:36:26.952root 11241100x8000000000000000545677Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:26.952{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8219118e6130ab652021-12-21 11:36:26.952root 11241100x8000000000000000545678Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:26.952{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.245aae936da0decd2021-12-21 11:36:26.952root 11241100x8000000000000000545679Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:26.952{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3ea56bfd62df4a222021-12-21 11:36:26.952root 11241100x8000000000000000545680Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:26.953{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.36b5b7482b706dbd2021-12-21 11:36:26.953root 11241100x8000000000000000545681Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:26.953{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.735e220e1083d3a02021-12-21 11:36:26.953root 11241100x8000000000000000545682Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:26.953{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c72c5b439b21c6692021-12-21 11:36:26.953root 11241100x8000000000000000545683Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:26.953{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ae604cee89daed372021-12-21 11:36:26.953root 11241100x8000000000000000545684Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:26.954{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.75357c3028c5b8882021-12-21 11:36:26.954root 11241100x8000000000000000545685Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:26.954{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.53a1f0980d310a732021-12-21 11:36:26.954root 11241100x8000000000000000545686Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:26.954{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6b85f849d29cbc0e2021-12-21 11:36:26.954root 11241100x8000000000000000545687Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:26.949{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.32bbcca8826769f22021-12-21 11:36:26.949root 11241100x8000000000000000545688Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:26.950{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e1b8cf5d187cf6fc2021-12-21 11:36:26.950root 11241100x8000000000000000545689Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:26.950{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a2038cfbe4f1ea512021-12-21 11:36:26.950root 11241100x8000000000000000545690Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:26.950{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d579d7f602e859832021-12-21 11:36:26.950root 11241100x8000000000000000545691Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:26.950{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8a9364f0bc0772ce2021-12-21 11:36:26.950root 11241100x8000000000000000545692Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:26.950{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f257f5b790a3e7582021-12-21 11:36:26.950root 11241100x8000000000000000545693Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:26.950{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5be147e193ba1f2b2021-12-21 11:36:26.950root 11241100x8000000000000000545694Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:26.950{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c5642fb3711d00802021-12-21 11:36:26.950root 11241100x8000000000000000545695Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:26.950{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b8859936284d42f82021-12-21 11:36:26.950root 11241100x8000000000000000545696Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:26.950{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.710644364d5fe57d2021-12-21 11:36:26.950root 11241100x8000000000000000545697Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:26.954{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f02dbe84cf2d80f52021-12-21 11:36:26.954root 11241100x8000000000000000545698Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:26.954{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7a820a701badc05d2021-12-21 11:36:26.954root 11241100x8000000000000000545699Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:26.955{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.842208199b25bb522021-12-21 11:36:26.955root 11241100x8000000000000000545700Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:26.955{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.feeca9264b2dc9032021-12-21 11:36:26.955root 11241100x8000000000000000545701Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:26.955{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b71574525baa24fa2021-12-21 11:36:26.955root 11241100x8000000000000000545702Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:26.955{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9875c097518679392021-12-21 11:36:26.955root 11241100x8000000000000000545703Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:26.955{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f4d54bcbb4cdee7d2021-12-21 11:36:26.955root 11241100x8000000000000000545704Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:26.956{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1c30fa1492941be12021-12-21 11:36:26.956root 11241100x8000000000000000545705Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:26.956{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3850afd2ac1fa88b2021-12-21 11:36:26.956root 11241100x8000000000000000545706Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:26.957{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a8d3dea0f6435c542021-12-21 11:36:26.957root 11241100x8000000000000000545707Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:26.957{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9cc094012066ec302021-12-21 11:36:26.957root 11241100x8000000000000000545708Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:26.957{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ab4ddabbd63664e22021-12-21 11:36:26.957root 11241100x8000000000000000545709Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:26.958{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.50062180361bc50b2021-12-21 11:36:26.958root 11241100x8000000000000000545710Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:26.958{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.272bbc13c7b357102021-12-21 11:36:26.958root 11241100x8000000000000000545711Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:26.959{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.53604f40f1cece6e2021-12-21 11:36:26.959root 11241100x8000000000000000545712Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:26.959{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.356074221dab531e2021-12-21 11:36:26.959root 11241100x8000000000000000545713Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:26.960{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.95cce636ee1b9aad2021-12-21 11:36:26.960root 11241100x8000000000000000545714Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:26.960{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.59772ae7a81204942021-12-21 11:36:26.960root 11241100x8000000000000000545715Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:26.960{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ccb3aec0aff6654f2021-12-21 11:36:26.960root 11241100x8000000000000000545716Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:26.961{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9654b8915d2136492021-12-21 11:36:26.961root 11241100x8000000000000000545717Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:26.961{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5ee4470c29b734512021-12-21 11:36:26.961root 11241100x8000000000000000545718Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:26.961{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e007c432a459110e2021-12-21 11:36:26.961root 11241100x8000000000000000545719Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:26.961{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7ad2a1de3fdc7ce52021-12-21 11:36:26.961root 11241100x8000000000000000545720Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:26.961{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.caa51b7a9d5f82d52021-12-21 11:36:26.961root 11241100x8000000000000000545721Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:26.963{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b839b0e4c01cac8e2021-12-21 11:36:26.963root 11241100x8000000000000000545722Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:26.963{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b63a862f5a89e2152021-12-21 11:36:26.963root 11241100x8000000000000000545723Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:26.963{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ceba7240562709002021-12-21 11:36:26.963root 11241100x8000000000000000545724Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:26.964{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.50d38d1c85bb973d2021-12-21 11:36:26.964root 11241100x8000000000000000545725Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:26.964{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5b474a0caed8c6b52021-12-21 11:36:26.964root 11241100x8000000000000000545726Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:26.964{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.66b59b7eadc8620c2021-12-21 11:36:26.964root 11241100x8000000000000000545727Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:26.965{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7d9be0d67cbdea742021-12-21 11:36:26.965root 11241100x8000000000000000545728Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:26.965{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.02faf51fc42705f22021-12-21 11:36:26.965root 11241100x8000000000000000545729Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:26.965{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1b510286c97ddf9c2021-12-21 11:36:26.965root 11241100x8000000000000000545730Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:26.965{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.87ea83e7e39c68212021-12-21 11:36:26.965root 11241100x8000000000000000545731Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:26.965{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4cd14d0cea1e1f112021-12-21 11:36:26.965root 11241100x8000000000000000545732Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:26.966{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.bb3a3cbb5baac1542021-12-21 11:36:26.966root 11241100x8000000000000000545733Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:26.966{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.376a82e34748b3692021-12-21 11:36:26.966root 11241100x8000000000000000545734Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:26.966{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.17e35b151836839b2021-12-21 11:36:26.966root 11241100x8000000000000000545735Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:26.966{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1a7dd1041a089b1d2021-12-21 11:36:26.966root 11241100x8000000000000000545736Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:26.966{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7af9cd84dca31f952021-12-21 11:36:26.966root 11241100x8000000000000000545737Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:26.967{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6215b71dca25002c2021-12-21 11:36:26.967root 11241100x8000000000000000545738Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:26.967{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1cda0665ea4220682021-12-21 11:36:26.967root 11241100x8000000000000000545739Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:26.967{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d7c0a0ff7bd5f8912021-12-21 11:36:26.967root 11241100x8000000000000000545740Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:26.968{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2634a01dc36038fd2021-12-21 11:36:26.968root 11241100x8000000000000000545741Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:26.968{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3c6762b64c05249f2021-12-21 11:36:26.968root 11241100x8000000000000000545742Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:26.968{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.fe26ca62b2aa70a22021-12-21 11:36:26.968root 11241100x8000000000000000545743Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:26.969{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.014c6339b438ada42021-12-21 11:36:26.969root 11241100x8000000000000000545744Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:26.969{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.91355af5c64b4c012021-12-21 11:36:26.969root 11241100x8000000000000000545745Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:26.969{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f372c984155750862021-12-21 11:36:26.969root 11241100x8000000000000000545746Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:26.969{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.276e43506e9de5e02021-12-21 11:36:26.969root 11241100x8000000000000000545747Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:26.969{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9ff249fc577ae9892021-12-21 11:36:26.969root 11241100x8000000000000000545748Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:26.969{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.00654f9dea256bb42021-12-21 11:36:26.969root 11241100x8000000000000000545749Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:26.969{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.fe40257dbd8a66a92021-12-21 11:36:26.969root 11241100x8000000000000000545750Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:26.972{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.db57ce74a075a3042021-12-21 11:36:26.972root 11241100x8000000000000000545751Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:26.972{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.da4571fd2f17d2e42021-12-21 11:36:26.972root 11241100x8000000000000000545752Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:26.972{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8b1adab4d2d3e68f2021-12-21 11:36:26.972root 11241100x8000000000000000545753Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:26.973{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2b375ccb9d2c15c72021-12-21 11:36:26.973root 11241100x8000000000000000545754Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:26.973{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c8b7a0bce10825082021-12-21 11:36:26.973root 11241100x8000000000000000545755Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:26.973{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.76c5661bc36432722021-12-21 11:36:26.973root 11241100x8000000000000000545756Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:26.973{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.aca589a40e3ecd852021-12-21 11:36:26.973root 11241100x8000000000000000545757Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:26.974{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b36e9ead8fa250c62021-12-21 11:36:26.974root 11241100x8000000000000000545758Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:26.974{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c44453ddd588f8772021-12-21 11:36:26.974root 11241100x8000000000000000545759Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:26.974{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.94eee1f4aff44d762021-12-21 11:36:26.974root 11241100x8000000000000000545760Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:26.974{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e7d4a58bdc55d79e2021-12-21 11:36:26.974root 11241100x8000000000000000545761Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:26.975{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e941b71c727e4a1f2021-12-21 11:36:26.975root 11241100x8000000000000000545762Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:26.975{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8ce7200adee984c32021-12-21 11:36:26.975root 11241100x8000000000000000545763Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:26.975{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8b9f900182e28e5b2021-12-21 11:36:26.975root 11241100x8000000000000000545764Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:26.975{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a2211dc6dfd9ecdb2021-12-21 11:36:26.975root 11241100x8000000000000000545765Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:26.976{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b770c95fe070139b2021-12-21 11:36:26.976root 11241100x8000000000000000545766Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:26.976{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d6f56a28e7e050b92021-12-21 11:36:26.976root 11241100x8000000000000000545767Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:26.977{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.96888575e2a9dc712021-12-21 11:36:26.977root 11241100x8000000000000000545768Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:26.977{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7c81255b406351a92021-12-21 11:36:26.977root 11241100x8000000000000000545769Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:26.977{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.775f71433ee014552021-12-21 11:36:26.977root 11241100x8000000000000000545770Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:26.977{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b113c19ea6d546ba2021-12-21 11:36:26.977root 11241100x8000000000000000545771Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:26.977{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.308ec819b7663e9a2021-12-21 11:36:26.977root 11241100x8000000000000000545772Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:26.977{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4c668e0c96bebe242021-12-21 11:36:26.977root 11241100x8000000000000000545773Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:26.977{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b4c553203053e7632021-12-21 11:36:26.977root 11241100x8000000000000000545774Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:26.977{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.096b194a6578b34a2021-12-21 11:36:26.977root 11241100x8000000000000000545775Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:26.977{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f51dfcff23a20bea2021-12-21 11:36:26.977root 11241100x8000000000000000545776Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:26.977{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e0314e1d9f632d892021-12-21 11:36:26.977root 11241100x8000000000000000545777Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:26.977{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.25721ed396e9facd2021-12-21 11:36:26.977root 11241100x8000000000000000545778Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:26.978{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e34edc67d98a51342021-12-21 11:36:26.978root 11241100x8000000000000000545779Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:26.978{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.19d101abb8d503902021-12-21 11:36:26.978root 11241100x8000000000000000545780Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:26.978{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1a4e96739b2641242021-12-21 11:36:26.978root 11241100x8000000000000000545781Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:26.978{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.69585d8fcfea4a2c2021-12-21 11:36:26.978root 11241100x8000000000000000545782Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:26.978{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e6027a3591af0b5d2021-12-21 11:36:26.978root 11241100x8000000000000000545783Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:26.978{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c5a1eed1b825fc5f2021-12-21 11:36:26.978root 11241100x8000000000000000545784Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:26.978{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b66127a9326c24772021-12-21 11:36:26.978root 11241100x8000000000000000545785Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:26.978{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8719ba6cfefcb3182021-12-21 11:36:26.978root 11241100x8000000000000000545786Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:26.978{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.99203d9536d6edf42021-12-21 11:36:26.978root 11241100x8000000000000000545787Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:26.978{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a5ea34a8b5b09a612021-12-21 11:36:26.978root 11241100x8000000000000000545788Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:26.978{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.abcb13d9584602bb2021-12-21 11:36:26.978root 11241100x8000000000000000545789Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:26.979{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6b41e93e074b8aea2021-12-21 11:36:26.979root 11241100x8000000000000000545790Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:26.979{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f9dcf4d4de5dbbfb2021-12-21 11:36:26.979root 11241100x8000000000000000545791Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:26.979{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.244becacf20aa51a2021-12-21 11:36:26.979root 11241100x8000000000000000545792Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:26.979{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.fb51d1ca3890ed9e2021-12-21 11:36:26.979root 11241100x8000000000000000545793Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:26.979{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.94ee644974f1b8842021-12-21 11:36:26.979root 11241100x8000000000000000545794Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:26.979{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.114339257b51fe882021-12-21 11:36:26.979root 11241100x8000000000000000545795Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:26.979{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0d9dc86b9d0d9f002021-12-21 11:36:26.979root 11241100x8000000000000000545796Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:26.979{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3979c782f85e3e4e2021-12-21 11:36:26.979root 11241100x8000000000000000545797Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:26.979{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.75d7994ea3f57e5d2021-12-21 11:36:26.979root 11241100x8000000000000000545798Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:26.979{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9b0de0074d48f5972021-12-21 11:36:26.979root 11241100x8000000000000000545799Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:26.979{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0e1ee06b0de523ea2021-12-21 11:36:26.979root 11241100x8000000000000000545800Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:26.980{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.32df7edd22988fde2021-12-21 11:36:26.980root 11241100x8000000000000000545801Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:26.980{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4c3d0033ac96fb632021-12-21 11:36:26.980root 11241100x8000000000000000545802Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:26.980{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ffea1cf69a74dd332021-12-21 11:36:26.980root 11241100x8000000000000000545803Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:26.980{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a9f52abe841366d52021-12-21 11:36:26.980root 11241100x8000000000000000545804Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:26.980{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7ef8cfed66aae6c12021-12-21 11:36:26.980root 11241100x8000000000000000545805Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:26.980{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.785cb0144caebc8f2021-12-21 11:36:26.980root 11241100x8000000000000000545806Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:26.980{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.188fef2be88bfabe2021-12-21 11:36:26.980root 11241100x8000000000000000545807Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:26.980{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d3556f4a4b7420de2021-12-21 11:36:26.980root 11241100x8000000000000000545808Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:26.980{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.060cb18c4fc10baa2021-12-21 11:36:26.980root 11241100x8000000000000000545809Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:26.980{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a78f8d7f3588e3ba2021-12-21 11:36:26.980root 11241100x8000000000000000545810Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:26.980{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c8f8d5dde4c9f5d62021-12-21 11:36:26.980root 11241100x8000000000000000545811Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:26.981{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.027b7245e717d3582021-12-21 11:36:26.981root 11241100x8000000000000000545812Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:26.981{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.94513a46374b887e2021-12-21 11:36:26.981root 11241100x8000000000000000545813Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:26.981{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1cc3a929290e51562021-12-21 11:36:26.981root 11241100x8000000000000000545814Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:26.981{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9ce4413a40283b372021-12-21 11:36:26.981root 11241100x8000000000000000545815Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:26.981{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.33069e965c16d09f2021-12-21 11:36:26.981root 11241100x8000000000000000545816Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:26.981{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a7334b8f88778ab12021-12-21 11:36:26.981root 11241100x8000000000000000545817Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:26.981{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8e90280d76841e932021-12-21 11:36:26.981root 11241100x8000000000000000545818Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:26.981{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.eaf9894deb584ee02021-12-21 11:36:26.981root 11241100x8000000000000000545819Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:26.981{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.73fae0697a2990b42021-12-21 11:36:26.981root 11241100x8000000000000000545820Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:26.981{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e563352adce000af2021-12-21 11:36:26.981root 11241100x8000000000000000545821Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:26.981{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e729b8764b53acf72021-12-21 11:36:26.981root 11241100x8000000000000000545822Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:26.982{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9ee76469cb59b26d2021-12-21 11:36:26.982root 11241100x8000000000000000545823Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:26.982{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f48576b63a81d50e2021-12-21 11:36:26.982root 11241100x8000000000000000545824Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:26.982{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7dac561b438f1f0b2021-12-21 11:36:26.982root 11241100x8000000000000000545825Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:26.982{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6cee75d591dbd0492021-12-21 11:36:26.982root 11241100x8000000000000000545826Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:26.982{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.79207327b46d17fd2021-12-21 11:36:26.982root 11241100x8000000000000000545827Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:26.982{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.375511718fc3f1ed2021-12-21 11:36:26.982root 11241100x8000000000000000545828Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:26.982{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5a79d53f4dafd8922021-12-21 11:36:26.982root 11241100x8000000000000000545829Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:26.982{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9376344651f42a3b2021-12-21 11:36:26.982root 11241100x8000000000000000545830Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:26.982{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0364c77939936d392021-12-21 11:36:26.982root 11241100x8000000000000000545831Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:26.982{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.874c96033c8c420a2021-12-21 11:36:26.982root 11241100x8000000000000000545832Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:26.984{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3c1b2bfddfab0ad02021-12-21 11:36:26.984root 11241100x8000000000000000545833Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:26.984{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3be06c17bc3448452021-12-21 11:36:26.984root 11241100x8000000000000000545834Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:26.985{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4edc275602e8eb5b2021-12-21 11:36:26.985root 11241100x8000000000000000545835Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:26.985{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.eb6afda6993e43642021-12-21 11:36:26.985root 11241100x8000000000000000545836Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:26.985{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1ad7c03d25e710c62021-12-21 11:36:26.985root 11241100x8000000000000000545837Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:26.987{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.86d1e5370e604d3a2021-12-21 11:36:26.987root 11241100x8000000000000000545838Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:26.987{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.864e416d1460b7362021-12-21 11:36:26.987root 11241100x8000000000000000545839Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:26.988{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c1214218d0f7d7dc2021-12-21 11:36:26.988root 11241100x8000000000000000545840Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:26.988{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.10617166ba7ced372021-12-21 11:36:26.988root 11241100x8000000000000000545841Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:26.988{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c3e24b4d0d042b992021-12-21 11:36:26.988root 11241100x8000000000000000545842Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:26.988{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.95581f8ffa320c1d2021-12-21 11:36:26.988root 11241100x8000000000000000545843Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:26.988{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.77f9218a7ba1171e2021-12-21 11:36:26.988root 11241100x8000000000000000545844Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:26.988{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d6d53363a272fea12021-12-21 11:36:26.988root 11241100x8000000000000000545845Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:26.988{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e056015a9e7a0a182021-12-21 11:36:26.988root 11241100x8000000000000000545846Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:26.988{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9a9a5f9b5697aae02021-12-21 11:36:26.988root 11241100x8000000000000000545847Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:26.989{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.bee482b4b3886f4f2021-12-21 11:36:26.989root 11241100x8000000000000000545848Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:26.989{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b3d48d062af577242021-12-21 11:36:26.989root 11241100x8000000000000000545849Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:26.989{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.cb7efb2335da9fbf2021-12-21 11:36:26.989root 11241100x8000000000000000545850Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:26.989{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.56ac5378164186cc2021-12-21 11:36:26.989root 11241100x8000000000000000545851Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:26.989{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a95070a8e9e19aa12021-12-21 11:36:26.989root 11241100x8000000000000000545852Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:26.989{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.aa4abb0fc961575b2021-12-21 11:36:26.989root 11241100x8000000000000000545853Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:26.989{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3e0934cfc52fa7392021-12-21 11:36:26.989root 11241100x8000000000000000545854Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:26.989{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.981516e80ca31a5e2021-12-21 11:36:26.989root 11241100x8000000000000000545855Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:26.990{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ffb3e9f643a1d0902021-12-21 11:36:26.990root 11241100x8000000000000000545856Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:26.990{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.10f06363220ec05f2021-12-21 11:36:26.990root 11241100x8000000000000000545857Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:26.990{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b597628366bff4162021-12-21 11:36:26.990root 11241100x8000000000000000545858Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:26.990{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.fec177e51cffc54d2021-12-21 11:36:26.990root 11241100x8000000000000000545859Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:26.990{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e16d1ec33720c50b2021-12-21 11:36:26.990root 11241100x8000000000000000545860Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:26.990{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.520e89a82feed3f72021-12-21 11:36:26.990root 11241100x8000000000000000545861Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:26.990{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1e4596962b337bfe2021-12-21 11:36:26.990root 11241100x8000000000000000545862Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:26.990{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0c3c9ac39895a4472021-12-21 11:36:26.990root 11241100x8000000000000000545863Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:26.990{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.52e3a30e1d4b4df22021-12-21 11:36:26.990root 11241100x8000000000000000545864Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:26.991{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.553e15bb74a1b0ef2021-12-21 11:36:26.991root 11241100x8000000000000000545865Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:26.991{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.64c3afd9771a75242021-12-21 11:36:26.991root 11241100x8000000000000000545866Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:26.992{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a5f9af3caad3b3d92021-12-21 11:36:26.992root 11241100x8000000000000000545867Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:26.992{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4a9b7bd297c48b982021-12-21 11:36:26.992root 11241100x8000000000000000545868Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:26.992{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6da75a799af72d7b2021-12-21 11:36:26.992root 11241100x8000000000000000545869Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:26.992{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4a3ecd5b035d478c2021-12-21 11:36:26.992root 11241100x8000000000000000545870Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:26.992{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7a693fe379e6a6db2021-12-21 11:36:26.992root 11241100x8000000000000000545871Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:26.993{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.496d192628480eb22021-12-21 11:36:26.993root 11241100x8000000000000000545872Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:26.993{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ecaf7424ed4d99992021-12-21 11:36:26.993root 11241100x8000000000000000545873Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:26.993{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.69b8462983676dab2021-12-21 11:36:26.993root 11241100x8000000000000000545874Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:26.993{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9d79f79c17c9594b2021-12-21 11:36:26.993root 11241100x8000000000000000545875Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:26.993{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a81c96680ffe52542021-12-21 11:36:26.993root 11241100x8000000000000000545876Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:26.993{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3d23bf1b59276aa52021-12-21 11:36:26.993root 11241100x8000000000000000545877Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:26.993{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a449d711c9730f312021-12-21 11:36:26.993root 11241100x8000000000000000545878Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:26.993{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.78acfea782ed2d122021-12-21 11:36:26.993root 11241100x8000000000000000545879Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:26.993{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.de83c40fd774facb2021-12-21 11:36:26.993root 11241100x8000000000000000545880Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:26.994{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.22ac578f4cdfb9cb2021-12-21 11:36:26.994root 11241100x8000000000000000545881Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:26.994{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d3f44611894583bf2021-12-21 11:36:26.994root 11241100x8000000000000000545882Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:26.994{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e98c4cce7b3dd1d92021-12-21 11:36:26.994root 11241100x8000000000000000545883Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:26.994{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f60de69dded42bdb2021-12-21 11:36:26.994root 11241100x8000000000000000545884Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:26.994{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b891145b1e7ee4532021-12-21 11:36:26.994root 11241100x8000000000000000545885Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:26.994{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8f6d3f4b1fc396342021-12-21 11:36:26.994root 11241100x8000000000000000545886Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:26.994{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.24d81481fcf199872021-12-21 11:36:26.994root 11241100x8000000000000000545887Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:26.994{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.477ae586a9c344812021-12-21 11:36:26.994root 11241100x8000000000000000545888Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:26.994{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.dc3924f58a17786c2021-12-21 11:36:26.994root 11241100x8000000000000000545889Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:26.994{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.aa581c06d5b3376e2021-12-21 11:36:26.994root 11241100x8000000000000000545890Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:26.995{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.55cd5572808d1f7f2021-12-21 11:36:26.995root 11241100x8000000000000000545891Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:26.995{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.cfc35766b72882412021-12-21 11:36:26.995root 11241100x8000000000000000545892Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:26.995{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.efd3e82ebe0d23f92021-12-21 11:36:26.995root 11241100x8000000000000000545893Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:26.995{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5ad585006aa495dd2021-12-21 11:36:26.995root 11241100x8000000000000000545894Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:26.995{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.27054a1fb398553d2021-12-21 11:36:26.995root 11241100x8000000000000000545895Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:26.995{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b91ac9c34c10800e2021-12-21 11:36:26.995root 11241100x8000000000000000545896Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:26.995{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5f45ff621f2ccad02021-12-21 11:36:26.995root 11241100x8000000000000000545897Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:26.995{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2a529304ef141faf2021-12-21 11:36:26.995root 11241100x8000000000000000545898Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:26.995{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2e0131a6f0309e0a2021-12-21 11:36:26.995root 11241100x8000000000000000545899Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:26.995{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.afa56b98a545cf872021-12-21 11:36:26.995root 11241100x8000000000000000545900Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:26.995{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.31ea859d871299eb2021-12-21 11:36:26.995root 11241100x8000000000000000545901Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:26.995{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3d21e249796458e82021-12-21 11:36:26.995root 11241100x8000000000000000545902Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:26.995{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.556526a1c3adc6b42021-12-21 11:36:26.995root 11241100x8000000000000000545903Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:26.996{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7b9ae612721c69f82021-12-21 11:36:26.996root 11241100x8000000000000000545904Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:26.996{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9f0453b37375bc812021-12-21 11:36:26.996root 11241100x8000000000000000545905Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:26.996{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.18c7d5b04c089fdf2021-12-21 11:36:26.996root 11241100x8000000000000000545906Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:26.996{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a619e305b83e53c32021-12-21 11:36:26.996root 11241100x8000000000000000545907Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:26.996{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3172c547bea5af4f2021-12-21 11:36:26.996root 11241100x8000000000000000545908Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:26.996{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.726feb52cefc64b62021-12-21 11:36:26.996root 11241100x8000000000000000545909Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:26.996{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.22d14825eaf8a17a2021-12-21 11:36:26.996root 11241100x8000000000000000545910Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:26.996{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.72cd7bf3ef9647da2021-12-21 11:36:26.996root 11241100x8000000000000000545911Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:26.996{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f35836629410b8692021-12-21 11:36:26.996root 11241100x8000000000000000545912Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:26.996{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6274037263b4eba82021-12-21 11:36:26.996root 11241100x8000000000000000545913Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:26.996{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6b2d96843d13936d2021-12-21 11:36:26.996root 11241100x8000000000000000545914Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:26.997{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.adfb712228a94cbd2021-12-21 11:36:26.997root 11241100x8000000000000000545915Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:26.997{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1c37797c9a8e21142021-12-21 11:36:26.997root 11241100x8000000000000000545916Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:26.997{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.eb908b8056df131a2021-12-21 11:36:26.997root 11241100x8000000000000000545917Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:26.997{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.951f23a3221ea83d2021-12-21 11:36:26.997root 11241100x8000000000000000545918Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:26.997{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.52b6c2eafb94e52e2021-12-21 11:36:26.997root 11241100x8000000000000000545919Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:26.997{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.68da0baff2dc6ba72021-12-21 11:36:26.997root 11241100x8000000000000000545920Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:26.997{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d6004d02bb669c942021-12-21 11:36:26.997root 11241100x8000000000000000545921Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:26.997{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0017a893e137fe422021-12-21 11:36:26.997root 11241100x8000000000000000545922Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:26.997{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ad454fd116958fba2021-12-21 11:36:26.997root 11241100x8000000000000000545923Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:26.997{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.92a926f15cd8522e2021-12-21 11:36:26.997root 11241100x8000000000000000545924Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:26.997{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d65ece40bd58ffdc2021-12-21 11:36:26.997root 11241100x8000000000000000545925Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:26.998{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6ebd91b69a6634302021-12-21 11:36:26.998root 11241100x8000000000000000545926Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:26.998{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a43b93b90a5a35ed2021-12-21 11:36:26.998root 11241100x8000000000000000545927Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:26.998{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e20ee18916bc3cbc2021-12-21 11:36:26.998root 11241100x8000000000000000545928Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:26.998{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f89d813206a64da72021-12-21 11:36:26.998root 11241100x8000000000000000545929Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:26.998{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f57b76484557fd912021-12-21 11:36:26.998root 11241100x8000000000000000545930Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:26.998{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.fbf8e2c88bf042402021-12-21 11:36:26.998root 11241100x8000000000000000545931Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:26.998{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ae72a118e85f8b1f2021-12-21 11:36:26.998root 11241100x8000000000000000545932Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:26.998{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d6960fe157daf30e2021-12-21 11:36:26.998root 11241100x8000000000000000545933Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:26.998{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ea634b0ba3445aac2021-12-21 11:36:26.998root 11241100x8000000000000000545934Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:26.999{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.999b0639846243c42021-12-21 11:36:26.999root 11241100x8000000000000000545935Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:26.999{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.aff31105b809c7842021-12-21 11:36:26.999root 11241100x8000000000000000545936Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:26.999{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.44eaf3927eb7edfe2021-12-21 11:36:26.999root 11241100x8000000000000000545937Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:26.999{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.59856b2f6d95882a2021-12-21 11:36:26.999root 11241100x8000000000000000545938Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:26.999{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a353cf7ac38a04b92021-12-21 11:36:26.999root 11241100x8000000000000000545939Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:27.000{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a5c5d7ea04e39afb2021-12-21 11:36:27.000root 11241100x8000000000000000545940Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:27.000{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6d57765a1ddfb5162021-12-21 11:36:27.000root 11241100x8000000000000000545941Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:27.000{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.66d0e7b3e53ec0072021-12-21 11:36:27.000root 11241100x8000000000000000545942Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:27.000{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c2590843a5a1db1b2021-12-21 11:36:27.000root 11241100x8000000000000000545943Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:27.000{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ecda5df103113d492021-12-21 11:36:27.000root 11241100x8000000000000000545944Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:27.000{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5142af4bc78feeee2021-12-21 11:36:27.000root 11241100x8000000000000000545945Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:27.000{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9ec5c87c84a4a0df2021-12-21 11:36:27.000root 11241100x8000000000000000545946Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:27.000{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c17df2c5187cb7632021-12-21 11:36:27.000root 11241100x8000000000000000545947Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:27.000{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.bda0231f95eddb9d2021-12-21 11:36:27.000root 11241100x8000000000000000545948Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:27.000{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1f935891b5dc07cf2021-12-21 11:36:27.000root 11241100x8000000000000000545949Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:27.000{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.52e4dc3deb6f050b2021-12-21 11:36:27.000root 11241100x8000000000000000545950Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:27.000{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.13d7d8ec6753082d2021-12-21 11:36:27.000root 11241100x8000000000000000545951Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:27.001{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.fcb2add813c1dbea2021-12-21 11:36:27.001root 11241100x8000000000000000545952Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:27.001{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6aade3b32a2478aa2021-12-21 11:36:27.001root 11241100x8000000000000000545953Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:27.001{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b09395e4fa24b00c2021-12-21 11:36:27.001root 11241100x8000000000000000545954Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:27.001{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1f4201577e63362e2021-12-21 11:36:27.001root 11241100x8000000000000000545955Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:27.001{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f9cfbcaf830407842021-12-21 11:36:27.001root 11241100x8000000000000000545956Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:27.001{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.bb21e10e39b85b472021-12-21 11:36:27.001root 11241100x8000000000000000545957Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:27.001{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.120a3131b261c36a2021-12-21 11:36:27.001root 11241100x8000000000000000545958Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:27.001{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8c9ca83145c596de2021-12-21 11:36:27.001root 11241100x8000000000000000545959Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:27.001{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c1caa7679059a35b2021-12-21 11:36:27.001root 11241100x8000000000000000545960Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:27.002{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3fa4a3c93386159e2021-12-21 11:36:27.002root 11241100x8000000000000000545961Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:27.002{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1a4e7211f7d1bd472021-12-21 11:36:27.002root 11241100x8000000000000000545962Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:27.002{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.749da472cfd565592021-12-21 11:36:27.002root 11241100x8000000000000000545963Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:27.002{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.728ef7d86e10ff602021-12-21 11:36:27.002root 11241100x8000000000000000545964Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:27.002{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b0160365788c5f352021-12-21 11:36:27.002root 11241100x8000000000000000545965Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:27.002{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1c30ec7c08bb30aa2021-12-21 11:36:27.002root 11241100x8000000000000000545966Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:27.002{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c4f4a5038d9767a92021-12-21 11:36:27.002root 11241100x8000000000000000545967Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:27.002{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.85bb448b53195ba42021-12-21 11:36:27.002root 11241100x8000000000000000545968Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:27.002{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.58af0a0b51a4dc6e2021-12-21 11:36:27.002root 11241100x8000000000000000545969Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:27.003{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.389d49ded582f6192021-12-21 11:36:27.003root 11241100x8000000000000000545970Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:27.003{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f46344de32938f9f2021-12-21 11:36:27.003root 11241100x8000000000000000545971Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:27.003{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.020f4c55ac06bd782021-12-21 11:36:27.003root 11241100x8000000000000000545972Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:27.003{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f65105b46e836e172021-12-21 11:36:27.003root 11241100x8000000000000000545973Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:27.003{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.74261b963d743f9d2021-12-21 11:36:27.003root 11241100x8000000000000000545974Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:27.003{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1a735d2b81492c3c2021-12-21 11:36:27.003root 11241100x8000000000000000545975Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:27.003{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.29d37ec1fa41f97e2021-12-21 11:36:27.003root 11241100x8000000000000000545976Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:27.003{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c089be459e9c753e2021-12-21 11:36:27.003root 11241100x8000000000000000545977Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:27.004{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.60d99b1e7711d4882021-12-21 11:36:27.004root 11241100x8000000000000000545978Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:27.004{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.524db1b6a8c9ac4f2021-12-21 11:36:27.004root 11241100x8000000000000000545979Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:27.004{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.fa38eeac319d3a322021-12-21 11:36:27.004root 11241100x8000000000000000545980Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:27.004{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a23db728898529732021-12-21 11:36:27.004root 11241100x8000000000000000545981Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:27.004{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3a02f79631cad8bf2021-12-21 11:36:27.004root 11241100x8000000000000000545982Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:27.004{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b3df1859ff924ea22021-12-21 11:36:27.004root 11241100x8000000000000000545983Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:27.004{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.88a6aa70b4e858bb2021-12-21 11:36:27.004root 11241100x8000000000000000545984Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:27.004{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5cbcaca466cd86aa2021-12-21 11:36:27.004root 11241100x8000000000000000545985Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:27.004{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a03debe3d776a5512021-12-21 11:36:27.004root 11241100x8000000000000000545986Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:27.005{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.886297c90dc0e6de2021-12-21 11:36:27.005root 11241100x8000000000000000545987Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:27.005{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3b7f5afe170c7d052021-12-21 11:36:27.005root 11241100x8000000000000000545988Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:27.005{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3fa46bb9c7967cb42021-12-21 11:36:27.005root 11241100x8000000000000000545989Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:27.005{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3cb126a79a076cf02021-12-21 11:36:27.005root 11241100x8000000000000000545990Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:27.005{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c4638bbd73e982962021-12-21 11:36:27.005root 11241100x8000000000000000545991Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:27.005{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b22d0a9452048c8a2021-12-21 11:36:27.005root 11241100x8000000000000000545992Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:27.005{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f132feb879a2705c2021-12-21 11:36:27.005root 11241100x8000000000000000545993Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:27.005{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ccdea079c45a78652021-12-21 11:36:27.005root 11241100x8000000000000000545994Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:27.005{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8de86296c972c8ad2021-12-21 11:36:27.005root 11241100x8000000000000000545995Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:27.006{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.16625329fcfbbcf72021-12-21 11:36:27.006root 11241100x8000000000000000545996Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:27.006{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3110e046fa498df42021-12-21 11:36:27.006root 11241100x8000000000000000545997Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:27.006{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.88a45522a99986472021-12-21 11:36:27.006root 11241100x8000000000000000545998Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:27.006{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.330632183e2a8ab52021-12-21 11:36:27.006root 11241100x8000000000000000545999Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:27.006{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2d9f7fce088a9b382021-12-21 11:36:27.006root 11241100x8000000000000000546000Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:27.006{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1beb6c971aba13032021-12-21 11:36:27.006root 11241100x8000000000000000546001Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:27.006{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d32833ca362ba8a92021-12-21 11:36:27.006root 11241100x8000000000000000546002Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:27.006{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f27a59046f0b33c62021-12-21 11:36:27.006root 11241100x8000000000000000546003Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:27.006{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6a1567329005a2092021-12-21 11:36:27.006root 11241100x8000000000000000546004Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:27.007{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.850d3e0a19db2c762021-12-21 11:36:27.007root 11241100x8000000000000000546005Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:27.007{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e2a36f7f5b790b232021-12-21 11:36:27.007root 11241100x8000000000000000546006Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:27.007{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1f750afc98032ee72021-12-21 11:36:27.007root 11241100x8000000000000000546007Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:27.442{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a37516eb10c7c8092021-12-21 11:36:27.442root 11241100x8000000000000000546008Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:27.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.610c587f258b715c2021-12-21 11:36:27.443root 11241100x8000000000000000546009Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:27.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9ad041ce5389a9d62021-12-21 11:36:27.443root 11241100x8000000000000000546010Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:27.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e785e23be5cc524c2021-12-21 11:36:27.443root 11241100x8000000000000000546011Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:27.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.74d71b67225cd5822021-12-21 11:36:27.443root 11241100x8000000000000000546012Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:27.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b70fe9fd1deaa9e72021-12-21 11:36:27.443root 11241100x8000000000000000546013Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:27.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b31696dc64ed0c572021-12-21 11:36:27.443root 11241100x8000000000000000546014Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:27.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1504cde690f17cdf2021-12-21 11:36:27.443root 11241100x8000000000000000546015Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:27.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.eee0038b7065cd0b2021-12-21 11:36:27.443root 11241100x8000000000000000546016Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:27.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.69bdd6226277349a2021-12-21 11:36:27.443root 11241100x8000000000000000546017Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:27.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.920efbfc933390c22021-12-21 11:36:27.443root 11241100x8000000000000000546018Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:27.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f1d8d66acf65029f2021-12-21 11:36:27.444root 11241100x8000000000000000546019Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:27.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.cd37eb2d0f0fe9e42021-12-21 11:36:27.444root 11241100x8000000000000000546020Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:27.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9e24411512fd48c42021-12-21 11:36:27.444root 11241100x8000000000000000546021Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:27.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.61ab3ba228bf2b862021-12-21 11:36:27.444root 11241100x8000000000000000546022Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:27.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0f2b8fae69e1c07f2021-12-21 11:36:27.444root 11241100x8000000000000000546023Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:27.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2bd6278e9845e56c2021-12-21 11:36:27.444root 11241100x8000000000000000546024Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:27.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.324e4f9f5b9a7bbd2021-12-21 11:36:27.444root 11241100x8000000000000000546025Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:27.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.74cda1aef8f396782021-12-21 11:36:27.445root 11241100x8000000000000000546026Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:27.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2d6821bf137acfc92021-12-21 11:36:27.445root 11241100x8000000000000000546027Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:27.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9db3301b660c78212021-12-21 11:36:27.445root 11241100x8000000000000000546028Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:27.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3d624f9cd7d5115b2021-12-21 11:36:27.445root 11241100x8000000000000000546029Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:27.446{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d87e72e02c7905bb2021-12-21 11:36:27.446root 11241100x8000000000000000546030Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:27.446{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.26f368592e0c92b52021-12-21 11:36:27.446root 11241100x8000000000000000546031Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:27.446{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d2c2cb968d47d2632021-12-21 11:36:27.446root 11241100x8000000000000000546032Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:27.446{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.78b2c5e39c4ba80a2021-12-21 11:36:27.446root 11241100x8000000000000000546033Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:27.446{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7e48c0eb361c55822021-12-21 11:36:27.446root 11241100x8000000000000000546034Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:27.446{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2a4040a31e36ae662021-12-21 11:36:27.446root 11241100x8000000000000000546035Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:27.446{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c7e92139654495fa2021-12-21 11:36:27.446root 11241100x8000000000000000546036Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:27.446{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.60883efb281ddbde2021-12-21 11:36:27.446root 11241100x8000000000000000546037Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:27.446{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.915e425f82f063942021-12-21 11:36:27.446root 11241100x8000000000000000546038Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:27.446{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.66fbb664b4c1cc862021-12-21 11:36:27.446root 11241100x8000000000000000546039Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:27.446{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a069e7aec9324dde2021-12-21 11:36:27.446root 11241100x8000000000000000546040Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:27.446{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.cc4570f25193f8692021-12-21 11:36:27.446root 11241100x8000000000000000546041Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:27.446{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b6c5b850a71bf60e2021-12-21 11:36:27.446root 11241100x8000000000000000546042Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:27.447{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f897ab08bfc2f3f42021-12-21 11:36:27.447root 11241100x8000000000000000546043Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:27.447{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c115c487b0794aea2021-12-21 11:36:27.447root 11241100x8000000000000000546044Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:27.447{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.34b91b02e5ebc4e62021-12-21 11:36:27.447root 11241100x8000000000000000546045Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:27.447{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1662bce9555e27222021-12-21 11:36:27.447root 11241100x8000000000000000546046Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:27.447{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.433322e0ebd17b7d2021-12-21 11:36:27.447root 11241100x8000000000000000546047Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:27.447{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.19e4eb0b5e8138bc2021-12-21 11:36:27.447root 11241100x8000000000000000546048Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:27.447{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4970a116abfac60d2021-12-21 11:36:27.447root 11241100x8000000000000000546049Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:27.447{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3bb03f637fc09fa32021-12-21 11:36:27.447root 11241100x8000000000000000546050Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:27.447{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.fb946188ff2e06062021-12-21 11:36:27.447root 11241100x8000000000000000546051Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:27.448{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.cce17929291fa1492021-12-21 11:36:27.448root 11241100x8000000000000000546052Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:27.448{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7fbcc20eca6ec17b2021-12-21 11:36:27.448root 11241100x8000000000000000546053Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:27.448{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5a724a1b3f4542202021-12-21 11:36:27.448root 11241100x8000000000000000546054Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:27.448{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c53c03799e6a89102021-12-21 11:36:27.448root 11241100x8000000000000000546055Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:27.448{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1c865aeaddbe3d962021-12-21 11:36:27.448root 11241100x8000000000000000546056Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:27.448{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a4044eaa8f5c794d2021-12-21 11:36:27.448root 11241100x8000000000000000546057Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:27.448{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9939afd1dc135b622021-12-21 11:36:27.448root 11241100x8000000000000000546058Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:27.448{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d8f67a0fca2dfc072021-12-21 11:36:27.448root 11241100x8000000000000000546059Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:27.448{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e1dbbfd01f091c402021-12-21 11:36:27.448root 11241100x8000000000000000546060Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:27.448{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.77422f1cb591c8892021-12-21 11:36:27.448root 11241100x8000000000000000546061Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:27.448{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.75cb033bf974addf2021-12-21 11:36:27.448root 11241100x8000000000000000546062Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:27.449{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9f9a26d3cbf8ad022021-12-21 11:36:27.449root 11241100x8000000000000000546063Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:27.449{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f6749b94257314972021-12-21 11:36:27.449root 11241100x8000000000000000546064Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:27.449{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.788ed2a3693cbfa22021-12-21 11:36:27.449root 11241100x8000000000000000546065Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:27.449{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.82427fd3f43c2cdb2021-12-21 11:36:27.449root 11241100x8000000000000000546066Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:27.449{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.79da77ade7a22eac2021-12-21 11:36:27.449root 11241100x8000000000000000546067Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:27.450{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9856236e0171eb4e2021-12-21 11:36:27.450root 11241100x8000000000000000546068Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:27.450{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d2af8203abf2308e2021-12-21 11:36:27.450root 11241100x8000000000000000546069Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:27.450{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a01709394ebdc4812021-12-21 11:36:27.450root 11241100x8000000000000000546070Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:27.450{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7209bdb8909db96b2021-12-21 11:36:27.450root 11241100x8000000000000000546071Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:27.450{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b453a6dd3ed0b61d2021-12-21 11:36:27.450root 11241100x8000000000000000546072Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:27.450{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7abe1bf0256716ee2021-12-21 11:36:27.450root 11241100x8000000000000000546073Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:27.450{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.47fc1ac12dec6d2a2021-12-21 11:36:27.450root 11241100x8000000000000000546074Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:27.450{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ebaccc2f5ece641d2021-12-21 11:36:27.450root 11241100x8000000000000000546075Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:27.450{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4e68c3ac68492a232021-12-21 11:36:27.450root 11241100x8000000000000000546076Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:27.450{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3ce10d720a9ed2e52021-12-21 11:36:27.450root 11241100x8000000000000000546077Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:27.450{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9fa3ce06e71b98b32021-12-21 11:36:27.450root 11241100x8000000000000000546078Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:27.450{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.30fcdfde7492a7712021-12-21 11:36:27.450root 11241100x8000000000000000546079Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:27.450{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.87e66ca70a12094b2021-12-21 11:36:27.450root 11241100x8000000000000000546080Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:27.451{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2efcfa798e4557f72021-12-21 11:36:27.451root 11241100x8000000000000000546081Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:27.451{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.46dd7164bb312b102021-12-21 11:36:27.451root 11241100x8000000000000000546082Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:27.451{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f9ca976df3fe013e2021-12-21 11:36:27.451root 11241100x8000000000000000546083Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:27.451{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.bbad05f50a2586cd2021-12-21 11:36:27.451root 11241100x8000000000000000546084Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:27.451{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f3c1719f33d6720a2021-12-21 11:36:27.451root 11241100x8000000000000000546085Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:27.451{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1d4830e53b97f3942021-12-21 11:36:27.451root 11241100x8000000000000000546086Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:27.451{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4b0a220d7e8b36e12021-12-21 11:36:27.451root 11241100x8000000000000000546087Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:27.451{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4e197300db652e382021-12-21 11:36:27.451root 11241100x8000000000000000546088Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:27.451{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f02dff440dbc10e02021-12-21 11:36:27.451root 11241100x8000000000000000546089Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:27.451{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8845300072138d1c2021-12-21 11:36:27.451root 11241100x8000000000000000546090Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:27.451{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e881068a82b22bb92021-12-21 11:36:27.451root 11241100x8000000000000000546091Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:27.451{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.bcc62a5207e5eda62021-12-21 11:36:27.451root 11241100x8000000000000000546092Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:27.451{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1427e572232cbb3a2021-12-21 11:36:27.451root 11241100x8000000000000000546093Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:27.451{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.bfa764c7f0c75b532021-12-21 11:36:27.451root 11241100x8000000000000000546094Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:27.451{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.271fce1d65da4f172021-12-21 11:36:27.451root 11241100x8000000000000000546095Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:27.452{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.29a0155284b2526d2021-12-21 11:36:27.452root 11241100x8000000000000000546096Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:27.452{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.cf773a104f9fa6152021-12-21 11:36:27.452root 11241100x8000000000000000546097Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:27.452{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.99fa61e0981d13492021-12-21 11:36:27.452root 11241100x8000000000000000546098Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:27.452{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.500bba5198e7eed92021-12-21 11:36:27.452root 11241100x8000000000000000546099Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:27.452{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8cc099789554dce42021-12-21 11:36:27.452root 11241100x8000000000000000546100Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:27.452{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f4a513f24eaf1d222021-12-21 11:36:27.452root 11241100x8000000000000000546101Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:27.452{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0ad53db926c85e812021-12-21 11:36:27.452root 11241100x8000000000000000546102Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:27.452{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6fd1f81be7df4f372021-12-21 11:36:27.452root 11241100x8000000000000000546103Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:27.452{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b53aa1051dd130562021-12-21 11:36:27.452root 11241100x8000000000000000546104Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:27.452{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6dd437d1ba3ac0ff2021-12-21 11:36:27.452root 11241100x8000000000000000546105Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:27.452{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c0aa6fcddcc8adec2021-12-21 11:36:27.452root 11241100x8000000000000000546106Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:27.452{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.74743dee2aa3176c2021-12-21 11:36:27.452root 11241100x8000000000000000546107Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:27.452{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.97f21dce7212972c2021-12-21 11:36:27.452root 11241100x8000000000000000546108Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:27.452{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.505c5f1057416c122021-12-21 11:36:27.452root 11241100x8000000000000000546109Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:27.453{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6a6a7655a65dc4aa2021-12-21 11:36:27.453root 11241100x8000000000000000546110Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:27.453{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.113421b8777d25f32021-12-21 11:36:27.453root 11241100x8000000000000000546111Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:27.453{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.32f02d871d3a14172021-12-21 11:36:27.453root 11241100x8000000000000000546112Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:27.453{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3045f71dc40574fd2021-12-21 11:36:27.453root 11241100x8000000000000000546113Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:27.453{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8400fe6a9e2189eb2021-12-21 11:36:27.453root 11241100x8000000000000000546114Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:27.453{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f7cb9923748fd7b72021-12-21 11:36:27.453root 11241100x8000000000000000546115Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:27.454{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2962a380421eef122021-12-21 11:36:27.454root 11241100x8000000000000000546116Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:27.454{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4d32eca1b45b8c142021-12-21 11:36:27.454root 11241100x8000000000000000546117Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:27.454{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e98c974377da23442021-12-21 11:36:27.454root 11241100x8000000000000000546118Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:27.454{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.904fad03b359cd9e2021-12-21 11:36:27.454root 11241100x8000000000000000546119Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:27.454{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7cde0d42ce98e56b2021-12-21 11:36:27.454root 11241100x8000000000000000546120Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:27.454{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.633fa05a565e5bee2021-12-21 11:36:27.454root 11241100x8000000000000000546121Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:27.454{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.02c00eb07abcbf2f2021-12-21 11:36:27.454root 11241100x8000000000000000546122Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:27.454{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.496d82c1c4ff6bab2021-12-21 11:36:27.454root 11241100x8000000000000000546123Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:27.455{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.43477314a231f74c2021-12-21 11:36:27.455root 11241100x8000000000000000546124Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:27.455{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.522d39564f41c7382021-12-21 11:36:27.455root 11241100x8000000000000000546125Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:27.456{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d2376a7713b91cb92021-12-21 11:36:27.456root 11241100x8000000000000000546126Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:27.456{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ca0da030035ee8292021-12-21 11:36:27.456root 11241100x8000000000000000546127Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:27.456{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9d8be9fe35c28dc72021-12-21 11:36:27.456root 11241100x8000000000000000546128Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:27.456{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.651ee367387b082c2021-12-21 11:36:27.456root 11241100x8000000000000000546129Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:27.456{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5f67e210e7f201cc2021-12-21 11:36:27.456root 11241100x8000000000000000546130Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:27.456{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f8b8974bd11853822021-12-21 11:36:27.456root 11241100x8000000000000000546131Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:27.456{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0a56c6fde94e20712021-12-21 11:36:27.456root 11241100x8000000000000000546132Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:27.456{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.32aa89fae36c98e62021-12-21 11:36:27.456root 11241100x8000000000000000546133Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:27.456{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6f2e7dad406b2ad32021-12-21 11:36:27.456root 11241100x8000000000000000546134Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:27.456{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9f1268d2f14163032021-12-21 11:36:27.456root 11241100x8000000000000000546135Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:27.456{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.eccd48e1d3062a042021-12-21 11:36:27.456root 11241100x8000000000000000546136Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:27.456{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9054079e7e87dc932021-12-21 11:36:27.456root 11241100x8000000000000000546137Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:27.456{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d971fb12cbd31f632021-12-21 11:36:27.456root 11241100x8000000000000000546138Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:27.457{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0cf4a14cb21a81a22021-12-21 11:36:27.457root 11241100x8000000000000000546139Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:27.457{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.476797ac1c2d7da52021-12-21 11:36:27.457root 11241100x8000000000000000546140Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:27.457{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9e6dcc0c4854ee1a2021-12-21 11:36:27.457root 11241100x8000000000000000546141Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:27.457{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.634dabc86dc7cc912021-12-21 11:36:27.457root 11241100x8000000000000000546142Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:27.457{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.12ade9a886410a7c2021-12-21 11:36:27.457root 11241100x8000000000000000546143Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:27.457{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3b02e2a5ba5b3df22021-12-21 11:36:27.457root 11241100x8000000000000000546144Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:27.457{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0b2d91cc205439ad2021-12-21 11:36:27.457root 11241100x8000000000000000546145Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:27.457{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.23dd50dc1f337c952021-12-21 11:36:27.457root 11241100x8000000000000000546146Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:27.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c8083c9b3a0f950e2021-12-21 11:36:27.943root 11241100x8000000000000000546147Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:27.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7ab73d9ce48daed12021-12-21 11:36:27.943root 11241100x8000000000000000546148Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:27.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c5b4a6484990dcb22021-12-21 11:36:27.943root 11241100x8000000000000000546149Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:27.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.91756924a35c84052021-12-21 11:36:27.943root 11241100x8000000000000000546150Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:27.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9e5e0a35fd59e0fb2021-12-21 11:36:27.943root 11241100x8000000000000000546151Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:27.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b2d2481af9ae5d462021-12-21 11:36:27.943root 11241100x8000000000000000546152Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:27.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7fad2ff21e97bd632021-12-21 11:36:27.943root 11241100x8000000000000000546153Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:27.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.87fff0d536a648892021-12-21 11:36:27.943root 11241100x8000000000000000546154Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:27.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9be3bea9c772f6892021-12-21 11:36:27.943root 11241100x8000000000000000546155Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:27.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e4a4ab0b21b6ab6e2021-12-21 11:36:27.944root 11241100x8000000000000000546156Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:27.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.94a0ecdf28301ef92021-12-21 11:36:27.944root 11241100x8000000000000000546157Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:27.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8408e9b5c462240f2021-12-21 11:36:27.944root 11241100x8000000000000000546158Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:27.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9e10e9df9b887d752021-12-21 11:36:27.944root 11241100x8000000000000000546159Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:27.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c43e6b0bf9728b0c2021-12-21 11:36:27.944root 11241100x8000000000000000546160Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:27.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.777678423fd7b19a2021-12-21 11:36:27.944root 11241100x8000000000000000546161Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:27.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4a973a072d60445e2021-12-21 11:36:27.944root 11241100x8000000000000000546162Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:27.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9862dd8b44bea8f62021-12-21 11:36:27.944root 11241100x8000000000000000546163Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:27.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.af420e1ed9fa78892021-12-21 11:36:27.945root 11241100x8000000000000000546164Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:27.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.709f3d31a138cbca2021-12-21 11:36:27.945root 11241100x8000000000000000546165Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:27.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.dc4f7236fcf50c8a2021-12-21 11:36:27.945root 11241100x8000000000000000546166Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:27.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.baaa8bcf9e77dbcd2021-12-21 11:36:27.945root 11241100x8000000000000000546167Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:27.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4a49b559a3b0c43c2021-12-21 11:36:27.945root 11241100x8000000000000000546168Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:27.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.443b44bccd657fbc2021-12-21 11:36:27.945root 11241100x8000000000000000546169Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:27.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4ae7aff84cb498192021-12-21 11:36:27.945root 11241100x8000000000000000546170Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:27.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.382baa9ce6238dc62021-12-21 11:36:27.945root 11241100x8000000000000000546171Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:27.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.fde3f889ad9e3fc52021-12-21 11:36:27.945root 11241100x8000000000000000546172Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:27.946{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.aec303195f0025b92021-12-21 11:36:27.946root 11241100x8000000000000000546173Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:27.946{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c4c53009bbec69232021-12-21 11:36:27.946root 11241100x8000000000000000546174Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:27.946{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9a634f7000d1279d2021-12-21 11:36:27.946root 11241100x8000000000000000546175Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:27.946{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7f4dce1ffb755d2f2021-12-21 11:36:27.946root 11241100x8000000000000000546176Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:27.946{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ba8e394e0342ac092021-12-21 11:36:27.946root 11241100x8000000000000000546177Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:27.946{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d1f1a895afd39f042021-12-21 11:36:27.946root 11241100x8000000000000000546178Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:27.946{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9eb7b77c8a78c1652021-12-21 11:36:27.946root 11241100x8000000000000000546179Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:27.947{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a58ffdde19b13ddb2021-12-21 11:36:27.947root 11241100x8000000000000000546180Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:27.947{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.fe9f51b56524bbec2021-12-21 11:36:27.947root 11241100x8000000000000000546181Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:27.947{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e0cb153a20cd18852021-12-21 11:36:27.947root 11241100x8000000000000000546182Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:27.947{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.45257c875bdb946d2021-12-21 11:36:27.947root 11241100x8000000000000000546183Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:27.947{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d68b7e483f1a313f2021-12-21 11:36:27.947root 11241100x8000000000000000546184Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:27.947{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e533379af8bd08812021-12-21 11:36:27.947root 11241100x8000000000000000546185Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:27.947{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.fa8cfcfe4abbec382021-12-21 11:36:27.947root 11241100x8000000000000000546186Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:27.947{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2e61d32a72f4cfd02021-12-21 11:36:27.947root 11241100x8000000000000000546187Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:27.948{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8b2317ccccb61ac42021-12-21 11:36:27.948root 11241100x8000000000000000546188Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:27.948{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2c6fb887c0983d2d2021-12-21 11:36:27.948root 11241100x8000000000000000546189Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:27.948{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f308205688c7096f2021-12-21 11:36:27.948root 11241100x8000000000000000546190Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:27.948{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.75a50441331f29072021-12-21 11:36:27.948root 11241100x8000000000000000546191Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:27.949{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5751de17f6e7c15f2021-12-21 11:36:27.949root 11241100x8000000000000000546192Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:27.949{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d60e3033338e5b7d2021-12-21 11:36:27.949root 11241100x8000000000000000546193Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:27.949{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f70edb1325f68f8a2021-12-21 11:36:27.949root 11241100x8000000000000000546194Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:27.949{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d5ad7fd70d4f3c1c2021-12-21 11:36:27.949root 11241100x8000000000000000546195Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:27.949{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8a5636b0a0bdbd112021-12-21 11:36:27.949root 11241100x8000000000000000546196Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:27.949{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b16d408e3d0fafb62021-12-21 11:36:27.949root 11241100x8000000000000000546197Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:27.949{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.692a561530a58f682021-12-21 11:36:27.949root 11241100x8000000000000000546198Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:27.949{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ad68f15329f44e4c2021-12-21 11:36:27.949root 11241100x8000000000000000546199Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:27.950{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a25bd700eef8cc632021-12-21 11:36:27.950root 11241100x8000000000000000546200Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:27.950{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.bc25f4dec13c8a0e2021-12-21 11:36:27.950root 11241100x8000000000000000546201Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:27.950{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0ae3e252383297c42021-12-21 11:36:27.950root 11241100x8000000000000000546202Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:27.950{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.16f68889b21177bd2021-12-21 11:36:27.950root 11241100x8000000000000000546203Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:27.950{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.29be91ad08bb8a3f2021-12-21 11:36:27.950root 11241100x8000000000000000546204Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:27.950{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9c3f9ac1492257a42021-12-21 11:36:27.950root 11241100x8000000000000000546205Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:27.950{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4cdec100f143953a2021-12-21 11:36:27.950root 11241100x8000000000000000546206Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:27.950{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f36748c3832935552021-12-21 11:36:27.950root 11241100x8000000000000000546207Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:27.951{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.bf23ef63b2c640152021-12-21 11:36:27.951root 11241100x8000000000000000546208Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:27.951{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.09d24cb508f9d0802021-12-21 11:36:27.951root 11241100x8000000000000000546209Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:27.951{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.de95fdad665ca9832021-12-21 11:36:27.951root 11241100x8000000000000000546210Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:27.951{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7b167cfc8d58fbf12021-12-21 11:36:27.951root 11241100x8000000000000000546211Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:27.951{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d22a8f18834c2dfc2021-12-21 11:36:27.951root 11241100x8000000000000000546212Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:27.951{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.50a45e056dbf24f62021-12-21 11:36:27.951root 11241100x8000000000000000546213Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:27.951{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.813a8a3ee8dc743a2021-12-21 11:36:27.951root 11241100x8000000000000000546214Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:27.951{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e997a04d1fd5c4f92021-12-21 11:36:27.951root 11241100x8000000000000000546215Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:27.952{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.73c642a5f24621a92021-12-21 11:36:27.952root 11241100x8000000000000000546216Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:27.952{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4e7d28ae2b535d562021-12-21 11:36:27.952root 11241100x8000000000000000546217Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:27.952{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f5fbf880b68ba5b02021-12-21 11:36:27.952root 11241100x8000000000000000546218Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:27.952{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8d885462423954052021-12-21 11:36:27.952root 11241100x8000000000000000546219Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:27.952{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.239519f022df52262021-12-21 11:36:27.952root 11241100x8000000000000000546220Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:27.953{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b731ee81d0b2f3d82021-12-21 11:36:27.953root 11241100x8000000000000000546221Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:27.953{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f3633f090ce8048e2021-12-21 11:36:27.953root 11241100x8000000000000000546222Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:27.953{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.88785bf9c3c60aa52021-12-21 11:36:27.953root 11241100x8000000000000000546223Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:27.953{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.cd76cbc0be5521232021-12-21 11:36:27.953root 11241100x8000000000000000546224Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:27.953{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.37f28d055676c5822021-12-21 11:36:27.953root 11241100x8000000000000000546225Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:27.953{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f56bcd5f68f23dce2021-12-21 11:36:27.953root 11241100x8000000000000000546226Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:27.953{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9d602b8171b17f172021-12-21 11:36:27.953root 11241100x8000000000000000546227Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:27.953{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a8a3c6a5950d60732021-12-21 11:36:27.953root 11241100x8000000000000000546228Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:27.953{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8719fd93543f450f2021-12-21 11:36:27.953root 11241100x8000000000000000546229Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:27.953{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.59b8df5427be35302021-12-21 11:36:27.953root 11241100x8000000000000000546230Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:27.954{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9bb261367e9bcecd2021-12-21 11:36:27.954root 11241100x8000000000000000546231Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:27.954{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8d07aa77323d1cb22021-12-21 11:36:27.954root 11241100x8000000000000000546232Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:27.954{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.970e80b9321cc4f22021-12-21 11:36:27.954root 11241100x8000000000000000546233Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:27.954{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d94d760fc50a6cff2021-12-21 11:36:27.954root 11241100x8000000000000000546234Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:27.954{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.490636e2a32df6d22021-12-21 11:36:27.954root 11241100x8000000000000000546235Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:27.954{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.68167a26ad185d802021-12-21 11:36:27.954root 11241100x8000000000000000546236Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:27.954{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3aea3d7475819fe02021-12-21 11:36:27.954root 11241100x8000000000000000546237Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:27.954{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7ab9353e0817bf882021-12-21 11:36:27.954root 11241100x8000000000000000546238Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:27.955{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d7ecb9d0a71ac5ce2021-12-21 11:36:27.955root 11241100x8000000000000000546239Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:27.955{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7cd9a2d34c436c282021-12-21 11:36:27.955root 11241100x8000000000000000546240Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:27.955{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9c3004e9f4a13cd92021-12-21 11:36:27.955root 11241100x8000000000000000546241Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:27.955{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f909019b7c7e22092021-12-21 11:36:27.955root 11241100x8000000000000000546242Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:27.955{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.62689b816dae71272021-12-21 11:36:27.955root 11241100x8000000000000000546243Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:27.955{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.58d19df44480fca32021-12-21 11:36:27.955root 11241100x8000000000000000546244Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:27.955{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8d3ca3126595810d2021-12-21 11:36:27.955root 11241100x8000000000000000546245Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:27.955{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b0217996470d7d002021-12-21 11:36:27.955root 11241100x8000000000000000546246Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:27.956{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.39cb7166e38c379c2021-12-21 11:36:27.956root 11241100x8000000000000000546247Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:27.956{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d3ab4224da6ab3842021-12-21 11:36:27.956root 11241100x8000000000000000546248Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:27.956{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2f1e63589c9ba4a62021-12-21 11:36:27.956root 11241100x8000000000000000546249Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:27.956{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8e42a25def05255a2021-12-21 11:36:27.956root 11241100x8000000000000000546250Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:27.956{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.76531b551603a43a2021-12-21 11:36:27.956root 11241100x8000000000000000546251Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:27.956{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.47943df0cab64f442021-12-21 11:36:27.956root 11241100x8000000000000000546252Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:27.957{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e4a3290f620a8dcd2021-12-21 11:36:27.957root 11241100x8000000000000000546253Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:27.957{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.db780ed812cc0ea22021-12-21 11:36:27.957root 11241100x8000000000000000546254Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:27.957{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d04e87dd142e4dec2021-12-21 11:36:27.957root 11241100x8000000000000000546255Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:27.957{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f26a9f717438d3d92021-12-21 11:36:27.957root 11241100x8000000000000000546256Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:27.958{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f6ff73bd1e9119222021-12-21 11:36:27.958root 11241100x8000000000000000546257Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:27.958{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.cdccaee0ae2ad8cd2021-12-21 11:36:27.958root 11241100x8000000000000000546258Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:27.958{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2d77ca8e98a7950b2021-12-21 11:36:27.958root 11241100x8000000000000000546259Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:27.958{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6569cd98da8093492021-12-21 11:36:27.958root 11241100x8000000000000000546260Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:27.958{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.efeb352edb12082d2021-12-21 11:36:27.958root 11241100x8000000000000000546261Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:27.958{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9976746be7db82eb2021-12-21 11:36:27.958root 11241100x8000000000000000546262Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:27.959{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c2090d536216a5d32021-12-21 11:36:27.959root 11241100x8000000000000000546263Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:27.959{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c906c7b0e9d21dfc2021-12-21 11:36:27.959root 11241100x8000000000000000546264Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:27.959{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7ea3d6a3201025f32021-12-21 11:36:27.959root 11241100x8000000000000000546265Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:27.959{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3095e22735d13cac2021-12-21 11:36:27.959root 11241100x8000000000000000546266Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:27.959{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0d02276b7cb8d16f2021-12-21 11:36:27.959root 11241100x8000000000000000546267Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:27.960{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.deff0869758030702021-12-21 11:36:27.960root 11241100x8000000000000000546268Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:27.960{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d15444bacc12d1a22021-12-21 11:36:27.960root 11241100x8000000000000000546269Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:27.960{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.84bcf37a7d5eb9312021-12-21 11:36:27.960root 11241100x8000000000000000546270Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:27.960{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1a60a83d2b177c982021-12-21 11:36:27.960root 11241100x8000000000000000546271Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:27.960{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.018f22ffb5c6b8d22021-12-21 11:36:27.960root 11241100x8000000000000000546272Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:27.960{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.233852c5057830942021-12-21 11:36:27.960root 11241100x8000000000000000546273Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:27.961{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7105f86ecc033cd52021-12-21 11:36:27.961root 11241100x8000000000000000546274Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:27.961{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.cc225396f943082f2021-12-21 11:36:27.961root 11241100x8000000000000000546275Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:27.961{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.777435c4e0144c4e2021-12-21 11:36:27.961root 11241100x8000000000000000546276Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:27.961{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d3cd51b46f93f2232021-12-21 11:36:27.961root 11241100x8000000000000000546277Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:27.961{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0d40403e68a477482021-12-21 11:36:27.961root 11241100x8000000000000000546278Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:27.961{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8bef941c0543be262021-12-21 11:36:27.961root 11241100x8000000000000000546279Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:27.962{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e5b90e8a9e3f82872021-12-21 11:36:27.962root 11241100x8000000000000000546280Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:27.962{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.216017d13f30de922021-12-21 11:36:27.962root 11241100x8000000000000000546281Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:27.962{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1f7fc4898e77ea392021-12-21 11:36:27.962root 11241100x8000000000000000546282Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:27.962{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.63dd99a781a2b3492021-12-21 11:36:27.962root 11241100x8000000000000000546283Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:27.962{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6eba14595a8346872021-12-21 11:36:27.962root 11241100x8000000000000000546284Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:27.963{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1bafca062160807e2021-12-21 11:36:27.963root 11241100x8000000000000000546285Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:27.963{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.882ced196a5375562021-12-21 11:36:27.963root 11241100x8000000000000000546286Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:27.963{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.df60e5a09d142c172021-12-21 11:36:27.963root 11241100x8000000000000000546287Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:27.964{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d726e57f9c7a82c52021-12-21 11:36:27.964root 11241100x8000000000000000546288Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:27.965{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d36e80a4738e46c72021-12-21 11:36:27.965root 11241100x8000000000000000546289Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:27.965{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c5cd48e89e8dc2ca2021-12-21 11:36:27.965root 11241100x8000000000000000546290Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:27.965{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.43d5f7d7e6c2f8652021-12-21 11:36:27.965root 11241100x8000000000000000546291Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:27.965{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8a0962fc149cece12021-12-21 11:36:27.965root 11241100x8000000000000000546292Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:27.965{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.345e2e2b6c7e433c2021-12-21 11:36:27.965root 11241100x8000000000000000546293Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:27.965{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.41e5cbcea6d61d162021-12-21 11:36:27.965root 11241100x8000000000000000546294Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:27.966{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.cc574c41cb6026462021-12-21 11:36:27.966root 11241100x8000000000000000546295Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:27.966{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3727cded88e2d19d2021-12-21 11:36:27.966root 11241100x8000000000000000546296Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:27.966{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.25bcd2ebb8a8714d2021-12-21 11:36:27.966root 11241100x8000000000000000546297Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:27.966{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.24d14e92fed08bf12021-12-21 11:36:27.966root 11241100x8000000000000000546298Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:27.966{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.08b1a259dab451b92021-12-21 11:36:27.966root 11241100x8000000000000000546299Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:27.967{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4fe07384d18782ba2021-12-21 11:36:27.967root 11241100x8000000000000000546300Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:27.967{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c00b07ca7f334e8a2021-12-21 11:36:27.967root 11241100x8000000000000000546301Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:27.967{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a52f06d862121e4c2021-12-21 11:36:27.967root 11241100x8000000000000000546302Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:27.967{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f9370dc501e0acb12021-12-21 11:36:27.967root 11241100x8000000000000000546303Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:27.967{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b68166e6833b45bb2021-12-21 11:36:27.967root 11241100x8000000000000000546304Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:27.967{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8cba1baae86423fd2021-12-21 11:36:27.967root 11241100x8000000000000000546305Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:27.968{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.10b599d7f14b9fa32021-12-21 11:36:27.968root 11241100x8000000000000000546306Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:27.968{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.fc02cc089f5c90fb2021-12-21 11:36:27.968root 11241100x8000000000000000546307Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:27.968{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3d8a00816fbda6012021-12-21 11:36:27.968root 11241100x8000000000000000546308Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:27.968{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f2e15efc0709ced82021-12-21 11:36:27.968root 11241100x8000000000000000546309Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:27.968{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.dbf9bd9fff3fa0d62021-12-21 11:36:27.968root 11241100x8000000000000000546310Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:27.968{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.194f3953a55e6a1f2021-12-21 11:36:27.968root 11241100x8000000000000000546311Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:27.969{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c148e82e8eb42a542021-12-21 11:36:27.969root 11241100x8000000000000000546312Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:27.969{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.775b9949677e769f2021-12-21 11:36:27.969root 11241100x8000000000000000546313Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:27.969{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.89e528b949ce89ac2021-12-21 11:36:27.969root 11241100x8000000000000000546314Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:27.969{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.36e8ac8a960e20692021-12-21 11:36:27.969root 11241100x8000000000000000546315Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:27.969{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e0c4170d5c3aef492021-12-21 11:36:27.969root 11241100x8000000000000000546316Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:27.969{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6ba6346e5574fa432021-12-21 11:36:27.969root 11241100x8000000000000000546317Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:27.970{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.31bd6fbfa957773c2021-12-21 11:36:27.970root 11241100x8000000000000000546318Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:27.970{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c4a184d8a870c7702021-12-21 11:36:27.970root 11241100x8000000000000000546319Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:27.970{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.defeb0eaaf7158d32021-12-21 11:36:27.970root 11241100x8000000000000000546320Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:27.970{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3cd0554cde2774582021-12-21 11:36:27.970root 11241100x8000000000000000546321Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:27.970{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2f4661aea93c2d432021-12-21 11:36:27.970root 11241100x8000000000000000546322Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:27.970{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e1b94faf3f50dcf62021-12-21 11:36:27.970root 11241100x8000000000000000546323Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:27.970{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f736cb51f580aeb02021-12-21 11:36:27.970root 11241100x8000000000000000546324Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:27.971{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.62c37a71e5e9a5432021-12-21 11:36:27.971root 11241100x8000000000000000546325Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:27.971{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.443255e4f8ce56452021-12-21 11:36:27.971root 11241100x8000000000000000546326Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:27.971{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.12fc133f3907ac662021-12-21 11:36:27.971root 11241100x8000000000000000546327Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:27.971{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3df83c8118a77c102021-12-21 11:36:27.971root 11241100x8000000000000000546328Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:27.971{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.fdb3c8eba4c845e72021-12-21 11:36:27.971root 11241100x8000000000000000546329Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:27.971{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.19692f69694f21f12021-12-21 11:36:27.971root 11241100x8000000000000000546330Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:27.971{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.acc8def427198be02021-12-21 11:36:27.971root 11241100x8000000000000000546331Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:27.972{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.505563ef840815502021-12-21 11:36:27.972root 11241100x8000000000000000546332Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:27.972{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e09895fc3d699fc22021-12-21 11:36:27.972root 11241100x8000000000000000546333Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:27.972{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f100279bb94700c02021-12-21 11:36:27.972root 11241100x8000000000000000546334Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:27.972{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c500723d5fe38f072021-12-21 11:36:27.972root 11241100x8000000000000000546335Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:27.972{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2522a41f017c7b402021-12-21 11:36:27.972root 11241100x8000000000000000546336Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:27.972{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3d3315a609a5287f2021-12-21 11:36:27.972root 11241100x8000000000000000546337Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:27.972{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.43389fda564061152021-12-21 11:36:27.972root 11241100x8000000000000000546338Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:27.972{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.176ab58611ec7ace2021-12-21 11:36:27.972root 11241100x8000000000000000546339Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:27.972{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.240e890c8c4cb5842021-12-21 11:36:27.972root 11241100x8000000000000000546340Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:27.973{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.40c5835afd7d5f642021-12-21 11:36:27.973root 11241100x8000000000000000546341Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:27.973{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8a9b39d3f750a4832021-12-21 11:36:27.973root 11241100x8000000000000000546342Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:27.973{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7a0c0c69d1b5d7272021-12-21 11:36:27.973root 11241100x8000000000000000546343Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:27.973{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c5fde9dd179d12ff2021-12-21 11:36:27.973root 11241100x8000000000000000546344Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:27.973{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b10a71442d21fe162021-12-21 11:36:27.973root 11241100x8000000000000000546345Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:27.973{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6c04f2dbdc965a3c2021-12-21 11:36:27.973root 11241100x8000000000000000546346Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:27.973{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.07a86c7c256c8db82021-12-21 11:36:27.973root 11241100x8000000000000000546347Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:27.973{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.01e107ee86a2dfc02021-12-21 11:36:27.973root 11241100x8000000000000000546348Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:27.973{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ceec85f2c11b69902021-12-21 11:36:27.973root 11241100x8000000000000000546349Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:27.973{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.13f06156363381452021-12-21 11:36:27.973root 11241100x8000000000000000546350Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:27.974{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.900e3672ee851ac72021-12-21 11:36:27.974root 11241100x8000000000000000546351Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:27.974{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.520418b2ac222dba2021-12-21 11:36:27.974root 11241100x8000000000000000546352Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:27.974{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4980ddba129c15cc2021-12-21 11:36:27.974root 11241100x8000000000000000546353Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:27.974{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.310ea7d84f4fda722021-12-21 11:36:27.974root 11241100x8000000000000000546354Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:27.974{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.68658e27597b85602021-12-21 11:36:27.974root 11241100x8000000000000000546355Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:27.974{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0538e4f45b2e23de2021-12-21 11:36:27.974root 11241100x8000000000000000546356Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:27.974{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.08f935e3ffc702072021-12-21 11:36:27.974root 11241100x8000000000000000546357Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:27.974{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0fc4d06ad26349742021-12-21 11:36:27.974root 11241100x8000000000000000546358Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:27.974{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b956d0c1c9d0596e2021-12-21 11:36:27.974root 11241100x8000000000000000546359Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:27.975{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.dade591ac73448982021-12-21 11:36:27.975root 11241100x8000000000000000546360Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:27.975{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8ec8e7d633f2a3422021-12-21 11:36:27.975root 11241100x8000000000000000546361Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:27.975{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f333ef03676a74ab2021-12-21 11:36:27.975root 11241100x8000000000000000546362Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:27.975{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.15928596ce9a0bc62021-12-21 11:36:27.975root 11241100x8000000000000000546363Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:27.975{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.41863fd2840c3ce02021-12-21 11:36:27.975root 11241100x8000000000000000546364Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:27.975{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.fe449ae08374dd092021-12-21 11:36:27.975root 11241100x8000000000000000546365Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:27.975{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.07385f2913c4a7b22021-12-21 11:36:27.975root 11241100x8000000000000000546366Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:27.976{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.fa8ff780043a13b82021-12-21 11:36:27.976root 11241100x8000000000000000546367Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:27.976{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6bba515e40646d6d2021-12-21 11:36:27.976root 11241100x8000000000000000546368Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:27.976{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8ed551f88f8f62ca2021-12-21 11:36:27.976root 11241100x8000000000000000546369Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:27.976{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e81434669bb27daf2021-12-21 11:36:27.976root 11241100x8000000000000000546370Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:27.976{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ada4f530143296d82021-12-21 11:36:27.976root 11241100x8000000000000000546371Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:27.976{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4634f7515b236af92021-12-21 11:36:27.976root 11241100x8000000000000000546372Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:27.976{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1d52bfd66a4875492021-12-21 11:36:27.976root 11241100x8000000000000000546373Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:27.977{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ddef06ba9d91224b2021-12-21 11:36:27.977root 11241100x8000000000000000546374Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:27.977{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7026af9f906a35bc2021-12-21 11:36:27.977root 11241100x8000000000000000546375Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:27.977{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ea36936dab515c492021-12-21 11:36:27.977root 11241100x8000000000000000546376Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:27.977{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ee337e14bc7421b72021-12-21 11:36:27.977root 11241100x8000000000000000546377Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:27.977{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a251910038a47db52021-12-21 11:36:27.977root 11241100x8000000000000000546378Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:27.977{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5305c44dda8586912021-12-21 11:36:27.977root 11241100x8000000000000000546379Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:27.977{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.78b2103d454dd3de2021-12-21 11:36:27.977root 11241100x8000000000000000546380Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:27.978{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7a545e951b60b5d02021-12-21 11:36:27.978root 11241100x8000000000000000546381Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:27.978{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c850e9779505242e2021-12-21 11:36:27.978root 11241100x8000000000000000546382Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:27.978{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.126a72fd3189ec062021-12-21 11:36:27.978root 11241100x8000000000000000546383Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:27.978{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.40ccb7f532b979822021-12-21 11:36:27.978root 11241100x8000000000000000546384Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:27.978{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.bfa4339bcfd6a2e82021-12-21 11:36:27.978root 11241100x8000000000000000546385Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:27.978{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.25d1394ee0aadafd2021-12-21 11:36:27.978root 11241100x8000000000000000546386Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:27.979{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0d41d35a5fb45c552021-12-21 11:36:27.979root 11241100x8000000000000000546387Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:27.979{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d00adffd7fbe5eff2021-12-21 11:36:27.979root 11241100x8000000000000000546388Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:27.980{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8ccd86dad5f213aa2021-12-21 11:36:27.980root 11241100x8000000000000000546389Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:27.980{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c111eff89aeb57502021-12-21 11:36:27.980root 11241100x8000000000000000546390Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:27.980{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3be9025ecb90bb8b2021-12-21 11:36:27.980root 11241100x8000000000000000546391Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:27.980{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3640435915a0eefd2021-12-21 11:36:27.980root 11241100x8000000000000000546392Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:27.980{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.611aa44930d130032021-12-21 11:36:27.980root 11241100x8000000000000000546393Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:27.980{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c142251c75959e472021-12-21 11:36:27.980root 11241100x8000000000000000546394Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:27.981{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ab9ffecdb86e343b2021-12-21 11:36:27.981root 11241100x8000000000000000546395Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:27.981{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.af7f7376035b55292021-12-21 11:36:27.981root 11241100x8000000000000000546396Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:27.981{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3280c24b2cb7e4b02021-12-21 11:36:27.981root 11241100x8000000000000000546397Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:27.981{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.03e9b5aa0e1f98c52021-12-21 11:36:27.981root 11241100x8000000000000000546398Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:27.981{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d1d0ba140cd56c692021-12-21 11:36:27.981root 11241100x8000000000000000546399Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:27.981{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.bde3d1da3016520c2021-12-21 11:36:27.981root 11241100x8000000000000000546400Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:27.982{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7de2578b752d79012021-12-21 11:36:27.982root 11241100x8000000000000000546401Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:27.983{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ab28b9f6331c92512021-12-21 11:36:27.983root 11241100x8000000000000000546402Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:27.983{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5bd78283688d021b2021-12-21 11:36:27.983root 11241100x8000000000000000546403Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:27.984{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5de07157e5544f022021-12-21 11:36:27.984root 11241100x8000000000000000546404Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:27.984{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.dae023b1846514dc2021-12-21 11:36:27.984root 11241100x8000000000000000546405Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:27.985{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ee11a9ba1a3d97962021-12-21 11:36:27.985root 11241100x8000000000000000546406Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:27.985{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.40940911ae62d3fc2021-12-21 11:36:27.985root 11241100x8000000000000000546407Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:27.985{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6ece265746942fc02021-12-21 11:36:27.985root 11241100x8000000000000000546408Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:27.985{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.484d1c0b0c386db82021-12-21 11:36:27.985root 11241100x8000000000000000546409Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:27.985{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.13a9ec5dfa461f822021-12-21 11:36:27.985root 11241100x8000000000000000546410Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:27.985{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2ce0df917a0ca6f72021-12-21 11:36:27.985root 11241100x8000000000000000546411Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:27.985{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6f24e381cf05b78c2021-12-21 11:36:27.985root 11241100x8000000000000000546412Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:27.986{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.84d2a24b712e8c862021-12-21 11:36:27.986root 11241100x8000000000000000546413Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:27.986{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.39e132e4e0971f412021-12-21 11:36:27.986root 11241100x8000000000000000546414Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:27.986{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.847e08fb6a2a0a032021-12-21 11:36:27.986root 11241100x8000000000000000546415Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:27.986{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0de8a2c358ee20702021-12-21 11:36:27.986root 11241100x8000000000000000546416Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:27.986{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c63751fdb15ac5712021-12-21 11:36:27.986root 11241100x8000000000000000546417Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:27.986{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.490151400ce25e9d2021-12-21 11:36:27.986root 11241100x8000000000000000546418Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:27.987{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9858e695eeaf86072021-12-21 11:36:27.987root 11241100x8000000000000000546419Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:27.987{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0a6ed497a056099e2021-12-21 11:36:27.987root 11241100x8000000000000000546420Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:27.987{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d42243d7eca73f362021-12-21 11:36:27.987root 11241100x8000000000000000546421Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:27.987{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5aa12c1c9d6ce4b82021-12-21 11:36:27.987root 11241100x8000000000000000546422Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:27.987{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8a4ad0f17ece7b152021-12-21 11:36:27.987root 11241100x8000000000000000546423Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:27.987{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7b4c78ea3daf1d3e2021-12-21 11:36:27.987root 11241100x8000000000000000546424Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:27.988{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0dbaaf39925774792021-12-21 11:36:27.988root 11241100x8000000000000000546425Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:27.988{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b4798e979b9cf2f42021-12-21 11:36:27.988root 11241100x8000000000000000546426Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:27.989{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f2a127c17988b63d2021-12-21 11:36:27.989root 11241100x8000000000000000546427Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:27.989{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.728ac63633fd8b712021-12-21 11:36:27.989root 11241100x8000000000000000546428Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:27.989{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e68d1d90f706f9722021-12-21 11:36:27.989root 11241100x8000000000000000546429Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:27.990{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.bd34eb51ad568e8b2021-12-21 11:36:27.990root 11241100x8000000000000000546430Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:27.990{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d8a0594878d0fc012021-12-21 11:36:27.990root 11241100x8000000000000000546431Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:27.990{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5ce76cadfd0c176b2021-12-21 11:36:27.990root 11241100x8000000000000000546432Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:27.990{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.58998200b5403a722021-12-21 11:36:27.990root 11241100x8000000000000000546433Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:27.994{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1815cff0f5c4ba4d2021-12-21 11:36:27.994root 11241100x8000000000000000546434Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:27.994{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9eb95d49fd1110ba2021-12-21 11:36:27.994root 11241100x8000000000000000546435Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:27.994{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7676963beba048962021-12-21 11:36:27.994root 11241100x8000000000000000546436Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:27.995{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6879f1a98ea57a9c2021-12-21 11:36:27.995root 11241100x8000000000000000546437Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:27.995{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f1357c51cdd97d8d2021-12-21 11:36:27.995root 11241100x8000000000000000546438Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:27.996{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ff9c5e7d242848dd2021-12-21 11:36:27.996root 11241100x8000000000000000546439Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:27.996{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f13aa14124c627f12021-12-21 11:36:27.996root 11241100x8000000000000000546440Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:27.997{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f494785406f764662021-12-21 11:36:27.997root 11241100x8000000000000000546441Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:27.997{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.85b1bce8f04d54112021-12-21 11:36:27.997root 11241100x8000000000000000546442Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:27.997{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9c009a7a751177dd2021-12-21 11:36:27.997root 11241100x8000000000000000546443Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:27.998{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.146cfc9403d748822021-12-21 11:36:27.998root 11241100x8000000000000000546444Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:27.998{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8312a4a4aa61d07c2021-12-21 11:36:27.998root 11241100x8000000000000000546445Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:27.999{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ebd2c77786ca48c02021-12-21 11:36:27.999root 11241100x8000000000000000546446Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:27.999{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a3c259a5b69065b62021-12-21 11:36:27.999root 11241100x8000000000000000546447Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:27.999{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.85a0fce773ee74df2021-12-21 11:36:27.999root 11241100x8000000000000000546448Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:27.999{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.46675b153ec5617d2021-12-21 11:36:27.999root 11241100x8000000000000000546449Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:28.000{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4f01e3fbe51003db2021-12-21 11:36:28.000root 11241100x8000000000000000546450Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:28.000{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.46bf995a064004f52021-12-21 11:36:28.000root 11241100x8000000000000000546451Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:28.000{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0ed3b47da35dba5a2021-12-21 11:36:28.000root 11241100x8000000000000000546452Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:28.001{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0cb54d3d48ac61952021-12-21 11:36:28.001root 11241100x8000000000000000546453Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:28.001{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.432e670193eed4fa2021-12-21 11:36:28.001root 11241100x8000000000000000546454Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:28.001{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.798758664210cfdd2021-12-21 11:36:28.001root 11241100x8000000000000000546455Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:28.001{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0e6d55f505e1edec2021-12-21 11:36:28.001root 11241100x8000000000000000546456Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:28.001{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2521da29435482dd2021-12-21 11:36:28.001root 11241100x8000000000000000546457Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:28.002{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.84f466511b4aa2692021-12-21 11:36:28.002root 11241100x8000000000000000546458Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:28.002{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.107121ea282207442021-12-21 11:36:28.002root 11241100x8000000000000000546459Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:28.002{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ab39ad29aadbde122021-12-21 11:36:28.002root 11241100x8000000000000000546460Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:28.003{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4117b7fd2d2825af2021-12-21 11:36:28.003root 11241100x8000000000000000546461Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:28.003{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.92a26a7090381be52021-12-21 11:36:28.003root 11241100x8000000000000000546462Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:28.003{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1173cc0f3cad1a6d2021-12-21 11:36:28.003root 11241100x8000000000000000546463Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:28.003{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4d154f719b96e20f2021-12-21 11:36:28.003root 11241100x8000000000000000546464Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:28.004{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.bfde9c36630b0dc92021-12-21 11:36:28.004root 11241100x8000000000000000546465Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:28.004{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7ee1d01b9b129e222021-12-21 11:36:28.004root 11241100x8000000000000000546466Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:28.006{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d0a7e65d0f5c38932021-12-21 11:36:28.006root 11241100x8000000000000000546467Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:28.006{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d58f1d44162060b12021-12-21 11:36:28.006root 11241100x8000000000000000546468Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:28.006{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.09367f10f9756b3f2021-12-21 11:36:28.006root 11241100x8000000000000000546469Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:28.006{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.098747364db125552021-12-21 11:36:28.006root 11241100x8000000000000000546470Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:28.008{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d700ce4acb3c25c22021-12-21 11:36:28.008root 11241100x8000000000000000546471Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:28.008{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.91dbc1ccdbf4f69f2021-12-21 11:36:28.008root 11241100x8000000000000000546472Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:28.009{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.94297cc50b975d592021-12-21 11:36:28.009root 11241100x8000000000000000546473Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:28.009{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ff02c58c6c353c812021-12-21 11:36:28.009root 11241100x8000000000000000546474Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:28.009{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8431989ce349feb42021-12-21 11:36:28.009root 11241100x8000000000000000546475Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:28.009{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.67acfcf46c5ce0252021-12-21 11:36:28.009root 11241100x8000000000000000546476Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:28.009{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f48021bec7fcd23c2021-12-21 11:36:28.009root 11241100x8000000000000000546477Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:28.009{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.734657b7d769342c2021-12-21 11:36:28.009root 11241100x8000000000000000546478Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:28.010{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.097d190609309e4c2021-12-21 11:36:28.010root 11241100x8000000000000000546479Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:28.010{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.52dd56e7238f0f7c2021-12-21 11:36:28.010root 11241100x8000000000000000546480Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:28.011{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0f2f6ffce39a48f62021-12-21 11:36:28.011root 11241100x8000000000000000546481Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:28.011{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.94bcc10ab3bfdf1b2021-12-21 11:36:28.011root 11241100x8000000000000000546482Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:28.011{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e9e3f5d0205e0dae2021-12-21 11:36:28.011root 11241100x8000000000000000546483Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:28.012{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.06af3b536ed5ace32021-12-21 11:36:28.012root 11241100x8000000000000000546484Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:28.013{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e292b4886eb729672021-12-21 11:36:28.013root 11241100x8000000000000000546485Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:28.013{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.67eb9d51bbecc3b92021-12-21 11:36:28.013root 11241100x8000000000000000546486Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:28.013{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.98bbde79814000282021-12-21 11:36:28.013root 11241100x8000000000000000546487Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:28.013{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.76e6a039573d6ddf2021-12-21 11:36:28.013root 11241100x8000000000000000546488Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:28.013{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3e30058a6bf1928e2021-12-21 11:36:28.013root 11241100x8000000000000000546489Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:28.013{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.11c43018e0db1ce32021-12-21 11:36:28.013root 11241100x8000000000000000546490Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:28.013{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.36846a0e6d6485c82021-12-21 11:36:28.013root 11241100x8000000000000000546491Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:28.013{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5c17c8b32870cca72021-12-21 11:36:28.013root 11241100x8000000000000000546492Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:28.013{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.21b6ee65a8d88f6c2021-12-21 11:36:28.013root 11241100x8000000000000000546493Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:28.014{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.68cc10a974504ed02021-12-21 11:36:28.014root 11241100x8000000000000000546494Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:28.014{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.767c611e46bf19002021-12-21 11:36:28.014root 11241100x8000000000000000546495Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:28.014{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.bd8005489cc894182021-12-21 11:36:28.014root 11241100x8000000000000000546496Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:28.014{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9d40653cdeb40b212021-12-21 11:36:28.014root 11241100x8000000000000000546497Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:28.014{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a7e24493485db46e2021-12-21 11:36:28.014root 11241100x8000000000000000546498Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:28.014{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.251310d9e97194242021-12-21 11:36:28.014root 11241100x8000000000000000546499Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:28.014{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6d3accd5ec1cb3d42021-12-21 11:36:28.014root 11241100x8000000000000000546500Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:28.014{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.fee8ed8bd08de3f52021-12-21 11:36:28.014root 11241100x8000000000000000546501Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:28.014{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.220fa8978e4d8e9b2021-12-21 11:36:28.014root 11241100x8000000000000000546502Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:28.014{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7c0fb1b979bf317d2021-12-21 11:36:28.014root 11241100x8000000000000000546503Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:28.481{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f4dbfe9aed9b404a2021-12-21 11:36:28.481root 11241100x8000000000000000546504Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:28.481{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9f8f83dce32482682021-12-21 11:36:28.481root 11241100x8000000000000000546505Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:28.481{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a05c53090b30b07b2021-12-21 11:36:28.481root 11241100x8000000000000000546506Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:28.481{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ba42e414f60eb62a2021-12-21 11:36:28.481root 11241100x8000000000000000546507Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:28.481{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6841d065fe0aaa122021-12-21 11:36:28.481root 11241100x8000000000000000546508Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:28.481{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a7fc3ad144cf34982021-12-21 11:36:28.481root 11241100x8000000000000000546509Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:28.481{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.60d65f08954f536c2021-12-21 11:36:28.481root 11241100x8000000000000000546510Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:28.481{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4fbcfc568359109c2021-12-21 11:36:28.481root 11241100x8000000000000000546511Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:28.481{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a25d101cd16ecae62021-12-21 11:36:28.481root 11241100x8000000000000000546512Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:28.481{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1687173f9748f0372021-12-21 11:36:28.481root 11241100x8000000000000000546513Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:28.481{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ecbe04ed6c79932b2021-12-21 11:36:28.481root 11241100x8000000000000000546514Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:28.482{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2da30fc6030fab7c2021-12-21 11:36:28.482root 11241100x8000000000000000546515Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:28.482{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e58fd4395e38e1cd2021-12-21 11:36:28.482root 11241100x8000000000000000546516Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:28.482{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d5fcf60459ed94642021-12-21 11:36:28.482root 11241100x8000000000000000546517Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:28.482{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.26a02ad48b374ea62021-12-21 11:36:28.482root 11241100x8000000000000000546518Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:28.482{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e40280b92b2316682021-12-21 11:36:28.482root 11241100x8000000000000000546519Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:28.482{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8485f92bbc1a33df2021-12-21 11:36:28.482root 11241100x8000000000000000546520Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:28.482{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9fab01f69979ce032021-12-21 11:36:28.482root 11241100x8000000000000000546521Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:28.482{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c4fa2f8dc33eb1532021-12-21 11:36:28.482root 11241100x8000000000000000546522Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:28.482{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.fd38b75c687b723b2021-12-21 11:36:28.482root 11241100x8000000000000000546523Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:28.482{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.002504267ecba2d72021-12-21 11:36:28.482root 11241100x8000000000000000546524Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:28.482{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.bdc9a1bd6042dffb2021-12-21 11:36:28.482root 11241100x8000000000000000546525Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:28.482{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.47df28cc46ce0c892021-12-21 11:36:28.482root 11241100x8000000000000000546526Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:28.482{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8d8c85869ee574552021-12-21 11:36:28.482root 11241100x8000000000000000546527Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:28.482{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b027f808f67477a52021-12-21 11:36:28.482root 11241100x8000000000000000546528Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:28.482{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.970c2c582e7f46ba2021-12-21 11:36:28.482root 11241100x8000000000000000546529Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:28.482{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f719f2a9425d35362021-12-21 11:36:28.482root 11241100x8000000000000000546530Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:28.482{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a39ae34415fad8fb2021-12-21 11:36:28.482root 11241100x8000000000000000546531Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:28.483{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6a83301d16acdedf2021-12-21 11:36:28.483root 11241100x8000000000000000546532Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:28.483{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7cbc3f38d8e57aed2021-12-21 11:36:28.483root 11241100x8000000000000000546533Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:28.483{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.601fa54bc83584bc2021-12-21 11:36:28.483root 11241100x8000000000000000546534Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:28.483{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3b9e1dcb61fcaae32021-12-21 11:36:28.483root 11241100x8000000000000000546535Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:28.483{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f5a1208930d7e4812021-12-21 11:36:28.483root 11241100x8000000000000000546536Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:28.483{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ca713fd712276d4a2021-12-21 11:36:28.483root 11241100x8000000000000000546537Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:28.483{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.12cbad7a3ad4b4ca2021-12-21 11:36:28.483root 11241100x8000000000000000546538Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:28.483{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.adc490959f80a0b32021-12-21 11:36:28.483root 11241100x8000000000000000546539Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:28.483{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e8fecc39ae76c0022021-12-21 11:36:28.483root 11241100x8000000000000000546540Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:28.483{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3dab1a156314c1472021-12-21 11:36:28.483root 11241100x8000000000000000546541Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:28.483{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3b74549dbd8029fb2021-12-21 11:36:28.483root 11241100x8000000000000000546542Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:28.483{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5437c307b2471d2d2021-12-21 11:36:28.483root 11241100x8000000000000000546543Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:28.483{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1884cd172833a0772021-12-21 11:36:28.483root 11241100x8000000000000000546544Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:28.483{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b541f08d0bfd4e9e2021-12-21 11:36:28.483root 11241100x8000000000000000546545Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:28.483{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6de201fdd3869a0b2021-12-21 11:36:28.483root 11241100x8000000000000000546546Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:28.483{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.dca40c5cf3099eea2021-12-21 11:36:28.483root 11241100x8000000000000000546547Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:28.484{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8921a73027764f712021-12-21 11:36:28.484root 11241100x8000000000000000546548Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:28.484{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a8564a224b80fa812021-12-21 11:36:28.484root 11241100x8000000000000000546549Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:28.484{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2976ea7a41ecd24c2021-12-21 11:36:28.484root 11241100x8000000000000000546550Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:28.484{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d6a67b4a91d7cc572021-12-21 11:36:28.484root 11241100x8000000000000000546551Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:28.484{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f7e6f07440f49d722021-12-21 11:36:28.484root 11241100x8000000000000000546552Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:28.484{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d04c797363f722382021-12-21 11:36:28.484root 11241100x8000000000000000546553Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:28.484{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.857ab538df7663c12021-12-21 11:36:28.484root 11241100x8000000000000000546554Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:28.484{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.62daf0bc7b29bd0e2021-12-21 11:36:28.484root 11241100x8000000000000000546555Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:28.484{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3d805d2d8d22b5d32021-12-21 11:36:28.484root 11241100x8000000000000000546556Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:28.484{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7358cc11f8e858542021-12-21 11:36:28.484root 11241100x8000000000000000546557Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:28.484{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.993d115b09ccfe602021-12-21 11:36:28.484root 11241100x8000000000000000546558Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:28.484{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8205a93c6bda1c832021-12-21 11:36:28.484root 11241100x8000000000000000546559Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:28.484{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a7b973e83fdef47f2021-12-21 11:36:28.484root 11241100x8000000000000000546560Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:28.484{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f5a8be6c074c44632021-12-21 11:36:28.484root 11241100x8000000000000000546561Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:28.484{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.555fc7c315e031072021-12-21 11:36:28.484root 11241100x8000000000000000546562Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:28.485{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4e8ff9575a3a05382021-12-21 11:36:28.485root 11241100x8000000000000000546563Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:28.485{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.cdeaf5c7d7a859752021-12-21 11:36:28.485root 11241100x8000000000000000546564Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:28.485{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a9876dd29798d5b12021-12-21 11:36:28.485root 11241100x8000000000000000546565Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:28.485{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.080c2f57d71d31d72021-12-21 11:36:28.485root 11241100x8000000000000000546566Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:28.485{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.273caef4436167242021-12-21 11:36:28.485root 11241100x8000000000000000546567Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:28.485{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6f6d2c834461a93b2021-12-21 11:36:28.485root 11241100x8000000000000000546568Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:28.485{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7edf8984eeb1bc5f2021-12-21 11:36:28.485root 11241100x8000000000000000546569Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:28.485{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f740e73ab8b48b2a2021-12-21 11:36:28.485root 11241100x8000000000000000546570Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:28.485{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a7bb8487030702972021-12-21 11:36:28.485root 11241100x8000000000000000546571Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:28.485{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0b0e3657967fe5492021-12-21 11:36:28.485root 11241100x8000000000000000546572Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:28.485{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d127bc83d3d25b492021-12-21 11:36:28.485root 11241100x8000000000000000546573Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:28.485{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ba1b8b86e21978982021-12-21 11:36:28.485root 11241100x8000000000000000546574Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:28.485{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.56b06e9e3062b4b12021-12-21 11:36:28.485root 11241100x8000000000000000546575Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:28.485{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.854a98cfc18095382021-12-21 11:36:28.485root 11241100x8000000000000000546576Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:28.486{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.65216e07503a3cb22021-12-21 11:36:28.486root 11241100x8000000000000000546577Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:28.486{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.86730932843d65572021-12-21 11:36:28.486root 11241100x8000000000000000546578Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:28.486{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4008ba5aeb9146b72021-12-21 11:36:28.486root 11241100x8000000000000000546579Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:28.486{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f82f37f292111c372021-12-21 11:36:28.486root 11241100x8000000000000000546580Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:28.486{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e8a80a0b6d3ae3cb2021-12-21 11:36:28.486root 11241100x8000000000000000546581Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:28.486{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.682dedaa62d0ae5e2021-12-21 11:36:28.486root 11241100x8000000000000000546582Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:28.486{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d0455463330eb2a72021-12-21 11:36:28.486root 11241100x8000000000000000546583Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:28.486{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a1ddf5a1efb33f092021-12-21 11:36:28.486root 11241100x8000000000000000546584Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:28.486{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.11ccd661847942b62021-12-21 11:36:28.486root 11241100x8000000000000000546585Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:28.486{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1496613668e4c0382021-12-21 11:36:28.486root 11241100x8000000000000000546586Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:28.486{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.bfa51e6a66ea10012021-12-21 11:36:28.486root 11241100x8000000000000000546587Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:28.486{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1a4a0c66bff8ac632021-12-21 11:36:28.486root 11241100x8000000000000000546588Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:28.486{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.32d841b7c712b5892021-12-21 11:36:28.486root 11241100x8000000000000000546589Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:28.486{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9822c869c73956262021-12-21 11:36:28.486root 11241100x8000000000000000546590Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:28.486{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f59c468c7eb2c03d2021-12-21 11:36:28.486root 11241100x8000000000000000546591Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:28.486{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2f6041b116a563382021-12-21 11:36:28.486root 11241100x8000000000000000546592Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:28.487{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0846742b4af3cc682021-12-21 11:36:28.487root 11241100x8000000000000000546593Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:28.487{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8adbf7db38bd7fb42021-12-21 11:36:28.487root 11241100x8000000000000000546594Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:28.487{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.fc7258cdd00825fd2021-12-21 11:36:28.487root 11241100x8000000000000000546595Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:28.487{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.26c4c1b2109928222021-12-21 11:36:28.487root 11241100x8000000000000000546596Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:28.487{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9190fdc5946a56b62021-12-21 11:36:28.487root 11241100x8000000000000000546597Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:28.487{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.750bed81f8872c2a2021-12-21 11:36:28.487root 11241100x8000000000000000546598Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:28.487{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.83cc9eb8f2097bca2021-12-21 11:36:28.487root 11241100x8000000000000000546599Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:28.487{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.99a2177ed8c100a62021-12-21 11:36:28.487root 11241100x8000000000000000546600Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:28.487{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8c4d27e82f95261a2021-12-21 11:36:28.487root 11241100x8000000000000000546601Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:28.487{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.eb3278ca1ae92ac42021-12-21 11:36:28.487root 11241100x8000000000000000546602Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:28.487{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1b205c9d2b360f902021-12-21 11:36:28.487root 11241100x8000000000000000546603Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:28.487{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4d4caca0176607d02021-12-21 11:36:28.487root 11241100x8000000000000000546604Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:28.487{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b19b3d4a8636c6972021-12-21 11:36:28.487root 11241100x8000000000000000546605Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:28.487{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ab97736a245050992021-12-21 11:36:28.487root 11241100x8000000000000000546606Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:28.487{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9ca68550a05e60752021-12-21 11:36:28.487root 11241100x8000000000000000546607Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:28.488{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.69a894f21433d9742021-12-21 11:36:28.488root 11241100x8000000000000000546608Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:28.488{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.67b4aac0496d35b22021-12-21 11:36:28.488root 11241100x8000000000000000546609Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:28.488{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e51ac30842814bf22021-12-21 11:36:28.488root 11241100x8000000000000000546610Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:28.488{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6097d56b79557c3b2021-12-21 11:36:28.488root 11241100x8000000000000000546611Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:28.488{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.da527f792508e2832021-12-21 11:36:28.488root 11241100x8000000000000000546612Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:28.488{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f7468fb3ab4dbc462021-12-21 11:36:28.488root 11241100x8000000000000000546613Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:28.488{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9a3e68e21d98090b2021-12-21 11:36:28.488root 11241100x8000000000000000546614Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:28.489{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.719ed28756a008e32021-12-21 11:36:28.489root 11241100x8000000000000000546615Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:28.489{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4b8b93a6013affa62021-12-21 11:36:28.489root 11241100x8000000000000000546616Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:28.489{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0e644129918b24412021-12-21 11:36:28.489root 11241100x8000000000000000546617Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:28.490{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.fe3ffcb83d591d2d2021-12-21 11:36:28.490root 11241100x8000000000000000546618Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:28.490{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.82666ca035a7c83e2021-12-21 11:36:28.490root 11241100x8000000000000000546619Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:28.490{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.69d9d5b8928bd1c32021-12-21 11:36:28.490root 11241100x8000000000000000546620Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:28.490{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.06449625d1b57c8f2021-12-21 11:36:28.490root 11241100x8000000000000000546621Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:28.490{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1df23e8b0d71086e2021-12-21 11:36:28.490root 11241100x8000000000000000546622Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:28.490{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0a20f9bdfa7aa04a2021-12-21 11:36:28.490root 11241100x8000000000000000546623Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:28.490{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f99c5d66c966ef712021-12-21 11:36:28.490root 11241100x8000000000000000546624Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:28.490{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0e3331d4af881f1d2021-12-21 11:36:28.490root 11241100x8000000000000000546625Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:28.490{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.13a8fc817af84ebd2021-12-21 11:36:28.490root 11241100x8000000000000000546626Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:28.490{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1eaf106976a72adb2021-12-21 11:36:28.490root 11241100x8000000000000000546627Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:28.490{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8f6343933ab8255d2021-12-21 11:36:28.490root 11241100x8000000000000000546628Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:28.490{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.72248fe1389399102021-12-21 11:36:28.490root 11241100x8000000000000000546629Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:28.490{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d37f6ae6b47da7442021-12-21 11:36:28.490root 11241100x8000000000000000546630Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:28.490{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.32b7e772c492420d2021-12-21 11:36:28.490root 11241100x8000000000000000546631Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:28.491{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.228387bed9aa42532021-12-21 11:36:28.491root 11241100x8000000000000000546632Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:28.492{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3b43897aa9684c272021-12-21 11:36:28.492root 11241100x8000000000000000546633Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:28.493{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.29aa9fd8f362bb142021-12-21 11:36:28.493root 11241100x8000000000000000546634Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:28.493{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.de647ae3b8bb3b692021-12-21 11:36:28.493root 11241100x8000000000000000546635Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:28.493{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e9b8cc437d0596f72021-12-21 11:36:28.493root 11241100x8000000000000000546636Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:28.493{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ffe67b0c0229aae62021-12-21 11:36:28.493root 11241100x8000000000000000546637Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:28.493{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.14cf4f1f1173ae192021-12-21 11:36:28.493root 11241100x8000000000000000546638Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:28.493{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7d24e86b3ac1a3532021-12-21 11:36:28.493root 11241100x8000000000000000546639Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:28.493{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f6d952509b8577dc2021-12-21 11:36:28.493root 11241100x8000000000000000546640Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:28.493{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.de297f8b31fa98bc2021-12-21 11:36:28.493root 11241100x8000000000000000546641Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:28.493{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ba7e1ed79e85e38a2021-12-21 11:36:28.493root 11241100x8000000000000000546642Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:28.493{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a585c8955b0bbcd22021-12-21 11:36:28.493root 11241100x8000000000000000546643Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:28.493{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.cecc13a045224c8c2021-12-21 11:36:28.493root 11241100x8000000000000000546644Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:28.493{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d0a0e8ace5aaad032021-12-21 11:36:28.493root 11241100x8000000000000000546645Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:28.942{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.071e844b4ec1eb782021-12-21 11:36:28.942root 11241100x8000000000000000546646Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:28.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a8405873df1171052021-12-21 11:36:28.943root 11241100x8000000000000000546647Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:28.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5404b88b2cf0500e2021-12-21 11:36:28.943root 11241100x8000000000000000546648Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:28.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5876d710560df9032021-12-21 11:36:28.943root 11241100x8000000000000000546649Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:28.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1b19e62825c67d142021-12-21 11:36:28.943root 11241100x8000000000000000546650Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:28.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c478c95d88326dcd2021-12-21 11:36:28.943root 11241100x8000000000000000546651Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:28.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a54c11d06d7de2b52021-12-21 11:36:28.943root 11241100x8000000000000000546652Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:28.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.14d5c71904ca7ced2021-12-21 11:36:28.943root 11241100x8000000000000000546653Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:28.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.fed90e9a8be9d7ca2021-12-21 11:36:28.943root 11241100x8000000000000000546654Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:28.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6915f9047ad3bbd82021-12-21 11:36:28.943root 11241100x8000000000000000546655Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:28.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6e10ac51212907a32021-12-21 11:36:28.944root 11241100x8000000000000000546656Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:28.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7d4163013d2b2f3a2021-12-21 11:36:28.944root 11241100x8000000000000000546657Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:28.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8b60857ecc9206ce2021-12-21 11:36:28.944root 11241100x8000000000000000546658Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:28.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.44b3cd953aefdc712021-12-21 11:36:28.944root 11241100x8000000000000000546659Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:28.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5c66696392bd4c0f2021-12-21 11:36:28.944root 11241100x8000000000000000546660Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:28.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ad15673f8b989a3e2021-12-21 11:36:28.944root 11241100x8000000000000000546661Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:28.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.dcbd99a51b1577bb2021-12-21 11:36:28.944root 11241100x8000000000000000546662Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:28.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2b59d4a0fe6b1ad52021-12-21 11:36:28.944root 11241100x8000000000000000546663Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:28.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ab6653cdc1eb41552021-12-21 11:36:28.944root 11241100x8000000000000000546664Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:28.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b4ace1111cb23d4b2021-12-21 11:36:28.944root 11241100x8000000000000000546665Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:28.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.65408fa9c34445fb2021-12-21 11:36:28.944root 11241100x8000000000000000546666Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:28.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9a5e76202227a7282021-12-21 11:36:28.944root 11241100x8000000000000000546667Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:28.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b829467886ab69232021-12-21 11:36:28.944root 11241100x8000000000000000546668Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:28.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c289e3aec746b1892021-12-21 11:36:28.944root 11241100x8000000000000000546669Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:28.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8033a72e8ca602632021-12-21 11:36:28.944root 11241100x8000000000000000546670Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:28.946{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.575c86fa8e617dfd2021-12-21 11:36:28.946root 11241100x8000000000000000546671Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:28.946{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.47d47451d4b2b36e2021-12-21 11:36:28.946root 11241100x8000000000000000546672Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:28.946{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a7c9f58455b7edde2021-12-21 11:36:28.946root 11241100x8000000000000000546673Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:28.946{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.322b11be89601b6d2021-12-21 11:36:28.946root 11241100x8000000000000000546674Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:28.946{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d49a4a88ffbc79c62021-12-21 11:36:28.946root 11241100x8000000000000000546675Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:28.946{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.102c47461c29aab02021-12-21 11:36:28.946root 11241100x8000000000000000546676Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:28.946{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.cb9b81b4276647392021-12-21 11:36:28.946root 11241100x8000000000000000546677Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:28.946{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.eaed8a2ea7fa5a0e2021-12-21 11:36:28.946root 11241100x8000000000000000546678Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:28.946{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9411c3422c2ab36a2021-12-21 11:36:28.946root 11241100x8000000000000000546679Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:28.946{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f19f03afeffdac0a2021-12-21 11:36:28.946root 11241100x8000000000000000546680Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:28.946{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ec9b0adbe681f19e2021-12-21 11:36:28.946root 11241100x8000000000000000546681Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:28.946{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7088f2ec75dea59a2021-12-21 11:36:28.946root 11241100x8000000000000000546682Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:28.946{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1df4639c791857462021-12-21 11:36:28.946root 11241100x8000000000000000546683Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:28.946{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9a762350562a72102021-12-21 11:36:28.946root 11241100x8000000000000000546684Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:28.946{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e1881227face42892021-12-21 11:36:28.946root 11241100x8000000000000000546685Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:28.947{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2a8977ba2b93b1532021-12-21 11:36:28.947root 11241100x8000000000000000546686Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:28.947{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e41601041958b9252021-12-21 11:36:28.947root 11241100x8000000000000000546687Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:28.947{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.99559044fbecb6082021-12-21 11:36:28.947root 11241100x8000000000000000546688Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:28.947{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.505616d6038569e42021-12-21 11:36:28.947root 11241100x8000000000000000546689Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:28.947{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1b2c5ef1bac00ae42021-12-21 11:36:28.947root 11241100x8000000000000000546690Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:29.222{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c06eed67b004a9122021-12-21 11:36:29.222root 11241100x8000000000000000546691Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:29.222{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3279d1f3c9c616082021-12-21 11:36:29.222root 11241100x8000000000000000546692Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:29.222{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.dd0951e49951bdeb2021-12-21 11:36:29.222root 11241100x8000000000000000546693Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:29.222{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.abc2dd1948ce22822021-12-21 11:36:29.222root 354300x8000000000000000546754Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:46.158{ec2b6afe-95d9-61c1-5175-3a0400000000}5346/opt/splunkforwarder/etc/apps/Splunk_TA_stream/linux_x86_64/bin/streamfwdroottcptruefalse10.0.1.25-48796-false10.0.1.12-8000- 11241100x8000000000000000546755Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:46.442{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b87c31eac6e185cb2021-12-21 11:36:46.442root 11241100x8000000000000000546756Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:46.942{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a6f052c934b6f48e2021-12-21 11:36:46.942root 11241100x8000000000000000546757Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:47.442{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4f935263f2cdf4632021-12-21 11:36:47.442root 11241100x8000000000000000546758Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:47.942{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.45f087a17c514ca92021-12-21 11:36:47.942root 11241100x8000000000000000546759Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:48.442{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e9ace3e3edb7ab492021-12-21 11:36:48.442root 11241100x8000000000000000546760Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:48.942{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.cc59c852b96d97202021-12-21 11:36:48.942root 11241100x8000000000000000546761Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:49.442{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.af54e146128799cc2021-12-21 11:36:49.442root 11241100x8000000000000000546762Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:49.942{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.136a3773909247b22021-12-21 11:36:49.942root 534500x8000000000000000546763Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:50.012{ec2b6afe-bc52-61c1-0000-000000000000}9906-ubuntu 534500x8000000000000000546764Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:50.038{00000000-0000-0000-0000-000000000000}9907<unknown process>ubuntu 534500x8000000000000000546765Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:50.041{ec2b6afe-bc52-61c1-0000-000000000000}9908-ubuntu 534500x8000000000000000546766Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:50.043{00000000-0000-0000-0000-000000000000}9909<unknown process>ubuntu 11241100x8000000000000000546767Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:50.043{ec2b6afe-aacb-61c1-0834-fdd63c560000}5677/bin/bash/tmp/sh-thd.Qcun7d2021-12-21 11:36:50.043ubuntu 23542300x8000000000000000546768Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:50.043{ec2b6afe-aacb-61c1-0834-fdd63c560000}5677ubuntu/bin/bash/tmp/sh-thd.Qcun7d--- 11241100x8000000000000000546769Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:50.442{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.091fd5553b9c8c832021-12-21 11:36:50.442root 11241100x8000000000000000546770Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:50.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.76d489c88a7082702021-12-21 11:36:50.443root 11241100x8000000000000000546771Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:50.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f41eb23c5c6aa0ff2021-12-21 11:36:50.443root 11241100x8000000000000000546772Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:50.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.903000009dad2e872021-12-21 11:36:50.443root 11241100x8000000000000000546773Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:50.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6cd92a1d4e2677852021-12-21 11:36:50.443root 11241100x8000000000000000546774Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:50.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5db091fb4c7276ad2021-12-21 11:36:50.443root 11241100x8000000000000000546775Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:50.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.27a01d2208c9b8db2021-12-21 11:36:50.443root 11241100x8000000000000000546776Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:50.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.677e1a5355eb64b42021-12-21 11:36:50.444root 11241100x8000000000000000546777Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:50.942{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d5959f3abb402acd2021-12-21 11:36:50.942root 11241100x8000000000000000546778Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:50.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0a8c0bbcce6366882021-12-21 11:36:50.943root 11241100x8000000000000000546779Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:50.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.da0b7497aa04165b2021-12-21 11:36:50.943root 11241100x8000000000000000546780Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:50.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ad5e589670d706ea2021-12-21 11:36:50.943root 11241100x8000000000000000546781Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:50.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6aaf16e5ffaff6892021-12-21 11:36:50.943root 11241100x8000000000000000546782Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:50.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0e6906d2c69bcf3e2021-12-21 11:36:50.943root 11241100x8000000000000000546783Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:50.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7ec992ed11dd92cc2021-12-21 11:36:50.943root 11241100x8000000000000000546784Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:50.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e29a19bde9bb8be52021-12-21 11:36:50.944root 11241100x8000000000000000546785Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:50.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6053c37828ea17c72021-12-21 11:36:50.944root 11241100x8000000000000000546786Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:50.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.beb49bf1776471fb2021-12-21 11:36:50.944root 11241100x8000000000000000546787Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:50.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1e9dd2698247a2902021-12-21 11:36:50.944root 11241100x8000000000000000546788Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:50.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.fe409d1e2edca91d2021-12-21 11:36:50.944root 11241100x8000000000000000546789Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:50.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6a9646c6932a4ba22021-12-21 11:36:50.944root 11241100x8000000000000000546790Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:50.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.26a66c310b7ec3942021-12-21 11:36:50.944root 11241100x8000000000000000546791Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:50.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7ca32476fccb32c82021-12-21 11:36:50.944root 534500x8000000000000000546792Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:51.395{00000000-0000-0000-0000-000000000000}9910<unknown process>ubuntu 11241100x8000000000000000546793Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:51.395{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f993b478ef3071982021-12-21 11:36:51.395root 11241100x8000000000000000546794Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:51.395{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7b563e74730c4c262021-12-21 11:36:51.395root 11241100x8000000000000000546795Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:51.396{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.19757ca4e3c030a52021-12-21 11:36:51.396root 11241100x8000000000000000546796Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:51.396{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3a7ed13de2a327a62021-12-21 11:36:51.396root 11241100x8000000000000000546797Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:51.396{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6a9b6cf3ca1fcf0d2021-12-21 11:36:51.396root 11241100x8000000000000000546798Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:51.396{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.717699acd538dcf02021-12-21 11:36:51.396root 11241100x8000000000000000546799Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:51.396{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2c792ed3923174772021-12-21 11:36:51.396root 11241100x8000000000000000546800Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:51.396{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b25267a41137465c2021-12-21 11:36:51.396root 534500x8000000000000000546801Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:51.398{00000000-0000-0000-0000-000000000000}9911<unknown process>ubuntu 534500x8000000000000000546802Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:51.399{00000000-0000-0000-0000-000000000000}9912<unknown process>ubuntu 11241100x8000000000000000546803Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:51.400{ec2b6afe-aacb-61c1-0834-fdd63c560000}5677/bin/bash/tmp/sh-thd.lK4iHo2021-12-21 11:36:51.400ubuntu 23542300x8000000000000000546804Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:51.400{ec2b6afe-aacb-61c1-0834-fdd63c560000}5677ubuntu/bin/bash/tmp/sh-thd.lK4iHo--- 11241100x8000000000000000546805Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:51.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.86edfa08bfc97c022021-12-21 11:36:51.693root 11241100x8000000000000000546806Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:51.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.21fa7b8b217b1f392021-12-21 11:36:51.693root 11241100x8000000000000000546807Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:51.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.73f10ca86c85d0122021-12-21 11:36:51.693root 11241100x8000000000000000546808Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:51.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4a6fb673d16de2932021-12-21 11:36:51.693root 11241100x8000000000000000546809Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:51.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3538f2ec5a4b09b22021-12-21 11:36:51.693root 11241100x8000000000000000546810Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:51.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.70eadefec234ab572021-12-21 11:36:51.693root 11241100x8000000000000000546811Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:51.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.fb352eb036dedcac2021-12-21 11:36:51.693root 11241100x8000000000000000546812Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:51.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c5c111fc156721da2021-12-21 11:36:51.694root 11241100x8000000000000000546813Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:51.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.44b519564ddd0d9d2021-12-21 11:36:51.694root 11241100x8000000000000000546814Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:51.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e77721b43b7968c82021-12-21 11:36:51.694root 11241100x8000000000000000546815Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:51.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.bb20bae6c0d9c8c92021-12-21 11:36:51.694root 11241100x8000000000000000546816Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:51.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.cdfb01213f2d3c882021-12-21 11:36:51.694root 354300x8000000000000000546817Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:52.047{ec2b6afe-95d9-61c1-5175-3a0400000000}5346/opt/splunkforwarder/etc/apps/Splunk_TA_stream/linux_x86_64/bin/streamfwdroottcptruefalse10.0.1.25-48798-false10.0.1.12-8000- 11241100x8000000000000000546818Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:52.048{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.42cc1f02571aa9762021-12-21 11:36:52.048root 11241100x8000000000000000546819Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:52.048{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.085bda5a7d7f62022021-12-21 11:36:52.048root 11241100x8000000000000000546820Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:52.048{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.973eb7fd776cc8e82021-12-21 11:36:52.048root 11241100x8000000000000000546821Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:52.048{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c039451473fd3bb62021-12-21 11:36:52.048root 11241100x8000000000000000546822Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:52.048{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.cf30e52181cb1cb12021-12-21 11:36:52.048root 11241100x8000000000000000546823Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:52.048{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3709f266bffde5642021-12-21 11:36:52.048root 11241100x8000000000000000546824Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:52.048{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.114000914a86aa3e2021-12-21 11:36:52.048root 11241100x8000000000000000546825Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:52.049{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0bf9ed252e4738722021-12-21 11:36:52.049root 11241100x8000000000000000546826Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:52.049{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6bb596413868ff3f2021-12-21 11:36:52.049root 11241100x8000000000000000546827Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:52.049{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0f896bba4a5977b72021-12-21 11:36:52.049root 11241100x8000000000000000546828Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:52.049{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3faa600f5f1c58902021-12-21 11:36:52.049root 11241100x8000000000000000546829Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:52.049{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f37743cd4c4d72ad2021-12-21 11:36:52.049root 11241100x8000000000000000546830Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:52.049{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.daf4a832efe0b7d02021-12-21 11:36:52.049root 154100x8000000000000000546831Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:52.219{ec2b6afe-bc54-61c1-08ae-76ea95550000}9913/usr/bin/sudo-----sudo chown root evil2_bin/home/ubuntuubuntu{ec2b6afe-aacb-61c1-e803-000000000000}10006no level-{ec2b6afe-aacb-61c1-0834-fdd63c560000}5677/bin/bash-bashubuntu 354300x8000000000000000546832Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:52.222{ec2b6afe-bc54-61c1-08ae-76ea95550000}9913/usr/bin/sudoubuntuudptruefalse127.0.0.1-48787-false127.0.0.53-53- 354300x8000000000000000546833Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:52.223{ec2b6afe-9247-61c1-c097-2e4cb4550000}2604/lib/systemd/systemd-resolvedsystemd-resolveudptruefalse10.0.1.25-56175-false10.0.0.2-53- 354300x8000000000000000546834Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:52.223{ec2b6afe-9247-61c1-c097-2e4cb4550000}2604/lib/systemd/systemd-resolvedsystemd-resolveudptruefalse10.0.1.25-54412-false10.0.0.2-53- 354300x8000000000000000546835Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:52.226{ec2b6afe-9247-61c1-c097-2e4cb4550000}2604/lib/systemd/systemd-resolvedsystemd-resolveudptruefalse127.0.0.53-53-false127.0.0.1-48787- 354300x8000000000000000546836Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:52.227{ec2b6afe-bc54-61c1-08ae-76ea95550000}9913/usr/bin/sudoubuntuudpfalsefalse127.0.0.53-53-false127.0.0.1-51576- 354300x8000000000000000546837Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:52.227{ec2b6afe-bc54-61c1-08ae-76ea95550000}9913/usr/bin/sudoubuntuudptruefalse127.0.0.1-51576-false127.0.0.53-53- 354300x8000000000000000546838Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:52.227{ec2b6afe-9247-61c1-c097-2e4cb4550000}2604/lib/systemd/systemd-resolvedsystemd-resolveudptruefalse127.0.0.53-53-false127.0.0.1-51576- 154100x8000000000000000546839Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:52.229{ec2b6afe-bc54-61c1-60e9-6043d5550000}9914/bin/chown-----chown root evil2_bin/home/ubunturoot{ec2b6afe-0000-0000-0000-000000000000}06no level-{ec2b6afe-bc54-61c1-08ae-76ea95550000}9913/usr/bin/sudosudoubuntu 534500x8000000000000000546840Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:52.231{ec2b6afe-bc54-61c1-60e9-6043d5550000}9914/bin/chownroot 534500x8000000000000000546841Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:52.232{ec2b6afe-bc54-61c1-08ae-76ea95550000}9913/usr/bin/sudoroot 11241100x8000000000000000546842Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:52.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.71b8e1a81bb4a4c82021-12-21 11:36:52.443root 11241100x8000000000000000546843Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:52.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a129cbe95c7143112021-12-21 11:36:52.443root 11241100x8000000000000000546844Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:52.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a71881b213f241512021-12-21 11:36:52.443root 11241100x8000000000000000546845Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:52.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9bfb648410f3a2b52021-12-21 11:36:52.443root 11241100x8000000000000000546846Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:52.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1dea7fd6bb5b904a2021-12-21 11:36:52.444root 11241100x8000000000000000546847Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:52.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a9717792f87591892021-12-21 11:36:52.444root 11241100x8000000000000000546848Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:52.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2a08733c300f825c2021-12-21 11:36:52.444root 11241100x8000000000000000546849Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:52.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.40c332d68690f9f22021-12-21 11:36:52.444root 11241100x8000000000000000546850Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:52.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.01d1a87c5e5dee672021-12-21 11:36:52.444root 11241100x8000000000000000546851Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:52.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c42a88f39b77348d2021-12-21 11:36:52.444root 11241100x8000000000000000546852Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:52.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.15abbb93765fdbd22021-12-21 11:36:52.444root 11241100x8000000000000000546853Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:52.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.eb8c59d71fb811c92021-12-21 11:36:52.444root 11241100x8000000000000000546854Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:52.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4c29289bdc5130de2021-12-21 11:36:52.444root 11241100x8000000000000000546855Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:52.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.bd76676df4968d4f2021-12-21 11:36:52.444root 11241100x8000000000000000546856Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:52.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8b7d2fc76145a9422021-12-21 11:36:52.445root 11241100x8000000000000000546857Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:52.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.016a5fc8ac7536f72021-12-21 11:36:52.445root 11241100x8000000000000000546858Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:52.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d0447b1ff81335b52021-12-21 11:36:52.445root 11241100x8000000000000000546859Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:52.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9737d3ca72419e732021-12-21 11:36:52.445root 11241100x8000000000000000546860Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:52.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.db938630d16f09a42021-12-21 11:36:52.445root 11241100x8000000000000000546861Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:52.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.88634d360991287d2021-12-21 11:36:52.445root 11241100x8000000000000000546862Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:52.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a302cc0df9c87a342021-12-21 11:36:52.445root 11241100x8000000000000000546863Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:52.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e2bed561666b2f2d2021-12-21 11:36:52.445root 11241100x8000000000000000546864Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:52.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2480ce614d944f832021-12-21 11:36:52.445root 11241100x8000000000000000546865Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:52.446{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.48a32c1dd0872e062021-12-21 11:36:52.446root 11241100x8000000000000000546866Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:52.446{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.be592bc245443ef12021-12-21 11:36:52.446root 11241100x8000000000000000546867Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:52.446{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e5e414b30830f3402021-12-21 11:36:52.446root 11241100x8000000000000000546868Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:52.446{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.aad5e31f030116d42021-12-21 11:36:52.446root 11241100x8000000000000000546869Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:52.446{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0ac15e6d9ccf58042021-12-21 11:36:52.446root 11241100x8000000000000000546870Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:52.446{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0f8754ff1b5f96c52021-12-21 11:36:52.446root 11241100x8000000000000000546871Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:52.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.fcce66c9c26b8fa62021-12-21 11:36:52.943root 11241100x8000000000000000546872Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:52.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9e6aa645e0dc17f92021-12-21 11:36:52.943root 11241100x8000000000000000546873Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:52.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2ab0886b33ec77292021-12-21 11:36:52.943root 11241100x8000000000000000546874Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:52.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9a718407d92d9a822021-12-21 11:36:52.943root 11241100x8000000000000000546875Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:52.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c5b323d0f191b4262021-12-21 11:36:52.943root 11241100x8000000000000000546876Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:52.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b487060c37886e662021-12-21 11:36:52.943root 11241100x8000000000000000546877Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:52.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.bbf2ab16a2aab1682021-12-21 11:36:52.944root 11241100x8000000000000000546878Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:52.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.908861530a77bcfa2021-12-21 11:36:52.944root 11241100x8000000000000000546879Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:52.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.41d1aa678ef02ba22021-12-21 11:36:52.944root 11241100x8000000000000000546880Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:52.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e211e59a106ff5f52021-12-21 11:36:52.944root 11241100x8000000000000000546881Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:52.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ba014f96c115468d2021-12-21 11:36:52.944root 11241100x8000000000000000546882Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:52.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f5b9e07ed160cdc12021-12-21 11:36:52.944root 11241100x8000000000000000546883Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:52.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5e383d5a701f63682021-12-21 11:36:52.944root 11241100x8000000000000000546884Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:52.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.03bc7692694b9cdb2021-12-21 11:36:52.944root 11241100x8000000000000000546885Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:52.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a31ce8c744e1ff702021-12-21 11:36:52.944root 11241100x8000000000000000546886Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:52.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.00443ad4a428772d2021-12-21 11:36:52.944root 11241100x8000000000000000546887Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:52.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ef61e9d9c1008a4f2021-12-21 11:36:52.944root 11241100x8000000000000000546888Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:52.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4e58ba26fa6ee6812021-12-21 11:36:52.945root 11241100x8000000000000000546889Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:52.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.eec876c8509a61a12021-12-21 11:36:52.945root 11241100x8000000000000000546890Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:52.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ceef77b7e893071a2021-12-21 11:36:52.945root 11241100x8000000000000000546891Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:52.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.251f1f2f9008c44a2021-12-21 11:36:52.945root 11241100x8000000000000000546892Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:52.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e63a9f043a68e2d52021-12-21 11:36:52.945root 11241100x8000000000000000546893Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:52.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f7799ee504f7d1e12021-12-21 11:36:52.945root 11241100x8000000000000000546894Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:52.946{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1947b46c5f0712cb2021-12-21 11:36:52.946root 11241100x8000000000000000546895Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:53.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.78750131c53b16832021-12-21 11:36:53.443root 11241100x8000000000000000546896Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:53.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.cd8bd8c57eaca5182021-12-21 11:36:53.443root 11241100x8000000000000000546897Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:53.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.db881eb612cbfb912021-12-21 11:36:53.444root 11241100x8000000000000000546898Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:53.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0d73b5f340c22ba82021-12-21 11:36:53.444root 11241100x8000000000000000546899Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:53.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6c8b078ee9a2d8482021-12-21 11:36:53.444root 11241100x8000000000000000546900Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:53.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c0b71f77fbd13bf52021-12-21 11:36:53.444root 11241100x8000000000000000546901Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:53.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3439cc319b4278302021-12-21 11:36:53.444root 11241100x8000000000000000546902Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:53.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.44dc343258d32e5f2021-12-21 11:36:53.444root 11241100x8000000000000000546903Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:53.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.09c4cf31e6e32d842021-12-21 11:36:53.444root 11241100x8000000000000000546904Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:53.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.69018930f68f65b22021-12-21 11:36:53.444root 11241100x8000000000000000546905Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:53.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3259d9f467f415882021-12-21 11:36:53.444root 11241100x8000000000000000546906Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:53.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a3661186526e45b82021-12-21 11:36:53.444root 11241100x8000000000000000546907Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:53.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.aa59ab58fd7668a32021-12-21 11:36:53.444root 11241100x8000000000000000546908Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:53.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f33cc18473d88eed2021-12-21 11:36:53.444root 11241100x8000000000000000546909Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:53.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.187a212e7a5ad7a12021-12-21 11:36:53.444root 11241100x8000000000000000546910Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:53.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1005396c8d27cefa2021-12-21 11:36:53.444root 11241100x8000000000000000546911Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:53.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9c499b258385866e2021-12-21 11:36:53.445root 11241100x8000000000000000546912Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:53.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.02b13b38c55a805f2021-12-21 11:36:53.445root 11241100x8000000000000000546913Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:53.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f8d879c45c8ecef82021-12-21 11:36:53.445root 11241100x8000000000000000546914Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:53.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.832bd25ec96a968f2021-12-21 11:36:53.445root 11241100x8000000000000000546915Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:53.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.45738936e6ebf2f72021-12-21 11:36:53.445root 11241100x8000000000000000546916Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:53.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7478aa320c9fc8302021-12-21 11:36:53.445root 11241100x8000000000000000546917Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:53.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f7344a4b35c0c6ed2021-12-21 11:36:53.445root 11241100x8000000000000000546918Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:53.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.408d1a3060f9aeaf2021-12-21 11:36:53.445root 11241100x8000000000000000546919Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:53.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ff080beeb87bc7aa2021-12-21 11:36:53.943root 11241100x8000000000000000546920Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:53.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ba74d74602caa5942021-12-21 11:36:53.943root 11241100x8000000000000000546921Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:53.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8bc8269b6810ea062021-12-21 11:36:53.943root 11241100x8000000000000000546922Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:53.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.fcd5d3929abe8c372021-12-21 11:36:53.943root 11241100x8000000000000000546923Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:53.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d3147e6aba823e032021-12-21 11:36:53.944root 11241100x8000000000000000546924Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:53.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.80f6b2dc06660be52021-12-21 11:36:53.944root 11241100x8000000000000000546925Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:53.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.07fa09dffe4bedd22021-12-21 11:36:53.944root 11241100x8000000000000000546926Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:53.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1e35279e1f491a882021-12-21 11:36:53.944root 11241100x8000000000000000546927Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:53.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4e7f186149f3c6102021-12-21 11:36:53.944root 11241100x8000000000000000546928Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:53.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4edee4f79edb71bf2021-12-21 11:36:53.944root 11241100x8000000000000000546929Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:53.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5e691b6b1c8185332021-12-21 11:36:53.944root 11241100x8000000000000000546930Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:53.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ad0e492c9aa5896e2021-12-21 11:36:53.944root 11241100x8000000000000000546931Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:53.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.905710ae824bacfc2021-12-21 11:36:53.944root 11241100x8000000000000000546932Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:53.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.964b912ac0cc6a072021-12-21 11:36:53.944root 11241100x8000000000000000546933Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:53.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5f007cadd3041dbf2021-12-21 11:36:53.944root 11241100x8000000000000000546934Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:53.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5d5e5fef0505156a2021-12-21 11:36:53.944root 11241100x8000000000000000546935Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:53.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.301ac8e464d258de2021-12-21 11:36:53.944root 11241100x8000000000000000546936Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:53.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.700a406542aec3772021-12-21 11:36:53.944root 11241100x8000000000000000546937Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:53.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.923efabe3c19ca132021-12-21 11:36:53.944root 11241100x8000000000000000546938Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:53.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.929bea1f0ad5d3c82021-12-21 11:36:53.945root 11241100x8000000000000000546939Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:53.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e69ac765b6ca375f2021-12-21 11:36:53.945root 11241100x8000000000000000546940Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:53.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.22e18546c3dfd04a2021-12-21 11:36:53.945root 11241100x8000000000000000546941Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:53.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a27832db4a18fc802021-12-21 11:36:53.945root 11241100x8000000000000000546942Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:53.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.065b9c035f47dc252021-12-21 11:36:53.945root 11241100x8000000000000000546943Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:54.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e39ba317319f193e2021-12-21 11:36:54.443root 11241100x8000000000000000546944Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:54.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4ce57b349e09d9292021-12-21 11:36:54.443root 11241100x8000000000000000546945Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:54.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d2701fe02d8ea7432021-12-21 11:36:54.443root 11241100x8000000000000000546946Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:54.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.288faadd504557002021-12-21 11:36:54.443root 11241100x8000000000000000546947Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:54.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d776981f7bcdd2952021-12-21 11:36:54.443root 11241100x8000000000000000546948Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:54.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6c9ca46b91dd99a92021-12-21 11:36:54.443root 11241100x8000000000000000546949Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:54.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.76a68052b273efd52021-12-21 11:36:54.444root 11241100x8000000000000000546950Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:54.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d934bffa325ff19a2021-12-21 11:36:54.444root 11241100x8000000000000000546951Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:54.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a5204f5efdf62c642021-12-21 11:36:54.444root 11241100x8000000000000000546952Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:54.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.dbd93ff59bf474982021-12-21 11:36:54.444root 11241100x8000000000000000546953Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:54.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7d0bd60e1164baaa2021-12-21 11:36:54.444root 11241100x8000000000000000546954Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:54.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.28fa80eba48e8b342021-12-21 11:36:54.444root 11241100x8000000000000000546955Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:54.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.32782a7b3f7d64952021-12-21 11:36:54.444root 11241100x8000000000000000546956Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:54.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.20f39692369784792021-12-21 11:36:54.445root 11241100x8000000000000000546957Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:54.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1990dc521fe2d3382021-12-21 11:36:54.445root 11241100x8000000000000000546958Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:54.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.11a36f0569915cb92021-12-21 11:36:54.445root 11241100x8000000000000000546959Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:54.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.637db2cf065f27772021-12-21 11:36:54.445root 11241100x8000000000000000546960Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:54.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3ef501b236642a4e2021-12-21 11:36:54.445root 11241100x8000000000000000546961Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:54.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c33778e7d25772e72021-12-21 11:36:54.445root 11241100x8000000000000000546962Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:54.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2294627968b3c2b72021-12-21 11:36:54.445root 11241100x8000000000000000546963Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:54.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c8acd839345ac6b52021-12-21 11:36:54.445root 11241100x8000000000000000546964Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:54.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0ba8b721ebc5f6032021-12-21 11:36:54.445root 11241100x8000000000000000546965Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:54.446{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7e608472563301082021-12-21 11:36:54.446root 11241100x8000000000000000546966Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:54.446{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.430386b23bead21c2021-12-21 11:36:54.446root 11241100x8000000000000000546967Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:54.446{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.35257c97588732482021-12-21 11:36:54.446root 11241100x8000000000000000546968Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:54.446{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9ccd5bbc9cad24832021-12-21 11:36:54.446root 11241100x8000000000000000546969Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:54.446{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.147b69531058747c2021-12-21 11:36:54.446root 11241100x8000000000000000546970Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:54.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b892e47f88b44e642021-12-21 11:36:54.943root 11241100x8000000000000000546971Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:54.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.cf2b928ff83477c52021-12-21 11:36:54.943root 11241100x8000000000000000546972Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:54.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.368b97ca037ddd3f2021-12-21 11:36:54.943root 11241100x8000000000000000546973Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:54.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a5372966333fb70f2021-12-21 11:36:54.943root 11241100x8000000000000000546974Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:54.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.484e8e33387aef0b2021-12-21 11:36:54.943root 11241100x8000000000000000546975Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:54.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e3d55850fe4031c62021-12-21 11:36:54.943root 11241100x8000000000000000546976Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:54.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.04722a502ccf60b22021-12-21 11:36:54.944root 11241100x8000000000000000546977Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:54.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.03bd9dabae0d950e2021-12-21 11:36:54.944root 11241100x8000000000000000546978Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:54.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7f3273babdbf27c92021-12-21 11:36:54.944root 11241100x8000000000000000546979Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:54.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b4c15e9368e237f92021-12-21 11:36:54.944root 11241100x8000000000000000546980Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:54.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f8a4fa390e64f24d2021-12-21 11:36:54.944root 11241100x8000000000000000546981Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:54.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.632953d20dca9c942021-12-21 11:36:54.944root 11241100x8000000000000000546982Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:54.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b6b4fba16aaada322021-12-21 11:36:54.944root 11241100x8000000000000000546983Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:54.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.89b4224ce0c1a79b2021-12-21 11:36:54.944root 11241100x8000000000000000546984Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:54.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1a678e6e1326ad2f2021-12-21 11:36:54.944root 11241100x8000000000000000546985Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:54.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.910ea565ff0fea042021-12-21 11:36:54.944root 11241100x8000000000000000546986Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:54.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7fff34c32677754b2021-12-21 11:36:54.944root 11241100x8000000000000000546987Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:54.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.65ca06cae5e78aa22021-12-21 11:36:54.944root 11241100x8000000000000000546988Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:54.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0261da7f87a58b972021-12-21 11:36:54.944root 11241100x8000000000000000546989Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:54.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5404bdd8cbd85f422021-12-21 11:36:54.944root 11241100x8000000000000000546990Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:54.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.beccc551816c2f7e2021-12-21 11:36:54.945root 11241100x8000000000000000546991Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:54.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.03ea3a7d8a2e6a102021-12-21 11:36:54.945root 11241100x8000000000000000546992Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:54.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d7a555ebab9845dc2021-12-21 11:36:54.945root 11241100x8000000000000000546993Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:54.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9c1d3336954750d82021-12-21 11:36:54.945root 11241100x8000000000000000546994Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:55.442{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.225fe9cf07d036692021-12-21 11:36:55.442root 11241100x8000000000000000546995Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:55.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.be0b05a90c0ffddb2021-12-21 11:36:55.443root 11241100x8000000000000000546996Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:55.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8627e668ad07d0652021-12-21 11:36:55.443root 11241100x8000000000000000546997Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:55.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3ada6ccc8e02b1402021-12-21 11:36:55.443root 11241100x8000000000000000546998Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:55.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.53bee8229846c32a2021-12-21 11:36:55.443root 11241100x8000000000000000546999Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:55.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8dbe1ebe36c6d1ea2021-12-21 11:36:55.443root 11241100x8000000000000000547000Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:55.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.86f390afd5a27aa22021-12-21 11:36:55.443root 11241100x8000000000000000547001Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:55.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c4f1d08efd39c0512021-12-21 11:36:55.443root 11241100x8000000000000000547002Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:55.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.344aa79342b935d72021-12-21 11:36:55.443root 11241100x8000000000000000547003Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:55.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c8dc88ab002da0882021-12-21 11:36:55.443root 11241100x8000000000000000547004Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:55.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.094a9acc8073081e2021-12-21 11:36:55.443root 11241100x8000000000000000547005Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:55.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.fc6ffc1d7eded2892021-12-21 11:36:55.443root 11241100x8000000000000000547006Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:55.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5f9498c7ffe9b8e72021-12-21 11:36:55.443root 11241100x8000000000000000547007Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:55.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0c9310c7bd144f6e2021-12-21 11:36:55.444root 11241100x8000000000000000547008Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:55.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.28886df5abc0d6072021-12-21 11:36:55.444root 11241100x8000000000000000547009Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:55.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9f2088023315443d2021-12-21 11:36:55.444root 11241100x8000000000000000547010Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:55.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.feea016cd0c05c972021-12-21 11:36:55.444root 11241100x8000000000000000547011Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:55.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5c1cbaeab9b1f3fc2021-12-21 11:36:55.444root 11241100x8000000000000000547012Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:55.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.988f9d2b7618c9b42021-12-21 11:36:55.444root 11241100x8000000000000000547013Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:55.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.12a6bb48f7ad2aea2021-12-21 11:36:55.444root 11241100x8000000000000000547014Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:55.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.309e87845f59379c2021-12-21 11:36:55.444root 11241100x8000000000000000547015Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:55.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7945ae56494828702021-12-21 11:36:55.445root 11241100x8000000000000000547016Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:55.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9850e831fe430ef22021-12-21 11:36:55.445root 11241100x8000000000000000547017Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:55.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d109fb62545558fc2021-12-21 11:36:55.445root 11241100x8000000000000000547018Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:55.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d50d1c3a6bb566e22021-12-21 11:36:55.445root 11241100x8000000000000000547019Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:55.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.66fc478550e943792021-12-21 11:36:55.445root 11241100x8000000000000000547020Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:55.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8f283063c0e18ee22021-12-21 11:36:55.445root 11241100x8000000000000000547021Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:55.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.88f68eb40555ad182021-12-21 11:36:55.445root 11241100x8000000000000000547022Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:55.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3cfa8eba7232a5142021-12-21 11:36:55.445root 11241100x8000000000000000547023Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:55.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.aeb0e3092f82e1cd2021-12-21 11:36:55.445root 11241100x8000000000000000547024Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:55.446{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ebcbc9a4381d9f222021-12-21 11:36:55.446root 11241100x8000000000000000547025Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:55.447{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.19b4d6b0a54a60492021-12-21 11:36:55.447root 11241100x8000000000000000547026Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:55.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6a864812938f32da2021-12-21 11:36:55.943root 11241100x8000000000000000547027Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:55.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e44a36dc9c4707112021-12-21 11:36:55.943root 11241100x8000000000000000547028Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:55.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.eac9af8c10e379ac2021-12-21 11:36:55.943root 11241100x8000000000000000547029Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:55.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.bee214f9aa8a9bee2021-12-21 11:36:55.943root 11241100x8000000000000000547030Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:55.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6f6f4924b0c23e092021-12-21 11:36:55.943root 11241100x8000000000000000547031Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:55.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.94e80b818519344a2021-12-21 11:36:55.944root 11241100x8000000000000000547032Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:55.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d15737c364c59b382021-12-21 11:36:55.944root 11241100x8000000000000000547033Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:55.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b18ec14bfbcb42bd2021-12-21 11:36:55.944root 11241100x8000000000000000547034Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:55.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.dfbda1a10a647f442021-12-21 11:36:55.944root 11241100x8000000000000000547035Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:55.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ec9c76134812a7022021-12-21 11:36:55.944root 11241100x8000000000000000547036Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:55.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e1c136446fefa6ee2021-12-21 11:36:55.944root 11241100x8000000000000000547037Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:55.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.da4114679fccfafb2021-12-21 11:36:55.944root 11241100x8000000000000000547038Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:55.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e90b2f4dd4ca1a172021-12-21 11:36:55.944root 11241100x8000000000000000547039Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:55.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c1371fa976805ec62021-12-21 11:36:55.944root 11241100x8000000000000000547040Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:55.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.df51c67080170b192021-12-21 11:36:55.944root 11241100x8000000000000000547041Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:55.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ba73151d3a8b3aaa2021-12-21 11:36:55.945root 11241100x8000000000000000547042Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:55.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.089824601fa6a19d2021-12-21 11:36:55.945root 11241100x8000000000000000547043Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:55.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8055d46267a131982021-12-21 11:36:55.945root 11241100x8000000000000000547044Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:55.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.abbf9985cca0a6cf2021-12-21 11:36:55.945root 11241100x8000000000000000547045Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:55.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5aad69818d069fc72021-12-21 11:36:55.945root 11241100x8000000000000000547046Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:55.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.db63420dd342ae282021-12-21 11:36:55.945root 11241100x8000000000000000547047Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:55.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e2586dc25858bd242021-12-21 11:36:55.945root 11241100x8000000000000000547048Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:55.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.cf15f89ec58f649d2021-12-21 11:36:55.945root 11241100x8000000000000000547049Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:55.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8701cbed6dfc90842021-12-21 11:36:55.945root 11241100x8000000000000000547050Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:56.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.57f6b936ccc66eae2021-12-21 11:36:56.443root 11241100x8000000000000000547051Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:56.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ac424f1bc2c2ecbf2021-12-21 11:36:56.443root 11241100x8000000000000000547052Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:56.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.94bf6dc8c33104062021-12-21 11:36:56.443root 11241100x8000000000000000547053Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:56.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b78965fa662a40512021-12-21 11:36:56.443root 11241100x8000000000000000547054Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:56.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8d3754acf3ad6f242021-12-21 11:36:56.443root 11241100x8000000000000000547055Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:56.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.880ce9369cd663c82021-12-21 11:36:56.443root 11241100x8000000000000000547056Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:56.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.27ddd23657d524ac2021-12-21 11:36:56.443root 11241100x8000000000000000547057Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:56.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a59b98bd09c1b4432021-12-21 11:36:56.444root 11241100x8000000000000000547058Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:56.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ad5938dc73e7320e2021-12-21 11:36:56.444root 11241100x8000000000000000547059Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:56.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.fc6e9b3fc94ecb4e2021-12-21 11:36:56.444root 11241100x8000000000000000547060Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:56.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ac2e7d522773752e2021-12-21 11:36:56.444root 11241100x8000000000000000547061Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:56.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f2db7559ddd2d0422021-12-21 11:36:56.444root 11241100x8000000000000000547062Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:56.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.701999f6d6efff4e2021-12-21 11:36:56.444root 11241100x8000000000000000547063Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:56.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6aca484c172397152021-12-21 11:36:56.444root 11241100x8000000000000000547064Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:56.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6fd16aef9e75aecf2021-12-21 11:36:56.444root 11241100x8000000000000000547065Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:56.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0e25089a35d19a9d2021-12-21 11:36:56.445root 11241100x8000000000000000547066Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:56.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.700f5d5adae61bc42021-12-21 11:36:56.445root 11241100x8000000000000000547067Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:56.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e84a15f465a8b7ab2021-12-21 11:36:56.445root 11241100x8000000000000000547068Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:56.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.890429142b3b247c2021-12-21 11:36:56.445root 11241100x8000000000000000547069Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:56.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8b39471c88ed4bfd2021-12-21 11:36:56.445root 11241100x8000000000000000547070Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:56.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.99a05c5457864f792021-12-21 11:36:56.445root 11241100x8000000000000000547071Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:56.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.fa8bf39879d953392021-12-21 11:36:56.445root 11241100x8000000000000000547072Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:56.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.caa07ae5b1ef19402021-12-21 11:36:56.445root 11241100x8000000000000000547073Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:56.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0f1b72af07787edc2021-12-21 11:36:56.445root 11241100x8000000000000000547074Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:56.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0d7de2bcb2c008182021-12-21 11:36:56.445root 11241100x8000000000000000547075Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:56.446{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1b276fbff07060382021-12-21 11:36:56.446root 11241100x8000000000000000547076Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:56.446{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9425781c026972392021-12-21 11:36:56.446root 11241100x8000000000000000547077Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:56.446{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.254a48ccb2747b9b2021-12-21 11:36:56.446root 11241100x8000000000000000547078Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:56.446{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.926f982d1979aabc2021-12-21 11:36:56.446root 11241100x8000000000000000547079Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:56.446{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4a7b678def4eb5a62021-12-21 11:36:56.446root 11241100x8000000000000000547080Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:56.446{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d63dc04a83cf9fa12021-12-21 11:36:56.446root 11241100x8000000000000000547081Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:56.446{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.58f81441514c0dc92021-12-21 11:36:56.446root 11241100x8000000000000000547082Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:56.446{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b9176c2452a5c6892021-12-21 11:36:56.446root 11241100x8000000000000000547083Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:56.446{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b9748218b1f7a7e22021-12-21 11:36:56.446root 11241100x8000000000000000547084Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:56.447{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0b162ae48358fb152021-12-21 11:36:56.447root 11241100x8000000000000000547085Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:56.447{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.886f6e8eb3daedb42021-12-21 11:36:56.447root 11241100x8000000000000000547086Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:56.447{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.91ebcbce38c78f0f2021-12-21 11:36:56.447root 11241100x8000000000000000547087Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:56.447{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8b22dd111b0f5c102021-12-21 11:36:56.447root 11241100x8000000000000000547088Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:56.447{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.76895b939badf0cc2021-12-21 11:36:56.447root 11241100x8000000000000000547089Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:56.447{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.753e6aad545d2e5f2021-12-21 11:36:56.447root 11241100x8000000000000000547090Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:56.447{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b7c60497ddbfb3ee2021-12-21 11:36:56.447root 11241100x8000000000000000547091Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:56.457{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b81898f0c8b41f1f2021-12-21 11:36:56.457root 11241100x8000000000000000547092Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:56.458{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a740fe963b5651842021-12-21 11:36:56.458root 11241100x8000000000000000547093Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:56.458{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.09e827570eee4a9e2021-12-21 11:36:56.458root 11241100x8000000000000000547094Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:56.458{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.cfebdf5c499806b72021-12-21 11:36:56.458root 11241100x8000000000000000547095Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:56.458{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7a945e26ab8942f12021-12-21 11:36:56.458root 11241100x8000000000000000547096Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:56.458{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2bc7e63de2aaf6e42021-12-21 11:36:56.458root 11241100x8000000000000000547097Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:56.458{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7c3b98f8521126bb2021-12-21 11:36:56.458root 11241100x8000000000000000547098Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:56.458{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.cd52bca6f26a09192021-12-21 11:36:56.458root 11241100x8000000000000000547099Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:56.458{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9afeaacae212e6ac2021-12-21 11:36:56.458root 11241100x8000000000000000547100Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:56.458{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.05585be55c2f2f442021-12-21 11:36:56.458root 11241100x8000000000000000547101Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:56.458{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.25e43835ee0429a62021-12-21 11:36:56.458root 11241100x8000000000000000547102Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:56.459{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3dac1ae209a21ff22021-12-21 11:36:56.459root 11241100x8000000000000000547103Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:56.459{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.89e558bf61959e462021-12-21 11:36:56.459root 11241100x8000000000000000547104Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:56.459{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6b8eee26380907c52021-12-21 11:36:56.459root 11241100x8000000000000000547105Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:56.459{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4015b093a5360f932021-12-21 11:36:56.459root 11241100x8000000000000000547106Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:56.459{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.95806769e231aa6f2021-12-21 11:36:56.459root 11241100x8000000000000000547107Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:56.459{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9f4deee02be2d8932021-12-21 11:36:56.459root 11241100x8000000000000000547108Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:56.459{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.756da4c889bbd1232021-12-21 11:36:56.459root 11241100x8000000000000000547109Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:56.459{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4a44d1df52c68d712021-12-21 11:36:56.459root 11241100x8000000000000000547110Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:56.459{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c9b2e1b67712d8192021-12-21 11:36:56.459root 11241100x8000000000000000547111Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:56.465{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.508c92854678092c2021-12-21 11:36:56.465root 11241100x8000000000000000547112Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:56.465{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.39e6e655ce5119dd2021-12-21 11:36:56.465root 11241100x8000000000000000547113Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:56.465{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a9535ad2ba363dd02021-12-21 11:36:56.465root 11241100x8000000000000000547114Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:56.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.cf7e8d953e9fd80a2021-12-21 11:36:56.943root 11241100x8000000000000000547115Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:56.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7a96a8662c8fbf342021-12-21 11:36:56.943root 11241100x8000000000000000547116Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:56.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b595ba16145123ed2021-12-21 11:36:56.943root 11241100x8000000000000000547117Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:56.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9be54cfbcfce14612021-12-21 11:36:56.943root 11241100x8000000000000000547118Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:56.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3125c118e7ef6f362021-12-21 11:36:56.943root 11241100x8000000000000000547119Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:56.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.73c07d4ca394cc352021-12-21 11:36:56.943root 11241100x8000000000000000547120Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:56.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f958b31fd6d8f8332021-12-21 11:36:56.943root 11241100x8000000000000000547121Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:56.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.156785e651dfea912021-12-21 11:36:56.943root 11241100x8000000000000000547122Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:56.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4871559359cd2c612021-12-21 11:36:56.944root 11241100x8000000000000000547123Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:56.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1316855f0a04175b2021-12-21 11:36:56.944root 11241100x8000000000000000547124Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:56.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f1a51a51a536ae982021-12-21 11:36:56.944root 11241100x8000000000000000547125Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:56.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9a13108061689fce2021-12-21 11:36:56.944root 11241100x8000000000000000547126Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:56.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.47295294d77a6c052021-12-21 11:36:56.944root 11241100x8000000000000000547127Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:56.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5c540a04893257662021-12-21 11:36:56.944root 11241100x8000000000000000547128Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:56.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ff20bdb5879ba4612021-12-21 11:36:56.944root 11241100x8000000000000000547129Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:56.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.cbb0def13eef621d2021-12-21 11:36:56.944root 11241100x8000000000000000547130Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:56.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b7d4b459bc8a93622021-12-21 11:36:56.944root 11241100x8000000000000000547131Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:56.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.89d253ea41fc828a2021-12-21 11:36:56.944root 11241100x8000000000000000547132Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:56.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5ef865b5131a68c92021-12-21 11:36:56.944root 11241100x8000000000000000547133Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:56.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.eca3cb22b87927c32021-12-21 11:36:56.945root 11241100x8000000000000000547134Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:56.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9f23e1cfa677ffd62021-12-21 11:36:56.945root 11241100x8000000000000000547135Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:56.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c66613ba083987972021-12-21 11:36:56.945root 11241100x8000000000000000547136Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:56.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8b417d436565c7ab2021-12-21 11:36:56.945root 11241100x8000000000000000547137Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:56.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.39a563f3f3b8f6662021-12-21 11:36:56.945root 11241100x8000000000000000547138Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:56.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4b31953dbeff95d52021-12-21 11:36:56.945root 11241100x8000000000000000547139Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:56.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.95fff3338f085f792021-12-21 11:36:56.945root 11241100x8000000000000000547140Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:56.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2bf76fe51cc357262021-12-21 11:36:56.945root 11241100x8000000000000000547141Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:56.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c3e657f170170cfe2021-12-21 11:36:56.945root 11241100x8000000000000000547142Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:56.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3eb57a3ee0f4e55e2021-12-21 11:36:56.945root 11241100x8000000000000000547143Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:56.946{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0a4529e56907633a2021-12-21 11:36:56.946root 11241100x8000000000000000547144Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:56.946{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.01898f718524d53b2021-12-21 11:36:56.946root 11241100x8000000000000000547145Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:56.946{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.de02cce3922c68be2021-12-21 11:36:56.946root 11241100x8000000000000000547146Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:57.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5bd19e5f74ad788b2021-12-21 11:36:57.443root 11241100x8000000000000000547147Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:57.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.eab91971188bfc2c2021-12-21 11:36:57.443root 11241100x8000000000000000547148Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:57.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d74dbdd0186013582021-12-21 11:36:57.443root 11241100x8000000000000000547149Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:57.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6cdc0555324e70532021-12-21 11:36:57.443root 11241100x8000000000000000547150Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:57.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a8398d1f6eb8b1e92021-12-21 11:36:57.443root 11241100x8000000000000000547151Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:57.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1f1a6061fc4eaa0c2021-12-21 11:36:57.443root 11241100x8000000000000000547152Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:57.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4cde02f084c9debc2021-12-21 11:36:57.443root 11241100x8000000000000000547153Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:57.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.40de3b2ff9a993892021-12-21 11:36:57.443root 11241100x8000000000000000547154Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:57.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2a13ec48b0edd91c2021-12-21 11:36:57.444root 11241100x8000000000000000547155Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:57.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a6c0005eb08c88062021-12-21 11:36:57.444root 11241100x8000000000000000547156Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:57.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d722830b5d0e43952021-12-21 11:36:57.444root 11241100x8000000000000000547157Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:57.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.93ecc2def5e01df92021-12-21 11:36:57.444root 11241100x8000000000000000547158Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:57.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.18009dd28853a4662021-12-21 11:36:57.444root 11241100x8000000000000000547159Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:57.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.94a65f12e79101032021-12-21 11:36:57.444root 11241100x8000000000000000547160Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:57.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d18c6336e3a221472021-12-21 11:36:57.444root 11241100x8000000000000000547161Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:57.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e78ca7fec7094a9a2021-12-21 11:36:57.444root 11241100x8000000000000000547162Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:57.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.11663466eeee4b6b2021-12-21 11:36:57.444root 11241100x8000000000000000547163Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:57.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.de64b589e495467c2021-12-21 11:36:57.444root 11241100x8000000000000000547164Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:57.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c325acbab1e2f3742021-12-21 11:36:57.444root 11241100x8000000000000000547165Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:57.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0541cce10464413a2021-12-21 11:36:57.444root 11241100x8000000000000000547166Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:57.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.77d56efe323f4db42021-12-21 11:36:57.444root 11241100x8000000000000000547167Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:57.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.56685b502770794c2021-12-21 11:36:57.444root 11241100x8000000000000000547168Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:57.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.bfe1e822cc463f9b2021-12-21 11:36:57.445root 11241100x8000000000000000547169Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:57.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c5bfb61fa5421e1b2021-12-21 11:36:57.445root 11241100x8000000000000000547170Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:57.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d0aa558e9171a8fb2021-12-21 11:36:57.445root 11241100x8000000000000000547171Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:57.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.dd40afabaa2c87c32021-12-21 11:36:57.445root 11241100x8000000000000000547172Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:57.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.47027210bd5bd7112021-12-21 11:36:57.445root 11241100x8000000000000000547173Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:57.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.186945583fce30362021-12-21 11:36:57.445root 11241100x8000000000000000547174Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:57.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9024b1c0cf8dd6962021-12-21 11:36:57.445root 11241100x8000000000000000547175Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:57.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.df5f6c34f84ef6912021-12-21 11:36:57.445root 11241100x8000000000000000547176Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:57.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ee4f74a95307df862021-12-21 11:36:57.445root 11241100x8000000000000000547177Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:57.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.32c11df31626f26d2021-12-21 11:36:57.445root 11241100x8000000000000000547178Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:57.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6e11241bea8eab9a2021-12-21 11:36:57.445root 11241100x8000000000000000547179Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:57.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.67b00bd80a1aaf8e2021-12-21 11:36:57.445root 11241100x8000000000000000547180Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:57.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.201cd85fbab896162021-12-21 11:36:57.445root 11241100x8000000000000000547181Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:57.942{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7f2247f739cbedb22021-12-21 11:36:57.942root 11241100x8000000000000000547182Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:57.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f8d0645d6e9bf3f32021-12-21 11:36:57.943root 11241100x8000000000000000547183Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:57.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.70003bff89bd41ee2021-12-21 11:36:57.943root 11241100x8000000000000000547184Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:57.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c4396958816cdd712021-12-21 11:36:57.943root 11241100x8000000000000000547185Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:57.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ef4e53538764d2a42021-12-21 11:36:57.943root 11241100x8000000000000000547186Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:57.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.deb2c42ece31c9612021-12-21 11:36:57.943root 11241100x8000000000000000547187Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:57.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.383ead3ae750d49c2021-12-21 11:36:57.943root 11241100x8000000000000000547188Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:57.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3b9bd424e35487d12021-12-21 11:36:57.943root 11241100x8000000000000000547189Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:57.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c371413ba5a557182021-12-21 11:36:57.944root 11241100x8000000000000000547190Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:57.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.fe45c2449f03d9412021-12-21 11:36:57.944root 11241100x8000000000000000547191Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:57.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.706d7d3bcca402dc2021-12-21 11:36:57.944root 11241100x8000000000000000547192Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:57.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.89cc2f382c76fff92021-12-21 11:36:57.944root 11241100x8000000000000000547193Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:57.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.aeb9735b0f9d3b632021-12-21 11:36:57.944root 11241100x8000000000000000547194Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:57.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.347b2e521244f4142021-12-21 11:36:57.944root 11241100x8000000000000000547195Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:57.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d481fbc775f93c1c2021-12-21 11:36:57.944root 11241100x8000000000000000547196Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:57.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f4b494d1492be1c12021-12-21 11:36:57.944root 11241100x8000000000000000547197Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:57.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3a6159294fb251d92021-12-21 11:36:57.945root 11241100x8000000000000000547198Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:57.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e561d7066b45742f2021-12-21 11:36:57.945root 11241100x8000000000000000547199Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:57.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.72c9a2af86213bce2021-12-21 11:36:57.945root 11241100x8000000000000000547200Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:57.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.74341ee818ae40002021-12-21 11:36:57.945root 11241100x8000000000000000547201Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:57.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.743403448fcdfaff2021-12-21 11:36:57.945root 11241100x8000000000000000547202Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:57.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1a6acd07bc2a7ae42021-12-21 11:36:57.945root 11241100x8000000000000000547203Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:57.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.58b2e8c54959049e2021-12-21 11:36:57.945root 11241100x8000000000000000547204Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:57.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8684b201e28880592021-12-21 11:36:57.945root 11241100x8000000000000000547205Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:57.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8e0434a6ed248e572021-12-21 11:36:57.945root 11241100x8000000000000000547206Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:57.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1675bcfb4ad268fa2021-12-21 11:36:57.945root 11241100x8000000000000000547207Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:57.946{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e3a642c278c752622021-12-21 11:36:57.946root 11241100x8000000000000000547208Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:57.946{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.fa5dad096db0dfe52021-12-21 11:36:57.946root 11241100x8000000000000000547209Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:57.946{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.011de11e4e13fc3f2021-12-21 11:36:57.946root 11241100x8000000000000000547210Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:57.946{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.fd4246f04cbd373d2021-12-21 11:36:57.946root 11241100x8000000000000000547211Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:57.946{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e9c103c59ecc2bf62021-12-21 11:36:57.946root 11241100x8000000000000000547212Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:57.946{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b87f33f7e8de44092021-12-21 11:36:57.946root 11241100x8000000000000000547213Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:57.946{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.815caafa363affad2021-12-21 11:36:57.946root 11241100x8000000000000000547214Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:57.946{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9c2292a83d02e2c82021-12-21 11:36:57.946root 11241100x8000000000000000547215Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:57.946{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.37cd3812f8cf2fd32021-12-21 11:36:57.946root 354300x8000000000000000547216Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:58.026{ec2b6afe-95d9-61c1-5175-3a0400000000}5346/opt/splunkforwarder/etc/apps/Splunk_TA_stream/linux_x86_64/bin/streamfwdroottcptruefalse10.0.1.25-48800-false10.0.1.12-8000- 11241100x8000000000000000547217Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:58.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7ac4c2f4eddcbdc92021-12-21 11:36:58.443root 11241100x8000000000000000547218Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:58.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0ad586f81abe6a242021-12-21 11:36:58.444root 11241100x8000000000000000547219Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:58.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c938dc3df7c698962021-12-21 11:36:58.444root 11241100x8000000000000000547220Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:58.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.297520ee065d5c492021-12-21 11:36:58.444root 11241100x8000000000000000547221Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:58.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.12641d554a58a9352021-12-21 11:36:58.444root 11241100x8000000000000000547222Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:58.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3661359649b3e4332021-12-21 11:36:58.444root 11241100x8000000000000000547223Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:58.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d741dfbc07ccbda82021-12-21 11:36:58.444root 11241100x8000000000000000547224Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:58.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6e49b4c9b12c54dc2021-12-21 11:36:58.445root 11241100x8000000000000000547225Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:58.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.78dc11ecd8fd091a2021-12-21 11:36:58.445root 11241100x8000000000000000547226Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:58.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4470eea192a212612021-12-21 11:36:58.445root 11241100x8000000000000000547227Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:58.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e141b13c3447afae2021-12-21 11:36:58.445root 11241100x8000000000000000547228Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:58.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.573d843259699f702021-12-21 11:36:58.445root 11241100x8000000000000000547229Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:58.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.255bb5c6398f1fb62021-12-21 11:36:58.445root 11241100x8000000000000000547230Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:58.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a7b36ddadfaf5ec42021-12-21 11:36:58.445root 11241100x8000000000000000547231Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:58.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e09b9945eee934352021-12-21 11:36:58.445root 11241100x8000000000000000547232Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:58.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2a1523457b6d7d5c2021-12-21 11:36:58.445root 11241100x8000000000000000547233Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:58.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c78bec6a3a0b3b812021-12-21 11:36:58.445root 11241100x8000000000000000547234Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:58.446{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.78a798f2e0a21fd82021-12-21 11:36:58.446root 11241100x8000000000000000547235Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:58.446{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b29746300030106e2021-12-21 11:36:58.446root 11241100x8000000000000000547236Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:58.446{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.47e1ad64339a423b2021-12-21 11:36:58.446root 11241100x8000000000000000547237Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:58.446{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4ea1adddeb96592f2021-12-21 11:36:58.446root 11241100x8000000000000000547238Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:58.446{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8075e203dc6df9df2021-12-21 11:36:58.446root 11241100x8000000000000000547239Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:58.446{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.188cb60f5aa1b1882021-12-21 11:36:58.446root 11241100x8000000000000000547240Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:58.446{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.26f87b16f1e39e902021-12-21 11:36:58.446root 11241100x8000000000000000547241Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:58.446{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.34b1e2967734004a2021-12-21 11:36:58.446root 11241100x8000000000000000547242Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:58.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.45cc317362ad6c172021-12-21 11:36:58.943root 11241100x8000000000000000547243Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:58.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d97cc357779378d72021-12-21 11:36:58.943root 11241100x8000000000000000547244Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:58.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.da54ea517609c9c22021-12-21 11:36:58.943root 11241100x8000000000000000547245Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:58.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8f3d3b5fbe2867e72021-12-21 11:36:58.943root 11241100x8000000000000000547246Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:58.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f6e370eb0e394b792021-12-21 11:36:58.943root 11241100x8000000000000000547247Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:58.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.40115438006429a02021-12-21 11:36:58.943root 11241100x8000000000000000547248Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:58.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7a4784f8e25f39ce2021-12-21 11:36:58.943root 11241100x8000000000000000547249Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:58.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7afb06b17ac400242021-12-21 11:36:58.943root 11241100x8000000000000000547250Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:58.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.075f7a51aa2bc8182021-12-21 11:36:58.943root 11241100x8000000000000000547251Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:58.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.dce0cd6045a526722021-12-21 11:36:58.944root 11241100x8000000000000000547252Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:58.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.101631255781fc612021-12-21 11:36:58.944root 11241100x8000000000000000547253Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:58.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.68dafe661305497a2021-12-21 11:36:58.944root 11241100x8000000000000000547254Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:58.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a6714128ccef75d72021-12-21 11:36:58.944root 11241100x8000000000000000547255Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:58.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f393afbcc76baa102021-12-21 11:36:58.944root 11241100x8000000000000000547256Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:58.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e252493fc0d018762021-12-21 11:36:58.944root 11241100x8000000000000000547257Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:58.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.02736b72282ca7272021-12-21 11:36:58.944root 11241100x8000000000000000547258Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:58.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.defce803a189ac552021-12-21 11:36:58.944root 11241100x8000000000000000547259Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:58.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0b08716bcd84f5d92021-12-21 11:36:58.944root 11241100x8000000000000000547260Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:58.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7db42e3c5eaeef242021-12-21 11:36:58.944root 11241100x8000000000000000547261Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:58.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a4fa73f15b73fbc42021-12-21 11:36:58.945root 11241100x8000000000000000547262Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:58.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e9942176792baadf2021-12-21 11:36:58.945root 11241100x8000000000000000547263Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:58.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4bbec40e7bff22f62021-12-21 11:36:58.945root 11241100x8000000000000000547264Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:58.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e2a77bcb4bb535a32021-12-21 11:36:58.945root 11241100x8000000000000000547265Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:58.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.241a32e8ec1fa8db2021-12-21 11:36:58.945root 11241100x8000000000000000547266Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:58.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.47b5e90f63364a5b2021-12-21 11:36:58.945root 11241100x8000000000000000547267Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:58.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7c16a258929611e72021-12-21 11:36:58.945root 11241100x8000000000000000547268Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:58.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.68901a56167fea762021-12-21 11:36:58.945root 11241100x8000000000000000547269Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:58.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0cd77bb373cd1cf62021-12-21 11:36:58.945root 11241100x8000000000000000547270Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:58.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a3b61303b5bb30492021-12-21 11:36:58.945root 11241100x8000000000000000547271Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:58.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2ba4ff4a26218d262021-12-21 11:36:58.945root 11241100x8000000000000000547272Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:58.946{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2bb47aa848776cbe2021-12-21 11:36:58.946root 11241100x8000000000000000547273Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:58.946{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6c6a2040d8619f1b2021-12-21 11:36:58.946root 11241100x8000000000000000547274Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:58.946{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.fdc82632fedad7792021-12-21 11:36:58.946root 11241100x8000000000000000547275Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:58.946{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.13086c85d417f3ac2021-12-21 11:36:58.946root 11241100x8000000000000000547276Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:58.946{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4b18c911ebd25c522021-12-21 11:36:58.946root 11241100x8000000000000000547277Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:59.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a6a6dbd18fb55ae82021-12-21 11:36:59.443root 11241100x8000000000000000547278Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:59.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.939b5b22b0b277a42021-12-21 11:36:59.443root 11241100x8000000000000000547279Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:59.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.eec428f041d451e72021-12-21 11:36:59.443root 11241100x8000000000000000547280Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:59.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.dc4f0cf73600c9752021-12-21 11:36:59.443root 11241100x8000000000000000547281Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:59.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.88af6fe97b4c2ad12021-12-21 11:36:59.443root 11241100x8000000000000000547282Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:59.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f4f89967716f9e572021-12-21 11:36:59.444root 11241100x8000000000000000547283Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:59.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.78aee56ba861b3c82021-12-21 11:36:59.444root 11241100x8000000000000000547284Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:59.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.45cb32e4efcaaa7b2021-12-21 11:36:59.444root 11241100x8000000000000000547285Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:59.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b9f8fb79b6746efc2021-12-21 11:36:59.444root 11241100x8000000000000000547286Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:59.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.be2fd3033b99e6ed2021-12-21 11:36:59.444root 11241100x8000000000000000547287Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:59.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.01fa4b154ab23ff22021-12-21 11:36:59.444root 11241100x8000000000000000547288Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:59.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a88e385b296cc84e2021-12-21 11:36:59.445root 11241100x8000000000000000547289Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:59.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e980a6ef119511392021-12-21 11:36:59.445root 11241100x8000000000000000547290Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:59.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ef69d5974d7241272021-12-21 11:36:59.445root 11241100x8000000000000000547291Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:59.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c3771c559ee93c0d2021-12-21 11:36:59.445root 11241100x8000000000000000547292Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:59.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6472a5e8349853182021-12-21 11:36:59.445root 11241100x8000000000000000547293Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:59.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b54ee20fc9c61e8b2021-12-21 11:36:59.445root 11241100x8000000000000000547294Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:59.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ab79e1c5818a97962021-12-21 11:36:59.445root 11241100x8000000000000000547295Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:59.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ba71b8c1656e189e2021-12-21 11:36:59.445root 11241100x8000000000000000547296Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:59.446{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a440a9887dfca4102021-12-21 11:36:59.446root 11241100x8000000000000000547297Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:59.446{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.58d46d5be2b51db92021-12-21 11:36:59.446root 11241100x8000000000000000547298Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:59.446{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4cd00c13758142382021-12-21 11:36:59.446root 11241100x8000000000000000547299Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:59.446{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1b42beb50b91badb2021-12-21 11:36:59.446root 11241100x8000000000000000547300Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:59.446{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.770b9f52c3046a2c2021-12-21 11:36:59.446root 11241100x8000000000000000547301Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:59.446{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.477759ea3bc7cfb52021-12-21 11:36:59.446root 11241100x8000000000000000547302Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:59.446{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d712fd29672584782021-12-21 11:36:59.446root 11241100x8000000000000000547303Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:59.446{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c2f09f0fadbeccbe2021-12-21 11:36:59.446root 11241100x8000000000000000547304Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:59.446{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e0fade4bfd584e472021-12-21 11:36:59.446root 11241100x8000000000000000547305Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:59.446{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b28101a82fcf1fdb2021-12-21 11:36:59.446root 11241100x8000000000000000547306Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:59.446{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ecfd14635b5704782021-12-21 11:36:59.446root 11241100x8000000000000000547307Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:59.446{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.590c99ab74882de92021-12-21 11:36:59.446root 11241100x8000000000000000547308Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:59.446{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.eb0ca97257d911512021-12-21 11:36:59.446root 11241100x8000000000000000547309Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:59.446{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0e543b5a24ed8b2d2021-12-21 11:36:59.446root 11241100x8000000000000000547310Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:59.446{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.25bcd153db5fd82c2021-12-21 11:36:59.446root 11241100x8000000000000000547311Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:59.448{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.18eab89138856eec2021-12-21 11:36:59.448root 11241100x8000000000000000547312Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:59.448{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0161a70d4b9dde7e2021-12-21 11:36:59.448root 11241100x8000000000000000547313Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:59.448{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6d9bb7a5dec39bdc2021-12-21 11:36:59.448root 11241100x8000000000000000547314Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:59.448{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.915d2e3a00798f122021-12-21 11:36:59.448root 11241100x8000000000000000547315Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:59.448{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.926c330eee20cf092021-12-21 11:36:59.448root 11241100x8000000000000000547316Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:59.448{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e0d1176ad20608d02021-12-21 11:36:59.448root 11241100x8000000000000000547317Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:59.449{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2b2af2b1588fe3762021-12-21 11:36:59.449root 11241100x8000000000000000547318Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:59.449{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.65158b0846b638052021-12-21 11:36:59.449root 11241100x8000000000000000547319Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:59.450{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.78b98a0ccdff49522021-12-21 11:36:59.450root 11241100x8000000000000000547320Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:59.450{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.587d2bc9cb22a0352021-12-21 11:36:59.450root 11241100x8000000000000000547321Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:59.450{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5b19040dba7aeba22021-12-21 11:36:59.450root 11241100x8000000000000000547322Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:59.450{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.880edacf801df0a92021-12-21 11:36:59.450root 11241100x8000000000000000547323Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:59.451{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b9284ad9a12707412021-12-21 11:36:59.451root 11241100x8000000000000000547324Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:59.451{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5a015f4c3e3101bb2021-12-21 11:36:59.451root 11241100x8000000000000000547325Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:59.451{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.80a18a6cf8e70d742021-12-21 11:36:59.451root 11241100x8000000000000000547326Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:59.452{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3d8a92af97fc83df2021-12-21 11:36:59.452root 11241100x8000000000000000547327Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:59.452{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1aebe3bf1b83856d2021-12-21 11:36:59.452root 11241100x8000000000000000547328Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:59.452{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c6d9c52d2ed498332021-12-21 11:36:59.452root 11241100x8000000000000000547329Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:59.452{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d27848e48775f61c2021-12-21 11:36:59.452root 11241100x8000000000000000547330Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:59.452{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1f35230065c5e5442021-12-21 11:36:59.452root 11241100x8000000000000000547331Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:59.453{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4027e324db1fe1ef2021-12-21 11:36:59.453root 11241100x8000000000000000547332Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:59.453{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ae6d05ab4c904ce22021-12-21 11:36:59.453root 11241100x8000000000000000547333Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:59.453{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b36eaf6711d0a4382021-12-21 11:36:59.453root 11241100x8000000000000000547334Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:59.454{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.94f9313fc0d597862021-12-21 11:36:59.454root 11241100x8000000000000000547335Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:59.454{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c377cf696711df1f2021-12-21 11:36:59.454root 11241100x8000000000000000547336Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:59.454{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.098629877a2896b32021-12-21 11:36:59.454root 11241100x8000000000000000547337Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:59.454{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c2c28ab9b42057342021-12-21 11:36:59.454root 11241100x8000000000000000547338Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:59.455{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6a4d37f9d65a2d4c2021-12-21 11:36:59.455root 11241100x8000000000000000547339Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:59.455{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4f78da4de2edf8f92021-12-21 11:36:59.455root 11241100x8000000000000000547340Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:59.455{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6147c82caa58cc9c2021-12-21 11:36:59.455root 11241100x8000000000000000547341Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:59.455{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9f2770512269f2c32021-12-21 11:36:59.455root 11241100x8000000000000000547342Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:59.455{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3906dd0ec44c5fcd2021-12-21 11:36:59.455root 11241100x8000000000000000547343Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:59.455{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b7a1faf702acaa022021-12-21 11:36:59.455root 11241100x8000000000000000547344Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:59.456{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.45647d16043369222021-12-21 11:36:59.456root 11241100x8000000000000000547345Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:59.456{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.afb501471726149d2021-12-21 11:36:59.456root 11241100x8000000000000000547346Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:59.456{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.371fc5e0c9a455892021-12-21 11:36:59.456root 11241100x8000000000000000547347Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:59.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ee70b32e60d3be562021-12-21 11:36:59.943root 11241100x8000000000000000547348Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:59.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3f13310f263311652021-12-21 11:36:59.943root 11241100x8000000000000000547349Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:59.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.735e4e62f80315872021-12-21 11:36:59.943root 11241100x8000000000000000547350Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:59.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b6d52606eaa4000b2021-12-21 11:36:59.943root 11241100x8000000000000000547351Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:59.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8352fbf2660be7ac2021-12-21 11:36:59.943root 11241100x8000000000000000547352Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:59.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.982de7b8d0aa5a752021-12-21 11:36:59.943root 11241100x8000000000000000547353Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:59.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b1ce3e0cad3c9e382021-12-21 11:36:59.943root 11241100x8000000000000000547354Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:59.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8727a3157045dca22021-12-21 11:36:59.944root 11241100x8000000000000000547355Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:59.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8bc3aaefbcd46b082021-12-21 11:36:59.944root 11241100x8000000000000000547356Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:59.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ca02e01751fb7d552021-12-21 11:36:59.944root 11241100x8000000000000000547357Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:59.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ce0243045f42f3002021-12-21 11:36:59.944root 11241100x8000000000000000547358Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:59.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4a34f636775faa322021-12-21 11:36:59.944root 11241100x8000000000000000547359Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:59.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7fbfb0ea8f25d0032021-12-21 11:36:59.944root 11241100x8000000000000000547360Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:59.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a49ce62b31b2f8ff2021-12-21 11:36:59.944root 11241100x8000000000000000547361Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:59.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f11c3d697c26d78d2021-12-21 11:36:59.944root 11241100x8000000000000000547362Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:59.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.bdda1d140d1808c02021-12-21 11:36:59.944root 11241100x8000000000000000547363Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:59.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.35e9e2f754a29c742021-12-21 11:36:59.944root 11241100x8000000000000000547364Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:59.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.13290420639887e02021-12-21 11:36:59.944root 11241100x8000000000000000547365Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:59.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0938acecbcba0ba32021-12-21 11:36:59.944root 11241100x8000000000000000547366Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:59.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.bd92819fb85807402021-12-21 11:36:59.945root 11241100x8000000000000000547367Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:59.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.392f04e57ce2f1472021-12-21 11:36:59.945root 11241100x8000000000000000547368Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:59.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c8fb21892c6453622021-12-21 11:36:59.945root 11241100x8000000000000000547369Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:59.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7f17c1b93db3802a2021-12-21 11:36:59.945root 11241100x8000000000000000547370Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:59.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3ca508d75974d04c2021-12-21 11:36:59.945root 11241100x8000000000000000547371Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:36:59.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.cb4f0c3656f02fa52021-12-21 11:36:59.945root 11241100x8000000000000000547372Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:00.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8074841bab7bb29a2021-12-21 11:37:00.443root 11241100x8000000000000000547373Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:00.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.19a6e87833c4af4d2021-12-21 11:37:00.443root 11241100x8000000000000000547374Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:00.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.bbce0f8e4c9f5c082021-12-21 11:37:00.443root 11241100x8000000000000000547375Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:00.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.81e90dc0d07915282021-12-21 11:37:00.443root 11241100x8000000000000000547376Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:00.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5ca3a79db91df3ed2021-12-21 11:37:00.443root 11241100x8000000000000000547377Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:00.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.efc2f226543289bf2021-12-21 11:37:00.443root 11241100x8000000000000000547378Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:00.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e86a4b147299f2932021-12-21 11:37:00.443root 11241100x8000000000000000547379Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:00.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e4d6796dd3d040c32021-12-21 11:37:00.444root 11241100x8000000000000000547380Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:00.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.935c266d696e30d82021-12-21 11:37:00.444root 11241100x8000000000000000547381Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:00.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7ae1e6951784fc0e2021-12-21 11:37:00.444root 11241100x8000000000000000547382Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:00.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.993dd6a2296bcda62021-12-21 11:37:00.444root 11241100x8000000000000000547383Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:00.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.941d95e9f6177a482021-12-21 11:37:00.444root 11241100x8000000000000000547384Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:00.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2379d4f1eea87f722021-12-21 11:37:00.445root 11241100x8000000000000000547385Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:00.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9fdb79fc65f39d512021-12-21 11:37:00.445root 11241100x8000000000000000547386Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:00.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.bb6aeaa4d13858fc2021-12-21 11:37:00.445root 11241100x8000000000000000547387Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:00.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d2d7a2acc870192c2021-12-21 11:37:00.445root 11241100x8000000000000000547388Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:00.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.bf3a79798e3532212021-12-21 11:37:00.445root 11241100x8000000000000000547389Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:00.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5905d3f1d47e91842021-12-21 11:37:00.445root 11241100x8000000000000000547390Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:00.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1fe38c81ef27b2b92021-12-21 11:37:00.445root 11241100x8000000000000000547391Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:00.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9a63cf7cd482fb452021-12-21 11:37:00.445root 11241100x8000000000000000547392Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:00.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.cd735b3f22102efc2021-12-21 11:37:00.445root 11241100x8000000000000000547393Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:00.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.cb599b173c5981902021-12-21 11:37:00.445root 11241100x8000000000000000547394Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:00.446{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0750f1101faee8682021-12-21 11:37:00.446root 11241100x8000000000000000547395Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:00.446{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a5d4156374a419cf2021-12-21 11:37:00.446root 11241100x8000000000000000547396Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:00.446{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.dcc0e3a69c4777382021-12-21 11:37:00.446root 11241100x8000000000000000547397Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:00.446{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5a274fb1d80fddd02021-12-21 11:37:00.446root 11241100x8000000000000000547398Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:00.446{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ff2b3b1a058a5b9d2021-12-21 11:37:00.446root 11241100x8000000000000000547399Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:00.446{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.05d593dff6f7fb832021-12-21 11:37:00.446root 11241100x8000000000000000547400Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:00.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0533de551eaeab052021-12-21 11:37:00.943root 11241100x8000000000000000547401Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:00.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.42f15baaa5f9e0822021-12-21 11:37:00.943root 11241100x8000000000000000547402Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:00.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e659baa9089de4032021-12-21 11:37:00.943root 11241100x8000000000000000547403Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:00.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ea333ec42e168dae2021-12-21 11:37:00.943root 11241100x8000000000000000547404Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:00.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3eea5c9116ab8ad82021-12-21 11:37:00.943root 11241100x8000000000000000547405Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:00.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f84db69ca784182e2021-12-21 11:37:00.943root 11241100x8000000000000000547406Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:00.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d7ac3ad48cd2dd4e2021-12-21 11:37:00.943root 11241100x8000000000000000547407Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:00.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a62ebdc255c73f372021-12-21 11:37:00.943root 11241100x8000000000000000547408Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:00.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.afb3c5f212993eda2021-12-21 11:37:00.944root 11241100x8000000000000000547409Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:00.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.56b0b3ff1eb06ac52021-12-21 11:37:00.944root 11241100x8000000000000000547410Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:00.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.826ca289e1a0c9812021-12-21 11:37:00.944root 11241100x8000000000000000547411Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:00.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9540ec2770756f612021-12-21 11:37:00.944root 11241100x8000000000000000547412Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:00.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.60c3d629dc5c6f8e2021-12-21 11:37:00.944root 11241100x8000000000000000547413Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:00.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.43a6df3823f66a0f2021-12-21 11:37:00.944root 11241100x8000000000000000547414Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:00.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a8aa95b33b19fc642021-12-21 11:37:00.944root 11241100x8000000000000000547415Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:00.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.25c7f9bcba19f89f2021-12-21 11:37:00.944root 11241100x8000000000000000547416Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:00.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c0c093f664d347bb2021-12-21 11:37:00.944root 11241100x8000000000000000547417Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:00.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d5855b298bece10c2021-12-21 11:37:00.945root 11241100x8000000000000000547418Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:00.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0c7bbfd7ab1227e12021-12-21 11:37:00.945root 11241100x8000000000000000547419Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:00.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6b22b3f815b1686a2021-12-21 11:37:00.945root 11241100x8000000000000000547420Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:00.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8c47e4e2d488c3ee2021-12-21 11:37:00.945root 11241100x8000000000000000547421Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:00.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e425210dd56203422021-12-21 11:37:00.945root 11241100x8000000000000000547422Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:00.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7dff23bc6205c3972021-12-21 11:37:00.945root 11241100x8000000000000000547423Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:00.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ba48ab8fca9c5fdd2021-12-21 11:37:00.945root 11241100x8000000000000000547424Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:00.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.033cf35b6a4adfef2021-12-21 11:37:00.945root 11241100x8000000000000000547425Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:00.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.65fdfa3666b5e04a2021-12-21 11:37:00.945root 11241100x8000000000000000547426Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:00.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3d530a11f2e28e742021-12-21 11:37:00.945root 11241100x8000000000000000547427Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:00.946{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.99d1e1a9fd7efb432021-12-21 11:37:00.946root 11241100x8000000000000000547428Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:00.946{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3d96575c1e18f0d22021-12-21 11:37:00.946root 11241100x8000000000000000547429Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:00.946{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.47d0121133ed836b2021-12-21 11:37:00.946root 11241100x8000000000000000547430Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:00.946{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d7ba3d0e606884032021-12-21 11:37:00.946root 11241100x8000000000000000547431Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:00.946{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4d7ba4d8454bdd802021-12-21 11:37:00.946root 11241100x8000000000000000547432Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:00.946{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.03342c33bed3806e2021-12-21 11:37:00.946root 11241100x8000000000000000547433Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:00.946{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d2cc2bccfa09b97c2021-12-21 11:37:00.946root 11241100x8000000000000000547434Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:00.946{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b3d3d4d9939088432021-12-21 11:37:00.946root 11241100x8000000000000000547435Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:00.947{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.48a414bd85ce98792021-12-21 11:37:00.947root 11241100x8000000000000000547436Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:00.947{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.353ffd54ceef85fd2021-12-21 11:37:00.947root 11241100x8000000000000000547437Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:01.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d7dae30d3de4db6c2021-12-21 11:37:01.443root 11241100x8000000000000000547438Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:01.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4ce145a3c0c5a7a92021-12-21 11:37:01.443root 11241100x8000000000000000547439Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:01.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d6a11108b4e720f22021-12-21 11:37:01.443root 11241100x8000000000000000547440Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:01.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6bd90e935835d0052021-12-21 11:37:01.443root 11241100x8000000000000000547441Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:01.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1d3b2c0b0c99da252021-12-21 11:37:01.443root 11241100x8000000000000000547442Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:01.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6a3924f47a8039142021-12-21 11:37:01.444root 11241100x8000000000000000547443Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:01.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.29150ca0949f6a552021-12-21 11:37:01.444root 11241100x8000000000000000547444Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:01.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.72e97dc9e9de83c42021-12-21 11:37:01.444root 11241100x8000000000000000547445Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:01.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9ff26988f58af93c2021-12-21 11:37:01.444root 11241100x8000000000000000547446Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:01.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.61531ea27889478e2021-12-21 11:37:01.444root 11241100x8000000000000000547447Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:01.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.eae275dbaf092da22021-12-21 11:37:01.444root 11241100x8000000000000000547448Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:01.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4bd426eb481fe8fa2021-12-21 11:37:01.444root 11241100x8000000000000000547449Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:01.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f1b2e2a18bf34f7d2021-12-21 11:37:01.444root 11241100x8000000000000000547450Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:01.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f8e0530779a003162021-12-21 11:37:01.444root 11241100x8000000000000000547451Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:01.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5832b8455d40f2992021-12-21 11:37:01.444root 11241100x8000000000000000547452Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:01.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.dd7d5b8b01a22dde2021-12-21 11:37:01.445root 11241100x8000000000000000547453Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:01.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ab92eb800ee158612021-12-21 11:37:01.445root 11241100x8000000000000000547454Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:01.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.60ca1140cd3b54c82021-12-21 11:37:01.445root 11241100x8000000000000000547455Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:01.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7c7c980a359d8bac2021-12-21 11:37:01.445root 11241100x8000000000000000547456Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:01.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4de1f8e0de13df942021-12-21 11:37:01.445root 11241100x8000000000000000547457Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:01.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.51514933c6607d732021-12-21 11:37:01.445root 11241100x8000000000000000547458Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:01.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.caa73ce7974263802021-12-21 11:37:01.445root 11241100x8000000000000000547459Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:01.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.16223fefe9171e042021-12-21 11:37:01.445root 11241100x8000000000000000547460Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:01.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.44dc8bb529cb480f2021-12-21 11:37:01.445root 11241100x8000000000000000547461Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:01.446{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6b0a5c934a7975db2021-12-21 11:37:01.446root 11241100x8000000000000000547462Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:01.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d694b873cd089cc32021-12-21 11:37:01.943root 11241100x8000000000000000547463Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:01.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4f7488a725174bfd2021-12-21 11:37:01.943root 11241100x8000000000000000547464Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:01.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ef58c4c9e9c4912d2021-12-21 11:37:01.943root 11241100x8000000000000000547465Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:01.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.fdb89cf08fe33fb52021-12-21 11:37:01.943root 11241100x8000000000000000547466Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:01.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.94af98ffbe7eebbe2021-12-21 11:37:01.944root 11241100x8000000000000000547467Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:01.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4eb973c8af31ad482021-12-21 11:37:01.944root 11241100x8000000000000000547468Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:01.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.aa81030c8c62f7052021-12-21 11:37:01.944root 11241100x8000000000000000547469Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:01.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.424c3425566fc2482021-12-21 11:37:01.944root 11241100x8000000000000000547470Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:01.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.69fcdb4b4feb9c192021-12-21 11:37:01.944root 11241100x8000000000000000547471Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:01.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9c6af2538b2fd1962021-12-21 11:37:01.944root 11241100x8000000000000000547472Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:01.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.15d9bee4502d3ca42021-12-21 11:37:01.944root 11241100x8000000000000000547473Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:01.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.dfb0aa02f7ff77682021-12-21 11:37:01.944root 11241100x8000000000000000547474Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:01.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4672748f50dff9de2021-12-21 11:37:01.944root 11241100x8000000000000000547475Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:01.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2a3e1a9bf5469db02021-12-21 11:37:01.944root 11241100x8000000000000000547476Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:01.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.38f268d5579b85a32021-12-21 11:37:01.945root 11241100x8000000000000000547477Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:01.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1e62ff3da661bc4e2021-12-21 11:37:01.945root 11241100x8000000000000000547478Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:01.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e229e4b4218bd0d22021-12-21 11:37:01.945root 11241100x8000000000000000547479Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:01.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1488ad516863b3d42021-12-21 11:37:01.945root 11241100x8000000000000000547480Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:01.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5bdf68e455e7ac472021-12-21 11:37:01.945root 11241100x8000000000000000547481Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:01.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f1e04e4fa68880dd2021-12-21 11:37:01.945root 11241100x8000000000000000547482Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:01.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8f181d725bc9862f2021-12-21 11:37:01.945root 11241100x8000000000000000547483Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:01.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1c1875474e09e6112021-12-21 11:37:01.945root 11241100x8000000000000000547484Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:01.946{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ae63ca774a618da42021-12-21 11:37:01.946root 11241100x8000000000000000547485Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:01.946{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.eac2b6a5060a12382021-12-21 11:37:01.946root 11241100x8000000000000000547486Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:01.946{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.401c0b7bfac1a1ea2021-12-21 11:37:01.946root 11241100x8000000000000000547487Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:02.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7663dbed6bdecf942021-12-21 11:37:02.443root 11241100x8000000000000000547488Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:02.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.bbcd73fb0c985a802021-12-21 11:37:02.443root 11241100x8000000000000000547489Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:02.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3ea0e9288ed67cb72021-12-21 11:37:02.443root 11241100x8000000000000000547490Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:02.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b45b4c0b53a148582021-12-21 11:37:02.443root 11241100x8000000000000000547491Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:02.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d720539249a765e22021-12-21 11:37:02.443root 11241100x8000000000000000547492Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:02.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.804fcc060ced1d102021-12-21 11:37:02.443root 11241100x8000000000000000547493Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:02.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.12dbce08f94ea73b2021-12-21 11:37:02.443root 11241100x8000000000000000547494Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:02.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d250d464360478f72021-12-21 11:37:02.444root 11241100x8000000000000000547495Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:02.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7fcf4dd8750489182021-12-21 11:37:02.444root 11241100x8000000000000000547496Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:02.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.fd40225eb3b5a5552021-12-21 11:37:02.444root 11241100x8000000000000000547497Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:02.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9efcf07f6be782e22021-12-21 11:37:02.444root 11241100x8000000000000000547498Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:02.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8d6b4ae8db60bc8f2021-12-21 11:37:02.444root 11241100x8000000000000000547499Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:02.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.30384fb44f4520d12021-12-21 11:37:02.444root 11241100x8000000000000000547500Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:02.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.15a10f731f2b00fd2021-12-21 11:37:02.444root 11241100x8000000000000000547501Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:02.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9dffa8dc6b7c5a762021-12-21 11:37:02.444root 11241100x8000000000000000547502Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:02.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0725358c00a9cc9d2021-12-21 11:37:02.444root 11241100x8000000000000000547503Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:02.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.94f10ad1194105132021-12-21 11:37:02.444root 11241100x8000000000000000547504Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:02.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f53a004c70c980432021-12-21 11:37:02.444root 11241100x8000000000000000547505Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:02.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.abfa8a78d7b6a5852021-12-21 11:37:02.444root 11241100x8000000000000000547506Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:02.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0a031f4f16182fb32021-12-21 11:37:02.445root 11241100x8000000000000000547507Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:02.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6d8a34529505df472021-12-21 11:37:02.445root 11241100x8000000000000000547508Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:02.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b11a982c0381c9c82021-12-21 11:37:02.445root 11241100x8000000000000000547509Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:02.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4db8b2c372fbb4de2021-12-21 11:37:02.445root 11241100x8000000000000000547510Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:02.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.92a8494c84d95d482021-12-21 11:37:02.445root 11241100x8000000000000000547511Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:02.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8df04bba26b60d8c2021-12-21 11:37:02.445root 11241100x8000000000000000547512Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:02.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0211bca7ea22bdf62021-12-21 11:37:02.445root 11241100x8000000000000000547513Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:02.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.35048bdc3468fbb12021-12-21 11:37:02.943root 11241100x8000000000000000547514Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:02.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.277d22fd0ed4110c2021-12-21 11:37:02.943root 11241100x8000000000000000547515Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:02.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.25c91502eb4a101b2021-12-21 11:37:02.943root 11241100x8000000000000000547516Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:02.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.dac4f0b4c31c3a812021-12-21 11:37:02.943root 11241100x8000000000000000547517Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:02.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.91f8b8984054f6f12021-12-21 11:37:02.943root 11241100x8000000000000000547518Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:02.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ac9041c265d55c9f2021-12-21 11:37:02.943root 11241100x8000000000000000547519Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:02.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d44e923406bccc9f2021-12-21 11:37:02.943root 11241100x8000000000000000547520Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:02.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f4cbd6a33c39a71a2021-12-21 11:37:02.943root 11241100x8000000000000000547521Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:02.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f2cdd3d4d664742e2021-12-21 11:37:02.944root 11241100x8000000000000000547522Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:02.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5521e388665db9122021-12-21 11:37:02.944root 11241100x8000000000000000547523Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:02.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e1cfda387b1275972021-12-21 11:37:02.944root 11241100x8000000000000000547524Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:02.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.62f7a77e7a35b7d12021-12-21 11:37:02.944root 11241100x8000000000000000547525Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:02.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.35e3566bd105fe8b2021-12-21 11:37:02.944root 11241100x8000000000000000547526Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:02.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.488a8918844bf4e42021-12-21 11:37:02.944root 11241100x8000000000000000547527Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:02.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.718c9fadb7073e402021-12-21 11:37:02.944root 11241100x8000000000000000547528Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:02.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9a0bdc1b2c53b6652021-12-21 11:37:02.944root 11241100x8000000000000000547529Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:02.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.19790b25561d01b52021-12-21 11:37:02.944root 11241100x8000000000000000547530Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:02.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6c0ae07524da8ced2021-12-21 11:37:02.944root 11241100x8000000000000000547531Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:02.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3be6c24957eadaf42021-12-21 11:37:02.944root 11241100x8000000000000000547532Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:02.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f14dded78bfb90dc2021-12-21 11:37:02.945root 11241100x8000000000000000547533Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:02.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f675a39b35ea8d952021-12-21 11:37:02.945root 11241100x8000000000000000547534Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:02.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f76c9d6b0900a6b42021-12-21 11:37:02.945root 11241100x8000000000000000547535Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:02.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.41bc93f830c2ed322021-12-21 11:37:02.945root 11241100x8000000000000000547536Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:02.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.bf9e7b90ffe25b492021-12-21 11:37:02.945root 11241100x8000000000000000547537Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:02.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8266aa9a2316f5df2021-12-21 11:37:02.945root 11241100x8000000000000000547538Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:02.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f4818a9d6604385e2021-12-21 11:37:02.945root 11241100x8000000000000000547539Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:02.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2bffb4a0502dad722021-12-21 11:37:02.945root 11241100x8000000000000000547540Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:02.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5610cc87680aacde2021-12-21 11:37:02.945root 11241100x8000000000000000547541Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:02.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b90f509bf11ef4e92021-12-21 11:37:02.945root 11241100x8000000000000000547542Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:02.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b5f7d3f9aa9a0e2d2021-12-21 11:37:02.945root 11241100x8000000000000000547543Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:02.946{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2ed16bbd5f97659b2021-12-21 11:37:02.946root 354300x8000000000000000547544Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:03.233{ec2b6afe-95d9-61c1-5175-3a0400000000}5346/opt/splunkforwarder/etc/apps/Splunk_TA_stream/linux_x86_64/bin/streamfwdroottcptruefalse10.0.1.25-48802-false10.0.1.12-8000- 11241100x8000000000000000547545Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:03.235{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0e8c1fc6e8b4edf82021-12-21 11:37:03.235root 11241100x8000000000000000547546Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:03.235{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.04660599d3e0efe42021-12-21 11:37:03.235root 11241100x8000000000000000547547Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:03.235{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.15b418036b9eb1232021-12-21 11:37:03.235root 11241100x8000000000000000547548Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:03.235{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c3b5f0c9b38c46f42021-12-21 11:37:03.235root 11241100x8000000000000000547549Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:03.235{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.544822d372bf89e42021-12-21 11:37:03.235root 11241100x8000000000000000547550Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:03.235{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8ad040602feb2d1d2021-12-21 11:37:03.235root 11241100x8000000000000000547551Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:03.235{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.86c9abea8e7911da2021-12-21 11:37:03.235root 11241100x8000000000000000547552Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:03.235{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3ed1f442302e00ba2021-12-21 11:37:03.235root 11241100x8000000000000000547553Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:03.236{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.93fa1029a21ce6c02021-12-21 11:37:03.236root 11241100x8000000000000000547554Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:03.236{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0a45dc42595a883e2021-12-21 11:37:03.236root 11241100x8000000000000000547555Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:03.236{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9c1bea9cc8d1b8c82021-12-21 11:37:03.236root 11241100x8000000000000000547556Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:03.236{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6a5079704e535fd42021-12-21 11:37:03.236root 11241100x8000000000000000547557Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:03.236{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.09f135332971c1e72021-12-21 11:37:03.236root 11241100x8000000000000000547558Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:03.236{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8a0f228ba63a91a02021-12-21 11:37:03.236root 11241100x8000000000000000547559Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:03.236{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.23d65e05d49d5daf2021-12-21 11:37:03.236root 11241100x8000000000000000547560Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:03.236{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.01573ab7a7f1258f2021-12-21 11:37:03.236root 11241100x8000000000000000547561Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:03.236{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1a8c87ecc1a88f902021-12-21 11:37:03.236root 11241100x8000000000000000547562Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:03.236{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9d4dc55b5980fa822021-12-21 11:37:03.236root 11241100x8000000000000000547563Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:03.236{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.978cc85ca71776632021-12-21 11:37:03.236root 11241100x8000000000000000547564Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:03.236{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5bc857ce8cd96bdb2021-12-21 11:37:03.236root 11241100x8000000000000000547565Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:03.236{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6cadbdbb15c641c62021-12-21 11:37:03.236root 11241100x8000000000000000547566Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:03.236{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.eb0393158479ca3e2021-12-21 11:37:03.236root 11241100x8000000000000000547567Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:03.236{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.eb34624f353f0f3c2021-12-21 11:37:03.236root 11241100x8000000000000000547568Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:03.237{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.91d64610f471699f2021-12-21 11:37:03.237root 11241100x8000000000000000547569Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:03.237{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.41820b481e881a8e2021-12-21 11:37:03.237root 11241100x8000000000000000547570Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:03.237{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3d25f5e2c02e49d62021-12-21 11:37:03.237root 11241100x8000000000000000547571Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:03.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.dce5caf5e81f1b5f2021-12-21 11:37:03.693root 11241100x8000000000000000547572Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:03.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.447f0b444e32a1212021-12-21 11:37:03.693root 11241100x8000000000000000547573Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:03.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2ad963657dbb96922021-12-21 11:37:03.693root 11241100x8000000000000000547574Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:03.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.40bba369eb167c362021-12-21 11:37:03.693root 11241100x8000000000000000547575Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:03.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ea925827170e95be2021-12-21 11:37:03.693root 11241100x8000000000000000547576Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:03.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9e60a6a24ad25c3f2021-12-21 11:37:03.693root 11241100x8000000000000000547577Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:03.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.48a8b906561708fa2021-12-21 11:37:03.693root 11241100x8000000000000000547578Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:03.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b81ceb6e285669252021-12-21 11:37:03.693root 11241100x8000000000000000547579Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:03.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5ba8d025e442c28f2021-12-21 11:37:03.693root 11241100x8000000000000000547580Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:03.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.050dc0add9d0e6e22021-12-21 11:37:03.693root 11241100x8000000000000000547581Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:03.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.15e8b33b9306c2b32021-12-21 11:37:03.693root 11241100x8000000000000000547582Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:03.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e566b9fb2a7b59e42021-12-21 11:37:03.693root 11241100x8000000000000000547583Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:03.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ab97129ceaf570d42021-12-21 11:37:03.694root 11241100x8000000000000000547584Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:03.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.274488a7b3220a5c2021-12-21 11:37:03.694root 11241100x8000000000000000547585Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:03.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.056eef8bf15f6b7e2021-12-21 11:37:03.694root 11241100x8000000000000000547586Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:03.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3936c6ec735a5efa2021-12-21 11:37:03.694root 11241100x8000000000000000547587Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:03.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.bb7c8428cc481df22021-12-21 11:37:03.694root 11241100x8000000000000000547588Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:03.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.113614b3e4b064492021-12-21 11:37:03.694root 11241100x8000000000000000547589Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:03.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6b9b76d014b7a87b2021-12-21 11:37:03.694root 11241100x8000000000000000547590Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:03.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8d4a7728f0084a112021-12-21 11:37:03.694root 11241100x8000000000000000547591Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:03.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.244b4014ce67021a2021-12-21 11:37:03.694root 11241100x8000000000000000547592Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:03.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.89e9f6b7ed2fe4d72021-12-21 11:37:03.694root 11241100x8000000000000000547593Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:03.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a4afe794405415482021-12-21 11:37:03.694root 11241100x8000000000000000547594Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:03.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ae304feb95a7ebbd2021-12-21 11:37:03.694root 11241100x8000000000000000547595Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:03.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8ba2e50905cd6eca2021-12-21 11:37:03.694root 11241100x8000000000000000547596Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:03.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ac165faacb39bd832021-12-21 11:37:03.694root 11241100x8000000000000000547597Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:03.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0dc3ef75054e947a2021-12-21 11:37:03.694root 11241100x8000000000000000547598Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:03.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e55a5ea0070908bf2021-12-21 11:37:03.694root 11241100x8000000000000000547599Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:03.695{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1e9a68210739a24f2021-12-21 11:37:03.695root 11241100x8000000000000000547600Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:03.695{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4dd941904e4f3fe32021-12-21 11:37:03.695root 11241100x8000000000000000547601Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:03.695{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d96215f443e49d742021-12-21 11:37:03.695root 11241100x8000000000000000547602Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:03.695{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2bd7db8aa12842bf2021-12-21 11:37:03.695root 11241100x8000000000000000547603Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:03.695{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8d7932cdd1fd63432021-12-21 11:37:03.695root 11241100x8000000000000000547604Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:03.695{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d2cf91fab01baf4f2021-12-21 11:37:03.695root 11241100x8000000000000000547605Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:03.695{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.eee02898ecf9508a2021-12-21 11:37:03.695root 11241100x8000000000000000547606Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:03.695{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.45a5fd832a4efbc62021-12-21 11:37:03.695root 11241100x8000000000000000547607Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:03.695{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.df8d11c2a89aa7fc2021-12-21 11:37:03.695root 11241100x8000000000000000547608Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:03.695{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.781a1e99fa7cd6ad2021-12-21 11:37:03.695root 11241100x8000000000000000547609Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:03.695{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.961c1f1e3143edbb2021-12-21 11:37:03.695root 11241100x8000000000000000547610Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:03.695{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.dc566f28b3e22e882021-12-21 11:37:03.695root 11241100x8000000000000000547611Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:03.695{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f439f716c568cc912021-12-21 11:37:03.695root 11241100x8000000000000000547612Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:03.695{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.adeff34024b468312021-12-21 11:37:03.695root 11241100x8000000000000000547613Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:03.695{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d4893de4a33303af2021-12-21 11:37:03.695root 11241100x8000000000000000547614Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:03.696{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.779b19f76f0b0b772021-12-21 11:37:03.696root 11241100x8000000000000000547615Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:03.696{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.73d8cdf7335aa1732021-12-21 11:37:03.696root 11241100x8000000000000000547616Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:03.696{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e7f86d2f15ef7ea52021-12-21 11:37:03.696root 11241100x8000000000000000547617Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:03.696{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.607b17e6ffccc0c52021-12-21 11:37:03.696root 11241100x8000000000000000547618Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:03.696{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4215d7f23dbf070c2021-12-21 11:37:03.696root 11241100x8000000000000000547619Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:03.696{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d3a3270a6ae71f9b2021-12-21 11:37:03.696root 11241100x8000000000000000547620Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:03.696{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.39dc610474c79a412021-12-21 11:37:03.696root 11241100x8000000000000000547621Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:04.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6522e8a36dcb56e62021-12-21 11:37:04.193root 11241100x8000000000000000547622Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:04.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.dc8efbc9d1e082f72021-12-21 11:37:04.193root 11241100x8000000000000000547623Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:04.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.061aac3fbb3f6e362021-12-21 11:37:04.193root 11241100x8000000000000000547624Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:04.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.fbebed6815d791912021-12-21 11:37:04.193root 11241100x8000000000000000547625Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:04.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.31691ede1ed581c42021-12-21 11:37:04.193root 11241100x8000000000000000547626Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:04.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b95c9cab4ea98e4e2021-12-21 11:37:04.193root 11241100x8000000000000000547627Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:04.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8b6ee12cd9e50b7a2021-12-21 11:37:04.193root 11241100x8000000000000000547628Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:04.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.401b0f2d30488ecf2021-12-21 11:37:04.193root 11241100x8000000000000000547629Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:04.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.962e8b2eafbc5e092021-12-21 11:37:04.194root 11241100x8000000000000000547630Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:04.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8387ec3fdc8f378a2021-12-21 11:37:04.194root 11241100x8000000000000000547631Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:04.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0124a113feea60b62021-12-21 11:37:04.194root 11241100x8000000000000000547632Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:04.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.fc477ea42ffd61242021-12-21 11:37:04.194root 11241100x8000000000000000547633Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:04.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ca3d4a7c8da373b72021-12-21 11:37:04.194root 11241100x8000000000000000547634Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:04.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.dc1fc018f7072ab42021-12-21 11:37:04.194root 11241100x8000000000000000547635Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:04.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2e2d12dab47865382021-12-21 11:37:04.194root 11241100x8000000000000000547636Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:04.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5bc39881cf3631152021-12-21 11:37:04.194root 11241100x8000000000000000547637Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:04.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5c3d593f75ddb85b2021-12-21 11:37:04.194root 11241100x8000000000000000547638Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:04.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.77c01a958cfba2d72021-12-21 11:37:04.194root 11241100x8000000000000000547639Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:04.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ec4686d0213d11df2021-12-21 11:37:04.194root 11241100x8000000000000000547640Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:04.195{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a01dd8a0820eec462021-12-21 11:37:04.195root 11241100x8000000000000000547641Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:04.195{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.47064b5e80101f512021-12-21 11:37:04.195root 11241100x8000000000000000547642Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:04.195{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.62ad031a6c3cd4d22021-12-21 11:37:04.195root 11241100x8000000000000000547643Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:04.195{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.495878134a152ca82021-12-21 11:37:04.195root 11241100x8000000000000000547644Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:04.195{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5355e4a8b80d4e012021-12-21 11:37:04.195root 11241100x8000000000000000547645Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:04.195{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e70b25c9fff72f5e2021-12-21 11:37:04.195root 11241100x8000000000000000547646Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:04.195{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a247066da112e2572021-12-21 11:37:04.195root 11241100x8000000000000000547647Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:04.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.313b022b59cac0be2021-12-21 11:37:04.693root 11241100x8000000000000000547648Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:04.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b19893006c01ac452021-12-21 11:37:04.693root 11241100x8000000000000000547649Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:04.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.957bf53a98548d7b2021-12-21 11:37:04.693root 11241100x8000000000000000547650Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:04.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6ca3c3ae5927590d2021-12-21 11:37:04.693root 11241100x8000000000000000547651Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:04.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.446d8d76bbcec0ec2021-12-21 11:37:04.693root 11241100x8000000000000000547652Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:04.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.38643b76edb587522021-12-21 11:37:04.693root 11241100x8000000000000000547653Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:04.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.acdb5ec2ab0759e32021-12-21 11:37:04.693root 11241100x8000000000000000547654Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:04.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.92d340caa5d1031e2021-12-21 11:37:04.693root 11241100x8000000000000000547655Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:04.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1a5489f1e8d0f9822021-12-21 11:37:04.693root 11241100x8000000000000000547656Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:04.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c1021d7305a67c262021-12-21 11:37:04.693root 11241100x8000000000000000547657Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:04.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c03f223be4873ffb2021-12-21 11:37:04.693root 11241100x8000000000000000547658Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:04.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.06973f9f41c7a0522021-12-21 11:37:04.694root 11241100x8000000000000000547659Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:04.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6e9fe761f4315a1b2021-12-21 11:37:04.694root 11241100x8000000000000000547660Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:04.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6d1cd63dc59408ae2021-12-21 11:37:04.694root 11241100x8000000000000000547661Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:04.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3b795a03c15e46102021-12-21 11:37:04.694root 11241100x8000000000000000547662Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:04.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.55050d7c42b66d1c2021-12-21 11:37:04.694root 11241100x8000000000000000547663Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:04.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.bd1af38e71232c3e2021-12-21 11:37:04.694root 11241100x8000000000000000547664Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:04.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.16ffe153416acf842021-12-21 11:37:04.694root 11241100x8000000000000000547665Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:04.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2e988b0d6637f4c42021-12-21 11:37:04.694root 11241100x8000000000000000547666Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:04.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.44195650725665442021-12-21 11:37:04.694root 11241100x8000000000000000547667Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:04.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.93408873939cb3132021-12-21 11:37:04.694root 11241100x8000000000000000547668Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:04.695{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.dd3d5846ce200e182021-12-21 11:37:04.695root 11241100x8000000000000000547669Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:04.695{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.471757d13dedc3662021-12-21 11:37:04.695root 11241100x8000000000000000547670Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:04.695{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.342c49e959cf31e62021-12-21 11:37:04.695root 11241100x8000000000000000547671Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:04.695{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9a70080a47eba9332021-12-21 11:37:04.695root 11241100x8000000000000000547672Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:04.695{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.436911769475e3ab2021-12-21 11:37:04.695root 11241100x8000000000000000547673Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:04.695{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1e5d9e3f8e1d9a0e2021-12-21 11:37:04.695root 11241100x8000000000000000547674Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:04.695{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.76c578f3af4087622021-12-21 11:37:04.695root 11241100x8000000000000000547675Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:04.695{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9fa7f857926fc96f2021-12-21 11:37:04.695root 11241100x8000000000000000547676Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:04.696{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3eeac6d1009e738d2021-12-21 11:37:04.696root 11241100x8000000000000000547677Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:04.696{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.765ca66d5188f4d42021-12-21 11:37:04.696root 11241100x8000000000000000547678Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:04.696{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8a1c9fc8c6584fdd2021-12-21 11:37:04.696root 11241100x8000000000000000547679Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:04.696{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8a47c9c2381c1efc2021-12-21 11:37:04.696root 11241100x8000000000000000547680Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:04.696{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.226d2d2a03854f072021-12-21 11:37:04.696root 11241100x8000000000000000547681Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:04.696{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0000280b7809663e2021-12-21 11:37:04.696root 11241100x8000000000000000547682Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:04.696{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8851c9500f18bf952021-12-21 11:37:04.696root 11241100x8000000000000000547683Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:04.696{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d4f4b3a4606b2eec2021-12-21 11:37:04.696root 11241100x8000000000000000547684Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:04.697{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0f13f2b32a0bc32a2021-12-21 11:37:04.697root 11241100x8000000000000000547685Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:04.697{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7ffb09e7297524bc2021-12-21 11:37:04.697root 11241100x8000000000000000547686Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:04.697{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.cb5f1162efb7616c2021-12-21 11:37:04.697root 11241100x8000000000000000547687Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:04.697{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f6895ef11ec3609a2021-12-21 11:37:04.697root 11241100x8000000000000000547688Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:04.697{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b0ee6846077499a52021-12-21 11:37:04.697root 11241100x8000000000000000547689Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:04.697{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.983f664618b3f3802021-12-21 11:37:04.697root 11241100x8000000000000000547690Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:04.697{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.49b1aa68443b49a82021-12-21 11:37:04.697root 11241100x8000000000000000547691Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:04.697{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.767708c1c46cd50d2021-12-21 11:37:04.697root 11241100x8000000000000000547692Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:04.697{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ca3a21a504a398022021-12-21 11:37:04.697root 11241100x8000000000000000547693Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:04.698{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ef9c92c783c579002021-12-21 11:37:04.698root 11241100x8000000000000000547694Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:04.698{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.01cf34c5f5468d9b2021-12-21 11:37:04.698root 11241100x8000000000000000547695Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:05.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.611d92016d2c9c552021-12-21 11:37:05.193root 11241100x8000000000000000547696Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:05.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.751bd9ecebe6d85c2021-12-21 11:37:05.194root 11241100x8000000000000000547697Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:05.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.03c090306a62ae9d2021-12-21 11:37:05.194root 11241100x8000000000000000547698Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:05.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6027618438adf8af2021-12-21 11:37:05.194root 11241100x8000000000000000547699Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:05.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.eee969f766aa28032021-12-21 11:37:05.194root 11241100x8000000000000000547700Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:05.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.68a6535d8cc863072021-12-21 11:37:05.194root 11241100x8000000000000000547701Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:05.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.fa5f844b88434b882021-12-21 11:37:05.194root 11241100x8000000000000000547702Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:05.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a7b7e3495cc48d072021-12-21 11:37:05.194root 11241100x8000000000000000547703Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:05.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7c7f64a6308a5d802021-12-21 11:37:05.194root 11241100x8000000000000000547704Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:05.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3eb876809ce83a612021-12-21 11:37:05.194root 11241100x8000000000000000547705Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:05.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3aa524715955fcef2021-12-21 11:37:05.194root 11241100x8000000000000000547706Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:05.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.53c4895ebb4114e32021-12-21 11:37:05.194root 11241100x8000000000000000547707Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:05.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f0b733f95b3f82932021-12-21 11:37:05.194root 11241100x8000000000000000547708Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:05.195{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.49fc4f9f868a1b062021-12-21 11:37:05.195root 11241100x8000000000000000547709Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:05.195{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.21468c6783912a4c2021-12-21 11:37:05.195root 11241100x8000000000000000547710Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:05.195{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a2373474baf46aed2021-12-21 11:37:05.195root 11241100x8000000000000000547711Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:05.195{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.205c944df8924c122021-12-21 11:37:05.195root 11241100x8000000000000000547712Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:05.195{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6ce94f25fef14ff12021-12-21 11:37:05.195root 11241100x8000000000000000547713Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:05.195{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d5205148b752113b2021-12-21 11:37:05.195root 11241100x8000000000000000547714Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:05.195{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.13bd80de7c3397f72021-12-21 11:37:05.195root 11241100x8000000000000000547715Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:05.195{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c4331099ca4da24b2021-12-21 11:37:05.195root 11241100x8000000000000000547716Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:05.195{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.cff697a340d2b6be2021-12-21 11:37:05.195root 11241100x8000000000000000547717Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:05.196{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a8906c35a73c006a2021-12-21 11:37:05.196root 11241100x8000000000000000547718Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:05.196{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.50b7dc06db00a3092021-12-21 11:37:05.196root 11241100x8000000000000000547719Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:05.196{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.65861d478848c30c2021-12-21 11:37:05.196root 11241100x8000000000000000547720Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:05.196{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d360a536886654782021-12-21 11:37:05.196root 11241100x8000000000000000547721Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:05.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.28b04826f261f0972021-12-21 11:37:05.693root 11241100x8000000000000000547722Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:05.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6374995bb8841d5c2021-12-21 11:37:05.693root 11241100x8000000000000000547723Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:05.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0b3353519f8dbd2e2021-12-21 11:37:05.693root 11241100x8000000000000000547724Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:05.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1ff14cb63932c9c22021-12-21 11:37:05.693root 11241100x8000000000000000547725Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:05.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e93a13c68df2e4b72021-12-21 11:37:05.694root 11241100x8000000000000000547726Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:05.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0c4dc2e61b2d20ff2021-12-21 11:37:05.694root 11241100x8000000000000000547727Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:05.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.200507cd22dfb8f72021-12-21 11:37:05.694root 11241100x8000000000000000547728Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:05.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9191986ecf59ff3c2021-12-21 11:37:05.694root 11241100x8000000000000000547729Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:05.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.464bbf16068384f42021-12-21 11:37:05.694root 11241100x8000000000000000547730Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:05.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2dbecd1a1c793f822021-12-21 11:37:05.694root 11241100x8000000000000000547731Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:05.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.14fe09b6080f16b72021-12-21 11:37:05.694root 11241100x8000000000000000547732Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:05.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3f76b3a5ba90a8452021-12-21 11:37:05.694root 11241100x8000000000000000547733Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:05.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.fa510885851506142021-12-21 11:37:05.694root 11241100x8000000000000000547734Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:05.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2b7dcb6655f07be92021-12-21 11:37:05.694root 11241100x8000000000000000547735Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:05.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9d63b15fa8a380cb2021-12-21 11:37:05.694root 11241100x8000000000000000547736Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:05.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b8f23a925f50e8072021-12-21 11:37:05.694root 11241100x8000000000000000547737Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:05.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b2c9d62a50e0906f2021-12-21 11:37:05.694root 11241100x8000000000000000547738Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:05.695{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.43ad0baf47a454932021-12-21 11:37:05.695root 11241100x8000000000000000547739Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:05.695{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.308944c977e5aee72021-12-21 11:37:05.695root 11241100x8000000000000000547740Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:05.695{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.bb8038acb1cc6ea72021-12-21 11:37:05.695root 11241100x8000000000000000547741Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:05.695{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9a417d096c902da92021-12-21 11:37:05.695root 11241100x8000000000000000547742Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:05.695{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1abb03319a2188ff2021-12-21 11:37:05.695root 11241100x8000000000000000547743Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:05.695{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5f5f028ac9619ed62021-12-21 11:37:05.695root 11241100x8000000000000000547744Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:05.695{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.070fc4dc30ad95432021-12-21 11:37:05.695root 11241100x8000000000000000547745Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:05.695{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1cf0855f1c76a9af2021-12-21 11:37:05.695root 11241100x8000000000000000547746Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:05.695{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.fbd045595dcf5f6e2021-12-21 11:37:05.695root 11241100x8000000000000000547747Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:06.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3b8f4edd02e8a9bc2021-12-21 11:37:06.193root 11241100x8000000000000000547748Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:06.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.400197c0de4aea4c2021-12-21 11:37:06.194root 11241100x8000000000000000547749Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:06.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.54c195d962ce7c652021-12-21 11:37:06.194root 11241100x8000000000000000547750Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:06.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5cc4900dbf594b902021-12-21 11:37:06.194root 11241100x8000000000000000547751Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:06.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ceb1260be049a7052021-12-21 11:37:06.194root 11241100x8000000000000000547752Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:06.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.974baadd27c1015a2021-12-21 11:37:06.194root 11241100x8000000000000000547753Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:06.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.621f3d06ce69bafc2021-12-21 11:37:06.194root 11241100x8000000000000000547754Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:06.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f69df092fa9848fc2021-12-21 11:37:06.194root 11241100x8000000000000000547755Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:06.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d47daf8812c8904a2021-12-21 11:37:06.194root 11241100x8000000000000000547756Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:06.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.67044db5d939774b2021-12-21 11:37:06.194root 11241100x8000000000000000547757Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:06.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.167de544b3154ddc2021-12-21 11:37:06.194root 11241100x8000000000000000547758Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:06.195{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b225383f4019dd1f2021-12-21 11:37:06.195root 11241100x8000000000000000547759Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:06.195{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7fe343db75a5cec12021-12-21 11:37:06.195root 11241100x8000000000000000547760Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:06.195{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.79a6f771c1f490ad2021-12-21 11:37:06.195root 11241100x8000000000000000547761Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:06.195{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.00eee6fc1ce546212021-12-21 11:37:06.195root 11241100x8000000000000000547762Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:06.195{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6f59e45bf065c1722021-12-21 11:37:06.195root 11241100x8000000000000000547763Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:06.195{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7bb2667aa3d978fe2021-12-21 11:37:06.195root 11241100x8000000000000000547764Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:06.195{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1bed024af759aa312021-12-21 11:37:06.195root 11241100x8000000000000000547765Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:06.196{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3d0c6be1e30f40162021-12-21 11:37:06.196root 11241100x8000000000000000547766Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:06.196{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.135b4e0204ea5c072021-12-21 11:37:06.196root 11241100x8000000000000000547767Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:06.196{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e19f4826dcb0d2932021-12-21 11:37:06.196root 11241100x8000000000000000547768Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:06.196{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8aeba178bfafb7012021-12-21 11:37:06.196root 11241100x8000000000000000547769Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:06.196{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.30e25c651eb51d282021-12-21 11:37:06.196root 11241100x8000000000000000547770Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:06.196{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a23fdff30c9ca60c2021-12-21 11:37:06.196root 11241100x8000000000000000547771Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:06.196{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7b33923bd8f550122021-12-21 11:37:06.196root 11241100x8000000000000000547772Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:06.196{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b897e334bc7e73892021-12-21 11:37:06.196root 11241100x8000000000000000547773Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:06.326{ec2b6afe-95d2-61c1-3038-b84203560000}5272/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/spool/splunk/tracker.log2021-12-21 11:37:06.326root 11241100x8000000000000000547774Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:06.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.29131b1e4f55d6012021-12-21 11:37:06.693root 11241100x8000000000000000547775Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:06.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8672dd8ffe49599d2021-12-21 11:37:06.693root 11241100x8000000000000000547776Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:06.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.250fc33e7a14c84e2021-12-21 11:37:06.693root 11241100x8000000000000000547777Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:06.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9f05b8d39380f15c2021-12-21 11:37:06.693root 11241100x8000000000000000547778Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:06.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.39e58e2f95f232bc2021-12-21 11:37:06.693root 11241100x8000000000000000547779Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:06.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.41ec4049a9477f962021-12-21 11:37:06.693root 11241100x8000000000000000547780Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:06.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2658fda1d3b2dab02021-12-21 11:37:06.693root 11241100x8000000000000000547781Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:06.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4cc7dd610208fb4d2021-12-21 11:37:06.694root 11241100x8000000000000000547782Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:06.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.fbd579b6c869fbbd2021-12-21 11:37:06.694root 11241100x8000000000000000547783Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:06.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.674e717cf69a545f2021-12-21 11:37:06.694root 11241100x8000000000000000547784Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:06.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.fda97038703901eb2021-12-21 11:37:06.694root 11241100x8000000000000000547785Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:06.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d175ffcff53e95412021-12-21 11:37:06.694root 11241100x8000000000000000547786Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:06.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a6df96787659de992021-12-21 11:37:06.694root 11241100x8000000000000000547787Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:06.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c5271bb3cd16a56d2021-12-21 11:37:06.694root 11241100x8000000000000000547788Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:06.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.cf85be0d5eca0ec32021-12-21 11:37:06.694root 11241100x8000000000000000547789Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:06.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.39caa36f3106854b2021-12-21 11:37:06.694root 11241100x8000000000000000547790Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:06.695{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2925fcc527476a6e2021-12-21 11:37:06.695root 11241100x8000000000000000547791Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:06.695{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.bbd2302c49b945a92021-12-21 11:37:06.695root 11241100x8000000000000000547792Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:06.695{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c1f31d7a097f4bcb2021-12-21 11:37:06.695root 11241100x8000000000000000547793Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:06.695{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c15412f2fec225f22021-12-21 11:37:06.695root 11241100x8000000000000000547794Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:06.695{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6f10eccac41f567c2021-12-21 11:37:06.695root 11241100x8000000000000000547795Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:06.695{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7bdb4e75187fa55a2021-12-21 11:37:06.695root 11241100x8000000000000000547796Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:06.695{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.505c946bab0f211d2021-12-21 11:37:06.695root 11241100x8000000000000000547797Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:06.695{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.457a0435d780512c2021-12-21 11:37:06.695root 11241100x8000000000000000547798Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:06.696{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.44e0e30b9fb234432021-12-21 11:37:06.696root 11241100x8000000000000000547799Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:06.696{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e049ff0b9ca91e042021-12-21 11:37:06.696root 11241100x8000000000000000547800Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:06.696{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5346e9f96cfa80a42021-12-21 11:37:06.696root 11241100x8000000000000000547801Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:06.696{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.34faa78a5631bcaf2021-12-21 11:37:06.696root 11241100x8000000000000000547802Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:07.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1ffa1aaf8ef49f512021-12-21 11:37:07.193root 11241100x8000000000000000547803Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:07.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6696ffbd93fc93392021-12-21 11:37:07.193root 11241100x8000000000000000547804Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:07.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0e05207d3892d8882021-12-21 11:37:07.193root 11241100x8000000000000000547805Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:07.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e32976690002ff2c2021-12-21 11:37:07.193root 11241100x8000000000000000547806Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:07.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6cddbfdfbc18d38b2021-12-21 11:37:07.194root 11241100x8000000000000000547807Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:07.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4a9c53febb2924992021-12-21 11:37:07.194root 11241100x8000000000000000547808Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:07.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8e119077988a3dbf2021-12-21 11:37:07.194root 11241100x8000000000000000547809Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:07.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2fa51bd1accae1e82021-12-21 11:37:07.194root 11241100x8000000000000000547810Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:07.195{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.bdf859a57e76487a2021-12-21 11:37:07.195root 11241100x8000000000000000547811Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:07.195{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e40ec61f31beac5b2021-12-21 11:37:07.195root 11241100x8000000000000000547812Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:07.195{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.452ef9d47349c9622021-12-21 11:37:07.195root 11241100x8000000000000000547813Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:07.195{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8ef578aeea07ac2d2021-12-21 11:37:07.195root 11241100x8000000000000000547814Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:07.195{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c938dc60dd1822152021-12-21 11:37:07.195root 11241100x8000000000000000547815Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:07.195{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.24a73bd3201914c42021-12-21 11:37:07.195root 11241100x8000000000000000547816Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:07.195{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8c8503dc45012c3d2021-12-21 11:37:07.195root 11241100x8000000000000000547817Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:07.195{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3c101f2393a900562021-12-21 11:37:07.195root 11241100x8000000000000000547818Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:07.195{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6a9834b4916be4b62021-12-21 11:37:07.195root 11241100x8000000000000000547819Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:07.195{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.256399ecff8608d72021-12-21 11:37:07.195root 11241100x8000000000000000547820Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:07.196{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9ae030488aee00392021-12-21 11:37:07.196root 11241100x8000000000000000547821Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:07.196{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4cf2be0d2f5aeeed2021-12-21 11:37:07.196root 11241100x8000000000000000547822Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:07.196{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4e259fdeeedd0d462021-12-21 11:37:07.196root 11241100x8000000000000000547823Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:07.196{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.40478f1a2d63d2412021-12-21 11:37:07.196root 11241100x8000000000000000547824Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:07.196{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.986964b5677276912021-12-21 11:37:07.196root 11241100x8000000000000000547825Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:07.196{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b3c7e618d7a79bac2021-12-21 11:37:07.196root 11241100x8000000000000000547826Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:07.196{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.05daa78d49ceb8dc2021-12-21 11:37:07.196root 11241100x8000000000000000547827Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:07.196{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d32966f3658207ca2021-12-21 11:37:07.196root 11241100x8000000000000000547828Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:07.196{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7d8a4026676765a42021-12-21 11:37:07.196root 11241100x8000000000000000547829Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:07.197{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.700148f3be37c92a2021-12-21 11:37:07.197root 11241100x8000000000000000547830Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:07.197{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c2129cf1838d7e1f2021-12-21 11:37:07.197root 11241100x8000000000000000547831Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:07.197{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c91e0015ff0b92c22021-12-21 11:37:07.197root 11241100x8000000000000000547832Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:07.692{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f3c67b04a1f366372021-12-21 11:37:07.692root 11241100x8000000000000000547833Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:07.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.88dbdaea4047c6ac2021-12-21 11:37:07.693root 11241100x8000000000000000547834Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:07.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.fd885dea4bca95322021-12-21 11:37:07.693root 11241100x8000000000000000547835Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:07.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f4a4637f90f10c102021-12-21 11:37:07.693root 11241100x8000000000000000547836Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:07.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.316a59d8f38970082021-12-21 11:37:07.693root 11241100x8000000000000000547837Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:07.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f078b789d4392de02021-12-21 11:37:07.693root 11241100x8000000000000000547838Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:07.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a14544c519ed9d002021-12-21 11:37:07.693root 11241100x8000000000000000547839Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:07.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f04091cd5654a54a2021-12-21 11:37:07.693root 11241100x8000000000000000547840Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:07.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.679e245b6d22f39e2021-12-21 11:37:07.693root 11241100x8000000000000000547841Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:07.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.cb4737a73960feb12021-12-21 11:37:07.693root 11241100x8000000000000000547842Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:07.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d82930b4a685a5ed2021-12-21 11:37:07.694root 11241100x8000000000000000547843Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:07.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5cf4a461700e7ea02021-12-21 11:37:07.694root 11241100x8000000000000000547844Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:07.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.bbb865342804a2b52021-12-21 11:37:07.694root 11241100x8000000000000000547845Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:07.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.32fcd6e92fa0df212021-12-21 11:37:07.694root 11241100x8000000000000000547846Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:07.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.610fdf4ff0d6bb262021-12-21 11:37:07.694root 11241100x8000000000000000547847Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:07.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a5d0a284db06397e2021-12-21 11:37:07.694root 11241100x8000000000000000547848Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:07.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2bc2b41c4752d29c2021-12-21 11:37:07.694root 11241100x8000000000000000547849Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:07.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0fb219286a9503322021-12-21 11:37:07.694root 11241100x8000000000000000547850Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:07.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f2032d627e5066592021-12-21 11:37:07.694root 11241100x8000000000000000547851Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:07.695{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.35e1eef15b381f922021-12-21 11:37:07.695root 11241100x8000000000000000547852Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:07.695{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f9837136945b32962021-12-21 11:37:07.695root 11241100x8000000000000000547853Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:07.695{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f4af698be4240abf2021-12-21 11:37:07.695root 11241100x8000000000000000547854Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:07.695{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.71a1a0b7725336ef2021-12-21 11:37:07.695root 11241100x8000000000000000547855Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:07.695{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1aeeef675230c3f82021-12-21 11:37:07.695root 11241100x8000000000000000547856Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:07.695{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4dc12dcafa8adc022021-12-21 11:37:07.695root 11241100x8000000000000000547857Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:07.695{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f10cd5412ab53a282021-12-21 11:37:07.695root 11241100x8000000000000000547858Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:07.695{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8f6d73843b96e7562021-12-21 11:37:07.695root 11241100x8000000000000000547859Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:07.695{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e7a653675697013c2021-12-21 11:37:07.695root 11241100x8000000000000000547860Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:07.695{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c93d99be84da27f42021-12-21 11:37:07.695root 11241100x8000000000000000547861Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:07.695{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.77c36b7d6d45c5a62021-12-21 11:37:07.695root 11241100x8000000000000000547862Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:07.695{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6534880f5c3c73172021-12-21 11:37:07.695root 11241100x8000000000000000547863Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:07.695{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b0e228d11eb80cab2021-12-21 11:37:07.695root 11241100x8000000000000000547864Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:07.695{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f0aeae9c8bfbc6292021-12-21 11:37:07.695root 11241100x8000000000000000547865Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:07.696{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.50a78b58e568498d2021-12-21 11:37:07.696root 11241100x8000000000000000547866Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:07.696{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d1f7f6fbacf399842021-12-21 11:37:07.696root 11241100x8000000000000000547867Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:07.696{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ecc235acb9b50bbc2021-12-21 11:37:07.696root 11241100x8000000000000000547868Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:07.696{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.55045cd69236fb942021-12-21 11:37:07.696root 11241100x8000000000000000547869Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:07.696{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7d076e47136451952021-12-21 11:37:07.696root 11241100x8000000000000000547870Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:07.696{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6a1563e534c8437a2021-12-21 11:37:07.696root 11241100x8000000000000000547871Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:07.696{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.491337f2a421f6cc2021-12-21 11:37:07.696root 11241100x8000000000000000547872Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:07.696{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b1ab0ae494067f3b2021-12-21 11:37:07.696root 11241100x8000000000000000547873Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:07.696{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a3da2829c5796f4a2021-12-21 11:37:07.696root 11241100x8000000000000000547874Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:07.696{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2264c4ac4fe6df632021-12-21 11:37:07.696root 11241100x8000000000000000547875Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:07.696{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.113b56c43b698a8e2021-12-21 11:37:07.696root 11241100x8000000000000000547876Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:07.696{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.62d280ebfae4941e2021-12-21 11:37:07.696root 11241100x8000000000000000547877Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:07.696{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.bb5b002d954705452021-12-21 11:37:07.696root 11241100x8000000000000000547878Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:07.696{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.82a9e00cb5d30af12021-12-21 11:37:07.696root 11241100x8000000000000000547879Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:07.696{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b3b345cf1c4f150c2021-12-21 11:37:07.696root 11241100x8000000000000000547880Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:07.696{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6fc3cc870962a2192021-12-21 11:37:07.696root 11241100x8000000000000000547881Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:07.697{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.61a40b02cc5d6e8e2021-12-21 11:37:07.697root 11241100x8000000000000000547882Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:07.697{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.df6176f59bf453ea2021-12-21 11:37:07.697root 11241100x8000000000000000547883Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:07.697{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.40993bfae2363f2b2021-12-21 11:37:07.697root 11241100x8000000000000000547884Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:07.697{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1e32251e4e6ebbaf2021-12-21 11:37:07.697root 11241100x8000000000000000547885Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:07.697{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.04d9842d4cc91f442021-12-21 11:37:07.697root 11241100x8000000000000000547886Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:08.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.dc0ecf2d0dfb716b2021-12-21 11:37:08.193root 11241100x8000000000000000547887Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:08.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.88a1f6c9a8cb9e9a2021-12-21 11:37:08.193root 11241100x8000000000000000547888Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:08.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.eb8be7c26f51b8d92021-12-21 11:37:08.193root 11241100x8000000000000000547889Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:08.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d12068f0560ca92f2021-12-21 11:37:08.193root 11241100x8000000000000000547890Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:08.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2d1d3d2c7bf31c0d2021-12-21 11:37:08.193root 11241100x8000000000000000547891Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:08.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ba6db666442d5edd2021-12-21 11:37:08.193root 11241100x8000000000000000547892Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:08.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4948d3054c05eefd2021-12-21 11:37:08.193root 11241100x8000000000000000547893Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:08.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.25d5f9b3305403932021-12-21 11:37:08.193root 11241100x8000000000000000547894Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:08.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7b77aff5e475c8bf2021-12-21 11:37:08.193root 11241100x8000000000000000547895Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:08.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4a098b74a00b18742021-12-21 11:37:08.193root 11241100x8000000000000000547896Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:08.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.bf9069ae2d0059812021-12-21 11:37:08.193root 11241100x8000000000000000547897Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:08.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.866b1de7f632d6242021-12-21 11:37:08.193root 11241100x8000000000000000547898Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:08.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.cbfa33ec2962dfe02021-12-21 11:37:08.194root 11241100x8000000000000000547899Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:08.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ac29875cb9f19afd2021-12-21 11:37:08.194root 11241100x8000000000000000547900Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:08.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ec4c446bcb94d2ec2021-12-21 11:37:08.194root 11241100x8000000000000000547901Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:08.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.958f3cee159525422021-12-21 11:37:08.194root 11241100x8000000000000000547902Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:08.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.bc40a525fa00264c2021-12-21 11:37:08.194root 11241100x8000000000000000547903Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:08.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.707e3bc18d593c272021-12-21 11:37:08.194root 11241100x8000000000000000547904Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:08.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.13383549a5ac22832021-12-21 11:37:08.194root 11241100x8000000000000000547905Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:08.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b2b2b601023b6be22021-12-21 11:37:08.194root 11241100x8000000000000000547906Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:08.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3eaed15b0d39f8a22021-12-21 11:37:08.194root 11241100x8000000000000000547907Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:08.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.504a701984ed73aa2021-12-21 11:37:08.194root 11241100x8000000000000000547908Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:08.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.64496ab2288cbb542021-12-21 11:37:08.194root 11241100x8000000000000000547909Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:08.195{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9de84af0508deb702021-12-21 11:37:08.195root 11241100x8000000000000000547910Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:08.195{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.bafb828e1366a8092021-12-21 11:37:08.195root 11241100x8000000000000000547911Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:08.195{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4a96fafcc4e665d32021-12-21 11:37:08.195root 11241100x8000000000000000547912Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:08.195{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.677c5318d14ca8f82021-12-21 11:37:08.195root 11241100x8000000000000000547913Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:08.195{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f36b87f8f8c872ac2021-12-21 11:37:08.195root 11241100x8000000000000000547914Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:08.195{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c161a3c035271a9e2021-12-21 11:37:08.195root 11241100x8000000000000000547915Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:08.195{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.47c849154c62b0ea2021-12-21 11:37:08.195root 11241100x8000000000000000547916Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:08.195{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b1e6413817bdf9bb2021-12-21 11:37:08.195root 11241100x8000000000000000547917Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:08.195{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.500ea0c93fdf007d2021-12-21 11:37:08.195root 11241100x8000000000000000547918Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:08.196{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e977d77cb52f2c462021-12-21 11:37:08.196root 11241100x8000000000000000547919Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:08.196{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b0900f36c7b609882021-12-21 11:37:08.196root 11241100x8000000000000000547920Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:08.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6fdf8b8835f7fede2021-12-21 11:37:08.693root 11241100x8000000000000000547921Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:08.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.58bd53ad8e00357d2021-12-21 11:37:08.693root 11241100x8000000000000000547922Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:08.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.021672a9c9d42d442021-12-21 11:37:08.693root 11241100x8000000000000000547923Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:08.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.17155c9f0fc2ed0a2021-12-21 11:37:08.693root 11241100x8000000000000000547924Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:08.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f7d73d1e80281ceb2021-12-21 11:37:08.694root 11241100x8000000000000000547925Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:08.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.014e86efcc97872c2021-12-21 11:37:08.694root 11241100x8000000000000000547926Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:08.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.774c360a17806f9e2021-12-21 11:37:08.694root 11241100x8000000000000000547927Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:08.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.694e6ceff2af15ab2021-12-21 11:37:08.694root 11241100x8000000000000000547928Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:08.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.600010d24246aef52021-12-21 11:37:08.694root 11241100x8000000000000000547929Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:08.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.69041ea4307c59222021-12-21 11:37:08.694root 11241100x8000000000000000547930Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:08.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ca366865d620cfca2021-12-21 11:37:08.694root 11241100x8000000000000000547931Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:08.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e630201a59a0b6da2021-12-21 11:37:08.694root 11241100x8000000000000000547932Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:08.695{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e18b18976cfaaefe2021-12-21 11:37:08.695root 11241100x8000000000000000547933Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:08.695{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.976b251402bf3a9d2021-12-21 11:37:08.695root 11241100x8000000000000000547934Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:08.695{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3450fdc9f2a8a9e92021-12-21 11:37:08.695root 11241100x8000000000000000547935Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:08.695{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.78c53ec8449641e02021-12-21 11:37:08.695root 11241100x8000000000000000547936Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:08.695{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8af7162f06e6b89f2021-12-21 11:37:08.695root 11241100x8000000000000000547937Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:08.695{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.65d43388647814892021-12-21 11:37:08.695root 11241100x8000000000000000547938Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:08.695{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.caa08824ff318a8e2021-12-21 11:37:08.695root 11241100x8000000000000000547939Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:08.695{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.010d01df295877332021-12-21 11:37:08.695root 11241100x8000000000000000547940Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:08.695{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8014207d8659c6be2021-12-21 11:37:08.695root 11241100x8000000000000000547941Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:08.695{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f6527b2c2f7fa2882021-12-21 11:37:08.695root 11241100x8000000000000000547942Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:08.695{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2970d85abcf4f99d2021-12-21 11:37:08.695root 11241100x8000000000000000547943Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:08.695{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.fa659f8f7ad946812021-12-21 11:37:08.695root 11241100x8000000000000000547944Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:08.696{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.218d75519469d2ff2021-12-21 11:37:08.696root 11241100x8000000000000000547945Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:08.696{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7e1dc2ba5d34561f2021-12-21 11:37:08.696root 11241100x8000000000000000547946Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:08.696{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.75ced119ebd103532021-12-21 11:37:08.696root 354300x8000000000000000547947Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:09.062{ec2b6afe-95d9-61c1-5175-3a0400000000}5346/opt/splunkforwarder/etc/apps/Splunk_TA_stream/linux_x86_64/bin/streamfwdroottcptruefalse10.0.1.25-48804-false10.0.1.12-8000- 11241100x8000000000000000547948Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:09.063{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b29761707bb6bd3d2021-12-21 11:37:09.063root 11241100x8000000000000000547949Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:09.063{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6e537d5cbfb6db7c2021-12-21 11:37:09.063root 11241100x8000000000000000547950Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:09.063{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a782e067a31f6ab02021-12-21 11:37:09.063root 11241100x8000000000000000547951Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:09.063{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5e1b6f8b9aedd1922021-12-21 11:37:09.063root 11241100x8000000000000000547952Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:09.063{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.134b02058a0b09bc2021-12-21 11:37:09.063root 11241100x8000000000000000547953Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:09.064{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3829c0482c239ac42021-12-21 11:37:09.064root 11241100x8000000000000000547954Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:09.064{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e727ae2a1e5340a72021-12-21 11:37:09.064root 11241100x8000000000000000547955Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:09.064{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3bf041d7baf2225c2021-12-21 11:37:09.064root 11241100x8000000000000000547956Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:09.064{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.42dff79844fa0ede2021-12-21 11:37:09.064root 11241100x8000000000000000547957Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:09.064{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6a652a3dcbbadbd72021-12-21 11:37:09.064root 11241100x8000000000000000547958Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:09.064{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d82681a563bc4ae72021-12-21 11:37:09.064root 11241100x8000000000000000547959Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:09.064{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.38831a4d3fad3c2d2021-12-21 11:37:09.064root 11241100x8000000000000000547960Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:09.064{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5a273857675de1642021-12-21 11:37:09.064root 11241100x8000000000000000547961Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:09.064{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0d0e04fc5c16d59f2021-12-21 11:37:09.064root 11241100x8000000000000000547962Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:09.064{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6cec9ea83a70027b2021-12-21 11:37:09.064root 11241100x8000000000000000547963Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:09.064{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ec3dc1244266a4ee2021-12-21 11:37:09.064root 11241100x8000000000000000547964Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:09.064{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.957207da41dc867e2021-12-21 11:37:09.064root 11241100x8000000000000000547965Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:09.064{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.591a6895579163262021-12-21 11:37:09.064root 11241100x8000000000000000547966Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:09.064{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.28ac64eb063315eb2021-12-21 11:37:09.064root 11241100x8000000000000000547967Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:09.064{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8c0539d4ad41e18e2021-12-21 11:37:09.064root 11241100x8000000000000000547968Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:09.065{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3c0597443e5632fa2021-12-21 11:37:09.065root 11241100x8000000000000000547969Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:09.065{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.395dd7c4d9ed7e772021-12-21 11:37:09.065root 11241100x8000000000000000547970Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:09.065{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4b40277afb77350d2021-12-21 11:37:09.065root 11241100x8000000000000000547971Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:09.065{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4f82459a691642972021-12-21 11:37:09.065root 11241100x8000000000000000547972Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:09.065{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6dc9708ac1d9c6f72021-12-21 11:37:09.065root 11241100x8000000000000000547973Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:09.065{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.21535ab1026d21e52021-12-21 11:37:09.065root 11241100x8000000000000000547974Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:09.065{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.df418b659cd04d5b2021-12-21 11:37:09.065root 11241100x8000000000000000547975Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:09.065{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9b28b881eb596f852021-12-21 11:37:09.065root 23542300x8000000000000000547976Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:09.327{ec2b6afe-95d2-61c1-3038-b84203560000}5272root/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/spool/splunk/tracker.log--- 11241100x8000000000000000547977Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:09.329{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.cbcc552a9ac8a61a2021-12-21 11:37:09.329root 11241100x8000000000000000547978Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:09.329{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.eaf6aaaf59c8fae02021-12-21 11:37:09.329root 11241100x8000000000000000547979Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:09.330{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.466e465efb4ce2632021-12-21 11:37:09.330root 11241100x8000000000000000547980Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:09.330{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d0136723693b9e962021-12-21 11:37:09.330root 11241100x8000000000000000547981Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:09.330{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a4cf5828477c20e12021-12-21 11:37:09.330root 11241100x8000000000000000547982Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:09.330{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.92df5f1c3067c9df2021-12-21 11:37:09.330root 11241100x8000000000000000547983Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:09.330{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.839cd69dbce61eb82021-12-21 11:37:09.330root 11241100x8000000000000000547984Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:09.331{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8fa8159cfee1408e2021-12-21 11:37:09.331root 11241100x8000000000000000547985Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:09.331{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f28b390d6941d4922021-12-21 11:37:09.331root 11241100x8000000000000000547986Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:09.331{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5cbf20f44cf929cd2021-12-21 11:37:09.331root 11241100x8000000000000000547987Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:09.331{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.da4b2a9793d91c652021-12-21 11:37:09.331root 11241100x8000000000000000547988Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:09.331{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d2fc82f10d5b8a7e2021-12-21 11:37:09.331root 11241100x8000000000000000547989Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:09.331{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5ffd53fd611317392021-12-21 11:37:09.331root 11241100x8000000000000000547990Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:09.331{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b1dd2fa36137ee1f2021-12-21 11:37:09.331root 11241100x8000000000000000547991Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:09.331{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5361656f4593088c2021-12-21 11:37:09.331root 11241100x8000000000000000547992Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:09.331{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7b61c15b9dfc06a52021-12-21 11:37:09.331root 11241100x8000000000000000547993Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:09.331{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.97de70052acba5b62021-12-21 11:37:09.331root 11241100x8000000000000000547994Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:09.331{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.16b046193b97fca32021-12-21 11:37:09.331root 11241100x8000000000000000547995Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:09.331{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6c0c973e37fdcba42021-12-21 11:37:09.331root 11241100x8000000000000000547996Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:09.332{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8a9dadfda261315c2021-12-21 11:37:09.332root 11241100x8000000000000000547997Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:09.332{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.26ec62bb6205b4152021-12-21 11:37:09.332root 11241100x8000000000000000547998Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:09.332{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f6fb169d482206432021-12-21 11:37:09.332root 11241100x8000000000000000547999Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:09.332{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1260050924966f532021-12-21 11:37:09.332root 11241100x8000000000000000548000Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:09.332{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0729d5d25a3323182021-12-21 11:37:09.332root 11241100x8000000000000000548001Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:09.332{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.39f56a4eb618cd012021-12-21 11:37:09.332root 11241100x8000000000000000548002Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:09.332{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8b55f58c2f72bd182021-12-21 11:37:09.332root 11241100x8000000000000000548003Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:09.332{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.744339e7be84e14e2021-12-21 11:37:09.332root 11241100x8000000000000000548004Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:09.332{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.cfc77dc7211bdd452021-12-21 11:37:09.332root 11241100x8000000000000000548005Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:09.332{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1d7b022d7e66eeb32021-12-21 11:37:09.332root 11241100x8000000000000000548006Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:09.332{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.be5ff617988af79f2021-12-21 11:37:09.332root 11241100x8000000000000000548007Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:09.332{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a99c237571cd649c2021-12-21 11:37:09.332root 11241100x8000000000000000548008Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:09.333{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f61004f0fcbf3d642021-12-21 11:37:09.333root 11241100x8000000000000000548009Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:09.333{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3069461bbd8fac1e2021-12-21 11:37:09.333root 11241100x8000000000000000548010Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:09.333{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0eedf04d4d3778132021-12-21 11:37:09.333root 11241100x8000000000000000548011Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:09.333{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.427996dddbc04ad32021-12-21 11:37:09.333root 11241100x8000000000000000548012Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:09.333{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.afb41b8cce87c2032021-12-21 11:37:09.333root 11241100x8000000000000000548013Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:09.333{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.871514d5d38b6dff2021-12-21 11:37:09.333root 11241100x8000000000000000548014Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:09.333{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1fbc85e5824bcaa32021-12-21 11:37:09.333root 11241100x8000000000000000548015Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:09.333{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2258a11999dc972d2021-12-21 11:37:09.333root 11241100x8000000000000000548016Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:09.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.57558be98c47b87b2021-12-21 11:37:09.693root 11241100x8000000000000000548017Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:09.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.77c75b73d2fe27ba2021-12-21 11:37:09.693root 11241100x8000000000000000548018Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:09.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1de5262cd66948e72021-12-21 11:37:09.693root 11241100x8000000000000000548019Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:09.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.bc44f2ce40c8a7532021-12-21 11:37:09.693root 11241100x8000000000000000548020Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:09.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6e508ea494c71a5d2021-12-21 11:37:09.693root 11241100x8000000000000000548021Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:09.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f6a16850af16d8342021-12-21 11:37:09.693root 11241100x8000000000000000548022Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:09.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.168a6fe259cfbb432021-12-21 11:37:09.693root 11241100x8000000000000000548023Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:09.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1c3cee8ba16fea782021-12-21 11:37:09.693root 11241100x8000000000000000548024Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:09.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9b7701dfa3f087852021-12-21 11:37:09.693root 11241100x8000000000000000548025Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:09.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.bb7c9104386a37fd2021-12-21 11:37:09.693root 11241100x8000000000000000548026Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:09.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c20938061c65c75f2021-12-21 11:37:09.693root 11241100x8000000000000000548027Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:09.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.48fbeee8911b63d32021-12-21 11:37:09.693root 11241100x8000000000000000548028Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:09.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4a73404375d2fc8d2021-12-21 11:37:09.694root 11241100x8000000000000000548029Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:09.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d4f00db63e1c33462021-12-21 11:37:09.694root 11241100x8000000000000000548030Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:09.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a47eba8daf55c3042021-12-21 11:37:09.694root 11241100x8000000000000000548031Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:09.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d91f4ad45ced113a2021-12-21 11:37:09.694root 11241100x8000000000000000548032Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:09.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.82fe0440682316bd2021-12-21 11:37:09.694root 11241100x8000000000000000548033Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:09.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.89828d2cbf1a7e042021-12-21 11:37:09.694root 11241100x8000000000000000548034Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:09.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.be578d1d5dde32e22021-12-21 11:37:09.694root 11241100x8000000000000000548035Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:09.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7cc89d1868c309cb2021-12-21 11:37:09.694root 11241100x8000000000000000548036Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:09.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7f70b67efc92b9a42021-12-21 11:37:09.694root 11241100x8000000000000000548037Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:09.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.16b7bbaf8a78e3402021-12-21 11:37:09.694root 11241100x8000000000000000548038Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:09.695{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3ef91220be0445a52021-12-21 11:37:09.695root 11241100x8000000000000000548039Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:09.695{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4ab874b80dcc1c6d2021-12-21 11:37:09.695root 11241100x8000000000000000548040Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:09.695{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f3d1dd0a9afffc502021-12-21 11:37:09.695root 11241100x8000000000000000548041Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:09.695{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c7d7308017de37482021-12-21 11:37:09.695root 11241100x8000000000000000548042Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:09.695{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7a32b0f084c3ce652021-12-21 11:37:09.695root 11241100x8000000000000000548043Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:09.695{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8495a7b252053b5d2021-12-21 11:37:09.695root 11241100x8000000000000000548044Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:09.695{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c068b73864ee59fc2021-12-21 11:37:09.695root 11241100x8000000000000000548045Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:09.696{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6e3dd095b67e87c42021-12-21 11:37:09.696root 11241100x8000000000000000548046Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:09.696{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.dc742e7eb44fd3552021-12-21 11:37:09.696root 11241100x8000000000000000548047Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:09.696{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8c0e780cced38f9a2021-12-21 11:37:09.696root 11241100x8000000000000000548048Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:09.696{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f60e881d94f05ba72021-12-21 11:37:09.696root 11241100x8000000000000000548049Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:09.696{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b2e38d92d3c716892021-12-21 11:37:09.696root 11241100x8000000000000000548050Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:09.696{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.144e51805d1eb4222021-12-21 11:37:09.696root 11241100x8000000000000000548051Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:09.696{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8de8052b2f3fa9cc2021-12-21 11:37:09.696root 11241100x8000000000000000548052Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:09.696{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0d8c9addb80a05042021-12-21 11:37:09.696root 11241100x8000000000000000548053Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:09.696{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5788aa940b25e4c72021-12-21 11:37:09.696root 11241100x8000000000000000548054Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:09.696{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7e927c1bfe631e0a2021-12-21 11:37:09.696root 11241100x8000000000000000548055Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:09.696{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8a4b6084e1175af02021-12-21 11:37:09.696root 11241100x8000000000000000548056Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:09.696{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6cde3724b1ea218d2021-12-21 11:37:09.696root 11241100x8000000000000000548057Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:09.696{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.fc2db537a477a0472021-12-21 11:37:09.696root 11241100x8000000000000000548058Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:09.696{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.83d4f86f1fa64b4a2021-12-21 11:37:09.696root 11241100x8000000000000000548059Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:09.696{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c004221e8792d6f92021-12-21 11:37:09.696root 11241100x8000000000000000548060Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:09.696{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e52aa6387e85abcd2021-12-21 11:37:09.696root 11241100x8000000000000000548061Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:09.696{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4d6f20b80414441d2021-12-21 11:37:09.696root 11241100x8000000000000000548062Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:09.697{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e79ff347e79dcd442021-12-21 11:37:09.697root 11241100x8000000000000000548063Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:10.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.93bb35842e0cdd632021-12-21 11:37:10.193root 11241100x8000000000000000548064Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:10.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.226ef885101f5a982021-12-21 11:37:10.193root 11241100x8000000000000000548065Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:10.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4d045d4766b945dc2021-12-21 11:37:10.193root 11241100x8000000000000000548066Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:10.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.252862fcb1fc78722021-12-21 11:37:10.193root 11241100x8000000000000000548067Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:10.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9e1d7852e6e2371b2021-12-21 11:37:10.193root 11241100x8000000000000000548068Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:10.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.90c47a292446e6742021-12-21 11:37:10.193root 11241100x8000000000000000548069Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:10.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.eeb84ea14e31cfc62021-12-21 11:37:10.193root 11241100x8000000000000000548070Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:10.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a598b5220c0184522021-12-21 11:37:10.193root 11241100x8000000000000000548071Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:10.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.566aa34480eeb3212021-12-21 11:37:10.193root 11241100x8000000000000000548072Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:10.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1d3091dd975f739e2021-12-21 11:37:10.193root 11241100x8000000000000000548073Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:10.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e96820cfa33fd59e2021-12-21 11:37:10.193root 11241100x8000000000000000548074Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:10.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2de18fbae24cc3372021-12-21 11:37:10.194root 11241100x8000000000000000548075Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:10.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.782490d51bf8f22d2021-12-21 11:37:10.194root 11241100x8000000000000000548076Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:10.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a5ee6b72ed08e03c2021-12-21 11:37:10.194root 11241100x8000000000000000548077Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:10.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6e1593ba9ca8ce502021-12-21 11:37:10.194root 11241100x8000000000000000548078Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:10.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b8409bdf311d8f472021-12-21 11:37:10.194root 11241100x8000000000000000548079Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:10.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.cccfe4cffb94ed9b2021-12-21 11:37:10.194root 11241100x8000000000000000548080Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:10.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.68956a77844af6012021-12-21 11:37:10.194root 11241100x8000000000000000548081Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:10.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.752f27b61d35cca02021-12-21 11:37:10.194root 11241100x8000000000000000548082Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:10.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3d1dd7a1b5e5ba902021-12-21 11:37:10.194root 11241100x8000000000000000548083Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:10.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5ce88fda6fba33492021-12-21 11:37:10.194root 11241100x8000000000000000548084Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:10.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e04de06e05d6a2b22021-12-21 11:37:10.194root 11241100x8000000000000000548085Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:10.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.98c29cae80c5c4e52021-12-21 11:37:10.194root 11241100x8000000000000000548086Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:10.195{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c9120cc325d4db072021-12-21 11:37:10.195root 11241100x8000000000000000548087Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:10.195{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.00d04d897208caf02021-12-21 11:37:10.195root 11241100x8000000000000000548088Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:10.195{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.58ae96c7dc136d9f2021-12-21 11:37:10.195root 11241100x8000000000000000548089Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:10.195{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.fb30f6c4d1f8fba42021-12-21 11:37:10.195root 11241100x8000000000000000548090Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:10.195{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8b0ef2ebda2ce9a92021-12-21 11:37:10.195root 11241100x8000000000000000548091Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:10.195{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.346b334b41643a052021-12-21 11:37:10.195root 11241100x8000000000000000548092Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:10.195{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5b85faad8a8be8b22021-12-21 11:37:10.195root 11241100x8000000000000000548093Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:10.195{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8be4dfcce813fa692021-12-21 11:37:10.195root 11241100x8000000000000000548094Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:10.195{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1337f2ac6f89698d2021-12-21 11:37:10.195root 11241100x8000000000000000548095Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:10.195{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b783ea5ae956d9fa2021-12-21 11:37:10.195root 11241100x8000000000000000548096Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:10.196{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c2ffc5663ab067322021-12-21 11:37:10.196root 11241100x8000000000000000548097Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:10.196{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.92a819ed93c535a72021-12-21 11:37:10.196root 11241100x8000000000000000548098Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:10.196{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2cc345ec71ddd8b52021-12-21 11:37:10.196root 11241100x8000000000000000548099Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:10.196{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a9644921aea54de42021-12-21 11:37:10.196root 11241100x8000000000000000548100Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:10.196{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.59eed310aed430502021-12-21 11:37:10.196root 11241100x8000000000000000548101Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:10.196{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c61e7cd963ef76872021-12-21 11:37:10.196root 11241100x8000000000000000548102Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:10.196{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b1a353c8dc4f9c932021-12-21 11:37:10.196root 11241100x8000000000000000548103Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:10.196{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2ef508a11d596fb42021-12-21 11:37:10.196root 11241100x8000000000000000548104Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:10.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ef25008071ad35ff2021-12-21 11:37:10.693root 11241100x8000000000000000548105Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:10.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.45bb94073b7eb54b2021-12-21 11:37:10.693root 11241100x8000000000000000548106Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:10.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.fdcc71d627d260a02021-12-21 11:37:10.693root 11241100x8000000000000000548107Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:10.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c33a139bdf565f802021-12-21 11:37:10.693root 11241100x8000000000000000548108Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:10.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7a9de31fb062d5c92021-12-21 11:37:10.693root 11241100x8000000000000000548109Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:10.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.79433ac19836b95a2021-12-21 11:37:10.693root 11241100x8000000000000000548110Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:10.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f75d945283d22e2e2021-12-21 11:37:10.693root 11241100x8000000000000000548111Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:10.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.28a1d5a854f110de2021-12-21 11:37:10.693root 11241100x8000000000000000548112Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:10.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.32c9d842e01d1cf92021-12-21 11:37:10.693root 11241100x8000000000000000548113Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:10.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1a35b34c92cd71552021-12-21 11:37:10.693root 11241100x8000000000000000548114Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:10.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.db99440b7e2f46ea2021-12-21 11:37:10.693root 11241100x8000000000000000548115Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:10.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.fc1bc62ed72017a52021-12-21 11:37:10.694root 11241100x8000000000000000548116Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:10.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b91093d6c193559c2021-12-21 11:37:10.694root 11241100x8000000000000000548117Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:10.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.958c1c6112967de12021-12-21 11:37:10.694root 11241100x8000000000000000548118Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:10.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.89b313f6bcf9c0d22021-12-21 11:37:10.694root 11241100x8000000000000000548119Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:10.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.69a48a7a1b3d05292021-12-21 11:37:10.694root 11241100x8000000000000000548120Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:10.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.47a9ce46fb667ea12021-12-21 11:37:10.694root 11241100x8000000000000000548121Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:10.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4c0fed6f8e38fb5e2021-12-21 11:37:10.694root 11241100x8000000000000000548122Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:10.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f628cf4280f06c8e2021-12-21 11:37:10.694root 11241100x8000000000000000548123Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:10.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.86b7e8043fb3decb2021-12-21 11:37:10.694root 11241100x8000000000000000548124Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:10.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ee010c3c89ed59a72021-12-21 11:37:10.694root 11241100x8000000000000000548125Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:10.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b34a554bdbd00fb92021-12-21 11:37:10.694root 11241100x8000000000000000548126Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:10.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3442d276994569772021-12-21 11:37:10.694root 11241100x8000000000000000548127Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:10.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.cfe3b557041999e42021-12-21 11:37:10.694root 11241100x8000000000000000548128Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:10.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a381a1364aaaeb7c2021-12-21 11:37:10.694root 11241100x8000000000000000548129Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:10.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.355261ade34332f02021-12-21 11:37:10.694root 11241100x8000000000000000548130Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:10.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c27f9725388b4c352021-12-21 11:37:10.694root 11241100x8000000000000000548131Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:10.695{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e4f66275bc1289032021-12-21 11:37:10.695root 11241100x8000000000000000548132Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:10.695{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2ab61a810c9699712021-12-21 11:37:10.695root 11241100x8000000000000000548133Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:10.695{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.05d47e8d12f83af82021-12-21 11:37:10.695root 11241100x8000000000000000548134Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:10.695{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e27e31c78ad3ca942021-12-21 11:37:10.695root 11241100x8000000000000000548135Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:10.695{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a0d0068d2a5e3d1a2021-12-21 11:37:10.695root 11241100x8000000000000000548136Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:10.695{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.df72f6bcd2b17a0c2021-12-21 11:37:10.695root 11241100x8000000000000000548137Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:10.695{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.32fb069d707656fc2021-12-21 11:37:10.695root 11241100x8000000000000000548138Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:10.695{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.77a080c4613cedbd2021-12-21 11:37:10.695root 11241100x8000000000000000548139Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:10.695{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8acc9be800d3f00b2021-12-21 11:37:10.695root 11241100x8000000000000000548140Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:10.695{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7b71c2f31fb9c1102021-12-21 11:37:10.695root 11241100x8000000000000000548141Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:10.695{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.564485da9b8d5e372021-12-21 11:37:10.695root 11241100x8000000000000000548142Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:10.695{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a02dfcadce3546332021-12-21 11:37:10.695root 11241100x8000000000000000548143Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:10.695{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.be9e331f9acd8ef32021-12-21 11:37:10.695root 11241100x8000000000000000548144Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:10.696{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c7763c9722c655562021-12-21 11:37:10.696root 11241100x8000000000000000548145Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:10.696{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.78d9769da345d8ea2021-12-21 11:37:10.696root 11241100x8000000000000000548146Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:10.696{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5947190ae882f2bd2021-12-21 11:37:10.696root 11241100x8000000000000000548147Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:10.696{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.600631c3cab91bf82021-12-21 11:37:10.696root 11241100x8000000000000000548148Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:10.696{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.309b3b57f61b8b9a2021-12-21 11:37:10.696root 11241100x8000000000000000548149Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:10.696{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0297d9211dd420952021-12-21 11:37:10.696root 11241100x8000000000000000548150Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:10.696{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.75321850925163282021-12-21 11:37:10.696root 354300x8000000000000000548151Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:10.942{ec2b6afe-9236-61c1-9035-26beb1550000}689/lib/systemd/systemd-networkd-udptruefalse10.0.1.25-68-false10.0.1.1-67- 11241100x8000000000000000548152Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:10.942{ec2b6afe-9236-61c1-9035-26beb1550000}689/lib/systemd/systemd-networkd/run/systemd/netif/systemd/netif/.#stateXvYU4O2021-12-21 11:37:10.942systemd-network 11241100x8000000000000000548153Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:10.943{ec2b6afe-9236-61c1-9035-26beb1550000}689/lib/systemd/systemd-networkd/run/systemd/netif/systemd/netif/links/.#2sUXhZQ2021-12-21 11:37:10.943systemd-network 11241100x8000000000000000548154Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:10.943{ec2b6afe-9236-61c1-9035-26beb1550000}689/lib/systemd/systemd-networkd/run/systemd/netif/systemd/netif/leases/.#2VTlFTS2021-12-21 11:37:10.943systemd-network 11241100x8000000000000000548155Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:10.943{ec2b6afe-9236-61c1-9035-26beb1550000}689/lib/systemd/systemd-networkd/run/systemd/netif/systemd/netif/.#state46r6NU2021-12-21 11:37:10.943systemd-network 11241100x8000000000000000548156Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:10.943{ec2b6afe-9236-61c1-9035-26beb1550000}689/lib/systemd/systemd-networkd/run/systemd/netif/systemd/netif/links/.#2FxzyIW2021-12-21 11:37:10.943systemd-network 11241100x8000000000000000548157Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:10.943{ec2b6afe-9236-61c1-9035-26beb1550000}689/lib/systemd/systemd-networkd/run/systemd/netif/systemd/netif/leases/.#2iXv1CY2021-12-21 11:37:10.943systemd-network 534500x8000000000000000548158Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:10.942{ec2b6afe-9236-61c1-9035-26beb1550000}689/lib/systemd/systemd-networkdsystemd-network 354300x8000000000000000548159Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:10.943{ec2b6afe-9233-61c1-70b6-91c773550000}518/lib/systemd/systemd-timesyncdsystemd-timesyncudptruefalse10.0.1.25-52106-false169.254.169.123-123- 11241100x8000000000000000548160Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:10.944{ec2b6afe-9247-61c1-c097-2e4cb4550000}2604/lib/systemd/systemd-resolved/run/systemd/resolve/systemd/resolve/.#resolv.confK75spr2021-12-21 11:37:10.944systemd-resolve 11241100x8000000000000000548161Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:10.944{ec2b6afe-9247-61c1-c097-2e4cb4550000}2604/lib/systemd/systemd-resolved/run/systemd/resolve/systemd/resolve/.#stub-resolv.confu2N3jt2021-12-21 11:37:10.944systemd-resolve 354300x8000000000000000548162Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:10.943{ec2b6afe-9233-61c1-70b6-91c773550000}518/lib/systemd/systemd-timesyncdsystemd-timesyncudptruefalse10.0.1.25-45303-false169.254.169.123-123- 11241100x8000000000000000548163Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:10.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.de97169888b683862021-12-21 11:37:10.944root 11241100x8000000000000000548164Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:10.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.31c18d74a8e5b9912021-12-21 11:37:10.944root 11241100x8000000000000000548165Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:10.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.589404df3c8a5b0a2021-12-21 11:37:10.945root 11241100x8000000000000000548166Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:10.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c9c5d44ad59b45d72021-12-21 11:37:10.945root 11241100x8000000000000000548167Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:10.946{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f4e10763d955e2bc2021-12-21 11:37:10.946root 11241100x8000000000000000548168Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:10.946{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8006986e6ad2b1d72021-12-21 11:37:10.946root 11241100x8000000000000000548169Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:10.946{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6fff11c95b13393b2021-12-21 11:37:10.946root 11241100x8000000000000000548170Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:10.946{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.52bda1e131cea1662021-12-21 11:37:10.946root 11241100x8000000000000000548171Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:10.946{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ba726d1022b13dfc2021-12-21 11:37:10.946root 11241100x8000000000000000548172Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:10.946{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7b797ebad4aa243d2021-12-21 11:37:10.946root 11241100x8000000000000000548173Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:10.946{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.fe6c99d60cb0ac7b2021-12-21 11:37:10.946root 11241100x8000000000000000548174Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:10.946{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e64b1b023c5474582021-12-21 11:37:10.946root 11241100x8000000000000000548175Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:10.946{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b0104d49866925032021-12-21 11:37:10.946root 11241100x8000000000000000548176Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:10.946{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.44225c67f94dd2462021-12-21 11:37:10.946root 11241100x8000000000000000548177Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:10.946{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0adc5499e538a1782021-12-21 11:37:10.946root 11241100x8000000000000000548178Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:10.947{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8fc6edc6ecf0cbbc2021-12-21 11:37:10.947root 11241100x8000000000000000548179Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:10.947{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7bb8123a7a7149b92021-12-21 11:37:10.947root 11241100x8000000000000000548180Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:10.947{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.cf1f3c0269fedcf02021-12-21 11:37:10.947root 11241100x8000000000000000548181Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:10.947{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f7884bdcec29b07c2021-12-21 11:37:10.947root 11241100x8000000000000000548182Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:10.947{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.98dc82479c5c60ae2021-12-21 11:37:10.947root 11241100x8000000000000000548183Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:10.947{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2463b1bcea10f8e02021-12-21 11:37:10.947root 11241100x8000000000000000548184Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:10.947{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.342fdbcadd60142f2021-12-21 11:37:10.947root 11241100x8000000000000000548185Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:10.947{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b242ff23e77ed7272021-12-21 11:37:10.947root 11241100x8000000000000000548186Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:10.947{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ea9423c7353ddb042021-12-21 11:37:10.947root 11241100x8000000000000000548187Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:10.947{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.eff4edc5b4a340452021-12-21 11:37:10.947root 11241100x8000000000000000548188Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:10.947{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.069428ff3dd7b1662021-12-21 11:37:10.947root 11241100x8000000000000000548189Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:10.947{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4e8614af7d2200992021-12-21 11:37:10.947root 11241100x8000000000000000548190Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:10.948{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c5d600e5a4bcf0882021-12-21 11:37:10.948root 11241100x8000000000000000548191Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:10.948{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1a119a2da569b3a52021-12-21 11:37:10.948root 534500x8000000000000000548192Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:10.999{ec2b6afe-9233-61c1-c81a-006eee550000}454/lib/systemd/systemd-journaldroot 534500x8000000000000000548193Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:11.023{ec2b6afe-9233-61c1-c81a-006eee550000}454/lib/systemd/systemd-journaldroot 11241100x8000000000000000548194Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:11.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.28ece3b32abefb802021-12-21 11:37:11.443root 11241100x8000000000000000548195Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:11.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c21e679dfd5a30552021-12-21 11:37:11.443root 11241100x8000000000000000548196Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:11.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4056489cfdc4852a2021-12-21 11:37:11.443root 11241100x8000000000000000548197Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:11.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0158fd891370f66e2021-12-21 11:37:11.443root 11241100x8000000000000000548198Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:11.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.febe7eeea9930d9c2021-12-21 11:37:11.444root 11241100x8000000000000000548199Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:11.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d424505c057cf9b52021-12-21 11:37:11.444root 11241100x8000000000000000548200Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:11.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7da9e2e38d9d9ba12021-12-21 11:37:11.444root 11241100x8000000000000000548201Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:11.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.70d22a9e8932a42c2021-12-21 11:37:11.444root 11241100x8000000000000000548202Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:11.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.13bb0d5213ea68222021-12-21 11:37:11.444root 11241100x8000000000000000548203Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:11.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9f4610767080c96b2021-12-21 11:37:11.444root 11241100x8000000000000000548204Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:11.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.597ac297913b4c362021-12-21 11:37:11.444root 11241100x8000000000000000548205Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:11.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.64c4fa866b5cf4db2021-12-21 11:37:11.444root 11241100x8000000000000000548206Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:11.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a323c2a5442568782021-12-21 11:37:11.444root 11241100x8000000000000000548207Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:11.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4e42fe1986eb00a92021-12-21 11:37:11.444root 11241100x8000000000000000548208Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:11.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b6f45e4361df521e2021-12-21 11:37:11.444root 11241100x8000000000000000548209Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:11.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0ca51fd4f5e887992021-12-21 11:37:11.444root 11241100x8000000000000000548210Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:11.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2dccc4211c0407b72021-12-21 11:37:11.444root 11241100x8000000000000000548211Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:11.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.bd47cf61c023e0e22021-12-21 11:37:11.444root 11241100x8000000000000000548212Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:11.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0a523e334e6a54362021-12-21 11:37:11.444root 11241100x8000000000000000548213Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:11.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0fe504f9d01fdc0d2021-12-21 11:37:11.445root 11241100x8000000000000000548214Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:11.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.303a47b74b1140e12021-12-21 11:37:11.445root 11241100x8000000000000000548215Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:11.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.78c121004700c3732021-12-21 11:37:11.445root 11241100x8000000000000000548216Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:11.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b8d06a49ef3cdbde2021-12-21 11:37:11.445root 11241100x8000000000000000548217Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:11.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.67f44b9d552c2a482021-12-21 11:37:11.445root 11241100x8000000000000000548218Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:11.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.625641c189ad09842021-12-21 11:37:11.445root 11241100x8000000000000000548219Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:11.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7d34cf229126dba52021-12-21 11:37:11.445root 11241100x8000000000000000548220Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:11.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5298eca5df17a6a12021-12-21 11:37:11.445root 11241100x8000000000000000548221Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:11.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8b359b39b5fc8c572021-12-21 11:37:11.445root 11241100x8000000000000000548222Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:11.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.bb1ff0f7b668633c2021-12-21 11:37:11.445root 11241100x8000000000000000548223Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:11.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2b0c0a287aa8c50f2021-12-21 11:37:11.445root 11241100x8000000000000000548224Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:11.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.06dde4797ac647d82021-12-21 11:37:11.445root 11241100x8000000000000000548225Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:11.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.fd01e205403b82e92021-12-21 11:37:11.445root 11241100x8000000000000000548226Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:11.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.13e8a21bd213bce12021-12-21 11:37:11.445root 11241100x8000000000000000548227Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:11.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.12e6e2cf9172945c2021-12-21 11:37:11.445root 11241100x8000000000000000548228Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:11.446{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1415a9734788214f2021-12-21 11:37:11.446root 11241100x8000000000000000548229Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:11.446{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c79938afff7678372021-12-21 11:37:11.446root 11241100x8000000000000000548230Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:11.446{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a72a87d6160163972021-12-21 11:37:11.446root 11241100x8000000000000000548231Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:11.446{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a7ff6ff2431103cc2021-12-21 11:37:11.446root 11241100x8000000000000000548232Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:11.446{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d7b0bd7cdcbcc1272021-12-21 11:37:11.446root 11241100x8000000000000000548233Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:11.446{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c5c3d2b9cb86d1f02021-12-21 11:37:11.446root 11241100x8000000000000000548234Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:11.446{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2fb76234a0f15d042021-12-21 11:37:11.446root 11241100x8000000000000000548235Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:11.446{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c3cc5324a3828f222021-12-21 11:37:11.446root 11241100x8000000000000000548236Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:11.446{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.39965fca68a4ebba2021-12-21 11:37:11.446root 11241100x8000000000000000548237Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:11.942{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.844e2a51fd088b892021-12-21 11:37:11.942root 11241100x8000000000000000548238Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:11.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7b7ef3f4032f688e2021-12-21 11:37:11.943root 11241100x8000000000000000548239Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:11.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.44a8b5a60e2c2b1e2021-12-21 11:37:11.943root 11241100x8000000000000000548240Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:11.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.409915e39e31678b2021-12-21 11:37:11.943root 11241100x8000000000000000548241Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:11.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6ca6d87fb64aca6a2021-12-21 11:37:11.943root 11241100x8000000000000000548242Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:11.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0736cdb561a1664e2021-12-21 11:37:11.943root 11241100x8000000000000000548243Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:11.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.98e6c3aacd95b8262021-12-21 11:37:11.943root 11241100x8000000000000000548244Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:11.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f0952256d84c5df72021-12-21 11:37:11.943root 11241100x8000000000000000548245Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:11.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.22fcf9c57430c50d2021-12-21 11:37:11.943root 11241100x8000000000000000548246Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:11.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.998df38db9410d212021-12-21 11:37:11.943root 11241100x8000000000000000548247Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:11.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.92ea17efa0db155e2021-12-21 11:37:11.943root 11241100x8000000000000000548248Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:11.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b2c28751523e01f32021-12-21 11:37:11.943root 11241100x8000000000000000548249Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:11.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.72014354cb5fc2d12021-12-21 11:37:11.943root 11241100x8000000000000000548250Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:11.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6003ea0c601eccfa2021-12-21 11:37:11.944root 11241100x8000000000000000548251Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:11.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.591c3262e5ed0ca52021-12-21 11:37:11.944root 11241100x8000000000000000548252Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:11.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0230ee027aa51ebb2021-12-21 11:37:11.944root 11241100x8000000000000000548253Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:11.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.fe8964c99d9dfb4b2021-12-21 11:37:11.944root 11241100x8000000000000000548254Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:11.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.31c0d3f55fc9ab5c2021-12-21 11:37:11.944root 11241100x8000000000000000548255Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:11.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0385147dc89aa9f82021-12-21 11:37:11.944root 11241100x8000000000000000548256Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:11.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8e241e738163cdee2021-12-21 11:37:11.944root 11241100x8000000000000000548257Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:11.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.99758b7b48f019362021-12-21 11:37:11.944root 11241100x8000000000000000548258Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:11.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6c25ec52b9826f042021-12-21 11:37:11.944root 11241100x8000000000000000548259Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:11.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.74e445fdfd1f05942021-12-21 11:37:11.944root 11241100x8000000000000000548260Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:11.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7b7615cb5f553af02021-12-21 11:37:11.944root 11241100x8000000000000000548261Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:11.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2d1f6a12c72d3b972021-12-21 11:37:11.944root 11241100x8000000000000000548262Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:11.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.61e1beb371b3d8ac2021-12-21 11:37:11.944root 11241100x8000000000000000548263Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:11.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b3b4cab47d5e2f6d2021-12-21 11:37:11.945root 11241100x8000000000000000548264Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:11.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c894bfaf4bffddb02021-12-21 11:37:11.945root 11241100x8000000000000000548265Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:11.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3c6514079b621cac2021-12-21 11:37:11.945root 11241100x8000000000000000548266Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:11.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e9492211d9bba3ba2021-12-21 11:37:11.945root 11241100x8000000000000000548267Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:11.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e92cd654878852832021-12-21 11:37:11.945root 11241100x8000000000000000548268Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:11.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.42370fe7ab523c4b2021-12-21 11:37:11.945root 11241100x8000000000000000548269Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:11.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b39605290d4168682021-12-21 11:37:11.945root 11241100x8000000000000000548270Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:11.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8774beb45c1c7a232021-12-21 11:37:11.945root 11241100x8000000000000000548271Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:11.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.bab1a7e12166d5ee2021-12-21 11:37:11.945root 11241100x8000000000000000548272Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:11.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2fe89a042eb1539e2021-12-21 11:37:11.945root 11241100x8000000000000000548273Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:11.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6eac37aad9adba7d2021-12-21 11:37:11.945root 11241100x8000000000000000548274Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:11.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9d42bc80ea2d98d12021-12-21 11:37:11.945root 11241100x8000000000000000548275Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:11.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.97bcede7c3a269602021-12-21 11:37:11.945root 11241100x8000000000000000548276Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:11.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4480ea29cdcde6c12021-12-21 11:37:11.945root 11241100x8000000000000000548277Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:11.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d529ed826bd854612021-12-21 11:37:11.945root 11241100x8000000000000000548278Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:11.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.421310fe5889acb02021-12-21 11:37:11.945root 11241100x8000000000000000548279Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:11.946{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3029c3d3ed16fee92021-12-21 11:37:11.946root 11241100x8000000000000000548280Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:11.946{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.38fb26794abec65c2021-12-21 11:37:11.946root 11241100x8000000000000000548281Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:11.946{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.631ad36ed725826e2021-12-21 11:37:11.946root 11241100x8000000000000000548282Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:11.946{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.508dbedb0b9212ac2021-12-21 11:37:11.946root 11241100x8000000000000000548283Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:11.946{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d60188bd6d29262f2021-12-21 11:37:11.946root 11241100x8000000000000000548284Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:11.946{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0baa983ba668b36a2021-12-21 11:37:11.946root 11241100x8000000000000000548285Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:11.946{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4d8c7853d3b507d92021-12-21 11:37:11.946root 11241100x8000000000000000548286Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:11.946{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f070c090350f77b12021-12-21 11:37:11.946root 11241100x8000000000000000548287Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:11.946{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d004be9018427d232021-12-21 11:37:11.946root 11241100x8000000000000000548288Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:11.946{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.024403f75baf845b2021-12-21 11:37:11.946root 11241100x8000000000000000548289Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:11.946{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.bc2ff9da0cfe73e02021-12-21 11:37:11.946root 11241100x8000000000000000548290Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:11.946{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a1cdfca23a0381292021-12-21 11:37:11.946root 11241100x8000000000000000548291Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:11.946{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c25b5af9759c50af2021-12-21 11:37:11.946root 11241100x8000000000000000548292Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:11.946{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.248f05c604c450922021-12-21 11:37:11.946root 11241100x8000000000000000548293Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:12.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2b849f956d003be32021-12-21 11:37:12.443root 11241100x8000000000000000548294Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:12.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.cc99ccb9345c37dc2021-12-21 11:37:12.443root 11241100x8000000000000000548295Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:12.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.df79a770b2b128172021-12-21 11:37:12.443root 11241100x8000000000000000548296Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:12.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2e35624d28b29ecd2021-12-21 11:37:12.443root 11241100x8000000000000000548297Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:12.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1554498c959a1b0b2021-12-21 11:37:12.443root 11241100x8000000000000000548298Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:12.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.83166debbd73def92021-12-21 11:37:12.443root 11241100x8000000000000000548299Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:12.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ad0f9be0b5abd2192021-12-21 11:37:12.443root 11241100x8000000000000000548300Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:12.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5478f2321841dd0a2021-12-21 11:37:12.444root 11241100x8000000000000000548301Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:12.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.09252c95430a2e9a2021-12-21 11:37:12.444root 11241100x8000000000000000548302Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:12.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.62d00b74a730b65d2021-12-21 11:37:12.444root 11241100x8000000000000000548303Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:12.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e3295ba04403acb92021-12-21 11:37:12.444root 11241100x8000000000000000548304Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:12.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1e9320c5c8541b012021-12-21 11:37:12.444root 11241100x8000000000000000548305Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:12.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.92ab242dce35558c2021-12-21 11:37:12.444root 11241100x8000000000000000548306Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:12.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.025d1f0979fb1ff72021-12-21 11:37:12.444root 11241100x8000000000000000548307Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:12.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7fe7211f2ba652ee2021-12-21 11:37:12.444root 11241100x8000000000000000548308Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:12.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7b234a1fe3ee3c272021-12-21 11:37:12.444root 11241100x8000000000000000548309Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:12.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9ab11500385243c62021-12-21 11:37:12.444root 11241100x8000000000000000548310Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:12.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.58a1b4158ee84a1e2021-12-21 11:37:12.444root 11241100x8000000000000000548311Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:12.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.511c8e63d66db21e2021-12-21 11:37:12.444root 11241100x8000000000000000548312Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:12.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.cba2618edc9461352021-12-21 11:37:12.445root 11241100x8000000000000000548313Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:12.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ef7ea19845e608f92021-12-21 11:37:12.445root 11241100x8000000000000000548314Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:12.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.75c8b7712ddf95012021-12-21 11:37:12.445root 11241100x8000000000000000548315Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:12.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.61c236dee8e95b412021-12-21 11:37:12.445root 11241100x8000000000000000548316Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:12.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.cb22e4566a9e9eeb2021-12-21 11:37:12.445root 11241100x8000000000000000548317Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:12.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1edefa546a7bf7da2021-12-21 11:37:12.445root 11241100x8000000000000000548318Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:12.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ad5fe5147e7018e42021-12-21 11:37:12.445root 11241100x8000000000000000548319Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:12.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.04c76d9788525fe52021-12-21 11:37:12.445root 11241100x8000000000000000548320Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:12.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6ba8bb7e47adb8ba2021-12-21 11:37:12.445root 11241100x8000000000000000548321Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:12.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5f2e9f51edf1d14e2021-12-21 11:37:12.445root 11241100x8000000000000000548322Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:12.446{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9a9789901e97b4f02021-12-21 11:37:12.446root 11241100x8000000000000000548323Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:12.446{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d8813014e183e6632021-12-21 11:37:12.446root 11241100x8000000000000000548324Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:12.446{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.261e86e282e6c70c2021-12-21 11:37:12.446root 11241100x8000000000000000548325Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:12.446{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b4f63227d7df30d72021-12-21 11:37:12.446root 11241100x8000000000000000548326Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:12.446{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2fe5002b0ad039cc2021-12-21 11:37:12.446root 11241100x8000000000000000548327Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:12.446{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c711a23d7b45f51c2021-12-21 11:37:12.446root 11241100x8000000000000000548328Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:12.446{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c46c3ea752d8cc3e2021-12-21 11:37:12.446root 11241100x8000000000000000548329Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:12.446{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.119576bc5ac0d7df2021-12-21 11:37:12.446root 11241100x8000000000000000548330Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:12.446{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.55a1147ab3bd7bad2021-12-21 11:37:12.446root 11241100x8000000000000000548331Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:12.446{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5c095a1d2939ba712021-12-21 11:37:12.446root 11241100x8000000000000000548332Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:12.447{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a873952cf6b2ad822021-12-21 11:37:12.447root 11241100x8000000000000000548333Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:12.447{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5e81664429bb64322021-12-21 11:37:12.447root 11241100x8000000000000000548334Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:12.447{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d4813fff225998f42021-12-21 11:37:12.447root 11241100x8000000000000000548335Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:12.447{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3f25ec08501f5dfe2021-12-21 11:37:12.447root 11241100x8000000000000000548336Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:12.447{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0fc66c5f6498dce22021-12-21 11:37:12.447root 11241100x8000000000000000548337Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:12.447{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.90251c6befe042392021-12-21 11:37:12.447root 11241100x8000000000000000548338Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:12.447{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c17b2f54b11624e12021-12-21 11:37:12.447root 11241100x8000000000000000548339Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:12.447{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.76dbb03d2b1c771e2021-12-21 11:37:12.447root 11241100x8000000000000000548340Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:12.447{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b76bfa60c61378ff2021-12-21 11:37:12.447root 11241100x8000000000000000548341Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:12.447{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4c9814076870bac42021-12-21 11:37:12.447root 11241100x8000000000000000548342Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:12.448{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.11aea14943a923d02021-12-21 11:37:12.448root 11241100x8000000000000000548343Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:12.448{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8ff642c1e14602952021-12-21 11:37:12.448root 11241100x8000000000000000548344Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:12.448{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.57fdfdc9da5e0bd62021-12-21 11:37:12.448root 11241100x8000000000000000548345Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:12.448{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3542e488c1d3d00d2021-12-21 11:37:12.448root 11241100x8000000000000000548346Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:12.448{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b2401f4be3f6d08a2021-12-21 11:37:12.448root 11241100x8000000000000000548347Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:12.448{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4eb34e1fb5b924012021-12-21 11:37:12.448root 11241100x8000000000000000548348Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:12.448{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.613f1bb10e9de8722021-12-21 11:37:12.448root 11241100x8000000000000000548349Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:12.448{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5f0932701e21964a2021-12-21 11:37:12.448root 11241100x8000000000000000548350Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:12.448{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.32ac53a16d54e7362021-12-21 11:37:12.448root 11241100x8000000000000000548351Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:12.448{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.fc87c4e20d8f304b2021-12-21 11:37:12.448root 11241100x8000000000000000548352Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:12.448{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a22f9c1e9442560d2021-12-21 11:37:12.448root 11241100x8000000000000000548353Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:12.448{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.965f1135f5a507d92021-12-21 11:37:12.448root 11241100x8000000000000000548354Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:12.448{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.cfbccb2c9d6b7a1c2021-12-21 11:37:12.448root 11241100x8000000000000000548355Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:12.448{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2dfd8be209ebfa0d2021-12-21 11:37:12.448root 11241100x8000000000000000548356Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:12.448{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.837a758311f6d85a2021-12-21 11:37:12.448root 11241100x8000000000000000548357Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:12.449{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.561c75bf3594bc402021-12-21 11:37:12.449root 11241100x8000000000000000548358Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:12.449{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3fe2ad3fdbdf4e622021-12-21 11:37:12.449root 11241100x8000000000000000548359Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:12.449{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.10cc86830b8b1dda2021-12-21 11:37:12.449root 11241100x8000000000000000548360Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:12.449{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.aa5c20ee476665c72021-12-21 11:37:12.449root 11241100x8000000000000000548361Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:12.449{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.dd231b835e4ce4de2021-12-21 11:37:12.449root 11241100x8000000000000000548362Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:12.449{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e174396b1f78492a2021-12-21 11:37:12.449root 11241100x8000000000000000548363Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:12.449{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6e5461b16e00a9902021-12-21 11:37:12.449root 11241100x8000000000000000548364Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:12.449{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0b5b4c736e0f8a4a2021-12-21 11:37:12.449root 11241100x8000000000000000548365Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:12.449{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0d4e77eb5ddd727f2021-12-21 11:37:12.449root 11241100x8000000000000000548366Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:12.449{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.005935efee6a9cb32021-12-21 11:37:12.449root 11241100x8000000000000000548367Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:12.449{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.234221b744e37c462021-12-21 11:37:12.449root 11241100x8000000000000000548368Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:12.449{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e48177a5e8fadb072021-12-21 11:37:12.449root 11241100x8000000000000000548369Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:12.449{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.235a4bac743f25a62021-12-21 11:37:12.449root 11241100x8000000000000000548370Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:12.449{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.556752a9757519362021-12-21 11:37:12.449root 11241100x8000000000000000548371Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:12.450{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e2d8c2bc914b57092021-12-21 11:37:12.450root 11241100x8000000000000000548372Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:12.450{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.13b5615b32985ed82021-12-21 11:37:12.450root 11241100x8000000000000000548373Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:12.450{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1eafbcb7639fe0c62021-12-21 11:37:12.450root 11241100x8000000000000000548374Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:12.450{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a5e27cdf3822dca82021-12-21 11:37:12.450root 11241100x8000000000000000548375Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:12.450{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c4a1bce683b99d992021-12-21 11:37:12.450root 11241100x8000000000000000548376Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:12.450{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0194218d5e8b8f772021-12-21 11:37:12.450root 11241100x8000000000000000548377Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:12.450{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f0f5339ed57551ff2021-12-21 11:37:12.450root 11241100x8000000000000000548378Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:12.450{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8ea99aba40d950722021-12-21 11:37:12.450root 11241100x8000000000000000548379Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:12.450{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0e88a62fa689fce72021-12-21 11:37:12.450root 11241100x8000000000000000548380Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:12.450{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.87eee284b348b6372021-12-21 11:37:12.450root 11241100x8000000000000000548381Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:12.450{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a14a524c4a7828472021-12-21 11:37:12.450root 11241100x8000000000000000548382Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:12.450{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2d1afa0db6b1dcfc2021-12-21 11:37:12.450root 11241100x8000000000000000548383Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:12.451{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.069b14b28872ad852021-12-21 11:37:12.451root 11241100x8000000000000000548384Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:12.451{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.be96c5cc6a41d0df2021-12-21 11:37:12.451root 11241100x8000000000000000548385Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:12.451{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ff98a0858c7a87f62021-12-21 11:37:12.451root 11241100x8000000000000000548386Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:12.451{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0bbd43cf424910a92021-12-21 11:37:12.451root 11241100x8000000000000000548387Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:12.451{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.bd04f2b0cd898ec62021-12-21 11:37:12.451root 11241100x8000000000000000548388Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:12.451{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.84ce91aff82f2d322021-12-21 11:37:12.451root 11241100x8000000000000000548389Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:12.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.dca8e0e8e9ae4c622021-12-21 11:37:12.943root 11241100x8000000000000000548390Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:12.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.95cd605d4872a1952021-12-21 11:37:12.943root 11241100x8000000000000000548391Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:12.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.10ddc5d5cc3e44d32021-12-21 11:37:12.943root 11241100x8000000000000000548392Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:12.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e5263ab8f4dda6672021-12-21 11:37:12.943root 11241100x8000000000000000548393Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:12.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a4d35db674ff61e02021-12-21 11:37:12.943root 11241100x8000000000000000548394Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:12.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d05058281d530b552021-12-21 11:37:12.944root 11241100x8000000000000000548395Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:12.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7610fa8f7b45f8ca2021-12-21 11:37:12.944root 11241100x8000000000000000548396Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:12.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c41f44a023f1949f2021-12-21 11:37:12.944root 11241100x8000000000000000548397Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:12.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9df8c936ce6272df2021-12-21 11:37:12.944root 11241100x8000000000000000548398Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:12.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5055684976ad07a92021-12-21 11:37:12.944root 11241100x8000000000000000548399Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:12.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.08312ffd3793e7042021-12-21 11:37:12.944root 11241100x8000000000000000548400Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:12.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9425b55edf19fae62021-12-21 11:37:12.944root 11241100x8000000000000000548401Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:12.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.69947c90b03d85ce2021-12-21 11:37:12.944root 11241100x8000000000000000548402Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:12.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.373f559bdd6297612021-12-21 11:37:12.944root 11241100x8000000000000000548403Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:12.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0df112c6d1569c362021-12-21 11:37:12.944root 11241100x8000000000000000548404Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:12.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.01b724924822f61e2021-12-21 11:37:12.944root 11241100x8000000000000000548405Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:12.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1e78d08ee6863e352021-12-21 11:37:12.944root 11241100x8000000000000000548406Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:12.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5fce8349b673cde32021-12-21 11:37:12.944root 11241100x8000000000000000548407Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:12.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.21f78828cdae37a72021-12-21 11:37:12.944root 11241100x8000000000000000548408Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:12.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6022a0fc48048c9c2021-12-21 11:37:12.945root 11241100x8000000000000000548409Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:12.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.dcd673c4b2e55b5d2021-12-21 11:37:12.945root 11241100x8000000000000000548410Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:12.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6abf2255915c72ad2021-12-21 11:37:12.945root 11241100x8000000000000000548411Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:12.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.89e47e93267434ca2021-12-21 11:37:12.945root 11241100x8000000000000000548412Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:12.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2cc256bb1d4fa6752021-12-21 11:37:12.945root 11241100x8000000000000000548413Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:12.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ee7a2c6c5b72da5d2021-12-21 11:37:12.945root 11241100x8000000000000000548414Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:12.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9352f41e98af13532021-12-21 11:37:12.945root 11241100x8000000000000000548415Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:12.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5517b26f6b814ccb2021-12-21 11:37:12.945root 11241100x8000000000000000548416Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:12.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.af6852a9a353033a2021-12-21 11:37:12.945root 11241100x8000000000000000548417Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:12.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0540265f50f222de2021-12-21 11:37:12.945root 11241100x8000000000000000548418Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:12.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e2e671d18fc4d0f52021-12-21 11:37:12.945root 11241100x8000000000000000548419Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:12.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a97e0e1ef954712c2021-12-21 11:37:12.945root 11241100x8000000000000000548420Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:12.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c5088c8743973b662021-12-21 11:37:12.945root 11241100x8000000000000000548421Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:12.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6ab30623e127fc452021-12-21 11:37:12.945root 11241100x8000000000000000548422Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:12.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.61479f93f02cab7d2021-12-21 11:37:12.945root 11241100x8000000000000000548423Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:12.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.88dad51b5e7b88202021-12-21 11:37:12.945root 11241100x8000000000000000548424Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:12.946{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0ea024df7a3f3edc2021-12-21 11:37:12.946root 11241100x8000000000000000548425Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:12.946{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.fb9b58d558da75f52021-12-21 11:37:12.946root 11241100x8000000000000000548426Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:12.946{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e47c7d77d67516ba2021-12-21 11:37:12.946root 11241100x8000000000000000548427Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:12.946{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ddcb8348b32a593d2021-12-21 11:37:12.946root 11241100x8000000000000000548428Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:12.946{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b5aa8996c2e4077f2021-12-21 11:37:12.946root 11241100x8000000000000000548429Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:12.946{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.71744fc4ddc568e82021-12-21 11:37:12.946root 11241100x8000000000000000548430Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:12.946{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a2c67a7dabf349502021-12-21 11:37:12.946root 11241100x8000000000000000548431Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:12.946{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4fe7c749de1cc76c2021-12-21 11:37:12.946root 11241100x8000000000000000548432Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:12.946{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8bb400156b8c4ae12021-12-21 11:37:12.946root 11241100x8000000000000000548433Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:13.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3de017c1a37313742021-12-21 11:37:13.443root 11241100x8000000000000000548434Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:13.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.546985361e561ce52021-12-21 11:37:13.443root 11241100x8000000000000000548435Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:13.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.102ae6a1ce1fff1e2021-12-21 11:37:13.443root 11241100x8000000000000000548436Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:13.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e2ade1826c4eb56e2021-12-21 11:37:13.443root 11241100x8000000000000000548437Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:13.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.07e6d3e874982dc32021-12-21 11:37:13.443root 11241100x8000000000000000548438Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:13.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f8f178695a1235392021-12-21 11:37:13.443root 11241100x8000000000000000548439Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:13.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ede5c6415924e3c02021-12-21 11:37:13.443root 11241100x8000000000000000548440Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:13.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.db12a8fb5d5061462021-12-21 11:37:13.444root 11241100x8000000000000000548441Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:13.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.73c27b9f01a799e42021-12-21 11:37:13.444root 11241100x8000000000000000548442Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:13.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ec626aa0d90948a62021-12-21 11:37:13.444root 11241100x8000000000000000548443Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:13.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7974e222f0021d112021-12-21 11:37:13.444root 11241100x8000000000000000548444Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:13.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5506360aca3965ed2021-12-21 11:37:13.444root 11241100x8000000000000000548445Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:13.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.000bb407f9e7e1842021-12-21 11:37:13.444root 11241100x8000000000000000548446Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:13.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a2cb17ebfbe9f82d2021-12-21 11:37:13.444root 11241100x8000000000000000548447Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:13.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2182348c609a82ac2021-12-21 11:37:13.444root 11241100x8000000000000000548448Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:13.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.26cc78e87a544bff2021-12-21 11:37:13.445root 11241100x8000000000000000548449Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:13.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.fe57ea35e164183f2021-12-21 11:37:13.445root 11241100x8000000000000000548450Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:13.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5f79fe7a19c56bd02021-12-21 11:37:13.445root 11241100x8000000000000000548451Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:13.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1e996e1d7e7aa21e2021-12-21 11:37:13.445root 11241100x8000000000000000548452Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:13.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4053f58f5ac044b42021-12-21 11:37:13.445root 11241100x8000000000000000548453Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:13.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f76f09afc4b5feab2021-12-21 11:37:13.445root 11241100x8000000000000000548454Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:13.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4ae443e897c35aec2021-12-21 11:37:13.445root 11241100x8000000000000000548455Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:13.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8350bb80c2df6ace2021-12-21 11:37:13.445root 11241100x8000000000000000548456Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:13.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7579e20474a36f752021-12-21 11:37:13.445root 11241100x8000000000000000548457Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:13.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.047cc4bf3601be792021-12-21 11:37:13.445root 11241100x8000000000000000548458Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:13.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d358f79a5028ded82021-12-21 11:37:13.445root 11241100x8000000000000000548459Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:13.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.10e54b615171f6de2021-12-21 11:37:13.445root 11241100x8000000000000000548460Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:13.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.507a54e344459bcd2021-12-21 11:37:13.445root 11241100x8000000000000000548461Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:13.446{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.91ff85659d41cede2021-12-21 11:37:13.446root 11241100x8000000000000000548462Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:13.446{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f9afa9bd989ff5632021-12-21 11:37:13.446root 11241100x8000000000000000548463Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:13.446{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d545712535013bc12021-12-21 11:37:13.446root 11241100x8000000000000000548464Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:13.446{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.42e8caaf683ce3572021-12-21 11:37:13.446root 11241100x8000000000000000548465Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:13.446{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0618737e0e04de282021-12-21 11:37:13.446root 11241100x8000000000000000548466Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:13.446{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a486e20caf8f93e42021-12-21 11:37:13.446root 11241100x8000000000000000548467Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:13.446{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7420842be8a0eece2021-12-21 11:37:13.446root 11241100x8000000000000000548468Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:13.446{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3abce1bd44a056822021-12-21 11:37:13.446root 11241100x8000000000000000548469Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:13.446{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f0fc8031053723712021-12-21 11:37:13.446root 11241100x8000000000000000548470Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:13.446{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d8a5bcf30dcba6c52021-12-21 11:37:13.446root 11241100x8000000000000000548471Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:13.447{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6ab1d7d60a2edfce2021-12-21 11:37:13.447root 11241100x8000000000000000548472Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:13.447{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.028c21f9aec388702021-12-21 11:37:13.447root 11241100x8000000000000000548473Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:13.447{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7d22ee157d1a10172021-12-21 11:37:13.447root 11241100x8000000000000000548474Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:13.447{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2f9371e815b06cf02021-12-21 11:37:13.447root 11241100x8000000000000000548475Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:13.447{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4add760619ab766f2021-12-21 11:37:13.447root 11241100x8000000000000000548476Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:13.448{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.331d72f14ff3705a2021-12-21 11:37:13.448root 11241100x8000000000000000548477Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:13.448{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.995093a29583829e2021-12-21 11:37:13.448root 11241100x8000000000000000548478Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:13.448{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3c9c8c7f316f709b2021-12-21 11:37:13.448root 11241100x8000000000000000548479Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:13.448{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.054042d3d22348ce2021-12-21 11:37:13.448root 11241100x8000000000000000548480Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:13.448{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3b08ae2556b16df72021-12-21 11:37:13.448root 11241100x8000000000000000548481Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:13.448{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2e99ef208e59456f2021-12-21 11:37:13.448root 11241100x8000000000000000548482Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:13.448{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.251f5e7cc1c1e8e82021-12-21 11:37:13.448root 11241100x8000000000000000548483Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:13.448{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.edd1249b35b78d2c2021-12-21 11:37:13.448root 11241100x8000000000000000548484Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:13.448{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.710bba09c4dc49972021-12-21 11:37:13.448root 11241100x8000000000000000548485Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:13.449{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7657192b7cfced932021-12-21 11:37:13.449root 11241100x8000000000000000548486Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:13.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a3099f9b8376a3742021-12-21 11:37:13.943root 11241100x8000000000000000548487Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:13.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ffc7a07e42271d372021-12-21 11:37:13.943root 11241100x8000000000000000548488Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:13.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.97ef768ea35bf4012021-12-21 11:37:13.943root 11241100x8000000000000000548489Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:13.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0859639f0307a9052021-12-21 11:37:13.943root 11241100x8000000000000000548490Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:13.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8d5f7d20bd0b82122021-12-21 11:37:13.943root 11241100x8000000000000000548491Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:13.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f69dcd5c02927e282021-12-21 11:37:13.943root 11241100x8000000000000000548492Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:13.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.974f22b5e311b0882021-12-21 11:37:13.943root 11241100x8000000000000000548493Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:13.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.24b867fb7aa836902021-12-21 11:37:13.943root 11241100x8000000000000000548494Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:13.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8ee82241a8ad8dc62021-12-21 11:37:13.944root 11241100x8000000000000000548495Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:13.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.fe443b0d0a4998702021-12-21 11:37:13.944root 11241100x8000000000000000548496Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:13.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4b3927840ec702602021-12-21 11:37:13.944root 11241100x8000000000000000548497Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:13.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.61454b48c9eb5a682021-12-21 11:37:13.944root 11241100x8000000000000000548498Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:13.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5288fa4a686e0c522021-12-21 11:37:13.944root 11241100x8000000000000000548499Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:13.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.42c36c881a98cac12021-12-21 11:37:13.944root 11241100x8000000000000000548500Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:13.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.55acd35860168c302021-12-21 11:37:13.944root 11241100x8000000000000000548501Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:13.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5bb200bd9f4a360e2021-12-21 11:37:13.944root 11241100x8000000000000000548502Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:13.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.fcc89fb6e33072452021-12-21 11:37:13.944root 11241100x8000000000000000548503Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:13.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d4ce3d7fca5adf0a2021-12-21 11:37:13.944root 11241100x8000000000000000548504Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:13.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.359f34af314c22052021-12-21 11:37:13.945root 11241100x8000000000000000548505Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:13.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8a9522c427ccc7682021-12-21 11:37:13.945root 11241100x8000000000000000548506Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:13.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c0cd4ef8e96b76ee2021-12-21 11:37:13.945root 11241100x8000000000000000548507Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:13.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9f6e096a846f24872021-12-21 11:37:13.945root 11241100x8000000000000000548508Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:13.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.56eafdd0c3a0d77b2021-12-21 11:37:13.945root 11241100x8000000000000000548509Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:13.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4507a193d7d9334e2021-12-21 11:37:13.945root 11241100x8000000000000000548510Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:13.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2f0e535f991fccd92021-12-21 11:37:13.945root 11241100x8000000000000000548511Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:13.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7e43efe6501cae702021-12-21 11:37:13.945root 11241100x8000000000000000548512Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:13.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3e04f4fd650677ab2021-12-21 11:37:13.945root 11241100x8000000000000000548513Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:13.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b81c8c07200efa932021-12-21 11:37:13.945root 11241100x8000000000000000548514Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:13.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f980f128f294935d2021-12-21 11:37:13.945root 11241100x8000000000000000548515Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:13.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5169715974fda82e2021-12-21 11:37:13.945root 11241100x8000000000000000548516Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:13.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c8954c93649785ec2021-12-21 11:37:13.945root 11241100x8000000000000000548517Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:13.946{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7cda957b90a76c532021-12-21 11:37:13.946root 11241100x8000000000000000548518Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:13.946{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.722ef731a56de8b92021-12-21 11:37:13.946root 11241100x8000000000000000548519Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:13.946{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.61877b80874f75c52021-12-21 11:37:13.946root 11241100x8000000000000000548520Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:13.946{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.36796b3ec625d4d42021-12-21 11:37:13.946root 11241100x8000000000000000548521Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:13.946{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.032f7a6457056afd2021-12-21 11:37:13.946root 11241100x8000000000000000548522Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:13.946{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f6dab3dee87993a92021-12-21 11:37:13.946root 11241100x8000000000000000548523Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:13.946{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a2c67622a73cd6b92021-12-21 11:37:13.946root 11241100x8000000000000000548524Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:13.946{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.54ec90dee7b4eefb2021-12-21 11:37:13.946root 11241100x8000000000000000548525Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:13.946{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e4888dc19ab191e32021-12-21 11:37:13.946root 11241100x8000000000000000548526Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:13.946{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d59dd891aecb794a2021-12-21 11:37:13.946root 11241100x8000000000000000548527Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:13.946{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f74b22d178f61e4c2021-12-21 11:37:13.946root 11241100x8000000000000000548528Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:13.946{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.866eec80def507642021-12-21 11:37:13.946root 11241100x8000000000000000548529Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:13.947{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.39a7157f678aff222021-12-21 11:37:13.947root 354300x8000000000000000548530Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:14.107{ec2b6afe-95d9-61c1-5175-3a0400000000}5346/opt/splunkforwarder/etc/apps/Splunk_TA_stream/linux_x86_64/bin/streamfwdroottcptruefalse10.0.1.25-48806-false10.0.1.12-8000- 11241100x8000000000000000548531Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:14.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.fe300b7ce825acab2021-12-21 11:37:14.443root 11241100x8000000000000000548532Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:14.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5f6c14069cdd16cc2021-12-21 11:37:14.443root 11241100x8000000000000000548533Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:14.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.68ed5f91ab5573eb2021-12-21 11:37:14.443root 11241100x8000000000000000548534Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:14.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b5963d99d2a762122021-12-21 11:37:14.443root 11241100x8000000000000000548535Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:14.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.85d99520e8ad6bdd2021-12-21 11:37:14.443root 11241100x8000000000000000548536Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:14.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.37a9260bf71745752021-12-21 11:37:14.444root 11241100x8000000000000000548537Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:14.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5704dc487ce4f19f2021-12-21 11:37:14.444root 11241100x8000000000000000548538Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:14.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3384d4d36b37df322021-12-21 11:37:14.444root 11241100x8000000000000000548539Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:14.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f15a0152783fde612021-12-21 11:37:14.444root 11241100x8000000000000000548540Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:14.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0831c65be0375e362021-12-21 11:37:14.444root 11241100x8000000000000000548541Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:14.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4d99f56315d989ae2021-12-21 11:37:14.444root 11241100x8000000000000000548542Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:14.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d1f7da451d0258fc2021-12-21 11:37:14.445root 11241100x8000000000000000548543Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:14.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3669f3b071d1d3032021-12-21 11:37:14.445root 11241100x8000000000000000548544Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:14.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1910030dc3b1857e2021-12-21 11:37:14.445root 11241100x8000000000000000548545Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:14.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c93b56e74e1802202021-12-21 11:37:14.445root 11241100x8000000000000000548546Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:14.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.317344c1472180162021-12-21 11:37:14.445root 11241100x8000000000000000548547Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:14.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f1528b6c0ae89a012021-12-21 11:37:14.445root 11241100x8000000000000000548548Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:14.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.dd4e922afe40855f2021-12-21 11:37:14.445root 11241100x8000000000000000548549Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:14.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ef85d373e55c98612021-12-21 11:37:14.445root 11241100x8000000000000000548550Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:14.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b3eee39e5ba7a5862021-12-21 11:37:14.445root 11241100x8000000000000000548551Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:14.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.38c68556419060392021-12-21 11:37:14.445root 11241100x8000000000000000548552Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:14.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c1c4811d3e6316412021-12-21 11:37:14.445root 11241100x8000000000000000548553Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:14.446{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b9b9797def2c5ea92021-12-21 11:37:14.446root 11241100x8000000000000000548554Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:14.446{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c3113d53c6390cbb2021-12-21 11:37:14.446root 11241100x8000000000000000548555Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:14.446{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.78f1bb87cade2aaf2021-12-21 11:37:14.446root 11241100x8000000000000000548556Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:14.446{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4068f16a7984d99a2021-12-21 11:37:14.446root 11241100x8000000000000000548557Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:14.446{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9f16383d8fbc26c52021-12-21 11:37:14.446root 11241100x8000000000000000548558Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:14.446{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0e757e10913be46b2021-12-21 11:37:14.446root 11241100x8000000000000000548559Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:14.446{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.67ed201567fc5b342021-12-21 11:37:14.446root 11241100x8000000000000000548560Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:14.446{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ef6858b8caa62e902021-12-21 11:37:14.446root 11241100x8000000000000000548561Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:14.446{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.779be13356e9ff1e2021-12-21 11:37:14.446root 11241100x8000000000000000548562Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:14.446{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.cc709604b7fd02182021-12-21 11:37:14.446root 11241100x8000000000000000548563Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:14.447{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.abd0f3d2967dbf0b2021-12-21 11:37:14.447root 11241100x8000000000000000548564Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:14.447{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d7b1e4aed7cc09292021-12-21 11:37:14.447root 11241100x8000000000000000548565Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:14.447{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.eef3b07aef8e6cb82021-12-21 11:37:14.447root 11241100x8000000000000000548566Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:14.447{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7b5ee59f52429fad2021-12-21 11:37:14.447root 11241100x8000000000000000548567Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:14.447{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0b1a25c99a9c51542021-12-21 11:37:14.447root 11241100x8000000000000000548568Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:14.447{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.970e46a5526b5ba12021-12-21 11:37:14.447root 11241100x8000000000000000548569Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:14.447{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d44d304c16b7a4fe2021-12-21 11:37:14.447root 11241100x8000000000000000548570Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:14.448{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c74e689d1460213e2021-12-21 11:37:14.448root 11241100x8000000000000000548571Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:14.448{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d63b3bd06b5a70462021-12-21 11:37:14.448root 11241100x8000000000000000548572Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:14.448{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b747110aae68650c2021-12-21 11:37:14.448root 11241100x8000000000000000548573Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:14.448{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.cc0f13716e493a692021-12-21 11:37:14.448root 11241100x8000000000000000548574Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:14.448{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6f2442b682b385232021-12-21 11:37:14.448root 11241100x8000000000000000548575Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:14.448{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e9396132dcc9d8de2021-12-21 11:37:14.448root 11241100x8000000000000000548576Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:14.449{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.37fc728dd49f667d2021-12-21 11:37:14.449root 11241100x8000000000000000548577Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:14.449{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.80a521b47432ef532021-12-21 11:37:14.449root 11241100x8000000000000000548578Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:14.449{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.00081528bfff463b2021-12-21 11:37:14.449root 11241100x8000000000000000548579Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:14.449{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.cce3b2872314a0ef2021-12-21 11:37:14.449root 11241100x8000000000000000548580Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:14.449{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e98c057463fc5e2c2021-12-21 11:37:14.449root 11241100x8000000000000000548581Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:14.449{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.385a1e887027a8af2021-12-21 11:37:14.449root 11241100x8000000000000000548582Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:14.449{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.070dc9b436c09b862021-12-21 11:37:14.449root 11241100x8000000000000000548583Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:14.449{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0b5512142c9b4de72021-12-21 11:37:14.449root 11241100x8000000000000000548584Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:14.450{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.fc655d4a77c389d42021-12-21 11:37:14.450root 11241100x8000000000000000548585Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:14.942{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.287e36da61bd707c2021-12-21 11:37:14.942root 11241100x8000000000000000548586Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:14.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9c5e10f915c7cd2f2021-12-21 11:37:14.943root 11241100x8000000000000000548587Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:14.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.db8274dba10fdc742021-12-21 11:37:14.943root 11241100x8000000000000000548588Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:14.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.834362f6f8468ec92021-12-21 11:37:14.943root 11241100x8000000000000000548589Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:14.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9af5b1e5087ab73c2021-12-21 11:37:14.943root 11241100x8000000000000000548590Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:14.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3aa9920af410b4ef2021-12-21 11:37:14.944root 11241100x8000000000000000548591Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:14.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.017adb85b5b1c81d2021-12-21 11:37:14.944root 11241100x8000000000000000548592Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:14.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.718cbd1144a6ecd52021-12-21 11:37:14.944root 11241100x8000000000000000548593Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:14.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.443dddae2b99994b2021-12-21 11:37:14.944root 11241100x8000000000000000548594Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:14.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d147d974a95f1f3b2021-12-21 11:37:14.944root 11241100x8000000000000000548595Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:14.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5f0b43bc342640da2021-12-21 11:37:14.944root 11241100x8000000000000000548596Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:14.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.20c2e56be6a5f87d2021-12-21 11:37:14.944root 11241100x8000000000000000548597Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:14.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d1904db0d3958e312021-12-21 11:37:14.944root 11241100x8000000000000000548598Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:14.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.31501980ad67c2722021-12-21 11:37:14.944root 11241100x8000000000000000548599Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:14.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a526feaae96b7e932021-12-21 11:37:14.945root 11241100x8000000000000000548600Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:14.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1c1dfe0bcbf860642021-12-21 11:37:14.945root 11241100x8000000000000000548601Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:14.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d995e1131df10c982021-12-21 11:37:14.945root 11241100x8000000000000000548602Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:14.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ae77f9fb714e4a5f2021-12-21 11:37:14.945root 11241100x8000000000000000548603Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:14.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.539e8a9cd768e4372021-12-21 11:37:14.945root 11241100x8000000000000000548604Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:14.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.72fe29ad28faa5b12021-12-21 11:37:14.945root 11241100x8000000000000000548605Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:14.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0226264b05fb663d2021-12-21 11:37:14.945root 11241100x8000000000000000548606Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:14.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.18a021320821fd912021-12-21 11:37:14.945root 11241100x8000000000000000548607Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:14.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.183ff17f3917512b2021-12-21 11:37:14.945root 11241100x8000000000000000548608Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:14.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.261c303ebfa523f72021-12-21 11:37:14.945root 11241100x8000000000000000548609Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:14.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f4203277295e45a32021-12-21 11:37:14.945root 11241100x8000000000000000548610Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:14.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3786604ea94768c92021-12-21 11:37:14.945root 11241100x8000000000000000548611Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:14.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.07bdcbfc39f328f32021-12-21 11:37:14.945root 11241100x8000000000000000548612Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:14.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7e8c76f56d8880a52021-12-21 11:37:14.945root 11241100x8000000000000000548613Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:14.946{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d49406443eb998052021-12-21 11:37:14.946root 11241100x8000000000000000548614Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:14.946{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d71fa33494ecf9fa2021-12-21 11:37:14.946root 11241100x8000000000000000548615Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:14.946{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e94757c6a6b843912021-12-21 11:37:14.946root 11241100x8000000000000000548616Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:14.946{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.10e5004f8a87d6e72021-12-21 11:37:14.946root 11241100x8000000000000000548617Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:14.946{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.79c0db17616841712021-12-21 11:37:14.946root 11241100x8000000000000000548618Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:14.946{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.fdb6a47b697ea28c2021-12-21 11:37:14.946root 11241100x8000000000000000548619Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:14.946{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4cb5b6a0b2dd57c72021-12-21 11:37:14.946root 11241100x8000000000000000548620Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:14.946{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.54a43e7049c1659f2021-12-21 11:37:14.946root 11241100x8000000000000000548621Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:14.946{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.47cef0d3ee890fe12021-12-21 11:37:14.946root 11241100x8000000000000000548622Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:14.946{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.bcf7b75bb8dc82542021-12-21 11:37:14.946root 11241100x8000000000000000548623Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:14.946{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.616399778eb0b85d2021-12-21 11:37:14.946root 11241100x8000000000000000548624Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:14.946{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.82bf6ea56d754b042021-12-21 11:37:14.946root 11241100x8000000000000000548625Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:14.946{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e04b64b4d72b23732021-12-21 11:37:14.946root 11241100x8000000000000000548626Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:14.946{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a35b85013c4ab5d42021-12-21 11:37:14.946root 11241100x8000000000000000548627Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:14.946{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b66c4634110b89312021-12-21 11:37:14.946root 11241100x8000000000000000548628Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:14.947{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.62f4d5c2da011f432021-12-21 11:37:14.947root 11241100x8000000000000000548629Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:14.947{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a30b918408de80c32021-12-21 11:37:14.947root 11241100x8000000000000000548630Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:14.947{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b1dd20aa3da9762d2021-12-21 11:37:14.947root 11241100x8000000000000000548631Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:14.947{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a105dacf81cf13892021-12-21 11:37:14.947root 11241100x8000000000000000548632Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:14.947{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a3861d61637f96152021-12-21 11:37:14.947root 11241100x8000000000000000548633Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:14.947{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.bb75f2b7465d3e3e2021-12-21 11:37:14.947root 11241100x8000000000000000548634Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:14.947{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7ba8812c1354d6fd2021-12-21 11:37:14.947root 11241100x8000000000000000548635Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:14.947{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.fdd617e3b52c5aab2021-12-21 11:37:14.947root 11241100x8000000000000000548636Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:14.947{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b4457c6542c22d952021-12-21 11:37:14.947root 11241100x8000000000000000548637Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:14.947{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1e81571cfb3e478c2021-12-21 11:37:14.947root 11241100x8000000000000000548638Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:15.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9e093a473da09e282021-12-21 11:37:15.443root 11241100x8000000000000000548639Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:15.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0f435537954522c72021-12-21 11:37:15.443root 11241100x8000000000000000548640Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:15.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8e8d05ec64bccfe32021-12-21 11:37:15.443root 11241100x8000000000000000548641Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:15.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.380ce6011fec812e2021-12-21 11:37:15.443root 11241100x8000000000000000548642Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:15.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b6e92238652be2782021-12-21 11:37:15.443root 11241100x8000000000000000548643Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:15.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.780e83c3fa8922ff2021-12-21 11:37:15.444root 11241100x8000000000000000548644Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:15.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4b31720726cc83fe2021-12-21 11:37:15.444root 11241100x8000000000000000548645Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:15.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.097dd0a42e6a7aa02021-12-21 11:37:15.444root 11241100x8000000000000000548646Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:15.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.16f14716809455b72021-12-21 11:37:15.444root 11241100x8000000000000000548647Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:15.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8991c093106eab222021-12-21 11:37:15.444root 11241100x8000000000000000548648Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:15.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.289b5e38cbb123c52021-12-21 11:37:15.444root 11241100x8000000000000000548649Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:15.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4d3c6cf6f9d99afc2021-12-21 11:37:15.444root 11241100x8000000000000000548650Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:15.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b1f89a0d13fd2d312021-12-21 11:37:15.444root 11241100x8000000000000000548651Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:15.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b43c8d67057867902021-12-21 11:37:15.444root 11241100x8000000000000000548652Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:15.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.cecfcb1b357a60a72021-12-21 11:37:15.445root 11241100x8000000000000000548653Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:15.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9fc2748789239de62021-12-21 11:37:15.445root 11241100x8000000000000000548654Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:15.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d459194fac5dbf582021-12-21 11:37:15.445root 11241100x8000000000000000548655Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:15.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9f6ca0dccb7cd5002021-12-21 11:37:15.445root 11241100x8000000000000000548656Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:15.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1fae0b752b6e2e632021-12-21 11:37:15.445root 11241100x8000000000000000548657Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:15.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.728dbea875baa5052021-12-21 11:37:15.445root 11241100x8000000000000000548658Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:15.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1ce612109691860b2021-12-21 11:37:15.445root 11241100x8000000000000000548659Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:15.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9741ad37a0adba2a2021-12-21 11:37:15.445root 11241100x8000000000000000548660Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:15.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5547d1ce25d3f6162021-12-21 11:37:15.445root 11241100x8000000000000000548661Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:15.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.642a791e01ef73472021-12-21 11:37:15.445root 11241100x8000000000000000548662Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:15.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ad8bc22e8c29ce272021-12-21 11:37:15.445root 11241100x8000000000000000548663Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:15.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8a44c4e98e1d2fd52021-12-21 11:37:15.445root 11241100x8000000000000000548664Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:15.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1d26e1b5745486ae2021-12-21 11:37:15.445root 11241100x8000000000000000548665Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:15.446{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ed34de5753b63dd22021-12-21 11:37:15.446root 11241100x8000000000000000548666Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:15.446{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.451e953aef60bcfc2021-12-21 11:37:15.446root 11241100x8000000000000000548667Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:15.446{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.866a09dbf0cde77e2021-12-21 11:37:15.446root 11241100x8000000000000000548668Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:15.446{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.079ce3ff3b8f43bc2021-12-21 11:37:15.446root 11241100x8000000000000000548669Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:15.446{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.82d302ef35f16ed52021-12-21 11:37:15.446root 11241100x8000000000000000548670Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:15.446{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9a768528bcdc2d6c2021-12-21 11:37:15.446root 11241100x8000000000000000548671Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:15.446{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6fcdd2eb32d7896b2021-12-21 11:37:15.446root 11241100x8000000000000000548672Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:15.446{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0780bcc494559ce22021-12-21 11:37:15.446root 11241100x8000000000000000548673Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:15.446{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2a9a22a0abeb507e2021-12-21 11:37:15.446root 11241100x8000000000000000548674Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:15.446{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6a214a058f89f3b42021-12-21 11:37:15.446root 11241100x8000000000000000548675Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:15.446{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ae541489c983e7e92021-12-21 11:37:15.446root 11241100x8000000000000000548676Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:15.446{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.fe2b30327a8587032021-12-21 11:37:15.446root 11241100x8000000000000000548677Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:15.446{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d1748d594348288d2021-12-21 11:37:15.446root 11241100x8000000000000000548678Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:15.446{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b9d99ddadfba34482021-12-21 11:37:15.446root 11241100x8000000000000000548679Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:15.446{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.bf9866a3e36f540a2021-12-21 11:37:15.446root 11241100x8000000000000000548680Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:15.447{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.78ffe9f5e566adc42021-12-21 11:37:15.447root 11241100x8000000000000000548681Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:15.447{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.95fd147b1317d9e22021-12-21 11:37:15.447root 11241100x8000000000000000548682Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:15.447{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7a705198622303982021-12-21 11:37:15.447root 11241100x8000000000000000548683Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:15.447{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0f8e53d81be953de2021-12-21 11:37:15.447root 11241100x8000000000000000548684Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:15.447{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.743535d6b186c6ba2021-12-21 11:37:15.447root 11241100x8000000000000000548685Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:15.447{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.449571d7fcb2392d2021-12-21 11:37:15.447root 11241100x8000000000000000548686Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:15.447{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.adcb9074019e4bdc2021-12-21 11:37:15.447root 11241100x8000000000000000548687Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:15.447{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.04b5db4e32fc0b7d2021-12-21 11:37:15.447root 11241100x8000000000000000548688Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:15.447{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4d398d2197bd2fc62021-12-21 11:37:15.447root 11241100x8000000000000000548689Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:15.447{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9c7345889ddea0f72021-12-21 11:37:15.447root 11241100x8000000000000000548690Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:15.448{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9850bc7714f207402021-12-21 11:37:15.448root 11241100x8000000000000000548691Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:15.448{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8f61461c57e673652021-12-21 11:37:15.448root 11241100x8000000000000000548692Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:15.448{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7f47a8b4fbe448b42021-12-21 11:37:15.448root 11241100x8000000000000000548693Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:15.448{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e9d7022414b81e2f2021-12-21 11:37:15.448root 11241100x8000000000000000548694Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:15.448{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.55cfff6710b40dcf2021-12-21 11:37:15.448root 11241100x8000000000000000548695Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:15.448{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.48c6cd0262f639952021-12-21 11:37:15.448root 534500x8000000000000000548696Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:15.888{00000000-0000-0000-0000-000000000000}9918<unknown process>ubuntu 11241100x8000000000000000548697Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:15.889{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.86f9acc2d479bc8d2021-12-21 11:37:15.889root 11241100x8000000000000000548698Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:15.889{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9294299f0fc7c6302021-12-21 11:37:15.889root 11241100x8000000000000000548699Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:15.889{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.48d5ce27149c85032021-12-21 11:37:15.889root 11241100x8000000000000000548700Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:15.889{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.55f38b97b91719df2021-12-21 11:37:15.889root 11241100x8000000000000000548701Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:15.890{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.eb981665587783bb2021-12-21 11:37:15.890root 11241100x8000000000000000548702Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:15.890{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6e5e947b92f8d2322021-12-21 11:37:15.890root 11241100x8000000000000000548703Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:15.890{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b65220fa5f262cfe2021-12-21 11:37:15.890root 11241100x8000000000000000548704Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:15.890{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.77bb1adbc2bed2232021-12-21 11:37:15.890root 11241100x8000000000000000548705Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:15.890{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.967a8f10e15086042021-12-21 11:37:15.890root 11241100x8000000000000000548706Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:15.890{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.74a34d5a33b9ab662021-12-21 11:37:15.890root 11241100x8000000000000000548707Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:15.890{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.69d1b84243fcf6ee2021-12-21 11:37:15.890root 11241100x8000000000000000548708Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:15.890{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.597a068644e882652021-12-21 11:37:15.890root 11241100x8000000000000000548709Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:15.890{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.46d5ffc25b79d8b72021-12-21 11:37:15.890root 11241100x8000000000000000548710Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:15.891{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a6955e0565434dba2021-12-21 11:37:15.891root 11241100x8000000000000000548711Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:15.891{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0e5dee335f9384642021-12-21 11:37:15.891root 11241100x8000000000000000548712Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:15.891{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d25179b698ab3fd02021-12-21 11:37:15.891root 11241100x8000000000000000548713Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:15.891{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.aa88ced8fb13e3062021-12-21 11:37:15.891root 11241100x8000000000000000548714Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:15.891{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f92698dd867e4d602021-12-21 11:37:15.891root 11241100x8000000000000000548715Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:15.891{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.dbfd929edefa35bc2021-12-21 11:37:15.891root 11241100x8000000000000000548716Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:15.891{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3859d4102a27de102021-12-21 11:37:15.891root 534500x8000000000000000548717Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:15.891{00000000-0000-0000-0000-000000000000}9919<unknown process>ubuntu 11241100x8000000000000000548718Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:15.891{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.57c33274f4701b3c2021-12-21 11:37:15.891root 11241100x8000000000000000548719Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:15.891{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b372883692f7b5a52021-12-21 11:37:15.891root 11241100x8000000000000000548720Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:15.892{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.bc496d856371d4e02021-12-21 11:37:15.892root 11241100x8000000000000000548721Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:15.892{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e1bdba8c9a7a6ed92021-12-21 11:37:15.892root 11241100x8000000000000000548722Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:15.892{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a8bd43268e30840a2021-12-21 11:37:15.892root 11241100x8000000000000000548723Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:15.892{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1037a2dd03bc77502021-12-21 11:37:15.892root 11241100x8000000000000000548724Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:15.892{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d8d2499bfb2067f82021-12-21 11:37:15.892root 11241100x8000000000000000548725Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:15.892{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0c6faec228448b852021-12-21 11:37:15.892root 11241100x8000000000000000548726Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:15.892{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3538002d896a50492021-12-21 11:37:15.892root 11241100x8000000000000000548727Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:15.892{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.55993e1fd7f301222021-12-21 11:37:15.892root 11241100x8000000000000000548728Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:15.892{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.951cfb68dda544ba2021-12-21 11:37:15.892root 11241100x8000000000000000548729Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:15.892{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3fe2ab2f6a9bc5ba2021-12-21 11:37:15.892root 11241100x8000000000000000548730Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:15.892{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9967b19699e9ae112021-12-21 11:37:15.892root 11241100x8000000000000000548731Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:15.892{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.bcef1ff58c0317502021-12-21 11:37:15.892root 11241100x8000000000000000548732Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:15.892{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.28607c010975d5bd2021-12-21 11:37:15.892root 534500x8000000000000000548733Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:15.892{00000000-0000-0000-0000-000000000000}9920<unknown process>ubuntu 11241100x8000000000000000548734Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:15.893{ec2b6afe-aacb-61c1-0834-fdd63c560000}5677/bin/bash/tmp/sh-thd.Wbda7D2021-12-21 11:37:15.893ubuntu 23542300x8000000000000000548735Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:15.893{ec2b6afe-aacb-61c1-0834-fdd63c560000}5677ubuntu/bin/bash/tmp/sh-thd.Wbda7D--- 11241100x8000000000000000548736Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:15.893{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5e383a6244cef6612021-12-21 11:37:15.893root 11241100x8000000000000000548737Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:15.893{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3a9c2f148c44dc552021-12-21 11:37:15.893root 11241100x8000000000000000548738Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:15.893{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e6c10df49a3b7c812021-12-21 11:37:15.893root 11241100x8000000000000000548739Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:15.893{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e16de36fd47d89992021-12-21 11:37:15.893root 11241100x8000000000000000548740Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:15.894{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7fabdd83a6b4fd112021-12-21 11:37:15.894root 11241100x8000000000000000548741Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:15.894{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.60082d907b414bb82021-12-21 11:37:15.894root 11241100x8000000000000000548742Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:15.894{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c2837dd83e3741e82021-12-21 11:37:15.894root 11241100x8000000000000000548743Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:15.894{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.441950e4688b84322021-12-21 11:37:15.894root 11241100x8000000000000000548744Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:15.894{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b1eccdda2a34547e2021-12-21 11:37:15.894root 11241100x8000000000000000548745Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:15.894{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5b83968de0a2cc112021-12-21 11:37:15.894root 11241100x8000000000000000548746Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:15.894{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d287a2df67832fc12021-12-21 11:37:15.894root 11241100x8000000000000000548747Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:15.894{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5a066bf915c0763f2021-12-21 11:37:15.894root 11241100x8000000000000000548748Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:15.894{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.19cd52db7f191e162021-12-21 11:37:15.894root 11241100x8000000000000000548749Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:15.894{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f60a3b6201445c0e2021-12-21 11:37:15.894root 11241100x8000000000000000548750Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:15.894{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b493972ae5ffa0a32021-12-21 11:37:15.894root 11241100x8000000000000000548751Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:15.894{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.29de9010aa912cb22021-12-21 11:37:15.894root 11241100x8000000000000000548752Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:15.895{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b7b711df2bc8e47f2021-12-21 11:37:15.895root 11241100x8000000000000000548753Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:15.895{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7482d575780b6b5c2021-12-21 11:37:15.895root 11241100x8000000000000000548754Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:15.895{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7c9456bea67d92a22021-12-21 11:37:15.895root 11241100x8000000000000000548755Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:15.895{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f15f03fe03bdc0ad2021-12-21 11:37:15.895root 11241100x8000000000000000548756Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:15.895{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.474a091e1873d9942021-12-21 11:37:15.895root 11241100x8000000000000000548757Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:15.895{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1b241f15e6a389c02021-12-21 11:37:15.895root 11241100x8000000000000000548758Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:15.895{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c49dfa681b92f32a2021-12-21 11:37:15.895root 11241100x8000000000000000548759Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:15.897{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.236367a79a1fdae52021-12-21 11:37:15.897root 11241100x8000000000000000548760Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:15.897{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.97c813c1e85e1b2d2021-12-21 11:37:15.897root 11241100x8000000000000000548761Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:15.897{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d9c63e86f0e1b0832021-12-21 11:37:15.897root 11241100x8000000000000000548762Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:15.898{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.87fe7521687bfb5d2021-12-21 11:37:15.898root 11241100x8000000000000000548763Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:15.898{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.86e5387627132ce92021-12-21 11:37:15.898root 11241100x8000000000000000548764Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:15.898{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d4b32155b97933622021-12-21 11:37:15.898root 11241100x8000000000000000548765Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:15.898{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.fbab410564477cce2021-12-21 11:37:15.898root 11241100x8000000000000000548766Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:15.898{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8c9eab216616eb432021-12-21 11:37:15.898root 11241100x8000000000000000548767Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:15.898{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f7132a2f1fb2ba722021-12-21 11:37:15.898root 11241100x8000000000000000548768Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:15.898{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.bbf12c4211ba77262021-12-21 11:37:15.898root 11241100x8000000000000000548769Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:15.898{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3a72bf216c5420b72021-12-21 11:37:15.898root 11241100x8000000000000000548770Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:15.898{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7c89bc4452c340f22021-12-21 11:37:15.898root 11241100x8000000000000000548771Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:15.898{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.cc90280c407faf0b2021-12-21 11:37:15.898root 11241100x8000000000000000548772Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:15.899{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.282a102b0a8e9fb12021-12-21 11:37:15.899root 11241100x8000000000000000548773Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:15.899{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.28d8c5bb4080f1232021-12-21 11:37:15.899root 11241100x8000000000000000548774Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:15.899{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1892045bfdd19ac52021-12-21 11:37:15.899root 11241100x8000000000000000548775Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:15.899{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f72692f9203504782021-12-21 11:37:15.899root 11241100x8000000000000000548776Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:15.899{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c0e05c09880144d12021-12-21 11:37:15.899root 11241100x8000000000000000548777Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:15.899{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ac442a2ab6a1be752021-12-21 11:37:15.899root 11241100x8000000000000000548778Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:15.902{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.10b4173a6bf53a982021-12-21 11:37:15.902root 11241100x8000000000000000548779Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:15.902{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2ea93237608ffd9b2021-12-21 11:37:15.902root 11241100x8000000000000000548780Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:15.907{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.10fd1d32eae814552021-12-21 11:37:15.907root 11241100x8000000000000000548781Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:15.907{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8f1799eca945151f2021-12-21 11:37:15.907root 11241100x8000000000000000548782Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:15.907{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.35497c4b3b063e372021-12-21 11:37:15.907root 11241100x8000000000000000548783Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:15.907{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.57b45d156fddbe392021-12-21 11:37:15.907root 11241100x8000000000000000548784Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:15.907{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.abbc584aa3ed59b22021-12-21 11:37:15.907root 11241100x8000000000000000548785Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:15.908{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3602cff74fecd7652021-12-21 11:37:15.908root 11241100x8000000000000000548786Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:15.908{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.285d267bad64fc892021-12-21 11:37:15.908root 11241100x8000000000000000548787Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:15.908{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d92e2d6e67b28ca22021-12-21 11:37:15.908root 11241100x8000000000000000548788Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:15.908{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c28b78b556a90b2c2021-12-21 11:37:15.908root 11241100x8000000000000000548789Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:15.908{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.62916a34bbcd03992021-12-21 11:37:15.908root 11241100x8000000000000000548790Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:15.908{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1b89b540eac599a02021-12-21 11:37:15.908root 11241100x8000000000000000548791Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:15.908{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f42bd7d6244ca6a12021-12-21 11:37:15.908root 11241100x8000000000000000548792Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:15.909{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.fa939e9e3d301d2b2021-12-21 11:37:15.909root 11241100x8000000000000000548793Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:15.909{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.933abf6583fc1ced2021-12-21 11:37:15.909root 11241100x8000000000000000548794Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:15.909{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5c01cd2e9764c6dc2021-12-21 11:37:15.909root 11241100x8000000000000000548795Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:15.909{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f7f08d0b6497f75b2021-12-21 11:37:15.909root 11241100x8000000000000000548796Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:15.909{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.12d025992fdde0b52021-12-21 11:37:15.909root 11241100x8000000000000000548797Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:15.909{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2b8d8ef956a7b7162021-12-21 11:37:15.909root 11241100x8000000000000000548798Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:15.909{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f59de2fd407f919a2021-12-21 11:37:15.909root 11241100x8000000000000000548799Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:15.910{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1b8710f359364c342021-12-21 11:37:15.910root 11241100x8000000000000000548800Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:15.910{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a6874a19afb2244e2021-12-21 11:37:15.910root 11241100x8000000000000000548801Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:15.910{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1ed572396e8de5682021-12-21 11:37:15.910root 11241100x8000000000000000548802Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:15.910{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.62643ecb221f3dc22021-12-21 11:37:15.910root 11241100x8000000000000000548803Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:15.910{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.64e0be8132b530562021-12-21 11:37:15.910root 11241100x8000000000000000548804Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:15.911{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1735c3fa2cf2d39f2021-12-21 11:37:15.911root 11241100x8000000000000000548805Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:15.911{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b65d2cd0534ee2992021-12-21 11:37:15.911root 11241100x8000000000000000548806Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:15.911{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.384d7c84cafb83ff2021-12-21 11:37:15.911root 11241100x8000000000000000548807Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:15.911{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.111085b15249c5122021-12-21 11:37:15.911root 11241100x8000000000000000548808Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:15.911{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c3d9fe2dd92f2efe2021-12-21 11:37:15.911root 11241100x8000000000000000548809Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:15.911{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.302fe40d05eec16f2021-12-21 11:37:15.911root 11241100x8000000000000000548810Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:15.911{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9de5ecc7ad585f612021-12-21 11:37:15.911root 11241100x8000000000000000548811Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:15.912{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9353b4acdb947a8b2021-12-21 11:37:15.912root 11241100x8000000000000000548812Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:15.912{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0f15b28abf84e2662021-12-21 11:37:15.912root 11241100x8000000000000000548813Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:15.912{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.252566c8d4f1ca902021-12-21 11:37:15.912root 11241100x8000000000000000548814Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:15.912{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.93eeff2c8e8c20312021-12-21 11:37:15.912root 11241100x8000000000000000548815Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:15.912{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.22e9b396ca1c66b52021-12-21 11:37:15.912root 11241100x8000000000000000548816Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:15.912{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.844424f2d979a8962021-12-21 11:37:15.912root 11241100x8000000000000000548817Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:15.912{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.796403c7cc6768232021-12-21 11:37:15.912root 11241100x8000000000000000548818Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:15.912{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b8b045534c87d31f2021-12-21 11:37:15.912root 11241100x8000000000000000548819Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:15.912{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.91433429039ea0832021-12-21 11:37:15.912root 11241100x8000000000000000548820Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:15.912{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.586f15f28d1f8ecf2021-12-21 11:37:15.912root 11241100x8000000000000000548821Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:15.912{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.10685813e05180e52021-12-21 11:37:15.912root 11241100x8000000000000000548822Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:15.912{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e433d797e552af732021-12-21 11:37:15.912root 11241100x8000000000000000548823Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:15.912{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.366510c8791083422021-12-21 11:37:15.912root 11241100x8000000000000000548824Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:15.912{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.278832e35a0f00782021-12-21 11:37:15.912root 11241100x8000000000000000548825Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:15.912{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a5a153e7d4806a4d2021-12-21 11:37:15.912root 11241100x8000000000000000548826Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:15.913{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.15cc179fee6ebac82021-12-21 11:37:15.913root 11241100x8000000000000000548827Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:15.913{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6befe448953b8d532021-12-21 11:37:15.913root 11241100x8000000000000000548828Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:15.913{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2f0c11cea20110ee2021-12-21 11:37:15.913root 11241100x8000000000000000548829Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:15.913{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.22cf3cfa8d397d782021-12-21 11:37:15.913root 11241100x8000000000000000548830Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:15.913{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.17be68f7bc7315422021-12-21 11:37:15.913root 11241100x8000000000000000548831Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:15.913{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.794596cc08150ab62021-12-21 11:37:15.913root 11241100x8000000000000000548832Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:15.913{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a15f545ed0a6c0c32021-12-21 11:37:15.913root 11241100x8000000000000000548833Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:15.913{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2aacfc866b99959e2021-12-21 11:37:15.913root 11241100x8000000000000000548834Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:15.913{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c948176750bcd15b2021-12-21 11:37:15.913root 11241100x8000000000000000548835Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:15.913{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.08c1a174b42edecd2021-12-21 11:37:15.913root 11241100x8000000000000000548836Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:15.913{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1b70a94873e7b7202021-12-21 11:37:15.913root 11241100x8000000000000000548837Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:15.913{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.11fb1a0b8389bb8a2021-12-21 11:37:15.913root 11241100x8000000000000000548838Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:15.913{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0c42c1e4b681548d2021-12-21 11:37:15.913root 11241100x8000000000000000548839Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:15.913{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c6572f28194431342021-12-21 11:37:15.913root 11241100x8000000000000000548840Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:15.913{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.00bfb75970de35a52021-12-21 11:37:15.913root 11241100x8000000000000000548841Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:15.913{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e11ddcdd0c15c1552021-12-21 11:37:15.913root 11241100x8000000000000000548842Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:15.914{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a66471a7d723a4662021-12-21 11:37:15.914root 11241100x8000000000000000548843Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:15.914{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9f3e9632f821411a2021-12-21 11:37:15.914root 11241100x8000000000000000548844Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:15.914{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.30cdefe1aa4cf6a52021-12-21 11:37:15.914root 11241100x8000000000000000548845Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:15.914{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6cd16a08595815152021-12-21 11:37:15.914root 11241100x8000000000000000548846Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:15.914{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.47352d06cdd7bbac2021-12-21 11:37:15.914root 11241100x8000000000000000548847Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:15.915{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.194eaf0fdb8598212021-12-21 11:37:15.915root 11241100x8000000000000000548848Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:15.915{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8abce931b400f8872021-12-21 11:37:15.915root 11241100x8000000000000000548849Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:15.915{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1759c68e7d3c0b9f2021-12-21 11:37:15.915root 11241100x8000000000000000548850Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:15.915{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.81a11e4fb546e6952021-12-21 11:37:15.915root 11241100x8000000000000000548851Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:15.915{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b916bf861d57081e2021-12-21 11:37:15.915root 11241100x8000000000000000548852Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:15.915{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.38e52d9b4a9b78f82021-12-21 11:37:15.915root 11241100x8000000000000000548853Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:15.915{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8359e7b62a409b1a2021-12-21 11:37:15.915root 11241100x8000000000000000548854Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:15.915{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.00df825005cb39862021-12-21 11:37:15.915root 11241100x8000000000000000548855Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:15.915{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e38f8deb7adf529c2021-12-21 11:37:15.915root 11241100x8000000000000000548856Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:15.915{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2e068b4fea308e142021-12-21 11:37:15.915root 11241100x8000000000000000548857Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:15.915{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.39fba5ce55116c3d2021-12-21 11:37:15.915root 11241100x8000000000000000548858Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:15.916{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ac855b5da6eed2f22021-12-21 11:37:15.916root 11241100x8000000000000000548859Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:15.916{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1311715aaad933912021-12-21 11:37:15.916root 11241100x8000000000000000548860Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:15.916{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.82ac576ffbaf65fd2021-12-21 11:37:15.916root 11241100x8000000000000000548861Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:15.916{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2df980d4866c2b852021-12-21 11:37:15.916root 11241100x8000000000000000548862Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:15.916{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2b950dcfdec4dd2a2021-12-21 11:37:15.916root 11241100x8000000000000000548863Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:15.916{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.de3c496d1abfd7822021-12-21 11:37:15.916root 11241100x8000000000000000548864Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:15.916{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.725316b779e3d8962021-12-21 11:37:15.916root 11241100x8000000000000000548865Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:15.916{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6a4120a0d5bca2862021-12-21 11:37:15.916root 11241100x8000000000000000548866Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:15.916{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.598d3699ec1851ef2021-12-21 11:37:15.916root 11241100x8000000000000000548867Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:15.916{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9696a9647e042f5c2021-12-21 11:37:15.916root 11241100x8000000000000000548868Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:15.916{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0929496f11ca6d612021-12-21 11:37:15.916root 11241100x8000000000000000548869Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:15.916{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6fcc52eef6ea9d892021-12-21 11:37:15.916root 11241100x8000000000000000548870Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:15.916{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.fbdfc4274f66bcd52021-12-21 11:37:15.916root 11241100x8000000000000000548871Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:15.916{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a5c178d5880a44bb2021-12-21 11:37:15.916root 11241100x8000000000000000548872Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:15.917{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1093db9c543b79f22021-12-21 11:37:15.917root 11241100x8000000000000000548873Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:15.917{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7ca7bd27972e90bd2021-12-21 11:37:15.917root 11241100x8000000000000000548874Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:15.917{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c984ceac8322043f2021-12-21 11:37:15.917root 11241100x8000000000000000548875Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:15.917{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e0736be79c9dd0152021-12-21 11:37:15.917root 11241100x8000000000000000548876Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:15.917{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2884a966084eb6852021-12-21 11:37:15.917root 11241100x8000000000000000548877Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:15.917{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a1905164d82452172021-12-21 11:37:15.917root 11241100x8000000000000000548878Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:15.917{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.dd2dcc8c13c045bc2021-12-21 11:37:15.917root 11241100x8000000000000000548879Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:15.917{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.528f78c3991799012021-12-21 11:37:15.917root 11241100x8000000000000000548880Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:15.917{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d94593ebd4a09f902021-12-21 11:37:15.917root 11241100x8000000000000000548881Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:15.917{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.16979c6476af874b2021-12-21 11:37:15.917root 11241100x8000000000000000548882Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:15.917{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4752e1a3cb5977e72021-12-21 11:37:15.917root 11241100x8000000000000000548883Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:15.917{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.dffc46e646f8edf12021-12-21 11:37:15.917root 11241100x8000000000000000548884Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:15.917{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b9a3a662e5508e252021-12-21 11:37:15.917root 11241100x8000000000000000548885Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:15.917{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.096025bec7205f0e2021-12-21 11:37:15.917root 11241100x8000000000000000548886Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:15.917{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4cbf23ee31b7b12f2021-12-21 11:37:15.917root 11241100x8000000000000000548887Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:15.917{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6469147ad9de07ab2021-12-21 11:37:15.917root 11241100x8000000000000000548888Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:15.918{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.fd8e315bf86ce6732021-12-21 11:37:15.918root 11241100x8000000000000000548889Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:15.918{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.abf79020db601eca2021-12-21 11:37:15.918root 11241100x8000000000000000548890Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:15.918{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.df769cd914297e152021-12-21 11:37:15.918root 11241100x8000000000000000548891Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:15.918{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b44e2a22df19ab3c2021-12-21 11:37:15.918root 11241100x8000000000000000548892Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:15.918{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.50d97b4282ac61252021-12-21 11:37:15.918root 11241100x8000000000000000548893Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:15.918{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ca49156a14d154802021-12-21 11:37:15.918root 11241100x8000000000000000548894Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:15.919{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.13921e891f060cd32021-12-21 11:37:15.919root 11241100x8000000000000000548895Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:15.919{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f645a4e539b28b1b2021-12-21 11:37:15.919root 11241100x8000000000000000548896Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:15.919{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c280125a1e8aa2f02021-12-21 11:37:15.919root 11241100x8000000000000000548897Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:15.919{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c888f77b19c5c0f42021-12-21 11:37:15.919root 11241100x8000000000000000548898Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:15.919{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4ee1384ad279a8272021-12-21 11:37:15.919root 11241100x8000000000000000548899Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:15.919{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.192eeb085ea70b502021-12-21 11:37:15.919root 11241100x8000000000000000548900Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:15.919{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2cb6dfd3d3a96a392021-12-21 11:37:15.919root 11241100x8000000000000000548901Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:15.919{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.28ac3286ae7b37582021-12-21 11:37:15.919root 11241100x8000000000000000548902Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:15.919{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7e0538d09ddc777b2021-12-21 11:37:15.919root 11241100x8000000000000000548903Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:15.919{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7fbedf2bfa87cb902021-12-21 11:37:15.919root 11241100x8000000000000000548904Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:15.919{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5c9a34dbddb256e82021-12-21 11:37:15.919root 11241100x8000000000000000548905Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:15.919{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.eae4ce9d164167622021-12-21 11:37:15.919root 11241100x8000000000000000548906Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:15.919{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.37e1062228c87a242021-12-21 11:37:15.919root 11241100x8000000000000000548907Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:15.920{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.efb408df2fcd56912021-12-21 11:37:15.920root 11241100x8000000000000000548908Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:15.920{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5ecb8c314efd1c522021-12-21 11:37:15.920root 11241100x8000000000000000548909Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:15.920{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.90db05fd332f41b62021-12-21 11:37:15.920root 11241100x8000000000000000548910Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:15.920{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.09c77c0c14a80a122021-12-21 11:37:15.920root 11241100x8000000000000000548911Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:15.920{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3601eebc2a204f952021-12-21 11:37:15.920root 11241100x8000000000000000548912Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:15.920{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3551c485bcfae6f72021-12-21 11:37:15.920root 11241100x8000000000000000548913Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:15.920{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c3c47c4be2b694b42021-12-21 11:37:15.920root 11241100x8000000000000000548914Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:15.920{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.cbfa65aaa103a3f72021-12-21 11:37:15.920root 11241100x8000000000000000548915Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:15.920{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4de11ca1328fc0392021-12-21 11:37:15.920root 11241100x8000000000000000548916Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:15.920{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.be12722ba4ed2fa62021-12-21 11:37:15.920root 11241100x8000000000000000548917Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:15.920{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.98d2cc9db65d42752021-12-21 11:37:15.920root 11241100x8000000000000000548918Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:15.923{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4ba26bd146a98ea92021-12-21 11:37:15.923root 11241100x8000000000000000548919Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:15.923{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.19b360450e547c072021-12-21 11:37:15.923root 11241100x8000000000000000548920Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:15.923{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1abbfa54e9919d782021-12-21 11:37:15.923root 11241100x8000000000000000548921Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:15.923{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f0d3457b1dcabdc02021-12-21 11:37:15.923root 11241100x8000000000000000548922Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:15.923{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.24709c487a701a302021-12-21 11:37:15.923root 11241100x8000000000000000548923Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:15.924{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2f1c2a922a92492e2021-12-21 11:37:15.924root 11241100x8000000000000000548924Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:15.924{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.848c58f282278e282021-12-21 11:37:15.924root 11241100x8000000000000000548925Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:15.924{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5508da9c4ccfba5e2021-12-21 11:37:15.924root 11241100x8000000000000000548926Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:15.924{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7d7869b51395fbd82021-12-21 11:37:15.924root 11241100x8000000000000000548927Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:15.924{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.dd086671283acbb92021-12-21 11:37:15.924root 11241100x8000000000000000548928Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:15.924{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.abd22f0ecec4cbff2021-12-21 11:37:15.924root 11241100x8000000000000000548929Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:15.924{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5cdc106729d20a782021-12-21 11:37:15.924root 11241100x8000000000000000548930Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:15.924{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c8175044e76baf762021-12-21 11:37:15.924root 11241100x8000000000000000548931Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:15.925{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.425e4679b61eccd02021-12-21 11:37:15.925root 11241100x8000000000000000548932Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:15.925{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.30f09205133a8a332021-12-21 11:37:15.925root 11241100x8000000000000000548933Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:15.925{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.79636a08a1052f682021-12-21 11:37:15.925root 11241100x8000000000000000548934Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:15.925{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.68d4e4bbbf79e97c2021-12-21 11:37:15.925root 11241100x8000000000000000548935Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:15.925{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5b6409af6a52aa892021-12-21 11:37:15.925root 11241100x8000000000000000548936Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:15.925{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5748d97e73d2d65c2021-12-21 11:37:15.925root 11241100x8000000000000000548937Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:15.925{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5c14ad74b6e3865b2021-12-21 11:37:15.925root 11241100x8000000000000000548938Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:15.926{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7dabbca9acb305af2021-12-21 11:37:15.926root 11241100x8000000000000000548939Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:15.926{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6ed23a956d0afd242021-12-21 11:37:15.926root 11241100x8000000000000000548940Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:15.926{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.321de6efb2445bc72021-12-21 11:37:15.926root 11241100x8000000000000000548941Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:15.926{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1c2e9c3fd6e869d22021-12-21 11:37:15.926root 11241100x8000000000000000548942Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:15.926{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c218686baf920fe22021-12-21 11:37:15.926root 11241100x8000000000000000548943Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:15.927{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a67218dd760b52dd2021-12-21 11:37:15.927root 11241100x8000000000000000548944Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:15.927{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0ebd1e8676f8c5a92021-12-21 11:37:15.927root 11241100x8000000000000000548945Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:15.927{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1143280eed867f152021-12-21 11:37:15.927root 11241100x8000000000000000548946Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:15.927{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.866b8c4b87edb42d2021-12-21 11:37:15.927root 11241100x8000000000000000548947Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:15.927{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c703be44993ad7c62021-12-21 11:37:15.927root 11241100x8000000000000000548948Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:15.927{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.de2839e5387766992021-12-21 11:37:15.927root 11241100x8000000000000000548949Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:15.927{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3e7936b84fc8e3ad2021-12-21 11:37:15.927root 11241100x8000000000000000548950Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:15.928{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.529a6a07a5c366332021-12-21 11:37:15.928root 11241100x8000000000000000548951Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:15.928{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.de8e00af4c70aedf2021-12-21 11:37:15.928root 11241100x8000000000000000548952Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:15.928{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.59529f687c9aa50d2021-12-21 11:37:15.928root 11241100x8000000000000000548953Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:15.928{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e909d6710447dc062021-12-21 11:37:15.928root 11241100x8000000000000000548954Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:15.928{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a76039669ac391ff2021-12-21 11:37:15.928root 11241100x8000000000000000548955Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:15.928{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.37d5b29c704cafe92021-12-21 11:37:15.928root 11241100x8000000000000000548956Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:15.928{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7dc52d96fa0c9c5e2021-12-21 11:37:15.928root 11241100x8000000000000000548957Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:15.928{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.72062be2383733932021-12-21 11:37:15.928root 11241100x8000000000000000548958Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:15.928{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.eaea5f818ed212722021-12-21 11:37:15.928root 11241100x8000000000000000548959Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:15.928{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.322203f3c015c5572021-12-21 11:37:15.928root 11241100x8000000000000000548960Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:15.928{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.42854bfecc182b1f2021-12-21 11:37:15.928root 11241100x8000000000000000548961Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:15.928{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5a5c600168e577af2021-12-21 11:37:15.928root 11241100x8000000000000000548962Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:15.928{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.03e7968fd2b6445a2021-12-21 11:37:15.928root 11241100x8000000000000000548963Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:15.929{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8d7619667bc32d102021-12-21 11:37:15.929root 11241100x8000000000000000548964Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:15.929{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.adde754d90f1b8da2021-12-21 11:37:15.929root 11241100x8000000000000000548965Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:15.929{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.330001c99f383fa82021-12-21 11:37:15.929root 11241100x8000000000000000548966Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:15.929{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5ed9493c7c9ede832021-12-21 11:37:15.929root 11241100x8000000000000000548967Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:15.929{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5ae11256e1ae6ab32021-12-21 11:37:15.929root 11241100x8000000000000000548968Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:15.929{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ab701432c626da902021-12-21 11:37:15.929root 11241100x8000000000000000548969Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:15.929{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d6d90c74c137dcd42021-12-21 11:37:15.929root 11241100x8000000000000000548970Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:15.929{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d6ac82aab5cb28152021-12-21 11:37:15.929root 11241100x8000000000000000548971Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:15.929{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.29d4587d2998b8f52021-12-21 11:37:15.929root 11241100x8000000000000000548972Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:15.929{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.87b8d403046eee1b2021-12-21 11:37:15.929root 11241100x8000000000000000548973Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:15.929{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.15c068b9e4c27f4b2021-12-21 11:37:15.929root 11241100x8000000000000000548974Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:15.929{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.984d7f9bce6519902021-12-21 11:37:15.929root 11241100x8000000000000000548975Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:15.929{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.fecefe04bd3fc20b2021-12-21 11:37:15.929root 11241100x8000000000000000548976Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:15.929{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d3c3c642f9ba11432021-12-21 11:37:15.929root 11241100x8000000000000000548977Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:15.929{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.67f6ee3586c123ec2021-12-21 11:37:15.929root 11241100x8000000000000000548978Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:15.930{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5c34706589524a212021-12-21 11:37:15.930root 11241100x8000000000000000548979Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:15.930{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.cf002ba56666a42b2021-12-21 11:37:15.930root 11241100x8000000000000000548980Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:15.930{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.df2d7cb716334c972021-12-21 11:37:15.930root 11241100x8000000000000000548981Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:15.930{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.bfef45f2e9044cf62021-12-21 11:37:15.930root 11241100x8000000000000000548982Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:15.930{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.26d2ae39dcac05012021-12-21 11:37:15.930root 11241100x8000000000000000548983Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:15.930{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a8018fed77ee8ba62021-12-21 11:37:15.930root 11241100x8000000000000000548984Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:15.930{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3449be7c01f3aae02021-12-21 11:37:15.930root 11241100x8000000000000000548985Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:15.930{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f3efcb6795b35fd82021-12-21 11:37:15.930root 11241100x8000000000000000548986Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:15.930{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.683a35c14ce765af2021-12-21 11:37:15.930root 11241100x8000000000000000548987Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:15.930{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.dec8014234cbccee2021-12-21 11:37:15.930root 11241100x8000000000000000548988Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:15.930{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a70665c7cff1bd8b2021-12-21 11:37:15.930root 11241100x8000000000000000548989Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:15.930{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8c3c6c772157fed52021-12-21 11:37:15.930root 11241100x8000000000000000548990Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:15.930{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a4db985731b0bd212021-12-21 11:37:15.930root 11241100x8000000000000000548991Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:15.931{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a591b002248ab8922021-12-21 11:37:15.931root 11241100x8000000000000000548992Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:15.931{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.14b23bd0693e856a2021-12-21 11:37:15.931root 11241100x8000000000000000548993Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:15.931{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0594449550cf79d02021-12-21 11:37:15.931root 11241100x8000000000000000548994Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:15.931{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.dbbb505203967b5c2021-12-21 11:37:15.931root 11241100x8000000000000000548995Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:15.931{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4d904e20b5b79c262021-12-21 11:37:15.931root 11241100x8000000000000000548996Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:15.931{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.55ae91d38647c9aa2021-12-21 11:37:15.931root 11241100x8000000000000000548997Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:15.931{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9d627862072526112021-12-21 11:37:15.931root 11241100x8000000000000000548998Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:15.931{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9dc56af701b2ab202021-12-21 11:37:15.931root 11241100x8000000000000000548999Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:15.931{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1bb406c75ea4db932021-12-21 11:37:15.931root 11241100x8000000000000000549000Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:15.931{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d2ed5a81c3de376d2021-12-21 11:37:15.931root 11241100x8000000000000000549001Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:15.931{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0e1d791e4e54d9162021-12-21 11:37:15.931root 11241100x8000000000000000549002Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:15.931{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4132113c835516842021-12-21 11:37:15.931root 11241100x8000000000000000549003Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:15.931{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ecf923e49c566e412021-12-21 11:37:15.931root 11241100x8000000000000000549004Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:15.931{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6bec66eca1e17ce82021-12-21 11:37:15.931root 11241100x8000000000000000549005Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:15.932{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8e1e19919a6b35b92021-12-21 11:37:15.932root 11241100x8000000000000000549006Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:15.932{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2de2843c7a8e32622021-12-21 11:37:15.932root 11241100x8000000000000000549007Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:15.932{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.605243a95d39cc872021-12-21 11:37:15.932root 11241100x8000000000000000549008Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:15.932{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b57f90c26841ebff2021-12-21 11:37:15.932root 11241100x8000000000000000549009Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:15.932{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c1cb4048f1fde5c82021-12-21 11:37:15.932root 11241100x8000000000000000549010Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:15.932{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d5a5c3d639eb4c7b2021-12-21 11:37:15.932root 11241100x8000000000000000549011Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:15.932{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6f2ab04f96ff5f722021-12-21 11:37:15.932root 11241100x8000000000000000549012Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:15.932{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ad88abf06d0723f32021-12-21 11:37:15.932root 11241100x8000000000000000549013Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:15.932{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.45c56fa71e9dc1e42021-12-21 11:37:15.932root 11241100x8000000000000000549014Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:15.932{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6792994cb5d4191f2021-12-21 11:37:15.932root 11241100x8000000000000000549015Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:16.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.70948bb9df75cd4a2021-12-21 11:37:16.193root 11241100x8000000000000000549016Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:16.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.284e3cebd56783132021-12-21 11:37:16.193root 11241100x8000000000000000549017Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:16.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3795d150e7f6dd702021-12-21 11:37:16.193root 11241100x8000000000000000549018Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:16.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.093174ea787604292021-12-21 11:37:16.193root 11241100x8000000000000000549019Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:16.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9a05ddce969112492021-12-21 11:37:16.193root 11241100x8000000000000000549020Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:16.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.39e5a5211777f0f12021-12-21 11:37:16.193root 11241100x8000000000000000549021Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:16.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.27357f58444ab7e92021-12-21 11:37:16.194root 11241100x8000000000000000549022Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:16.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3f4371b520d93d1f2021-12-21 11:37:16.194root 11241100x8000000000000000549023Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:16.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c54c96d735892a0f2021-12-21 11:37:16.194root 11241100x8000000000000000549024Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:16.195{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f60a2ab7a76d94322021-12-21 11:37:16.195root 11241100x8000000000000000549025Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:16.195{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5dbbd483156b124e2021-12-21 11:37:16.195root 11241100x8000000000000000549026Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:16.195{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.86790200fcab07392021-12-21 11:37:16.195root 11241100x8000000000000000549027Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:16.195{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c433e3ea9df0be6d2021-12-21 11:37:16.195root 11241100x8000000000000000549028Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:16.195{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d58b2031797e916d2021-12-21 11:37:16.195root 11241100x8000000000000000549029Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:16.195{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0ec628ec8f88d84d2021-12-21 11:37:16.195root 11241100x8000000000000000549030Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:16.196{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.006dcd26c0fc55e72021-12-21 11:37:16.196root 11241100x8000000000000000549031Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:16.196{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.748c6703cb6028b42021-12-21 11:37:16.196root 11241100x8000000000000000549032Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:16.196{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f4f2bfabf8c272362021-12-21 11:37:16.196root 11241100x8000000000000000549033Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:16.196{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2e20ceab3ae087da2021-12-21 11:37:16.196root 11241100x8000000000000000549034Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:16.196{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d2f5c9dc8b7ac3592021-12-21 11:37:16.196root 11241100x8000000000000000549035Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:16.196{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.01d65c1b12d594082021-12-21 11:37:16.196root 11241100x8000000000000000549036Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:16.197{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9fdf21ae522329a32021-12-21 11:37:16.197root 11241100x8000000000000000549037Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:16.197{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.82c89177a31b97802021-12-21 11:37:16.197root 11241100x8000000000000000549038Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:16.197{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.06e094e2295d02f12021-12-21 11:37:16.197root 11241100x8000000000000000549039Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:16.197{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d27ec8e7b0a12bbc2021-12-21 11:37:16.197root 11241100x8000000000000000549040Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:16.197{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.375324a7c58f99fa2021-12-21 11:37:16.197root 11241100x8000000000000000549041Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:16.197{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ddc421fd0907efeb2021-12-21 11:37:16.197root 11241100x8000000000000000549042Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:16.197{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.19c38d8422b0890f2021-12-21 11:37:16.197root 11241100x8000000000000000549043Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:16.198{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.162af118f8cbab0d2021-12-21 11:37:16.198root 11241100x8000000000000000549044Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:16.198{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ab10e48e889b03482021-12-21 11:37:16.198root 11241100x8000000000000000549045Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:16.198{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.78b3cf5b42b132dd2021-12-21 11:37:16.198root 11241100x8000000000000000549046Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:16.198{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.603a3bab2a04272b2021-12-21 11:37:16.198root 11241100x8000000000000000549047Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:16.198{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.45706664a883d1e02021-12-21 11:37:16.198root 11241100x8000000000000000549048Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:16.198{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ea6ca1e7ad0f292e2021-12-21 11:37:16.198root 11241100x8000000000000000549049Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:16.198{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.926071079c6abf882021-12-21 11:37:16.198root 11241100x8000000000000000549050Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:16.198{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.012c92cbab71047d2021-12-21 11:37:16.198root 11241100x8000000000000000549051Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:16.199{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0a7a5e52d167b0c32021-12-21 11:37:16.199root 11241100x8000000000000000549052Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:16.199{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.212392ca66e7dccf2021-12-21 11:37:16.199root 11241100x8000000000000000549053Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:16.199{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e767e2592f89cd122021-12-21 11:37:16.199root 11241100x8000000000000000549054Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:16.199{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.99f08df03a86381a2021-12-21 11:37:16.199root 11241100x8000000000000000549055Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:16.199{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.28c24bea0279dd742021-12-21 11:37:16.199root 11241100x8000000000000000549056Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:16.199{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.09726f579917e33a2021-12-21 11:37:16.199root 11241100x8000000000000000549057Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:16.200{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.498e9d89059804092021-12-21 11:37:16.200root 11241100x8000000000000000549058Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:16.200{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.adce703629e756392021-12-21 11:37:16.200root 11241100x8000000000000000549059Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:16.200{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8220f1f9ae98bc532021-12-21 11:37:16.200root 11241100x8000000000000000549060Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:16.200{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f5b6fdf87f77f6192021-12-21 11:37:16.200root 11241100x8000000000000000549061Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:16.200{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.581f89880c2490a12021-12-21 11:37:16.200root 11241100x8000000000000000549062Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:16.200{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.968a010d127fabb22021-12-21 11:37:16.200root 11241100x8000000000000000549063Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:16.200{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.60022bde4d9d97852021-12-21 11:37:16.200root 11241100x8000000000000000549064Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:16.200{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0c777451f2dd78c72021-12-21 11:37:16.200root 11241100x8000000000000000549065Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:16.201{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a076220fe7630d352021-12-21 11:37:16.201root 11241100x8000000000000000549066Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:16.201{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f3c7a48e2f8dc4fe2021-12-21 11:37:16.201root 11241100x8000000000000000549067Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:16.201{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d6e2af336988a5ac2021-12-21 11:37:16.201root 11241100x8000000000000000549068Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:16.201{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3a9bb7d5d665686f2021-12-21 11:37:16.201root 11241100x8000000000000000549069Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:16.201{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.eb93b05f6ae3db442021-12-21 11:37:16.201root 11241100x8000000000000000549070Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:16.201{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.220f5cfeaeedd0d02021-12-21 11:37:16.201root 11241100x8000000000000000549071Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:16.201{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.07c036ff482b80cb2021-12-21 11:37:16.201root 11241100x8000000000000000549072Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:16.201{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.76bb8da7dd50cfe92021-12-21 11:37:16.201root 11241100x8000000000000000549073Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:16.201{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8e09a6474bd8762b2021-12-21 11:37:16.201root 11241100x8000000000000000549074Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:16.202{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.04907bff8c325e312021-12-21 11:37:16.202root 11241100x8000000000000000549075Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:16.202{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0430f82c4971d5422021-12-21 11:37:16.202root 11241100x8000000000000000549076Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:16.202{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.67a5fbfaaed73ee82021-12-21 11:37:16.202root 11241100x8000000000000000549077Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:16.202{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f4e54fccdf412ae32021-12-21 11:37:16.202root 11241100x8000000000000000549078Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:16.202{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b958b77d28d92b962021-12-21 11:37:16.202root 11241100x8000000000000000549079Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:16.202{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6ae9e2595f2e25692021-12-21 11:37:16.202root 11241100x8000000000000000549080Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:16.202{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e24e7f8e854158b62021-12-21 11:37:16.202root 11241100x8000000000000000549081Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:16.202{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c3558a87eacf51db2021-12-21 11:37:16.202root 11241100x8000000000000000549082Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:16.202{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7f9b87f2d0f49b382021-12-21 11:37:16.202root 11241100x8000000000000000549083Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:16.202{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b2e473cbfb2e3dc42021-12-21 11:37:16.202root 11241100x8000000000000000549084Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:16.202{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3741df87c7f03d422021-12-21 11:37:16.202root 11241100x8000000000000000549085Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:16.202{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.77dab69815f22df22021-12-21 11:37:16.202root 11241100x8000000000000000549086Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:16.203{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f44944857090363c2021-12-21 11:37:16.203root 11241100x8000000000000000549087Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:16.203{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0b0bf7a31e3a71252021-12-21 11:37:16.203root 11241100x8000000000000000549088Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:16.203{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.cdfd71bdd247a6342021-12-21 11:37:16.203root 11241100x8000000000000000549089Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:16.203{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9f3b6cf4490d3b5b2021-12-21 11:37:16.203root 11241100x8000000000000000549090Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:16.203{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4e4ce24498acec3c2021-12-21 11:37:16.203root 11241100x8000000000000000549091Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:16.203{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1c68e5a740f308c42021-12-21 11:37:16.203root 11241100x8000000000000000549092Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:16.203{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8e96aa457057184e2021-12-21 11:37:16.203root 11241100x8000000000000000549093Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:16.203{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.441927df9b1648e82021-12-21 11:37:16.203root 11241100x8000000000000000549094Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:16.203{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e9d8573fcc6a54632021-12-21 11:37:16.203root 11241100x8000000000000000549095Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:16.203{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9d0ed2ba6b94a4422021-12-21 11:37:16.203root 11241100x8000000000000000549096Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:16.203{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9e4879bf70fb7ef12021-12-21 11:37:16.203root 11241100x8000000000000000549097Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:16.203{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.01737d471cae05d62021-12-21 11:37:16.203root 11241100x8000000000000000549098Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:16.204{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.be31af5aeed68f022021-12-21 11:37:16.204root 11241100x8000000000000000549099Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:16.204{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ff3d4de7dfca73422021-12-21 11:37:16.204root 11241100x8000000000000000549100Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:16.204{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d16d4d8f39f11c7f2021-12-21 11:37:16.204root 11241100x8000000000000000549101Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:16.204{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ee97628c9f92fdfb2021-12-21 11:37:16.204root 11241100x8000000000000000549102Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:16.204{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e06484c4f27dc49a2021-12-21 11:37:16.204root 11241100x8000000000000000549103Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:16.204{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.13a7590065b531dd2021-12-21 11:37:16.204root 11241100x8000000000000000549104Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:16.205{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.799322e81b4c42492021-12-21 11:37:16.205root 11241100x8000000000000000549105Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:16.205{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4af1236210d7b72e2021-12-21 11:37:16.205root 11241100x8000000000000000549106Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:16.205{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e1a0225cd04675bf2021-12-21 11:37:16.205root 11241100x8000000000000000549107Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:16.205{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.56c5b595f8f42fd42021-12-21 11:37:16.205root 11241100x8000000000000000549108Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:16.205{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.be3176b9a9459e8f2021-12-21 11:37:16.205root 11241100x8000000000000000549109Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:16.205{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.612330484cb0a65e2021-12-21 11:37:16.205root 11241100x8000000000000000549110Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:16.206{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3c48b54171d34fa42021-12-21 11:37:16.206root 11241100x8000000000000000549111Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:16.206{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9c3b18d7fbfb8d142021-12-21 11:37:16.206root 11241100x8000000000000000549112Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:16.206{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.49eb021e7eb6b9302021-12-21 11:37:16.206root 11241100x8000000000000000549113Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:16.206{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.fa0bc1ec39103ab62021-12-21 11:37:16.206root 11241100x8000000000000000549114Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:16.206{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8488f3ab79bb31c02021-12-21 11:37:16.206root 11241100x8000000000000000549115Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:16.206{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.945b0ce6a2795fa02021-12-21 11:37:16.206root 11241100x8000000000000000549116Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:16.206{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5c1531b63297efb32021-12-21 11:37:16.206root 11241100x8000000000000000549117Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:16.206{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.aaea6e1980a1ae7c2021-12-21 11:37:16.206root 11241100x8000000000000000549118Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:16.207{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6bb3356e98e7073f2021-12-21 11:37:16.207root 11241100x8000000000000000549119Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:16.207{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c4fc4618c44a2a092021-12-21 11:37:16.207root 11241100x8000000000000000549120Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:16.207{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1c1ef6d35aec85342021-12-21 11:37:16.207root 11241100x8000000000000000549121Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:16.207{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c8b43352f964fac42021-12-21 11:37:16.207root 11241100x8000000000000000549122Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:16.207{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.bfa8ca2d70cb29da2021-12-21 11:37:16.207root 11241100x8000000000000000549123Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:16.207{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.23cec2c4750b02062021-12-21 11:37:16.207root 11241100x8000000000000000549124Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:16.207{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a61c8fb815baebbd2021-12-21 11:37:16.207root 11241100x8000000000000000549125Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:16.208{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.333be95cdf3574f92021-12-21 11:37:16.208root 11241100x8000000000000000549126Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:16.208{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.39b2a57ced8217632021-12-21 11:37:16.208root 11241100x8000000000000000549127Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:16.208{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7f4dea3bf0fbea2c2021-12-21 11:37:16.208root 11241100x8000000000000000549128Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:16.208{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2d87a1e001699aad2021-12-21 11:37:16.208root 11241100x8000000000000000549129Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:16.208{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b0ead322bc9080e02021-12-21 11:37:16.208root 11241100x8000000000000000549130Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:16.208{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3fda723338dcba3c2021-12-21 11:37:16.208root 11241100x8000000000000000549131Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:16.208{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.de480fd010b1d6122021-12-21 11:37:16.208root 11241100x8000000000000000549132Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:16.209{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.625b7341b334574b2021-12-21 11:37:16.209root 11241100x8000000000000000549133Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:16.209{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3952bc254d660a612021-12-21 11:37:16.209root 11241100x8000000000000000549134Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:16.209{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.68907fe45b4dd9062021-12-21 11:37:16.209root 11241100x8000000000000000549135Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:16.209{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a8d427b786a0ed2d2021-12-21 11:37:16.209root 11241100x8000000000000000549136Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:16.209{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.25b70bb6143d6bc62021-12-21 11:37:16.209root 11241100x8000000000000000549137Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:16.210{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.940767ade0b2d8962021-12-21 11:37:16.210root 11241100x8000000000000000549138Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:16.210{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.539946d8b78d9beb2021-12-21 11:37:16.210root 11241100x8000000000000000549139Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:16.210{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9b7b6f5a67ea14ff2021-12-21 11:37:16.210root 11241100x8000000000000000549140Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:16.210{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.75331ac2b2e163292021-12-21 11:37:16.210root 11241100x8000000000000000549141Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:16.211{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d8d2f9685cd2fbb72021-12-21 11:37:16.211root 11241100x8000000000000000549142Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:16.211{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.da3ef49593747ba92021-12-21 11:37:16.211root 11241100x8000000000000000549143Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:16.211{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.02eec6de1b09e3fe2021-12-21 11:37:16.211root 11241100x8000000000000000549144Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:16.211{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.86ec1eef109e65852021-12-21 11:37:16.211root 11241100x8000000000000000549145Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:16.211{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e95f58552e8b599a2021-12-21 11:37:16.211root 11241100x8000000000000000549146Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:16.211{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e66806a78597f9da2021-12-21 11:37:16.211root 11241100x8000000000000000549147Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:16.211{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3113a56b405167cc2021-12-21 11:37:16.211root 11241100x8000000000000000549148Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:16.212{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.dd254f48dc8530222021-12-21 11:37:16.212root 11241100x8000000000000000549149Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:16.212{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3828d56f790e5f922021-12-21 11:37:16.212root 11241100x8000000000000000549150Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:16.212{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ba0e05a77e6386c42021-12-21 11:37:16.212root 11241100x8000000000000000549151Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:16.212{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.41d3e61f02405d9a2021-12-21 11:37:16.212root 11241100x8000000000000000549152Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:16.212{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b8446088fd6c26332021-12-21 11:37:16.212root 11241100x8000000000000000549153Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:16.212{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8de1cd9f7fd4609e2021-12-21 11:37:16.212root 11241100x8000000000000000549154Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:16.212{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.cb96953d099c3bea2021-12-21 11:37:16.212root 11241100x8000000000000000549155Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:16.213{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6790bc37e52a18852021-12-21 11:37:16.213root 11241100x8000000000000000549156Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:16.213{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3baacbd30c7fe4cc2021-12-21 11:37:16.213root 11241100x8000000000000000549157Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:16.213{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.397305c0a78871fa2021-12-21 11:37:16.213root 11241100x8000000000000000549158Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:16.213{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7c23c798610d03552021-12-21 11:37:16.213root 11241100x8000000000000000549159Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:16.213{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.09eead5262612d7c2021-12-21 11:37:16.213root 11241100x8000000000000000549160Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:16.213{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.376a324ca31edb6e2021-12-21 11:37:16.213root 11241100x8000000000000000549161Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:16.214{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e3dea461c3610cf22021-12-21 11:37:16.214root 11241100x8000000000000000549162Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:16.214{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ed1197986479a3ff2021-12-21 11:37:16.214root 11241100x8000000000000000549163Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:16.214{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c8b4e6db1930e5f42021-12-21 11:37:16.214root 11241100x8000000000000000549164Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:16.214{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.49f44bf8c0a054142021-12-21 11:37:16.214root 11241100x8000000000000000549165Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:16.214{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.694acfd86e2a27bf2021-12-21 11:37:16.214root 11241100x8000000000000000549166Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:16.214{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c295b8c0be987f072021-12-21 11:37:16.214root 11241100x8000000000000000549167Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:16.214{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0fe8e4d2f25105a22021-12-21 11:37:16.214root 11241100x8000000000000000549168Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:16.214{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.49f57963971376dc2021-12-21 11:37:16.214root 11241100x8000000000000000549169Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:16.214{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e6766bc84366ea932021-12-21 11:37:16.214root 11241100x8000000000000000549170Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:16.214{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.622db3392b4dd47b2021-12-21 11:37:16.214root 11241100x8000000000000000549171Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:16.214{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.374be00ccc999f462021-12-21 11:37:16.214root 11241100x8000000000000000549172Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:16.215{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4856a93f06c5645e2021-12-21 11:37:16.215root 11241100x8000000000000000549173Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:16.215{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6bb34f29869448632021-12-21 11:37:16.215root 11241100x8000000000000000549174Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:16.215{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2d4effd5114ce0242021-12-21 11:37:16.215root 11241100x8000000000000000549175Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:16.215{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0b393993f787e4d82021-12-21 11:37:16.215root 11241100x8000000000000000549176Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:16.215{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.33435caf6d8ff1692021-12-21 11:37:16.215root 11241100x8000000000000000549177Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:16.215{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9fd97547a089c5f92021-12-21 11:37:16.215root 11241100x8000000000000000549178Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:16.215{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.702cda017dcf7c4d2021-12-21 11:37:16.215root 11241100x8000000000000000549179Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:16.215{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.eb18fb46e5139a6b2021-12-21 11:37:16.215root 11241100x8000000000000000549180Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:16.215{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.373eb59ff1fd7fc82021-12-21 11:37:16.215root 11241100x8000000000000000549181Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:16.215{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.192c0d63ec97db882021-12-21 11:37:16.215root 11241100x8000000000000000549182Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:16.215{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8724e938ae8d8ac52021-12-21 11:37:16.215root 11241100x8000000000000000549183Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:16.215{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.10d66b9fd4d93b2f2021-12-21 11:37:16.215root 11241100x8000000000000000549184Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:16.215{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.75bbfc316404685c2021-12-21 11:37:16.215root 11241100x8000000000000000549185Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:16.216{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5a730fdae74cd3322021-12-21 11:37:16.216root 11241100x8000000000000000549186Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:16.216{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ec3fd170df558cdd2021-12-21 11:37:16.216root 11241100x8000000000000000549187Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:16.216{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.21ef832527b691392021-12-21 11:37:16.216root 11241100x8000000000000000549188Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:16.216{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.35197126dba01a8d2021-12-21 11:37:16.216root 11241100x8000000000000000549189Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:16.216{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ae38c7ccf711e5142021-12-21 11:37:16.216root 11241100x8000000000000000549190Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:16.216{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ff0b47b39b78f1312021-12-21 11:37:16.216root 11241100x8000000000000000549191Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:16.216{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d1ac5515cf7673b32021-12-21 11:37:16.216root 11241100x8000000000000000549192Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:16.216{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.064104bb686bcfef2021-12-21 11:37:16.216root 11241100x8000000000000000549193Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:16.216{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.683090535701d31c2021-12-21 11:37:16.216root 11241100x8000000000000000549194Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:16.216{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d98981dafb2570a42021-12-21 11:37:16.216root 11241100x8000000000000000549195Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:16.217{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a5214062bd420c6e2021-12-21 11:37:16.217root 11241100x8000000000000000549196Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:16.217{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6e346f95e7812ded2021-12-21 11:37:16.217root 11241100x8000000000000000549197Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:16.217{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.171896c710e4fc352021-12-21 11:37:16.217root 11241100x8000000000000000549198Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:16.217{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c03bc2149affa1202021-12-21 11:37:16.217root 11241100x8000000000000000549199Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:16.217{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.96231634d85ad1d72021-12-21 11:37:16.217root 11241100x8000000000000000549200Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:16.217{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.cea47650354324a62021-12-21 11:37:16.217root 11241100x8000000000000000549201Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:16.217{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5c86256690b6eef42021-12-21 11:37:16.217root 11241100x8000000000000000549202Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:16.217{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7f950203924bcc4c2021-12-21 11:37:16.217root 11241100x8000000000000000549203Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:16.217{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5b91427f88fc5c682021-12-21 11:37:16.217root 11241100x8000000000000000549204Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:16.217{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.312d574da4cddfff2021-12-21 11:37:16.217root 11241100x8000000000000000549205Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:16.217{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.fb8109eb91937bf72021-12-21 11:37:16.217root 11241100x8000000000000000549206Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:16.218{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.159e16f477bc56e12021-12-21 11:37:16.218root 11241100x8000000000000000549207Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:16.218{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.37c4ec1fce95abe72021-12-21 11:37:16.218root 11241100x8000000000000000549208Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:16.218{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.28974446939e69482021-12-21 11:37:16.218root 11241100x8000000000000000549209Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:16.218{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.025dcea52ca634912021-12-21 11:37:16.218root 11241100x8000000000000000549210Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:16.218{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.bd6b8102cd1297c12021-12-21 11:37:16.218root 11241100x8000000000000000549211Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:16.218{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ad5e5bb1b30f0bae2021-12-21 11:37:16.218root 11241100x8000000000000000549212Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:16.218{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.539d9535c82b7ca52021-12-21 11:37:16.218root 11241100x8000000000000000549213Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:16.218{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.285611072ae89d842021-12-21 11:37:16.218root 11241100x8000000000000000549214Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:16.218{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.007677edbf3c68822021-12-21 11:37:16.218root 11241100x8000000000000000549215Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:16.218{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d0b760ff5dbbee4b2021-12-21 11:37:16.218root 11241100x8000000000000000549216Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:16.218{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.918beddba94901982021-12-21 11:37:16.218root 11241100x8000000000000000549217Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:16.218{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.67d180c5b5634dd02021-12-21 11:37:16.218root 11241100x8000000000000000549218Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:16.218{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.68a4a4debe9e39b62021-12-21 11:37:16.218root 11241100x8000000000000000549219Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:16.218{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8d53c0d1ed9be1012021-12-21 11:37:16.218root 11241100x8000000000000000549220Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:16.219{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6b0ff2f0ac860b3f2021-12-21 11:37:16.219root 11241100x8000000000000000549221Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:16.219{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.951380a0c92cc02f2021-12-21 11:37:16.219root 11241100x8000000000000000549222Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:16.219{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c0ae98b0ee60a4962021-12-21 11:37:16.219root 11241100x8000000000000000549223Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:16.219{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0bea1eaa52ab16262021-12-21 11:37:16.219root 11241100x8000000000000000549224Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:16.219{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6bd7f90dd4ffe9f42021-12-21 11:37:16.219root 11241100x8000000000000000549225Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:16.219{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8b50fdc9b68075bd2021-12-21 11:37:16.219root 11241100x8000000000000000549226Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:16.220{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.dab431ee4f413b7f2021-12-21 11:37:16.220root 11241100x8000000000000000549227Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:16.220{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d73ce8b9ba1c5c252021-12-21 11:37:16.220root 11241100x8000000000000000549228Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:16.220{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4201d86954fd45d02021-12-21 11:37:16.220root 11241100x8000000000000000549229Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:16.220{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3b8c30e8924c8a902021-12-21 11:37:16.220root 11241100x8000000000000000549230Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:16.220{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.68fab69ce87f0b622021-12-21 11:37:16.220root 11241100x8000000000000000549231Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:16.220{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9f37fc1acd86e69b2021-12-21 11:37:16.220root 11241100x8000000000000000549232Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:16.221{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ec0961246aa8bc972021-12-21 11:37:16.221root 11241100x8000000000000000549233Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:16.221{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1b22e37565eb4a182021-12-21 11:37:16.221root 11241100x8000000000000000549234Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:16.221{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3704d3b0ea54a9d02021-12-21 11:37:16.221root 11241100x8000000000000000549235Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:16.221{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c45ad82abaaed88c2021-12-21 11:37:16.221root 11241100x8000000000000000549236Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:16.221{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ba6f91d0c2ddb0482021-12-21 11:37:16.221root 11241100x8000000000000000549237Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:16.221{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.51c0f47166fe781f2021-12-21 11:37:16.221root 11241100x8000000000000000549238Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:16.221{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.85e6b47d87858c002021-12-21 11:37:16.221root 11241100x8000000000000000549239Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:16.221{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.20d833f8afd480222021-12-21 11:37:16.221root 11241100x8000000000000000549240Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:16.221{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c9e873011f395aac2021-12-21 11:37:16.221root 11241100x8000000000000000549241Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:16.221{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9a7d744c3258b8072021-12-21 11:37:16.221root 11241100x8000000000000000549242Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:16.221{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8e9e7d9941e1eb9a2021-12-21 11:37:16.221root 11241100x8000000000000000549243Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:16.221{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.338d6525de4fb5322021-12-21 11:37:16.221root 11241100x8000000000000000549244Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:16.222{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e3a6d229d433e37a2021-12-21 11:37:16.222root 11241100x8000000000000000549245Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:16.222{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.483c1794cca657ef2021-12-21 11:37:16.222root 11241100x8000000000000000549246Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:16.222{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d41f8c26447485082021-12-21 11:37:16.222root 11241100x8000000000000000549247Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:16.222{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e242527bc5c996172021-12-21 11:37:16.222root 11241100x8000000000000000549248Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:16.222{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2bd0e7f6230c44912021-12-21 11:37:16.222root 11241100x8000000000000000549249Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:16.222{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.656e466b57a984ff2021-12-21 11:37:16.222root 11241100x8000000000000000549250Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:16.222{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2b848085760e42832021-12-21 11:37:16.222root 11241100x8000000000000000549251Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:16.222{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.bfa4c96dcf7368952021-12-21 11:37:16.222root 11241100x8000000000000000549252Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:16.222{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.91d356e781ed9ee82021-12-21 11:37:16.222root 11241100x8000000000000000549253Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:16.222{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.91d8851d05e58b8c2021-12-21 11:37:16.222root 11241100x8000000000000000549254Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:16.222{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.824eee1a8be37b5a2021-12-21 11:37:16.222root 11241100x8000000000000000549255Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:16.692{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.17a90e4df618b0692021-12-21 11:37:16.692root 11241100x8000000000000000549256Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:16.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1c34e6ca221f02f02021-12-21 11:37:16.693root 11241100x8000000000000000549257Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:16.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4587632db1f41b8b2021-12-21 11:37:16.693root 11241100x8000000000000000549258Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:16.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6a6b148d30bf0fb42021-12-21 11:37:16.693root 11241100x8000000000000000549259Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:16.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9a107dacd691beff2021-12-21 11:37:16.693root 11241100x8000000000000000549260Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:16.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.dd5d5e58b3b8e1302021-12-21 11:37:16.693root 11241100x8000000000000000549261Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:16.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2dbaaed694cd086c2021-12-21 11:37:16.693root 11241100x8000000000000000549262Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:16.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6dd070a34f546b562021-12-21 11:37:16.693root 11241100x8000000000000000549263Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:16.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.98ec1f3042291e102021-12-21 11:37:16.693root 11241100x8000000000000000549264Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:16.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.042045acfafaf4242021-12-21 11:37:16.693root 11241100x8000000000000000549265Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:16.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.bedbc7c5ff81c4be2021-12-21 11:37:16.693root 11241100x8000000000000000549266Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:16.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.fdc5be94a833ea332021-12-21 11:37:16.693root 11241100x8000000000000000549267Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:16.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.fd6a62df2f394cf12021-12-21 11:37:16.693root 11241100x8000000000000000549268Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:16.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.91eba72af45db66c2021-12-21 11:37:16.693root 11241100x8000000000000000549269Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:16.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.faa3e6f10144d68e2021-12-21 11:37:16.693root 11241100x8000000000000000549270Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:16.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.16cb7a6bdef36a6e2021-12-21 11:37:16.694root 11241100x8000000000000000549271Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:16.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.00451bfa807d99712021-12-21 11:37:16.694root 11241100x8000000000000000549272Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:16.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5c91ce46a1345c362021-12-21 11:37:16.694root 11241100x8000000000000000549273Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:16.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.294a9d8fcd4e239f2021-12-21 11:37:16.694root 11241100x8000000000000000549274Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:16.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.988199367fc2a4492021-12-21 11:37:16.694root 11241100x8000000000000000549275Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:16.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4bd47bc0182f75242021-12-21 11:37:16.694root 11241100x8000000000000000549276Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:16.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7e77da79e44868a82021-12-21 11:37:16.694root 11241100x8000000000000000549277Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:16.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6d146e8b7698c4e02021-12-21 11:37:16.694root 11241100x8000000000000000549278Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:16.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d5fbe222d39e8fd82021-12-21 11:37:16.694root 11241100x8000000000000000549279Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:16.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e91c343d1d6a99712021-12-21 11:37:16.694root 11241100x8000000000000000549280Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:16.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.92d15475432e399f2021-12-21 11:37:16.694root 11241100x8000000000000000549281Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:16.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a4d09547ef40fb302021-12-21 11:37:16.694root 11241100x8000000000000000549282Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:16.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c37d70a5ab3898bd2021-12-21 11:37:16.694root 11241100x8000000000000000549283Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:16.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d23a94cd0f484ba72021-12-21 11:37:16.694root 11241100x8000000000000000549284Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:16.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a9aefda299c8f6682021-12-21 11:37:16.694root 11241100x8000000000000000549285Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:16.695{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.440375042dd7a1b52021-12-21 11:37:16.695root 11241100x8000000000000000549286Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:16.695{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e379b8876e86d38d2021-12-21 11:37:16.695root 11241100x8000000000000000549287Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:16.695{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c26df1b3c878a6bb2021-12-21 11:37:16.695root 11241100x8000000000000000549288Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:16.695{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b7387d7122eeb8592021-12-21 11:37:16.695root 11241100x8000000000000000549289Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:16.695{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.cc5ed5f11ec356d52021-12-21 11:37:16.695root 11241100x8000000000000000549290Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:16.695{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.be6a8869befef6ad2021-12-21 11:37:16.695root 11241100x8000000000000000549291Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:16.695{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.277197e7ff39bc272021-12-21 11:37:16.695root 11241100x8000000000000000549292Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:16.695{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a781c809b676b0d22021-12-21 11:37:16.695root 11241100x8000000000000000549293Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:16.695{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4dcef0f4db4ae0a02021-12-21 11:37:16.695root 11241100x8000000000000000549294Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:16.695{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.322f7ba80ab2b1ad2021-12-21 11:37:16.695root 11241100x8000000000000000549295Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:16.695{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7f43445c4adbeffd2021-12-21 11:37:16.695root 11241100x8000000000000000549296Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:16.695{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6acb4ae66cbb465e2021-12-21 11:37:16.695root 11241100x8000000000000000549297Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:16.695{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.01e36b1689c93b152021-12-21 11:37:16.695root 11241100x8000000000000000549298Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:16.696{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3119d2d09ac951c32021-12-21 11:37:16.696root 11241100x8000000000000000549299Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:16.696{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.77ef7911f4c85ae72021-12-21 11:37:16.696root 11241100x8000000000000000549300Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:16.696{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.607c350a537bd7152021-12-21 11:37:16.696root 11241100x8000000000000000549301Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:16.696{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.aa60a6b4427fddbc2021-12-21 11:37:16.696root 11241100x8000000000000000549302Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:16.696{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.38648ee29fd62e192021-12-21 11:37:16.696root 11241100x8000000000000000549303Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:16.696{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b3956a4926e1e8a32021-12-21 11:37:16.696root 11241100x8000000000000000549304Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:16.696{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3d341750b8d4d5ee2021-12-21 11:37:16.696root 11241100x8000000000000000549305Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:16.696{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.cf8b9785288704c62021-12-21 11:37:16.696root 11241100x8000000000000000549306Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:16.696{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7576f1ea4825ec8a2021-12-21 11:37:16.696root 11241100x8000000000000000549307Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:16.696{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.691c5877e9c90a092021-12-21 11:37:16.696root 11241100x8000000000000000549308Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:16.696{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1c8be7bf2bba299e2021-12-21 11:37:16.696root 11241100x8000000000000000549309Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:16.696{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.09c2599bf7092acc2021-12-21 11:37:16.696root 11241100x8000000000000000549310Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:16.696{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ab77f8ed97e3d2f12021-12-21 11:37:16.696root 11241100x8000000000000000549311Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:16.697{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d41d42ad451b62282021-12-21 11:37:16.697root 11241100x8000000000000000549312Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:16.697{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.de78d02ce962d5a22021-12-21 11:37:16.697root 11241100x8000000000000000549313Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:16.697{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ba1adfd4e1b64b2e2021-12-21 11:37:16.697root 11241100x8000000000000000549314Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:16.697{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.fbb67ed4a02595e22021-12-21 11:37:16.697root 11241100x8000000000000000549315Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:16.697{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.966970cbd51927742021-12-21 11:37:16.697root 11241100x8000000000000000549316Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:16.697{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.32dede14034d18852021-12-21 11:37:16.697root 11241100x8000000000000000549317Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:16.697{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.306e52925bd8ebf72021-12-21 11:37:16.697root 11241100x8000000000000000549318Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:16.697{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3db4e722fefbb4312021-12-21 11:37:16.697root 11241100x8000000000000000549319Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:16.698{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b70b90bfd837865c2021-12-21 11:37:16.698root 11241100x8000000000000000549320Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:16.698{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.dc30abe4ee1c662a2021-12-21 11:37:16.698root 11241100x8000000000000000549321Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:16.698{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3ccb8f31f88ef7152021-12-21 11:37:16.698root 11241100x8000000000000000549322Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:16.698{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.33ab7cf5e35978232021-12-21 11:37:16.698root 11241100x8000000000000000549323Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:16.698{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5c3ccd842926a5b42021-12-21 11:37:16.698root 11241100x8000000000000000549324Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:16.698{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a63b4d783cee42482021-12-21 11:37:16.698root 11241100x8000000000000000549325Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:16.698{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5c72eb1c11e7843c2021-12-21 11:37:16.698root 11241100x8000000000000000549326Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:16.698{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.addb18638ddd54e02021-12-21 11:37:16.698root 11241100x8000000000000000549327Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:16.698{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.bf71d2f33ac129c92021-12-21 11:37:16.698root 11241100x8000000000000000549328Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:16.698{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5b6f675fa8be855a2021-12-21 11:37:16.698root 11241100x8000000000000000549329Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:16.698{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.10b33fc587d84a352021-12-21 11:37:16.698root 11241100x8000000000000000549330Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:16.699{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6af0c6191e8ddd7b2021-12-21 11:37:16.699root 11241100x8000000000000000549331Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:16.699{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.eb76c6780c2577e32021-12-21 11:37:16.699root 11241100x8000000000000000549332Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:16.699{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.802fa2431b60ba2b2021-12-21 11:37:16.699root 11241100x8000000000000000549333Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:16.699{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.596bc447b12fd9c82021-12-21 11:37:16.699root 11241100x8000000000000000549334Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:16.699{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f51dc2aeaff7c2f22021-12-21 11:37:16.699root 11241100x8000000000000000549335Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:16.699{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b9c9ca77d7e11d2a2021-12-21 11:37:16.699root 11241100x8000000000000000549336Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:16.699{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.78638aa85c76ad9a2021-12-21 11:37:16.699root 11241100x8000000000000000549337Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:16.699{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6dd73457bc9a74152021-12-21 11:37:16.699root 11241100x8000000000000000549338Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:16.699{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d60d87605fd9b1c12021-12-21 11:37:16.699root 11241100x8000000000000000549339Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:16.699{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c3d7da5580918c732021-12-21 11:37:16.699root 11241100x8000000000000000549340Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:16.700{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7bdc8a6ed2bab1052021-12-21 11:37:16.700root 11241100x8000000000000000549341Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:16.700{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.dfbc935425c370ce2021-12-21 11:37:16.700root 11241100x8000000000000000549342Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:16.700{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8260359c700e20c02021-12-21 11:37:16.700root 11241100x8000000000000000549343Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:16.700{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2033be469391a77d2021-12-21 11:37:16.700root 11241100x8000000000000000549344Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:16.700{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.52c77b268382f5012021-12-21 11:37:16.700root 11241100x8000000000000000549345Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:16.700{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f1a64499ff7860502021-12-21 11:37:16.700root 11241100x8000000000000000549346Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:16.700{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.548a87c2cdafa3f62021-12-21 11:37:16.700root 11241100x8000000000000000549347Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:16.700{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8802a5e703e902562021-12-21 11:37:16.700root 11241100x8000000000000000549348Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:16.700{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.54d685d14c8b1d812021-12-21 11:37:16.700root 11241100x8000000000000000549349Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:16.700{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.00f969bb4b49cd4a2021-12-21 11:37:16.700root 11241100x8000000000000000549350Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:16.700{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7523d159a59858732021-12-21 11:37:16.700root 11241100x8000000000000000549351Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:16.700{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a811352207c0481c2021-12-21 11:37:16.700root 11241100x8000000000000000549352Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:16.701{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.92d4f7ef7416f67a2021-12-21 11:37:16.701root 11241100x8000000000000000549353Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:16.701{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1df1beabbd028d5c2021-12-21 11:37:16.701root 11241100x8000000000000000549354Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:16.701{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.abe2a05aa06be2f12021-12-21 11:37:16.701root 11241100x8000000000000000549355Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:16.701{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f274a3784dc577af2021-12-21 11:37:16.701root 11241100x8000000000000000549356Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:16.701{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b05f5bde20cf30e52021-12-21 11:37:16.701root 11241100x8000000000000000549357Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:16.701{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ac9565b0b7fa0ff02021-12-21 11:37:16.701root 11241100x8000000000000000549358Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:16.701{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0ed418c5e2c5bb2b2021-12-21 11:37:16.701root 11241100x8000000000000000549359Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:16.701{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b44f3f30c8dfe9532021-12-21 11:37:16.701root 11241100x8000000000000000549360Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:16.701{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c00f3d1acc24dd2f2021-12-21 11:37:16.701root 11241100x8000000000000000549361Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:16.701{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8e83a9bb9a56b4d82021-12-21 11:37:16.701root 11241100x8000000000000000549362Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:16.701{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4de48bac2cbcee922021-12-21 11:37:16.701root 11241100x8000000000000000549363Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:16.701{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.407bfbcec871600b2021-12-21 11:37:16.701root 11241100x8000000000000000549364Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:16.701{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c34a6876bb7e59152021-12-21 11:37:16.701root 11241100x8000000000000000549365Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:16.702{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8671a4b0280fc18a2021-12-21 11:37:16.702root 11241100x8000000000000000549366Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:16.702{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.65ed76971e1d32a52021-12-21 11:37:16.702root 534500x8000000000000000549367Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:16.809{00000000-0000-0000-0000-000000000000}9921<unknown process>ubuntu 534500x8000000000000000549368Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:16.818{00000000-0000-0000-0000-000000000000}9922<unknown process>ubuntu 534500x8000000000000000549369Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:16.820{00000000-0000-0000-0000-000000000000}9923<unknown process>ubuntu 11241100x8000000000000000549370Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:16.820{ec2b6afe-aacb-61c1-0834-fdd63c560000}5677/bin/bash/tmp/sh-thd.36aW3V2021-12-21 11:37:16.820ubuntu 23542300x8000000000000000549371Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:16.820{ec2b6afe-aacb-61c1-0834-fdd63c560000}5677ubuntu/bin/bash/tmp/sh-thd.36aW3V--- 11241100x8000000000000000549372Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:17.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e306a1dd8ce200f12021-12-21 11:37:17.193root 11241100x8000000000000000549373Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:17.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.76fd6e2d391f9c6e2021-12-21 11:37:17.194root 11241100x8000000000000000549374Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:17.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e5a0237d52ef11e42021-12-21 11:37:17.194root 11241100x8000000000000000549375Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:17.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c0cdc52920726f2d2021-12-21 11:37:17.194root 11241100x8000000000000000549376Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:17.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c3602eb425adac702021-12-21 11:37:17.194root 11241100x8000000000000000549377Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:17.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a47635699edf07c92021-12-21 11:37:17.194root 11241100x8000000000000000549378Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:17.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a8ed785d1e617da42021-12-21 11:37:17.194root 11241100x8000000000000000549379Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:17.195{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.84a3d9f255df8a112021-12-21 11:37:17.195root 11241100x8000000000000000549380Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:17.195{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2da8ab20c382ff3e2021-12-21 11:37:17.195root 11241100x8000000000000000549381Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:17.195{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.35744a4b596ec0832021-12-21 11:37:17.195root 11241100x8000000000000000549382Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:17.195{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c26075566477fc772021-12-21 11:37:17.195root 11241100x8000000000000000549383Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:17.195{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2ee19a19ad80dcae2021-12-21 11:37:17.195root 11241100x8000000000000000549384Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:17.195{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3119ab6d27f4bdd72021-12-21 11:37:17.195root 11241100x8000000000000000549385Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:17.195{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.dfb1fc660a3bb7c42021-12-21 11:37:17.195root 11241100x8000000000000000549386Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:17.195{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4869beac1bf669cd2021-12-21 11:37:17.195root 11241100x8000000000000000549387Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:17.195{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0bf499e45e8fed392021-12-21 11:37:17.195root 11241100x8000000000000000549388Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:17.196{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0222554025a7af3b2021-12-21 11:37:17.196root 11241100x8000000000000000549389Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:17.196{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.819049d17d8727e52021-12-21 11:37:17.196root 11241100x8000000000000000549390Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:17.196{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ab48055e0741923c2021-12-21 11:37:17.196root 11241100x8000000000000000549391Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:17.196{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a94779aba98b88cf2021-12-21 11:37:17.196root 11241100x8000000000000000549392Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:17.196{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e01f9137ad628eed2021-12-21 11:37:17.196root 11241100x8000000000000000549393Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:17.196{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4a2eb8666820fdd22021-12-21 11:37:17.196root 11241100x8000000000000000549394Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:17.196{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.eca58a5ed7ba78a82021-12-21 11:37:17.196root 11241100x8000000000000000549395Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:17.197{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ce7db7ae9fbd70c02021-12-21 11:37:17.197root 11241100x8000000000000000549396Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:17.197{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f86a0ca52236ead52021-12-21 11:37:17.197root 11241100x8000000000000000549397Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:17.197{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ec6aaff9875c4a562021-12-21 11:37:17.197root 11241100x8000000000000000549398Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:17.197{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.40fdd5eac7200a652021-12-21 11:37:17.197root 11241100x8000000000000000549399Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:17.197{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3e8173a5958045482021-12-21 11:37:17.197root 11241100x8000000000000000549400Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:17.197{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7044c4908302a8ad2021-12-21 11:37:17.197root 11241100x8000000000000000549401Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:17.197{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4f7952a2cbfad6d82021-12-21 11:37:17.197root 11241100x8000000000000000549402Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:17.197{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8277ae96f59f417b2021-12-21 11:37:17.197root 11241100x8000000000000000549403Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:17.197{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2d2e2632ff4175512021-12-21 11:37:17.197root 11241100x8000000000000000549404Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:17.198{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.fa5c1bb15fc52e9b2021-12-21 11:37:17.198root 11241100x8000000000000000549405Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:17.198{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5afba2e52882e8842021-12-21 11:37:17.198root 11241100x8000000000000000549406Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:17.198{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a66a6cd86d1139902021-12-21 11:37:17.198root 11241100x8000000000000000549407Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:17.198{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.fa656b3e6749d4ee2021-12-21 11:37:17.198root 11241100x8000000000000000549408Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:17.198{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f1d0d7c9ff2103152021-12-21 11:37:17.198root 11241100x8000000000000000549409Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:17.199{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e7c27fbbab99bd7f2021-12-21 11:37:17.199root 11241100x8000000000000000549410Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:17.199{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.836e4c6a38d097352021-12-21 11:37:17.199root 11241100x8000000000000000549411Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:17.199{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0449332e24f5e5012021-12-21 11:37:17.199root 11241100x8000000000000000549412Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:17.199{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.671a1ee8d0ceb5b62021-12-21 11:37:17.199root 11241100x8000000000000000549413Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:17.199{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.227ea78c52c388ee2021-12-21 11:37:17.199root 11241100x8000000000000000549414Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:17.200{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7f44e82d8d6001252021-12-21 11:37:17.200root 11241100x8000000000000000549415Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:17.200{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5647bdedbe5fb01c2021-12-21 11:37:17.200root 11241100x8000000000000000549416Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:17.200{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.85dd2cf58871a4312021-12-21 11:37:17.200root 11241100x8000000000000000549417Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:17.201{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e7c63fbe8716f48e2021-12-21 11:37:17.201root 11241100x8000000000000000549418Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:17.201{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f0da57e705e7b6c72021-12-21 11:37:17.201root 11241100x8000000000000000549419Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:17.201{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8b903ea17254e22a2021-12-21 11:37:17.201root 11241100x8000000000000000549420Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:17.202{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5484805d88796f302021-12-21 11:37:17.202root 11241100x8000000000000000549421Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:17.202{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a0ab9339a356d1592021-12-21 11:37:17.202root 11241100x8000000000000000549422Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:17.202{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.fda0ee17055f8eb02021-12-21 11:37:17.202root 11241100x8000000000000000549423Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:17.202{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.69551e6d6ed586df2021-12-21 11:37:17.202root 11241100x8000000000000000549424Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:17.203{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.aee6e8b6158248c52021-12-21 11:37:17.203root 11241100x8000000000000000549425Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:17.203{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d5f17f95352bcde32021-12-21 11:37:17.203root 11241100x8000000000000000549426Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:17.203{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4cd06528a173f1332021-12-21 11:37:17.203root 11241100x8000000000000000549427Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:17.204{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c7b8983e06b907412021-12-21 11:37:17.204root 11241100x8000000000000000549428Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:17.204{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.efc5ac11432773272021-12-21 11:37:17.204root 11241100x8000000000000000549429Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:17.205{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3d2875037cf3b53f2021-12-21 11:37:17.205root 11241100x8000000000000000549430Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:17.205{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7776e8e986a7a2d22021-12-21 11:37:17.205root 11241100x8000000000000000549431Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:17.205{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8025f88959c166112021-12-21 11:37:17.205root 11241100x8000000000000000549432Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:17.205{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.af950197885bf7922021-12-21 11:37:17.205root 11241100x8000000000000000549433Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:17.205{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.146f0ec1048f6fb72021-12-21 11:37:17.205root 11241100x8000000000000000549434Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:17.206{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.be9836a29e64dabc2021-12-21 11:37:17.206root 11241100x8000000000000000549435Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:17.206{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a8b714e217e2472f2021-12-21 11:37:17.206root 11241100x8000000000000000549436Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:17.206{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.02da6a62aa22146c2021-12-21 11:37:17.206root 11241100x8000000000000000549437Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:17.207{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.cee508ad8f9ec65e2021-12-21 11:37:17.207root 11241100x8000000000000000549438Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:17.207{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4344e286b229c2de2021-12-21 11:37:17.207root 11241100x8000000000000000549439Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:17.207{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0c94aa734564dfd72021-12-21 11:37:17.207root 11241100x8000000000000000549440Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:17.208{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0dd4776ec27fde062021-12-21 11:37:17.208root 11241100x8000000000000000549441Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:17.208{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.380ef7af8565e97f2021-12-21 11:37:17.208root 11241100x8000000000000000549442Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:17.208{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.60915e8d7a2e69212021-12-21 11:37:17.208root 11241100x8000000000000000549443Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:17.209{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8836ae7efe69489f2021-12-21 11:37:17.209root 11241100x8000000000000000549444Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:17.209{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2aa5c8be01faf9272021-12-21 11:37:17.209root 11241100x8000000000000000549445Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:17.210{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.881c008e223828932021-12-21 11:37:17.210root 11241100x8000000000000000549446Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:17.210{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.dd48402a3a4a73122021-12-21 11:37:17.210root 11241100x8000000000000000549447Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:17.210{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.124da2799c7da9982021-12-21 11:37:17.210root 11241100x8000000000000000549448Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:17.211{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.be92ce5a6bf0fb312021-12-21 11:37:17.211root 11241100x8000000000000000549449Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:17.211{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4e52328dd17704832021-12-21 11:37:17.211root 11241100x8000000000000000549450Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:17.212{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.bee2e48ea744cf1b2021-12-21 11:37:17.212root 11241100x8000000000000000549451Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:17.212{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.47ae6dc1279722d62021-12-21 11:37:17.212root 11241100x8000000000000000549452Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:17.212{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.aed968feaf7ef0df2021-12-21 11:37:17.212root 11241100x8000000000000000549453Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:17.213{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0e5bff39440641852021-12-21 11:37:17.213root 11241100x8000000000000000549454Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:17.214{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e6eececdb23ec09f2021-12-21 11:37:17.214root 11241100x8000000000000000549455Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:17.214{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0d53a2c3ee7895dd2021-12-21 11:37:17.214root 11241100x8000000000000000549456Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:17.215{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.25b3e11786e3b7802021-12-21 11:37:17.215root 11241100x8000000000000000549457Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:17.215{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.028ac3cd9994c5552021-12-21 11:37:17.215root 11241100x8000000000000000549458Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:17.215{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2a0a5977c48af70c2021-12-21 11:37:17.215root 11241100x8000000000000000549459Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:17.216{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6252d9039c0609b52021-12-21 11:37:17.216root 11241100x8000000000000000549460Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:17.216{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.523142b3244317d42021-12-21 11:37:17.216root 11241100x8000000000000000549461Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:17.216{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.403b6a945f063a3d2021-12-21 11:37:17.216root 11241100x8000000000000000549462Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:17.216{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.16061d14959251ff2021-12-21 11:37:17.216root 11241100x8000000000000000549463Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:17.217{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f0ba342e1b1566bd2021-12-21 11:37:17.217root 11241100x8000000000000000549464Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:17.217{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1427171beeb37dc92021-12-21 11:37:17.217root 11241100x8000000000000000549465Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:17.217{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b52d6a6f738651cb2021-12-21 11:37:17.217root 11241100x8000000000000000549466Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:17.218{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7871d27b0faf7ad22021-12-21 11:37:17.218root 11241100x8000000000000000549467Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:17.218{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.33f6f89b22b877202021-12-21 11:37:17.218root 11241100x8000000000000000549468Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:17.218{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4323f9f55ce4c2bb2021-12-21 11:37:17.218root 11241100x8000000000000000549469Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:17.219{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f39f11ebe26394b12021-12-21 11:37:17.219root 11241100x8000000000000000549470Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:17.219{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.04be456281ea91112021-12-21 11:37:17.219root 11241100x8000000000000000549471Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:17.219{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.07a1088f657892082021-12-21 11:37:17.219root 11241100x8000000000000000549472Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:17.220{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d9d81f67efed48d32021-12-21 11:37:17.220root 11241100x8000000000000000549473Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:17.220{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c461da413aafaef62021-12-21 11:37:17.220root 11241100x8000000000000000549474Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:17.220{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0a3ee52a424b5d622021-12-21 11:37:17.220root 11241100x8000000000000000549475Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:17.221{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.225701bc493aa1672021-12-21 11:37:17.221root 11241100x8000000000000000549476Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:17.221{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c4dced6daa298e252021-12-21 11:37:17.221root 11241100x8000000000000000549477Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:17.221{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.86adc82ee9dd85172021-12-21 11:37:17.221root 11241100x8000000000000000549478Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:17.222{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.52cd279f95675aef2021-12-21 11:37:17.222root 11241100x8000000000000000549479Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:17.222{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.05edcd661a84d6362021-12-21 11:37:17.222root 11241100x8000000000000000549480Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:17.222{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.146bd7211a4bf0852021-12-21 11:37:17.222root 11241100x8000000000000000549481Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:17.223{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b3e2f33cd01910e22021-12-21 11:37:17.223root 11241100x8000000000000000549482Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:17.224{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.fb7becc7c77f554f2021-12-21 11:37:17.224root 11241100x8000000000000000549483Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:17.224{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f8b0e20f6715d01e2021-12-21 11:37:17.224root 11241100x8000000000000000549484Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:17.224{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.aa808455782857a42021-12-21 11:37:17.224root 11241100x8000000000000000549485Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:17.225{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b34a12d19e387dce2021-12-21 11:37:17.225root 11241100x8000000000000000549486Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:17.225{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d68f77a8af6b2a252021-12-21 11:37:17.225root 11241100x8000000000000000549487Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:17.225{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.016782fc3b74a71b2021-12-21 11:37:17.225root 11241100x8000000000000000549488Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:17.225{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.57d2a9085056b7482021-12-21 11:37:17.225root 11241100x8000000000000000549489Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:17.226{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e5a5c5730dbf77c62021-12-21 11:37:17.226root 11241100x8000000000000000549490Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:17.226{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a580c063999b9c4e2021-12-21 11:37:17.226root 11241100x8000000000000000549491Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:17.226{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.67a73ea0558179052021-12-21 11:37:17.226root 11241100x8000000000000000549492Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:17.227{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.951efabd496be00f2021-12-21 11:37:17.227root 11241100x8000000000000000549493Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:17.227{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d8be06284b1d53a62021-12-21 11:37:17.227root 11241100x8000000000000000549494Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:17.227{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6103f06477093d302021-12-21 11:37:17.227root 11241100x8000000000000000549495Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:17.227{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.213bde8eafbebcfe2021-12-21 11:37:17.227root 11241100x8000000000000000549496Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:17.228{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0c81748635a5a8a62021-12-21 11:37:17.228root 11241100x8000000000000000549497Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:17.228{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.41e4295ceaf3eb9c2021-12-21 11:37:17.228root 11241100x8000000000000000549498Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:17.228{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.128419e94ad97c1c2021-12-21 11:37:17.228root 11241100x8000000000000000549499Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:17.228{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7c1b9a5d7cbd5d062021-12-21 11:37:17.228root 11241100x8000000000000000549500Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:17.229{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c8bf9f44dd100f372021-12-21 11:37:17.229root 11241100x8000000000000000549501Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:17.229{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.89732569235136ec2021-12-21 11:37:17.229root 11241100x8000000000000000549502Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:17.229{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.756b0c8a035431a42021-12-21 11:37:17.229root 11241100x8000000000000000549503Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:17.230{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f0c2d38b4dde19c62021-12-21 11:37:17.230root 11241100x8000000000000000549504Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:17.230{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5842b219bc19d3852021-12-21 11:37:17.230root 11241100x8000000000000000549505Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:17.230{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.12b8f3bbedb372272021-12-21 11:37:17.230root 11241100x8000000000000000549506Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:17.230{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c6da2037632959122021-12-21 11:37:17.230root 11241100x8000000000000000549507Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:17.231{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.71fff74014316fe22021-12-21 11:37:17.231root 11241100x8000000000000000549508Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:17.231{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6b880eb7db2ba6d12021-12-21 11:37:17.231root 11241100x8000000000000000549509Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:17.231{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e7eab774cc0c4bdc2021-12-21 11:37:17.231root 11241100x8000000000000000549510Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:17.231{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.62b73f48bb9c700e2021-12-21 11:37:17.231root 11241100x8000000000000000549511Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:17.231{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.489f701e5f3e82fe2021-12-21 11:37:17.231root 11241100x8000000000000000549512Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:17.231{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.db1b849173c430212021-12-21 11:37:17.231root 11241100x8000000000000000549513Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:17.232{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.fc145edaf538de742021-12-21 11:37:17.232root 11241100x8000000000000000549514Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:17.232{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.29c13fd7ede2a12d2021-12-21 11:37:17.232root 11241100x8000000000000000549515Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:17.232{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.aa0800bd95dd0fda2021-12-21 11:37:17.232root 11241100x8000000000000000549516Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:17.232{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ba666537cc2d41dc2021-12-21 11:37:17.232root 11241100x8000000000000000549517Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:17.232{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.bcb414db02f075772021-12-21 11:37:17.232root 11241100x8000000000000000549518Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:17.232{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.68532c7a8ff81aaf2021-12-21 11:37:17.232root 11241100x8000000000000000549519Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:17.232{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b0caebebf09ca0212021-12-21 11:37:17.232root 11241100x8000000000000000549520Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:17.232{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6685f63af9e9e4fd2021-12-21 11:37:17.232root 11241100x8000000000000000549521Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:17.232{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.596b878bc9d244f12021-12-21 11:37:17.232root 11241100x8000000000000000549522Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:17.233{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.76fb28bf4c0c60862021-12-21 11:37:17.233root 11241100x8000000000000000549523Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:17.233{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.dc4661c08e504c432021-12-21 11:37:17.233root 11241100x8000000000000000549524Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:17.233{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d9690c10766b50842021-12-21 11:37:17.233root 11241100x8000000000000000549525Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:17.233{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e82de106434367ac2021-12-21 11:37:17.233root 11241100x8000000000000000549526Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:17.233{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.50ae44ef5fb123202021-12-21 11:37:17.233root 11241100x8000000000000000549527Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:17.233{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4afcde8425dfbb112021-12-21 11:37:17.233root 11241100x8000000000000000549528Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:17.233{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.59114037872550002021-12-21 11:37:17.233root 11241100x8000000000000000549529Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:17.233{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5655d549782fc8872021-12-21 11:37:17.233root 11241100x8000000000000000549530Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:17.233{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7e4636e22feb2f7b2021-12-21 11:37:17.233root 11241100x8000000000000000549531Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:17.233{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d879a498b507b1622021-12-21 11:37:17.233root 11241100x8000000000000000549532Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:17.233{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a46b122519a178852021-12-21 11:37:17.233root 11241100x8000000000000000549533Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:17.233{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.26b81b838ef1c9512021-12-21 11:37:17.233root 11241100x8000000000000000549534Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:17.233{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.73a9df3c1a459a382021-12-21 11:37:17.233root 11241100x8000000000000000549535Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:17.233{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.26a831c25e09bc812021-12-21 11:37:17.233root 11241100x8000000000000000549536Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:17.233{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d079824b5e045e932021-12-21 11:37:17.233root 11241100x8000000000000000549537Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:17.234{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2907d28d0393cdc82021-12-21 11:37:17.234root 11241100x8000000000000000549538Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:17.234{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.fac72af498eaea312021-12-21 11:37:17.234root 11241100x8000000000000000549539Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:17.234{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8f940168f9bb8e1c2021-12-21 11:37:17.234root 11241100x8000000000000000549540Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:17.234{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7e1971eeeb010aae2021-12-21 11:37:17.234root 11241100x8000000000000000549541Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:17.234{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7dcd0901850b49002021-12-21 11:37:17.234root 11241100x8000000000000000549542Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:17.234{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.39d9857db7ee16a42021-12-21 11:37:17.234root 11241100x8000000000000000549543Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:17.234{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.999632d423ae1a452021-12-21 11:37:17.234root 11241100x8000000000000000549544Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:17.234{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.09bc9d56bfd0b6b02021-12-21 11:37:17.234root 11241100x8000000000000000549545Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:17.234{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d5db564a86a7982e2021-12-21 11:37:17.234root 11241100x8000000000000000549546Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:17.234{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1974067d133606232021-12-21 11:37:17.234root 11241100x8000000000000000549547Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:17.234{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e7eda2d84df6a90f2021-12-21 11:37:17.234root 11241100x8000000000000000549548Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:17.234{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c0f492f5cdc91fbe2021-12-21 11:37:17.234root 11241100x8000000000000000549549Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:17.234{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2bbd92cd1f87a6ea2021-12-21 11:37:17.234root 11241100x8000000000000000549550Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:17.235{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.60302fbd706458282021-12-21 11:37:17.235root 11241100x8000000000000000549551Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:17.235{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.fb0dd2c84554360e2021-12-21 11:37:17.235root 11241100x8000000000000000549552Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:17.235{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d6b17b851a622b432021-12-21 11:37:17.235root 11241100x8000000000000000549553Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:17.235{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d02482cac516c4802021-12-21 11:37:17.235root 11241100x8000000000000000549554Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:17.235{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.55adde616c05577f2021-12-21 11:37:17.235root 11241100x8000000000000000549555Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:17.235{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5fe3018b5dda5f252021-12-21 11:37:17.235root 11241100x8000000000000000549556Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:17.235{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.10dc43a86a45f0492021-12-21 11:37:17.235root 11241100x8000000000000000549557Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:17.235{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.072498f0e98df94b2021-12-21 11:37:17.235root 11241100x8000000000000000549558Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:17.235{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1f0fd30272647b152021-12-21 11:37:17.235root 11241100x8000000000000000549559Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:17.235{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.cf02143bc4c3f81e2021-12-21 11:37:17.235root 11241100x8000000000000000549560Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:17.235{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.448b7958c43464fa2021-12-21 11:37:17.235root 11241100x8000000000000000549561Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:17.236{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2c77d1dbdfcd79e52021-12-21 11:37:17.236root 11241100x8000000000000000549562Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:17.236{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8830471b70fd89d42021-12-21 11:37:17.236root 11241100x8000000000000000549563Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:17.236{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b9cbd7dc339592022021-12-21 11:37:17.236root 11241100x8000000000000000549564Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:17.236{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.562223efbc65a45e2021-12-21 11:37:17.236root 11241100x8000000000000000549565Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:17.236{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.fd286c671152f05e2021-12-21 11:37:17.236root 11241100x8000000000000000549566Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:17.236{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f9a891b87f0f0e592021-12-21 11:37:17.236root 11241100x8000000000000000549567Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:17.236{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b144dca6bc0734222021-12-21 11:37:17.236root 11241100x8000000000000000549568Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:17.236{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.aae930c5309f2ad22021-12-21 11:37:17.236root 11241100x8000000000000000549569Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:17.236{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ab29ac3f020f33712021-12-21 11:37:17.236root 11241100x8000000000000000549570Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:17.695{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2321c2971510ad7f2021-12-21 11:37:17.695root 11241100x8000000000000000549571Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:17.695{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.156b610a234ed7f02021-12-21 11:37:17.695root 11241100x8000000000000000549572Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:17.696{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b42c7d255f7ee6dc2021-12-21 11:37:17.696root 11241100x8000000000000000549573Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:17.696{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ab66a3374352afbb2021-12-21 11:37:17.696root 11241100x8000000000000000549574Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:17.696{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8a67e528902854a32021-12-21 11:37:17.696root 11241100x8000000000000000549575Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:17.697{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.20df897669ca80972021-12-21 11:37:17.697root 11241100x8000000000000000549576Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:17.697{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8e37aa2943770a0b2021-12-21 11:37:17.697root 11241100x8000000000000000549577Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:17.698{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.cade6923e05f594f2021-12-21 11:37:17.698root 11241100x8000000000000000549578Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:17.698{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.fed4555e58a4a4df2021-12-21 11:37:17.698root 11241100x8000000000000000549579Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:17.698{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6c5ba90e3ecc13e42021-12-21 11:37:17.698root 11241100x8000000000000000549580Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:17.698{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6a308e2aede9f2a32021-12-21 11:37:17.698root 11241100x8000000000000000549581Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:17.699{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5a06b9d7910f1a3b2021-12-21 11:37:17.699root 11241100x8000000000000000549582Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:17.699{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.24d250aa2d0e33942021-12-21 11:37:17.699root 11241100x8000000000000000549583Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:17.699{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.720139966b64d61b2021-12-21 11:37:17.699root 11241100x8000000000000000549584Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:17.699{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2926d7cbfb676bf82021-12-21 11:37:17.699root 11241100x8000000000000000549585Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:17.700{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.faf76f11e7af750c2021-12-21 11:37:17.700root 11241100x8000000000000000549586Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:17.700{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6313bf571bf32cfc2021-12-21 11:37:17.700root 11241100x8000000000000000549587Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:17.700{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3b16e8b8357f705c2021-12-21 11:37:17.700root 11241100x8000000000000000549588Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:17.700{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e7428d38caaa1e092021-12-21 11:37:17.700root 11241100x8000000000000000549589Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:17.700{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.74da389516cd8a632021-12-21 11:37:17.700root 11241100x8000000000000000549590Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:17.701{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1b20abba925508002021-12-21 11:37:17.701root 11241100x8000000000000000549591Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:17.701{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c9c2f39da0cc4d6e2021-12-21 11:37:17.701root 11241100x8000000000000000549592Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:17.701{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d2e0675e2c28f2032021-12-21 11:37:17.701root 11241100x8000000000000000549593Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:17.702{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.590e8e7e845291932021-12-21 11:37:17.702root 11241100x8000000000000000549594Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:17.702{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5219e211412db8692021-12-21 11:37:17.702root 11241100x8000000000000000549595Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:17.702{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2c30f1f004400c3e2021-12-21 11:37:17.702root 11241100x8000000000000000549596Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:17.703{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.778e6dedf99a42712021-12-21 11:37:17.703root 11241100x8000000000000000549597Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:17.703{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6316f7d54c1595f12021-12-21 11:37:17.703root 11241100x8000000000000000549598Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:17.703{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6389ce20c2fb68f02021-12-21 11:37:17.703root 11241100x8000000000000000549599Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:17.703{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.98365f19aeea66d02021-12-21 11:37:17.703root 11241100x8000000000000000549600Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:17.704{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6740f2cd1062cdfb2021-12-21 11:37:17.704root 11241100x8000000000000000549601Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:17.704{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b655a207fd2103462021-12-21 11:37:17.704root 11241100x8000000000000000549602Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:17.704{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.389d503142a7c7e42021-12-21 11:37:17.704root 11241100x8000000000000000549603Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:17.705{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1467bfaeddae4d512021-12-21 11:37:17.705root 11241100x8000000000000000549604Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:17.705{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e6ca91e17f05e7e92021-12-21 11:37:17.705root 11241100x8000000000000000549605Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:17.705{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.164c2a60336c40b02021-12-21 11:37:17.705root 11241100x8000000000000000549606Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:17.705{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e1106f8d98cbb61a2021-12-21 11:37:17.705root 11241100x8000000000000000549607Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:17.705{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ab6c619f9242521c2021-12-21 11:37:17.705root 11241100x8000000000000000549608Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:17.706{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4de9f28ec9ec3b2c2021-12-21 11:37:17.706root 11241100x8000000000000000549609Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:17.706{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d4bd2bd097923df62021-12-21 11:37:17.706root 11241100x8000000000000000549610Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:17.706{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f03106d1078d5f252021-12-21 11:37:17.706root 11241100x8000000000000000549611Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:17.706{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.db5debe578b44c852021-12-21 11:37:17.706root 11241100x8000000000000000549612Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:17.706{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.dee02b183b2324032021-12-21 11:37:17.706root 11241100x8000000000000000549613Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:17.706{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e5627de4d17fc5af2021-12-21 11:37:17.706root 11241100x8000000000000000549614Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:17.706{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.107ffa28db6d02792021-12-21 11:37:17.706root 11241100x8000000000000000549615Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:17.706{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7850f95c7a7e931a2021-12-21 11:37:17.706root 11241100x8000000000000000549616Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:17.707{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4851191c633d04fd2021-12-21 11:37:17.707root 11241100x8000000000000000549617Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:17.707{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.38b256d3a8f2c2b22021-12-21 11:37:17.707root 11241100x8000000000000000549618Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:17.707{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.71176d7ea80dafac2021-12-21 11:37:17.707root 11241100x8000000000000000549619Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:17.707{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5ea56f5e1f4826312021-12-21 11:37:17.707root 11241100x8000000000000000549620Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:17.708{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.307af10a670bc0f42021-12-21 11:37:17.708root 11241100x8000000000000000549621Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:17.708{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0cec89a6c8b3590b2021-12-21 11:37:17.708root 11241100x8000000000000000549622Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:17.708{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e14f3543f52f87902021-12-21 11:37:17.708root 11241100x8000000000000000549623Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:17.709{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.98ca0205eac0f08e2021-12-21 11:37:17.709root 11241100x8000000000000000549624Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:17.709{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.501b50f87fe364842021-12-21 11:37:17.709root 11241100x8000000000000000549625Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:17.709{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4bf2c305c59d9f112021-12-21 11:37:17.709root 11241100x8000000000000000549626Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:17.709{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.70a0f95a32bca2142021-12-21 11:37:17.709root 11241100x8000000000000000549627Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:17.709{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.28fc912069dc1c742021-12-21 11:37:17.709root 11241100x8000000000000000549628Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:17.709{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1bb064b0b94375802021-12-21 11:37:17.709root 11241100x8000000000000000549629Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:17.709{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.753f27eee2812df52021-12-21 11:37:17.709root 11241100x8000000000000000549630Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:17.709{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7de7e70a83e9e5b72021-12-21 11:37:17.709root 11241100x8000000000000000549631Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:17.710{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b7443ea77fd586352021-12-21 11:37:17.710root 11241100x8000000000000000549632Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:17.710{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.cd2df88ec83b7f032021-12-21 11:37:17.710root 11241100x8000000000000000549633Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:17.710{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.febe2ba5049507f72021-12-21 11:37:17.710root 11241100x8000000000000000549634Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:17.710{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.27a5f6e2fc7d01262021-12-21 11:37:17.710root 11241100x8000000000000000549635Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:17.710{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.07dffe95d814a1832021-12-21 11:37:17.710root 11241100x8000000000000000549636Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:17.711{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.01520d6909fdeb272021-12-21 11:37:17.711root 11241100x8000000000000000549637Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:17.711{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.fe4403b09893a94b2021-12-21 11:37:17.711root 11241100x8000000000000000549638Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:17.711{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6b92d6e4e812fedf2021-12-21 11:37:17.711root 11241100x8000000000000000549639Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:17.711{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9f0aac8f461f93062021-12-21 11:37:17.711root 11241100x8000000000000000549640Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:17.712{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4f1f2cadf120a8792021-12-21 11:37:17.712root 11241100x8000000000000000549641Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:17.712{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b277a4459675f24f2021-12-21 11:37:17.712root 11241100x8000000000000000549642Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:17.713{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.de4e9a0570ce71692021-12-21 11:37:17.713root 11241100x8000000000000000549643Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:17.713{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.64eb5ffa4de179e72021-12-21 11:37:17.713root 11241100x8000000000000000549644Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:17.713{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c98a72f141ef8a752021-12-21 11:37:17.713root 11241100x8000000000000000549645Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:17.713{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.fd8d5d74c02f54182021-12-21 11:37:17.713root 11241100x8000000000000000549646Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:17.713{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5a83b515fd58ecf52021-12-21 11:37:17.713root 11241100x8000000000000000549647Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:17.713{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.48d21522d2ab95632021-12-21 11:37:17.713root 11241100x8000000000000000549648Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:17.713{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.025772a3bba746722021-12-21 11:37:17.713root 154100x8000000000000000549649Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:17.879{ec2b6afe-bc6d-61c1-08ce-a28bad550000}9924/usr/bin/sudo-----sudo chmod g+s evil2_bin/home/ubuntuubuntu{ec2b6afe-aacb-61c1-e803-000000000000}10006no level-{ec2b6afe-aacb-61c1-0834-fdd63c560000}5677/bin/bash-bashubuntu 354300x8000000000000000549650Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:17.886{ec2b6afe-bc6d-61c1-08ce-a28bad550000}9924/usr/bin/sudoubuntuudptruefalse127.0.0.1-45890-false127.0.0.53-53- 354300x8000000000000000549651Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:17.886{ec2b6afe-9247-61c1-c097-2e4cb4550000}2604/lib/systemd/systemd-resolvedsystemd-resolveudptruefalse10.0.1.25-38251-false10.0.0.2-53- 354300x8000000000000000549652Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:17.886{ec2b6afe-9247-61c1-c097-2e4cb4550000}2604/lib/systemd/systemd-resolvedsystemd-resolveudptruefalse10.0.1.25-40533-false10.0.0.2-53- 354300x8000000000000000549653Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:17.887{ec2b6afe-9247-61c1-c097-2e4cb4550000}2604/lib/systemd/systemd-resolvedsystemd-resolveudptruefalse127.0.0.53-53-false127.0.0.1-45890- 354300x8000000000000000549654Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:17.887{ec2b6afe-bc6d-61c1-08ce-a28bad550000}9924/usr/bin/sudoubuntuudptruefalse127.0.0.1-58754-false127.0.0.53-53- 354300x8000000000000000549655Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:17.887{ec2b6afe-9247-61c1-c097-2e4cb4550000}2604/lib/systemd/systemd-resolvedsystemd-resolveudptruefalse127.0.0.53-53-false127.0.0.1-58754- 154100x8000000000000000549656Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:17.890{ec2b6afe-bc6d-61c1-e0b1-bfa3a4550000}9925/bin/chmod-----chmod g+s evil2_bin/home/ubunturoot{ec2b6afe-0000-0000-0000-000000000000}06no level-{ec2b6afe-bc6d-61c1-08ce-a28bad550000}9924/usr/bin/sudosudoubuntu 534500x8000000000000000549657Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:17.891{ec2b6afe-bc6d-61c1-e0b1-bfa3a4550000}9925/bin/chmodroot 534500x8000000000000000549658Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:17.892{ec2b6afe-bc6d-61c1-08ce-a28bad550000}9924/usr/bin/sudoroot 11241100x8000000000000000549659Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:18.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a0261b657dfe44a52021-12-21 11:37:18.193root 11241100x8000000000000000549660Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:18.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.bfb4d89c49920d992021-12-21 11:37:18.193root 11241100x8000000000000000549661Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:18.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.43e0303782d164b62021-12-21 11:37:18.193root 11241100x8000000000000000549662Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:18.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.03da5c05733141672021-12-21 11:37:18.194root 11241100x8000000000000000549663Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:18.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0e647571f7d7a7102021-12-21 11:37:18.194root 11241100x8000000000000000549664Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:18.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5e4549be608219fb2021-12-21 11:37:18.194root 11241100x8000000000000000549665Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:18.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d5f13b2b4a0add502021-12-21 11:37:18.194root 11241100x8000000000000000549666Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:18.195{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a06b90d39b5619872021-12-21 11:37:18.195root 11241100x8000000000000000549667Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:18.195{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.bff634484044d5622021-12-21 11:37:18.195root 11241100x8000000000000000549668Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:18.195{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.80c940bf915501f02021-12-21 11:37:18.195root 11241100x8000000000000000549669Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:18.195{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6edff597b8871f9d2021-12-21 11:37:18.195root 11241100x8000000000000000549670Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:18.195{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.196fe13dec4e648d2021-12-21 11:37:18.195root 11241100x8000000000000000549671Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:18.195{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2b8f015133bd165d2021-12-21 11:37:18.195root 11241100x8000000000000000549672Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:18.195{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.cf6a6a2e534fb6c62021-12-21 11:37:18.195root 11241100x8000000000000000549673Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:18.196{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2354028a526a79712021-12-21 11:37:18.196root 11241100x8000000000000000549674Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:18.196{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.685ba15e06368c9c2021-12-21 11:37:18.196root 11241100x8000000000000000549675Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:18.196{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.bdda3c8e00a715842021-12-21 11:37:18.196root 11241100x8000000000000000549676Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:18.196{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e7ffd85b33267d5d2021-12-21 11:37:18.196root 11241100x8000000000000000549677Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:18.196{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7260380ef651d4a12021-12-21 11:37:18.196root 11241100x8000000000000000549678Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:18.196{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5e1b2647d0d6af992021-12-21 11:37:18.196root 11241100x8000000000000000549679Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:18.196{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.cf075c31872126092021-12-21 11:37:18.196root 11241100x8000000000000000549680Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:18.196{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a7e5e7ad5bc222ab2021-12-21 11:37:18.196root 11241100x8000000000000000549681Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:18.196{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.de9205e6cd19de2b2021-12-21 11:37:18.196root 11241100x8000000000000000549682Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:18.196{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.eab0feffd48b58742021-12-21 11:37:18.196root 11241100x8000000000000000549683Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:18.196{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6bbd015913e90d012021-12-21 11:37:18.196root 11241100x8000000000000000549684Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:18.196{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.677574534daad6dc2021-12-21 11:37:18.196root 11241100x8000000000000000549685Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:18.196{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d2406fa91e07f7e62021-12-21 11:37:18.196root 11241100x8000000000000000549686Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:18.196{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6a2b7ece8622fd472021-12-21 11:37:18.196root 11241100x8000000000000000549687Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:18.196{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.75ebca1db75ec4cc2021-12-21 11:37:18.196root 11241100x8000000000000000549688Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:18.196{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.52ad5f4047b5e3432021-12-21 11:37:18.196root 11241100x8000000000000000549689Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:18.197{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.852ae6416c0ae0a02021-12-21 11:37:18.197root 11241100x8000000000000000549690Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:18.197{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.492159806a565d932021-12-21 11:37:18.197root 11241100x8000000000000000549691Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:18.197{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2f9523095a8449402021-12-21 11:37:18.197root 11241100x8000000000000000549692Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:18.197{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.19f673202e4d14222021-12-21 11:37:18.197root 11241100x8000000000000000549693Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:18.197{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8fa82f03139e9d742021-12-21 11:37:18.197root 11241100x8000000000000000549694Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:18.197{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.fc390723edec68712021-12-21 11:37:18.197root 11241100x8000000000000000549695Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:18.197{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.de7c16a21d58184d2021-12-21 11:37:18.197root 11241100x8000000000000000549696Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:18.197{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.199409a7ddd669d02021-12-21 11:37:18.197root 11241100x8000000000000000549697Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:18.197{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.dd9122f164a0742c2021-12-21 11:37:18.197root 11241100x8000000000000000549698Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:18.197{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.13d0da7de65f68872021-12-21 11:37:18.197root 11241100x8000000000000000549699Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:18.197{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ab0ee53392a884c52021-12-21 11:37:18.197root 11241100x8000000000000000549700Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:18.197{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e219f408c4afd93a2021-12-21 11:37:18.197root 11241100x8000000000000000549701Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:18.197{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.bd0fae44de22627b2021-12-21 11:37:18.197root 11241100x8000000000000000549702Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:18.197{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7be87cbec22cc8c72021-12-21 11:37:18.197root 11241100x8000000000000000549703Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:18.197{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.62f4272c120756c22021-12-21 11:37:18.197root 11241100x8000000000000000549704Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:18.197{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.72781e2380a544ee2021-12-21 11:37:18.197root 11241100x8000000000000000549705Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:18.198{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c0d07f94cc2b76842021-12-21 11:37:18.198root 11241100x8000000000000000549706Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:18.198{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5dea5910a65f6f4f2021-12-21 11:37:18.198root 11241100x8000000000000000549707Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:18.198{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.24600ff548ba9daf2021-12-21 11:37:18.198root 11241100x8000000000000000549708Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:18.199{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.60c42412da0b55b42021-12-21 11:37:18.199root 11241100x8000000000000000549709Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:18.199{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5758f46c81aae77e2021-12-21 11:37:18.199root 11241100x8000000000000000549710Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:18.199{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ba7cc2c7083ccc892021-12-21 11:37:18.199root 11241100x8000000000000000549711Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:18.199{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3e80540da47c61fc2021-12-21 11:37:18.199root 11241100x8000000000000000549712Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:18.199{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.bdd589fd0280fd3f2021-12-21 11:37:18.199root 11241100x8000000000000000549713Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:18.199{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e610d52dc68d03fc2021-12-21 11:37:18.199root 11241100x8000000000000000549714Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:18.199{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.34ab4eb00be41bd12021-12-21 11:37:18.199root 11241100x8000000000000000549715Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:18.199{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.23df4ffa9563eba72021-12-21 11:37:18.199root 11241100x8000000000000000549716Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:18.200{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.de17b6fe11ccfcf52021-12-21 11:37:18.200root 11241100x8000000000000000549717Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:18.200{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8a4f1098041fce642021-12-21 11:37:18.200root 11241100x8000000000000000549718Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:18.200{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5ca490a388f51b1a2021-12-21 11:37:18.200root 11241100x8000000000000000549719Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:18.200{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.81d5a197d88016322021-12-21 11:37:18.200root 11241100x8000000000000000549720Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:18.200{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6e31b4d958c9608a2021-12-21 11:37:18.200root 11241100x8000000000000000549721Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:18.200{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.928d90c7759309632021-12-21 11:37:18.200root 11241100x8000000000000000549722Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:18.200{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.648f2c3c55b063aa2021-12-21 11:37:18.200root 11241100x8000000000000000549723Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:18.200{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e5f7b78d66fbe2872021-12-21 11:37:18.200root 11241100x8000000000000000549724Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:18.200{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.fb40f5b77af57a652021-12-21 11:37:18.200root 11241100x8000000000000000549725Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:18.200{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.17a9a49d1a8305b42021-12-21 11:37:18.200root 11241100x8000000000000000549726Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:18.200{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3cf62104b0fa55d52021-12-21 11:37:18.200root 11241100x8000000000000000549727Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:18.200{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8b64e862de6d87cf2021-12-21 11:37:18.200root 11241100x8000000000000000549728Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:18.200{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.40b8994a4f9ec5032021-12-21 11:37:18.200root 11241100x8000000000000000549729Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:18.200{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.677312a86ffa931e2021-12-21 11:37:18.200root 11241100x8000000000000000549730Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:18.200{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.fd6a78babbbe0ba92021-12-21 11:37:18.200root 11241100x8000000000000000549731Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:18.201{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d21f93568e77834c2021-12-21 11:37:18.201root 11241100x8000000000000000549732Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:18.201{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a021fd594e1404342021-12-21 11:37:18.201root 11241100x8000000000000000549733Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:18.201{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.077e8cf9c72a68ca2021-12-21 11:37:18.201root 11241100x8000000000000000549734Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:18.201{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.514fa9ef1f3349ec2021-12-21 11:37:18.201root 11241100x8000000000000000549735Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:18.201{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4758bb283c4c919a2021-12-21 11:37:18.201root 11241100x8000000000000000549736Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:18.202{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.546cf12e7292990d2021-12-21 11:37:18.202root 11241100x8000000000000000549737Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:18.202{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.02bd077fe86a2ac92021-12-21 11:37:18.202root 11241100x8000000000000000549738Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:18.202{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6111d2f5273e82bd2021-12-21 11:37:18.202root 11241100x8000000000000000549739Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:18.202{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7f5fb5aad37249bc2021-12-21 11:37:18.202root 11241100x8000000000000000549740Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:18.202{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ea7c4f22138c8e342021-12-21 11:37:18.202root 11241100x8000000000000000549741Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:18.202{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.43dadf81147c63d32021-12-21 11:37:18.202root 11241100x8000000000000000549742Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:18.202{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6d7848a2d75628c22021-12-21 11:37:18.202root 11241100x8000000000000000549743Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:18.202{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7a581cd4e648c3f92021-12-21 11:37:18.202root 11241100x8000000000000000549744Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:18.202{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a905e718a937e7f12021-12-21 11:37:18.202root 11241100x8000000000000000549745Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:18.203{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2c7539671c9a8ab52021-12-21 11:37:18.203root 11241100x8000000000000000549746Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:18.203{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7aa78af2d54410d92021-12-21 11:37:18.203root 11241100x8000000000000000549747Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:18.203{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2c1c456fba00b08f2021-12-21 11:37:18.203root 11241100x8000000000000000549748Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:18.205{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.303f690d5b111d682021-12-21 11:37:18.205root 11241100x8000000000000000549749Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:18.205{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.080d081e41cba7a62021-12-21 11:37:18.205root 11241100x8000000000000000549750Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:18.205{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.31f23d6d02750af82021-12-21 11:37:18.205root 11241100x8000000000000000549751Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:18.205{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7df295b3e99efd202021-12-21 11:37:18.205root 11241100x8000000000000000549752Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:18.205{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.93a391bd0d41d9c82021-12-21 11:37:18.205root 11241100x8000000000000000549753Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:18.206{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.baec22cec52870002021-12-21 11:37:18.206root 11241100x8000000000000000549754Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:18.206{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e0429f3f86dd2d112021-12-21 11:37:18.206root 11241100x8000000000000000549755Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:18.206{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.743696cdc80fd6802021-12-21 11:37:18.206root 11241100x8000000000000000549756Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:18.206{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c54ea6c02acfaee72021-12-21 11:37:18.206root 11241100x8000000000000000549757Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:18.206{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8c536fb5b794201b2021-12-21 11:37:18.206root 11241100x8000000000000000549758Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:18.206{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ef29711b6215c6012021-12-21 11:37:18.206root 11241100x8000000000000000549759Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:18.206{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f4b24d5daa43cb012021-12-21 11:37:18.206root 11241100x8000000000000000549760Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:18.206{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a86ffb0457a495ca2021-12-21 11:37:18.206root 11241100x8000000000000000549761Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:18.206{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4e4dcf177bf51e6a2021-12-21 11:37:18.206root 11241100x8000000000000000549762Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:18.207{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.72d2f731c5feb19b2021-12-21 11:37:18.207root 11241100x8000000000000000549763Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:18.207{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d64975837ca402af2021-12-21 11:37:18.207root 11241100x8000000000000000549764Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:18.207{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.18d517453bada9082021-12-21 11:37:18.207root 11241100x8000000000000000549765Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:18.207{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c1a242016f4d42702021-12-21 11:37:18.207root 11241100x8000000000000000549766Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:18.207{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6bdcabb0aa308e802021-12-21 11:37:18.207root 11241100x8000000000000000549767Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:18.207{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0450f19b51a30bfe2021-12-21 11:37:18.207root 11241100x8000000000000000549768Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:18.207{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.28ae9444ef09b94f2021-12-21 11:37:18.207root 11241100x8000000000000000549769Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:18.207{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.69d77009938a76402021-12-21 11:37:18.207root 11241100x8000000000000000549770Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:18.208{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b257d44f56d13df12021-12-21 11:37:18.208root 11241100x8000000000000000549771Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:18.208{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.aee8314ef226a7d12021-12-21 11:37:18.208root 11241100x8000000000000000549772Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:18.209{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.20443ce8e00b04a52021-12-21 11:37:18.209root 11241100x8000000000000000549773Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:18.209{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.aeb7577261965c6d2021-12-21 11:37:18.209root 11241100x8000000000000000549774Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:18.209{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.386c1eb13edd3d592021-12-21 11:37:18.209root 11241100x8000000000000000549775Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:18.209{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7594cbd2bf6b15f62021-12-21 11:37:18.209root 11241100x8000000000000000549776Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:18.209{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d785f6801971e9d72021-12-21 11:37:18.209root 11241100x8000000000000000549777Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:18.209{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c60774ae672a83f12021-12-21 11:37:18.209root 11241100x8000000000000000549778Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:18.209{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5da567e06eb7104e2021-12-21 11:37:18.209root 11241100x8000000000000000549779Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:18.209{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1644710c3c556edb2021-12-21 11:37:18.209root 11241100x8000000000000000549780Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:18.209{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.378ad9df0de66e952021-12-21 11:37:18.209root 11241100x8000000000000000549781Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:18.209{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f7a6e9c973f1a8402021-12-21 11:37:18.209root 11241100x8000000000000000549782Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:18.209{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.79237be69d2f4dff2021-12-21 11:37:18.209root 11241100x8000000000000000549783Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:18.209{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ac534936797e703c2021-12-21 11:37:18.209root 11241100x8000000000000000549784Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:18.209{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f233dcdff8a1db642021-12-21 11:37:18.209root 11241100x8000000000000000549785Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:18.209{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.09f961a92a9199d12021-12-21 11:37:18.209root 11241100x8000000000000000549786Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:18.210{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0c3b868e7fadee2d2021-12-21 11:37:18.210root 11241100x8000000000000000549787Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:18.210{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.987eb738feddcb202021-12-21 11:37:18.210root 11241100x8000000000000000549788Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:18.210{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5bf995769c683ceb2021-12-21 11:37:18.210root 11241100x8000000000000000549789Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:18.210{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.bb6b82f4099e6dff2021-12-21 11:37:18.210root 11241100x8000000000000000549790Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:18.210{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.fb5c553fd20b5d9a2021-12-21 11:37:18.210root 11241100x8000000000000000549791Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:18.210{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1576cde59a1abc0e2021-12-21 11:37:18.210root 11241100x8000000000000000549792Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:18.210{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.eac30d5d37b21b862021-12-21 11:37:18.210root 11241100x8000000000000000549793Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:18.210{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9f8d6626d1f6b3fc2021-12-21 11:37:18.210root 11241100x8000000000000000549794Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:18.210{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9b43a6caf0ea8c2d2021-12-21 11:37:18.210root 11241100x8000000000000000549795Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:18.210{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6b05021f5bf1165b2021-12-21 11:37:18.210root 11241100x8000000000000000549796Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:18.210{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f50fb0a909100f472021-12-21 11:37:18.210root 11241100x8000000000000000549797Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:18.210{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.42a9b1684dcadb342021-12-21 11:37:18.210root 11241100x8000000000000000549798Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:18.211{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b244e18725a6bcb92021-12-21 11:37:18.211root 11241100x8000000000000000549799Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:18.211{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.32cb1a17c1681ba82021-12-21 11:37:18.211root 11241100x8000000000000000549800Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:18.211{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.09b4ed46b51afacc2021-12-21 11:37:18.211root 11241100x8000000000000000549801Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:18.211{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4f8f4464710934b22021-12-21 11:37:18.211root 11241100x8000000000000000549802Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:18.211{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.89f0ed5a07ccccf72021-12-21 11:37:18.211root 11241100x8000000000000000549803Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:18.211{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.420ae1f07f9f0f7a2021-12-21 11:37:18.211root 11241100x8000000000000000549804Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:18.211{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d40c272ce20951092021-12-21 11:37:18.211root 11241100x8000000000000000549805Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:18.211{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0bcbb095f6e2f84c2021-12-21 11:37:18.211root 11241100x8000000000000000549806Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:18.211{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.923734171c115e5a2021-12-21 11:37:18.211root 11241100x8000000000000000549807Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:18.211{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8b860997843fa9532021-12-21 11:37:18.211root 11241100x8000000000000000549808Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:18.211{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.aa537078bd638bc62021-12-21 11:37:18.211root 11241100x8000000000000000549809Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:18.211{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f2e9ecea54dce4ec2021-12-21 11:37:18.211root 11241100x8000000000000000549810Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:18.212{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9b5d5e8b67bedb272021-12-21 11:37:18.212root 11241100x8000000000000000549811Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:18.212{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.bbd323c8c5f934c12021-12-21 11:37:18.212root 11241100x8000000000000000549812Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:18.212{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3e0917b29eedb43a2021-12-21 11:37:18.212root 11241100x8000000000000000549813Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:18.212{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.829657c77efc3b802021-12-21 11:37:18.212root 11241100x8000000000000000549814Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:18.212{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.25788f20f3d734522021-12-21 11:37:18.212root 11241100x8000000000000000549815Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:18.213{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.afe87ecd3d3482762021-12-21 11:37:18.213root 11241100x8000000000000000549816Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:18.213{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f1b28556d023821d2021-12-21 11:37:18.213root 11241100x8000000000000000549817Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:18.213{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f985b36eddc6d05e2021-12-21 11:37:18.213root 11241100x8000000000000000549818Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:18.213{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.768ef9fb0688cd9a2021-12-21 11:37:18.213root 11241100x8000000000000000549819Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:18.213{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f957c8b1d12b28532021-12-21 11:37:18.213root 11241100x8000000000000000549820Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:18.213{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.fbf1a21caab1ac8f2021-12-21 11:37:18.213root 11241100x8000000000000000549821Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:18.213{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.47af5f7867db3b412021-12-21 11:37:18.213root 11241100x8000000000000000549822Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:18.213{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e95079dbe7335bb42021-12-21 11:37:18.213root 11241100x8000000000000000549823Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:18.213{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c7ef62972afcfd632021-12-21 11:37:18.213root 11241100x8000000000000000549824Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:18.213{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.36a96fec98e65a4b2021-12-21 11:37:18.213root 11241100x8000000000000000549825Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:18.213{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.262836616f3042eb2021-12-21 11:37:18.213root 11241100x8000000000000000549826Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:18.213{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1236accb0efc0abd2021-12-21 11:37:18.213root 11241100x8000000000000000549827Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:18.213{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.10f01a1693e2a82f2021-12-21 11:37:18.213root 11241100x8000000000000000549828Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:18.214{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.de6abb8dffb10c8d2021-12-21 11:37:18.214root 11241100x8000000000000000549829Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:18.214{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ead60e363400caed2021-12-21 11:37:18.214root 11241100x8000000000000000549830Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:18.214{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c603c3d1d548ca9d2021-12-21 11:37:18.214root 11241100x8000000000000000549831Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:18.214{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6e054c0f87091f452021-12-21 11:37:18.214root 11241100x8000000000000000549832Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:18.214{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5cfbd43356a1a6e82021-12-21 11:37:18.214root 11241100x8000000000000000549833Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:18.214{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5d12f586b68767fd2021-12-21 11:37:18.214root 11241100x8000000000000000549834Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:18.214{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2ad5c80bdb4380f92021-12-21 11:37:18.214root 11241100x8000000000000000549835Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:18.214{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.76238dbfcbee5f082021-12-21 11:37:18.214root 11241100x8000000000000000549836Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:18.214{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2593906a314745d92021-12-21 11:37:18.214root 11241100x8000000000000000549837Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:18.214{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e0e91c2a63f234bf2021-12-21 11:37:18.214root 11241100x8000000000000000549838Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:18.214{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.fae963e85724eb132021-12-21 11:37:18.214root 11241100x8000000000000000549839Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:18.214{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.69f340e3a3501f552021-12-21 11:37:18.214root 11241100x8000000000000000549840Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:18.214{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e1a8e64759e6fc452021-12-21 11:37:18.214root 11241100x8000000000000000549841Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:18.215{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4ccdfa616bf237332021-12-21 11:37:18.215root 11241100x8000000000000000549842Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:18.215{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6115285d54fb5ef12021-12-21 11:37:18.215root 11241100x8000000000000000549843Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:18.217{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0fbe1c1ff8b5e13d2021-12-21 11:37:18.217root 11241100x8000000000000000549844Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:18.218{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f3a302115330ec332021-12-21 11:37:18.218root 11241100x8000000000000000549845Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:18.218{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e73d968492f8296a2021-12-21 11:37:18.218root 11241100x8000000000000000549846Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:18.218{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0c90a584ea5266772021-12-21 11:37:18.218root 11241100x8000000000000000549847Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:18.218{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b42c40b234f4db2b2021-12-21 11:37:18.218root 11241100x8000000000000000549848Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:18.218{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0c0e445103f0ecac2021-12-21 11:37:18.218root 11241100x8000000000000000549849Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:18.219{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.42f283932965ca722021-12-21 11:37:18.219root 11241100x8000000000000000549850Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:18.219{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.fec514f11bc113102021-12-21 11:37:18.219root 11241100x8000000000000000549851Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:18.220{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.51c61f6255bd076d2021-12-21 11:37:18.220root 11241100x8000000000000000549852Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:18.220{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e2cc9618a66592db2021-12-21 11:37:18.220root 11241100x8000000000000000549853Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:18.220{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5a080957baaf58d32021-12-21 11:37:18.220root 11241100x8000000000000000549854Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:18.220{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.83b84b3f2e3db7f52021-12-21 11:37:18.220root 11241100x8000000000000000549855Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:18.220{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.98567ab739c03e812021-12-21 11:37:18.220root 11241100x8000000000000000549856Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:18.220{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1ea32b051680fb8a2021-12-21 11:37:18.220root 11241100x8000000000000000549857Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:18.220{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5570de35229058872021-12-21 11:37:18.220root 11241100x8000000000000000549858Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:18.221{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8d8e9caa15b444812021-12-21 11:37:18.221root 11241100x8000000000000000549859Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:18.221{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.65b09b66813321262021-12-21 11:37:18.221root 11241100x8000000000000000549860Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:18.221{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1172d1b9e7c635172021-12-21 11:37:18.221root 11241100x8000000000000000549861Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:18.221{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4409f450490e69922021-12-21 11:37:18.221root 11241100x8000000000000000549862Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:18.221{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0394b403638c42572021-12-21 11:37:18.221root 11241100x8000000000000000549863Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:18.221{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e47520f63870e48c2021-12-21 11:37:18.221root 11241100x8000000000000000549864Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:18.221{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0a95fd0ad151733b2021-12-21 11:37:18.221root 11241100x8000000000000000549865Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:18.221{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6bc86d99015b4ca92021-12-21 11:37:18.221root 11241100x8000000000000000549866Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:18.222{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f6bdcd85a9dffd6d2021-12-21 11:37:18.222root 11241100x8000000000000000549867Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:18.222{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4a2b8e6b9375bdbc2021-12-21 11:37:18.222root 11241100x8000000000000000549868Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:18.222{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e0bc4df77cd506962021-12-21 11:37:18.222root 11241100x8000000000000000549869Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:18.222{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4c62833d5e24d6522021-12-21 11:37:18.222root 11241100x8000000000000000549870Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:18.222{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7407d05fbfe7de572021-12-21 11:37:18.222root 11241100x8000000000000000549871Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:18.222{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d6218b62204350492021-12-21 11:37:18.222root 11241100x8000000000000000549872Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:18.222{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1ad75bc36fd54cd52021-12-21 11:37:18.222root 11241100x8000000000000000549873Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:18.222{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.bf5eddebbfb467d82021-12-21 11:37:18.222root 11241100x8000000000000000549874Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:18.222{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5b25d90c4cfb4ed92021-12-21 11:37:18.222root 11241100x8000000000000000549875Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:18.222{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6aa5ed94511517be2021-12-21 11:37:18.222root 11241100x8000000000000000549876Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:18.223{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.28c0a536cafddfea2021-12-21 11:37:18.223root 11241100x8000000000000000549877Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:18.223{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8ac047c809467b192021-12-21 11:37:18.223root 11241100x8000000000000000549878Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:18.223{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d05ddf4a026fa4b52021-12-21 11:37:18.223root 11241100x8000000000000000549879Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:18.223{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.17723be77575d9e62021-12-21 11:37:18.223root 11241100x8000000000000000549880Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:18.224{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0d21d7d6535f24ed2021-12-21 11:37:18.224root 11241100x8000000000000000549881Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:18.224{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d16a1c4d8955bbb82021-12-21 11:37:18.224root 11241100x8000000000000000549882Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:18.224{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.30681cb5da78f1012021-12-21 11:37:18.224root 11241100x8000000000000000549883Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:18.224{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d39bb25944a878e22021-12-21 11:37:18.224root 11241100x8000000000000000549884Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:18.224{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c9e8acaf6a771d322021-12-21 11:37:18.224root 11241100x8000000000000000549885Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:18.224{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.97a819b432e3d0872021-12-21 11:37:18.224root 11241100x8000000000000000549886Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:18.224{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.64449230c75ca0812021-12-21 11:37:18.224root 11241100x8000000000000000549887Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:18.224{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.fddec3a8929c9d162021-12-21 11:37:18.224root 11241100x8000000000000000549888Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:18.224{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e2a1703746ad32522021-12-21 11:37:18.224root 11241100x8000000000000000549889Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:18.224{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.dc3ba001151191ea2021-12-21 11:37:18.224root 11241100x8000000000000000549890Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:18.224{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a2e38f984acf97e02021-12-21 11:37:18.224root 11241100x8000000000000000549891Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:18.225{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.be64cd8c1530c3fa2021-12-21 11:37:18.225root 11241100x8000000000000000549892Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:18.225{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.695316d15fab80262021-12-21 11:37:18.225root 11241100x8000000000000000549893Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:18.225{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1ad3e028d0f710fa2021-12-21 11:37:18.225root 11241100x8000000000000000549894Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:18.225{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.995e443c370daf562021-12-21 11:37:18.225root 11241100x8000000000000000549895Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:18.225{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9c3100b1ad5138292021-12-21 11:37:18.225root 11241100x8000000000000000549896Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:18.225{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.657bb3fa3ce156b72021-12-21 11:37:18.225root 11241100x8000000000000000549897Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:18.225{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.536622c8e5c6aa262021-12-21 11:37:18.225root 11241100x8000000000000000549898Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:18.225{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.dc25c5daa14d5a212021-12-21 11:37:18.225root 11241100x8000000000000000549899Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:18.225{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d44d150076440e932021-12-21 11:37:18.225root 11241100x8000000000000000549900Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:18.226{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ed65fec80eaaacf82021-12-21 11:37:18.226root 11241100x8000000000000000549901Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:18.226{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.24caf5563ad201a72021-12-21 11:37:18.226root 11241100x8000000000000000549902Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:18.226{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.31856a438f53c8542021-12-21 11:37:18.226root 11241100x8000000000000000549903Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:18.226{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.eff7d561a650eecd2021-12-21 11:37:18.226root 11241100x8000000000000000549904Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:18.226{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ddf6f473a012bb3a2021-12-21 11:37:18.226root 11241100x8000000000000000549905Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:18.226{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.80cd77d204488ade2021-12-21 11:37:18.226root 11241100x8000000000000000549906Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:18.226{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c089d73187f394e32021-12-21 11:37:18.226root 11241100x8000000000000000549907Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:18.226{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.14ec36d7cf71d79f2021-12-21 11:37:18.226root 11241100x8000000000000000549908Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:18.226{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f600284de2a404f82021-12-21 11:37:18.226root 11241100x8000000000000000549909Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:18.226{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.10e05dc90ef76b212021-12-21 11:37:18.226root 11241100x8000000000000000549910Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:18.226{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4501ad0ed73f3e432021-12-21 11:37:18.226root 11241100x8000000000000000549911Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:18.226{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.82e06f88c8b0be622021-12-21 11:37:18.226root 11241100x8000000000000000549912Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:18.226{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.273a17d1134a97662021-12-21 11:37:18.226root 11241100x8000000000000000549913Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:18.226{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ac71106d11f9b3d12021-12-21 11:37:18.226root 11241100x8000000000000000549914Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:18.227{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.afbd3ed80812ea202021-12-21 11:37:18.227root 11241100x8000000000000000549915Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:18.227{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.bae81b48a56859672021-12-21 11:37:18.227root 11241100x8000000000000000549916Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:18.227{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.30bfd69e0f9491e82021-12-21 11:37:18.227root 11241100x8000000000000000549917Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:18.227{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f2e8e0b026b9a0572021-12-21 11:37:18.227root 11241100x8000000000000000549918Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:18.227{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a423ee8167c69edb2021-12-21 11:37:18.227root 11241100x8000000000000000549919Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:18.227{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.156b3cd798474baf2021-12-21 11:37:18.227root 11241100x8000000000000000549920Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:18.227{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d8e90710c08a61202021-12-21 11:37:18.227root 11241100x8000000000000000549921Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:18.227{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.365de4233d9e7cc42021-12-21 11:37:18.227root 11241100x8000000000000000549922Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:18.227{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1e329cfa0830244b2021-12-21 11:37:18.227root 11241100x8000000000000000549923Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:18.228{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.bd93c3bcea0d37dd2021-12-21 11:37:18.228root 11241100x8000000000000000549924Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:18.228{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.80ed5be3b84468702021-12-21 11:37:18.228root 11241100x8000000000000000549925Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:18.228{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.14daf81964fb83062021-12-21 11:37:18.228root 11241100x8000000000000000549926Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:18.228{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7c8d474cc6a1b2482021-12-21 11:37:18.228root 11241100x8000000000000000549927Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:18.228{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.618ca30f990e99302021-12-21 11:37:18.228root 11241100x8000000000000000549928Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:18.228{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d04eab3ddfd09dac2021-12-21 11:37:18.228root 11241100x8000000000000000549929Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:18.228{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6ca2dd9f9829f73e2021-12-21 11:37:18.228root 11241100x8000000000000000549930Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:18.230{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ca14c22516b66a0a2021-12-21 11:37:18.230root 11241100x8000000000000000549931Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:18.230{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c8b81ea017f49fec2021-12-21 11:37:18.230root 11241100x8000000000000000549932Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:18.230{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8d6facc9659e475c2021-12-21 11:37:18.230root 11241100x8000000000000000549933Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:18.230{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5f89d9eee7812e4b2021-12-21 11:37:18.230root 11241100x8000000000000000549934Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:18.230{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.21ac444c8b820b822021-12-21 11:37:18.230root 11241100x8000000000000000549935Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:18.230{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b231b7f1bdff683b2021-12-21 11:37:18.230root 11241100x8000000000000000549936Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:18.230{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.fa83c2ce2641d47a2021-12-21 11:37:18.230root 11241100x8000000000000000549937Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:18.231{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a94b26ed54f1fb4e2021-12-21 11:37:18.231root 11241100x8000000000000000549938Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:18.231{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.548366aafe8c45db2021-12-21 11:37:18.231root 11241100x8000000000000000549939Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:18.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.355969b5611a7b362021-12-21 11:37:18.693root 11241100x8000000000000000549940Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:18.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d337a4f1459cd7c42021-12-21 11:37:18.693root 11241100x8000000000000000549941Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:18.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f6db265fd32fcc1e2021-12-21 11:37:18.693root 11241100x8000000000000000549942Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:18.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a5e2afc090a379ee2021-12-21 11:37:18.693root 11241100x8000000000000000549943Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:18.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.88a280949b2622b42021-12-21 11:37:18.693root 11241100x8000000000000000549944Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:18.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6958e745a5626d5f2021-12-21 11:37:18.693root 11241100x8000000000000000549945Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:18.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.199a0ea20ab8d49e2021-12-21 11:37:18.693root 11241100x8000000000000000549946Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:18.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a550c45f21f2f01e2021-12-21 11:37:18.693root 11241100x8000000000000000549947Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:18.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.80e6bf070ec512c42021-12-21 11:37:18.693root 11241100x8000000000000000549948Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:18.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f2276c735319e36f2021-12-21 11:37:18.693root 11241100x8000000000000000549949Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:18.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6b719540f365d84b2021-12-21 11:37:18.693root 11241100x8000000000000000549950Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:18.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a8203922ed3757982021-12-21 11:37:18.694root 11241100x8000000000000000549951Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:18.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.fa4df38c29180b502021-12-21 11:37:18.694root 11241100x8000000000000000549952Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:18.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e2cb351fb351fbb32021-12-21 11:37:18.694root 11241100x8000000000000000549953Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:18.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d404cb4d2bbc434f2021-12-21 11:37:18.694root 11241100x8000000000000000549954Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:18.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8279dece17b011882021-12-21 11:37:18.694root 11241100x8000000000000000549955Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:18.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9c637eb8898a105f2021-12-21 11:37:18.694root 11241100x8000000000000000549956Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:18.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.59fc9bf2d2fc88d72021-12-21 11:37:18.694root 11241100x8000000000000000549957Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:18.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4bcd237c9e2dff122021-12-21 11:37:18.694root 11241100x8000000000000000549958Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:18.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.54001f7ce2824de02021-12-21 11:37:18.694root 11241100x8000000000000000549959Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:18.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.708f0a67359349bf2021-12-21 11:37:18.694root 11241100x8000000000000000549960Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:18.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.dffbc432e100b0142021-12-21 11:37:18.694root 11241100x8000000000000000549961Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:18.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.514e6d99a883c3252021-12-21 11:37:18.694root 11241100x8000000000000000549962Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:18.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.07d5b94e152ca0142021-12-21 11:37:18.694root 11241100x8000000000000000549963Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:18.695{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1f43fac34db47d8b2021-12-21 11:37:18.695root 11241100x8000000000000000549964Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:18.695{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1faaaf8d524baa3b2021-12-21 11:37:18.695root 11241100x8000000000000000549965Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:18.695{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c6118cfdf064d9f92021-12-21 11:37:18.695root 11241100x8000000000000000549966Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:18.695{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.defef8b85db7f6872021-12-21 11:37:18.695root 11241100x8000000000000000549967Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:18.695{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1b46ded0de8d206a2021-12-21 11:37:18.695root 11241100x8000000000000000549968Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:18.695{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.71fdb1b2a2d6d7232021-12-21 11:37:18.695root 11241100x8000000000000000549969Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:18.695{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2667ab40d88d9f1b2021-12-21 11:37:18.695root 11241100x8000000000000000549970Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:18.695{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.535c129e892ef0272021-12-21 11:37:18.695root 11241100x8000000000000000549971Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:18.695{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.33eb6c359413f7e02021-12-21 11:37:18.695root 11241100x8000000000000000549972Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:18.695{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9b17b5d9f3761b192021-12-21 11:37:18.695root 11241100x8000000000000000549973Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:18.696{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b65efbabcba9269e2021-12-21 11:37:18.696root 11241100x8000000000000000549974Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:18.696{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0ef60b29b3ad620b2021-12-21 11:37:18.696root 11241100x8000000000000000549975Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:18.696{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.55fd647d8433fec22021-12-21 11:37:18.696root 11241100x8000000000000000549976Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:18.696{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.559fd6d5baba3ff72021-12-21 11:37:18.696root 11241100x8000000000000000549977Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:18.696{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.630b61abc74eb7f52021-12-21 11:37:18.696root 11241100x8000000000000000549978Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:18.696{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e746e2f635c1593b2021-12-21 11:37:18.696root 11241100x8000000000000000549979Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:18.696{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ba1e82578e1a3de42021-12-21 11:37:18.696root 11241100x8000000000000000549980Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:18.696{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6a2acd470df076d12021-12-21 11:37:18.696root 11241100x8000000000000000549981Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:18.696{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.bed47e016ca353302021-12-21 11:37:18.696root 11241100x8000000000000000549982Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:18.696{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0e2b7ca917a0040b2021-12-21 11:37:18.696root 11241100x8000000000000000549983Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:18.696{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9b7af1f588a9e30d2021-12-21 11:37:18.696root 11241100x8000000000000000549984Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:18.697{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.90ff23d0ec75cef52021-12-21 11:37:18.697root 11241100x8000000000000000549985Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:18.697{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.51de7d022b7875892021-12-21 11:37:18.697root 11241100x8000000000000000549986Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:18.697{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.896ca3baee8dd9d02021-12-21 11:37:18.697root 11241100x8000000000000000549987Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:18.697{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.333f7a99c8bca0882021-12-21 11:37:18.697root 11241100x8000000000000000549988Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:18.697{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.eaecdca402a5876c2021-12-21 11:37:18.697root 11241100x8000000000000000549989Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:18.697{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d61da034bd8d83c92021-12-21 11:37:18.697root 11241100x8000000000000000549990Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:18.697{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ab50895a3d04b3ea2021-12-21 11:37:18.697root 11241100x8000000000000000549991Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:18.697{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.dbcbfcd8d6782a902021-12-21 11:37:18.697root 11241100x8000000000000000549992Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:18.697{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.46f2940ed317461f2021-12-21 11:37:18.697root 11241100x8000000000000000549993Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:18.697{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7d4129dbc3fdc9aa2021-12-21 11:37:18.697root 11241100x8000000000000000549994Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:18.697{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.77c13f15bbcc4ead2021-12-21 11:37:18.697root 11241100x8000000000000000549995Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:18.697{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d4945d808511c35a2021-12-21 11:37:18.697root 11241100x8000000000000000549996Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:18.698{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ac157539bf5b1ecf2021-12-21 11:37:18.698root 11241100x8000000000000000549997Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:18.698{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.267b9eba113933852021-12-21 11:37:18.698root 11241100x8000000000000000549998Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:18.698{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0608578e9bd917102021-12-21 11:37:18.698root 11241100x8000000000000000549999Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:18.698{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.231edfbf6e7d5cad2021-12-21 11:37:18.698root 11241100x8000000000000000550000Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:18.698{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3c830b2d4a8c1b892021-12-21 11:37:18.698root 11241100x8000000000000000550001Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:18.698{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.fd6fc145c1bf15bf2021-12-21 11:37:18.698root 11241100x8000000000000000550002Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:18.698{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ac5be10c867a14542021-12-21 11:37:18.698root 11241100x8000000000000000550003Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:18.698{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2fa4513c1da5a8e12021-12-21 11:37:18.698root 11241100x8000000000000000550004Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:18.698{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7f6b799b9c34ae852021-12-21 11:37:18.698root 11241100x8000000000000000550005Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:18.699{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.65c06ea8c2f074962021-12-21 11:37:18.699root 11241100x8000000000000000550006Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:18.699{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.54c3b278d656262a2021-12-21 11:37:18.699root 11241100x8000000000000000550007Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:18.699{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c16f679be694b5042021-12-21 11:37:18.699root 11241100x8000000000000000550008Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:18.699{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2176932f95321cd22021-12-21 11:37:18.699root 11241100x8000000000000000550009Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:18.699{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.32ccebc7b64937a52021-12-21 11:37:18.699root 11241100x8000000000000000550010Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:18.699{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d353c5b81424d8a92021-12-21 11:37:18.699root 11241100x8000000000000000550011Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:18.699{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.094d0923a8408aa72021-12-21 11:37:18.699root 11241100x8000000000000000550012Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:18.699{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.451c173abade292c2021-12-21 11:37:18.699root 11241100x8000000000000000550013Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:18.699{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.59535bc918ab27522021-12-21 11:37:18.699root 11241100x8000000000000000550014Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:18.699{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.966b2b763f3284342021-12-21 11:37:18.699root 11241100x8000000000000000550015Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:18.699{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e3acb844b731d7e72021-12-21 11:37:18.699root 11241100x8000000000000000550016Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:18.700{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a35ddccd2fd9d55c2021-12-21 11:37:18.700root 11241100x8000000000000000550017Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:18.700{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.cf86f84a4a30c0ee2021-12-21 11:37:18.700root 11241100x8000000000000000550018Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:18.700{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a0f2538fa2e7aa612021-12-21 11:37:18.700root 11241100x8000000000000000550019Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:18.700{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.539054d5b7aaf5952021-12-21 11:37:18.700root 11241100x8000000000000000550020Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:18.700{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.249f2b742747c5712021-12-21 11:37:18.700root 11241100x8000000000000000550021Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:18.700{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3c4e3f942f1113642021-12-21 11:37:18.700root 11241100x8000000000000000550022Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:18.700{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1217bc4230ca73692021-12-21 11:37:18.700root 11241100x8000000000000000550023Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:18.700{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2d87591ff89fc34f2021-12-21 11:37:18.700root 11241100x8000000000000000550024Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:18.700{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8ee10e03c679cef92021-12-21 11:37:18.700root 11241100x8000000000000000550025Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:18.700{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.dfde75b364a58a832021-12-21 11:37:18.700root 11241100x8000000000000000550026Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:18.700{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.da5100fd4cc5fab82021-12-21 11:37:18.700root 11241100x8000000000000000550027Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:18.700{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ddbc27f924d7c20b2021-12-21 11:37:18.700root 11241100x8000000000000000550028Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:18.700{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e9e6515b533e1de32021-12-21 11:37:18.700root 11241100x8000000000000000550029Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:18.700{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4420330149dfd5ba2021-12-21 11:37:18.700root 11241100x8000000000000000550030Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:18.701{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5a44c02a73be35e22021-12-21 11:37:18.701root 11241100x8000000000000000550031Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:18.701{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.598d09d54911eae72021-12-21 11:37:18.701root 11241100x8000000000000000550032Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:18.701{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4a0ca7c3621760d72021-12-21 11:37:18.701root 11241100x8000000000000000550033Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:18.701{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d8f37da97b3077902021-12-21 11:37:18.701root 11241100x8000000000000000550034Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:18.701{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.52d646a727e5d7af2021-12-21 11:37:18.701root 11241100x8000000000000000550035Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:18.701{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.688ddc30fd54e3f92021-12-21 11:37:18.701root 11241100x8000000000000000550036Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:18.701{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d7463caeef012fb42021-12-21 11:37:18.701root 11241100x8000000000000000550037Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:18.701{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c98466eff6fdc9e22021-12-21 11:37:18.701root 11241100x8000000000000000550038Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:18.701{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5749943bcd77fa932021-12-21 11:37:18.701root 11241100x8000000000000000550039Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:18.701{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.008fc5f86b52e0ae2021-12-21 11:37:18.701root 11241100x8000000000000000550040Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:18.702{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.41a43b4edc698aa02021-12-21 11:37:18.702root 11241100x8000000000000000550041Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:18.702{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b8f330d801833d3c2021-12-21 11:37:18.702root 11241100x8000000000000000550042Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:18.702{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6e6db503729b25c62021-12-21 11:37:18.702root 11241100x8000000000000000550043Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:18.702{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.34be4baa8476a8412021-12-21 11:37:18.702root 11241100x8000000000000000550044Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:18.702{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.bbe3f69c43f4868c2021-12-21 11:37:18.702root 11241100x8000000000000000550045Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:18.702{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.51f5db6736bbe1892021-12-21 11:37:18.702root 11241100x8000000000000000550046Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:18.702{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b21e31bdb6002e142021-12-21 11:37:18.702root 11241100x8000000000000000550047Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:18.702{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.10737bc39d6760272021-12-21 11:37:18.702root 11241100x8000000000000000550048Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:18.702{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ad29d4a74c28fca92021-12-21 11:37:18.702root 11241100x8000000000000000550049Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:18.703{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.180e06b546acad2e2021-12-21 11:37:18.703root 11241100x8000000000000000550050Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:18.703{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.709c401df14b594c2021-12-21 11:37:18.703root 11241100x8000000000000000550051Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:18.703{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.35a456ce66a627e52021-12-21 11:37:18.703root 11241100x8000000000000000550052Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:18.703{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a648da7166c4e8e12021-12-21 11:37:18.703root 11241100x8000000000000000550053Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:18.703{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.dcf3dea80889e7dd2021-12-21 11:37:18.703root 11241100x8000000000000000550054Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:18.703{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ff62325fe91d27322021-12-21 11:37:18.703root 11241100x8000000000000000550055Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:18.703{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.292c726c8643beac2021-12-21 11:37:18.703root 11241100x8000000000000000550056Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:18.703{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5c2d5337bca2f5422021-12-21 11:37:18.703root 11241100x8000000000000000550057Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:18.704{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.cf6fccf50e753b112021-12-21 11:37:18.704root 11241100x8000000000000000550058Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:18.704{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.01d60ff3c77e6c992021-12-21 11:37:18.704root 11241100x8000000000000000550059Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:18.704{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.29ba27da354522ce2021-12-21 11:37:18.704root 11241100x8000000000000000550060Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:18.704{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.92aedeae011754802021-12-21 11:37:18.704root 11241100x8000000000000000550061Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:18.704{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2022c4e109e1b02f2021-12-21 11:37:18.704root 11241100x8000000000000000550062Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:18.704{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ab8f8bee7b21cecc2021-12-21 11:37:18.704root 11241100x8000000000000000550063Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:18.704{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c9574879b60dada22021-12-21 11:37:18.704root 11241100x8000000000000000550064Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:18.704{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.60de4aefb5c137eb2021-12-21 11:37:18.704root 11241100x8000000000000000550065Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:18.704{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.67a9ae97184d5b952021-12-21 11:37:18.704root 11241100x8000000000000000550066Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:18.704{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7989b69678ba89f32021-12-21 11:37:18.704root 11241100x8000000000000000550067Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:18.704{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b604d526cb8ebcda2021-12-21 11:37:18.704root 11241100x8000000000000000550068Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:18.705{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7b81b46196469f762021-12-21 11:37:18.705root 11241100x8000000000000000550069Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:18.705{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.586ef32516fd01e72021-12-21 11:37:18.705root 11241100x8000000000000000550070Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:18.705{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.244452099bce46562021-12-21 11:37:18.705root 11241100x8000000000000000550071Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:18.705{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.738ef79b4ea585432021-12-21 11:37:18.705root 11241100x8000000000000000550072Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:18.705{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0a4f1aaf622c5c882021-12-21 11:37:18.705root 11241100x8000000000000000550073Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:18.705{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3439ba76a312d83e2021-12-21 11:37:18.705root 11241100x8000000000000000550074Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2fba798619f45ec52021-12-21 11:37:19.193root 11241100x8000000000000000550075Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e699e6f169f654ed2021-12-21 11:37:19.193root 11241100x8000000000000000550076Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ba4f031844e4b2b12021-12-21 11:37:19.193root 11241100x8000000000000000550077Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f5f4d8e91bcca4aa2021-12-21 11:37:19.193root 11241100x8000000000000000550078Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e22364a09d6deada2021-12-21 11:37:19.193root 11241100x8000000000000000550079Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b8694a1bb11ca9d32021-12-21 11:37:19.193root 11241100x8000000000000000550080Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0250ee52d09bc2ad2021-12-21 11:37:19.193root 11241100x8000000000000000550081Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.77e96bdfaa3588332021-12-21 11:37:19.193root 11241100x8000000000000000550082Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0a895557ef35dd8d2021-12-21 11:37:19.193root 11241100x8000000000000000550083Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8ffd4ebefb434ece2021-12-21 11:37:19.193root 11241100x8000000000000000550084Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6397aee5945f51462021-12-21 11:37:19.193root 11241100x8000000000000000550085Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.78ccfece69c5c9612021-12-21 11:37:19.193root 11241100x8000000000000000550086Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d83dfaf935d9f0cc2021-12-21 11:37:19.193root 11241100x8000000000000000550087Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.fcf72aef3d8d47402021-12-21 11:37:19.194root 11241100x8000000000000000550088Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.fbdbac054a8bdbd22021-12-21 11:37:19.194root 11241100x8000000000000000550089Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0e283eb325dbcfba2021-12-21 11:37:19.194root 11241100x8000000000000000550090Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.62c6dbaad5e584d52021-12-21 11:37:19.194root 11241100x8000000000000000550091Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8921fcef57950d912021-12-21 11:37:19.194root 11241100x8000000000000000550092Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.19e4d10fc74025d42021-12-21 11:37:19.194root 11241100x8000000000000000550093Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.195{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.753233749ee0bda42021-12-21 11:37:19.195root 11241100x8000000000000000550094Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.195{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.738c516a813130982021-12-21 11:37:19.195root 11241100x8000000000000000550095Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.195{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7def45007be20f602021-12-21 11:37:19.195root 11241100x8000000000000000550096Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.195{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b59361656ef78a032021-12-21 11:37:19.195root 11241100x8000000000000000550097Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.195{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ba7d53c3363c4ea32021-12-21 11:37:19.195root 11241100x8000000000000000550098Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.196{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2fed14900c9f18422021-12-21 11:37:19.196root 11241100x8000000000000000550099Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.196{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.542b5f1c0a9e450f2021-12-21 11:37:19.196root 11241100x8000000000000000550100Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.196{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.25ba45cd779831cb2021-12-21 11:37:19.196root 11241100x8000000000000000550101Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.196{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.28202271f0e7c9d52021-12-21 11:37:19.196root 11241100x8000000000000000550102Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.196{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f4fdb0947a3889682021-12-21 11:37:19.196root 11241100x8000000000000000550103Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.196{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0c6bb8cf95f562e12021-12-21 11:37:19.196root 11241100x8000000000000000550104Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.197{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.895865a015b4e0952021-12-21 11:37:19.197root 11241100x8000000000000000550105Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.197{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.fb234e67a2b53ca42021-12-21 11:37:19.197root 11241100x8000000000000000550106Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.197{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4a5e830d0ed67a7f2021-12-21 11:37:19.197root 11241100x8000000000000000550107Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.197{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.08dd654134ed35ce2021-12-21 11:37:19.197root 11241100x8000000000000000550108Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.197{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.59fd9df2a34cdf192021-12-21 11:37:19.197root 11241100x8000000000000000550109Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.198{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6e020b42318d188a2021-12-21 11:37:19.198root 11241100x8000000000000000550110Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.198{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5c7267ba64dc142c2021-12-21 11:37:19.198root 11241100x8000000000000000550111Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.198{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e3af02f0deb5231c2021-12-21 11:37:19.198root 11241100x8000000000000000550112Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.198{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0bbf3c61e91ef9d82021-12-21 11:37:19.198root 11241100x8000000000000000550113Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.198{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e40990a8fda0d0342021-12-21 11:37:19.198root 11241100x8000000000000000550114Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.199{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.99cb9be0928292392021-12-21 11:37:19.199root 11241100x8000000000000000550115Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.199{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ed0305451ccf78362021-12-21 11:37:19.199root 11241100x8000000000000000550116Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.199{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3bc8534fe15998d32021-12-21 11:37:19.199root 11241100x8000000000000000550117Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.200{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.040526c9662bfb232021-12-21 11:37:19.200root 11241100x8000000000000000550118Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.200{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4b14f10c35132e252021-12-21 11:37:19.200root 11241100x8000000000000000550119Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.200{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b3fb02e626c1e2162021-12-21 11:37:19.200root 11241100x8000000000000000550120Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.200{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.52900742b41f7e342021-12-21 11:37:19.200root 11241100x8000000000000000550121Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.200{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d086fed2859f9aef2021-12-21 11:37:19.200root 11241100x8000000000000000550122Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.201{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c28c4588cdcd8f7e2021-12-21 11:37:19.201root 11241100x8000000000000000550123Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.201{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0b3f1db8a92ce3412021-12-21 11:37:19.201root 11241100x8000000000000000550124Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.201{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.cecdf61b5e5bbb692021-12-21 11:37:19.201root 11241100x8000000000000000550125Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.201{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4474ff07f51d69bc2021-12-21 11:37:19.201root 11241100x8000000000000000550126Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.202{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.962aacd7a366d80d2021-12-21 11:37:19.202root 11241100x8000000000000000550127Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.202{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b89c50c757b9d0722021-12-21 11:37:19.202root 11241100x8000000000000000550128Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.202{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5f492b93b38701fd2021-12-21 11:37:19.202root 11241100x8000000000000000550129Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.202{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4a9097e0954fd9722021-12-21 11:37:19.202root 11241100x8000000000000000550130Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.202{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5c530d6108fdf13b2021-12-21 11:37:19.202root 11241100x8000000000000000550131Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.203{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.bcad85795967293d2021-12-21 11:37:19.203root 11241100x8000000000000000550132Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.203{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.cc07147cb5bb7adb2021-12-21 11:37:19.203root 11241100x8000000000000000550133Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.203{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4853afff447ad8362021-12-21 11:37:19.203root 11241100x8000000000000000550134Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.203{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.410ca4c8a1cea96c2021-12-21 11:37:19.203root 11241100x8000000000000000550135Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.204{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b9e6f1ccdb9108702021-12-21 11:37:19.204root 11241100x8000000000000000550136Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.204{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.53646587ef9904322021-12-21 11:37:19.204root 11241100x8000000000000000550137Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.204{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ad10a2e4acbb7e102021-12-21 11:37:19.204root 11241100x8000000000000000550138Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.204{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5f4507121871cbb22021-12-21 11:37:19.204root 11241100x8000000000000000550139Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.204{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2951cd7577c1c4572021-12-21 11:37:19.204root 11241100x8000000000000000550140Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.204{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ea40124b1b995d012021-12-21 11:37:19.204root 11241100x8000000000000000550141Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.204{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.52544b1e700b6f872021-12-21 11:37:19.204root 11241100x8000000000000000550142Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.204{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b08d1b35c78a34f72021-12-21 11:37:19.204root 11241100x8000000000000000550143Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.204{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.649cdc08139d9ab82021-12-21 11:37:19.204root 11241100x8000000000000000550144Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.204{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.06bf07d09043737c2021-12-21 11:37:19.204root 11241100x8000000000000000550145Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.205{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7ec3e4d65758caf22021-12-21 11:37:19.205root 11241100x8000000000000000550146Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.205{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8dbf7dd9ea62784f2021-12-21 11:37:19.205root 11241100x8000000000000000550147Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.205{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.785e2a69233fa55a2021-12-21 11:37:19.205root 11241100x8000000000000000550148Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.205{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8f2ae2989e92fe762021-12-21 11:37:19.205root 11241100x8000000000000000550149Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.205{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5f1d342b2303e6d82021-12-21 11:37:19.205root 11241100x8000000000000000550150Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.205{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6e1107e6e94775222021-12-21 11:37:19.205root 11241100x8000000000000000550151Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.205{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b9894550031efdb12021-12-21 11:37:19.205root 11241100x8000000000000000550152Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.205{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c223a9ace3730df12021-12-21 11:37:19.205root 11241100x8000000000000000550153Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.206{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3033d4a68573ca5e2021-12-21 11:37:19.206root 11241100x8000000000000000550154Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.206{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2b3c7330b35f797a2021-12-21 11:37:19.206root 11241100x8000000000000000550155Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.206{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.049fdf4f13c0f2a72021-12-21 11:37:19.206root 11241100x8000000000000000550156Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.207{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.035d9718889f04d72021-12-21 11:37:19.207root 11241100x8000000000000000550157Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.207{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.56a661287de3e60f2021-12-21 11:37:19.207root 11241100x8000000000000000550158Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.207{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a8f432f402b10f1e2021-12-21 11:37:19.207root 11241100x8000000000000000550159Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.207{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.47b68a1797d0ea682021-12-21 11:37:19.207root 11241100x8000000000000000550160Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.207{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8cad5090e715a3562021-12-21 11:37:19.207root 11241100x8000000000000000550161Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.207{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.21f2d49393a138682021-12-21 11:37:19.207root 11241100x8000000000000000550162Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.207{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e4ef26e68f4ae5902021-12-21 11:37:19.207root 11241100x8000000000000000550163Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.208{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4d1fe586e2fd08622021-12-21 11:37:19.208root 11241100x8000000000000000550164Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.208{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f015f5f02c7db0492021-12-21 11:37:19.208root 11241100x8000000000000000550165Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.208{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.99d3b0d13b5d53bc2021-12-21 11:37:19.208root 11241100x8000000000000000550166Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.208{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f06da39061df59f02021-12-21 11:37:19.208root 11241100x8000000000000000550167Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.208{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.71b86943991e8a472021-12-21 11:37:19.208root 11241100x8000000000000000550168Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.208{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6ef149c6e64edbc22021-12-21 11:37:19.208root 11241100x8000000000000000550169Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.208{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9c22a993f997369b2021-12-21 11:37:19.208root 11241100x8000000000000000550170Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.208{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a771900a79b3512b2021-12-21 11:37:19.208root 11241100x8000000000000000550171Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.209{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.bf10b5dc9af2d5582021-12-21 11:37:19.209root 11241100x8000000000000000550172Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.209{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.47ef915e05fc212d2021-12-21 11:37:19.209root 11241100x8000000000000000550173Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.209{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f49f0c1e42cc7d502021-12-21 11:37:19.209root 11241100x8000000000000000550174Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.209{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f5bd49223f72ae522021-12-21 11:37:19.209root 11241100x8000000000000000550175Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.209{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.73c78121da3948f02021-12-21 11:37:19.209root 11241100x8000000000000000550176Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.209{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.74a01c2e25513c542021-12-21 11:37:19.209root 11241100x8000000000000000550177Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.209{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a0f84fbdcb56bad82021-12-21 11:37:19.209root 11241100x8000000000000000550178Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.209{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.77877c7d35653d0b2021-12-21 11:37:19.209root 11241100x8000000000000000550179Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.209{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b4d72ef334f9dc2c2021-12-21 11:37:19.209root 11241100x8000000000000000550180Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.210{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.749213ab1b34268f2021-12-21 11:37:19.210root 11241100x8000000000000000550181Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.210{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0d8da6e8333088df2021-12-21 11:37:19.210root 11241100x8000000000000000550182Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.210{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0f36034d3127bece2021-12-21 11:37:19.210root 11241100x8000000000000000550183Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.210{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.13651513e88f862e2021-12-21 11:37:19.210root 11241100x8000000000000000550184Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.210{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1cc51997a97e48c82021-12-21 11:37:19.210root 11241100x8000000000000000550185Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.210{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f739d79755856a562021-12-21 11:37:19.210root 11241100x8000000000000000550186Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.210{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a3e00ddcbec6aacc2021-12-21 11:37:19.210root 11241100x8000000000000000550187Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.210{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3c45b5004b4536282021-12-21 11:37:19.210root 11241100x8000000000000000550188Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.210{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.01a95ec2008252be2021-12-21 11:37:19.210root 11241100x8000000000000000550189Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.211{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7a4d7f93ddbd284a2021-12-21 11:37:19.211root 11241100x8000000000000000550190Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.211{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ee2eb7cebbd7218c2021-12-21 11:37:19.211root 11241100x8000000000000000550191Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.211{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d32af90cd7e9edd42021-12-21 11:37:19.211root 11241100x8000000000000000550192Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.211{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.bdb520c4fbd11b062021-12-21 11:37:19.211root 11241100x8000000000000000550193Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.211{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.deeb6c510e1bc5462021-12-21 11:37:19.211root 11241100x8000000000000000550194Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.211{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.558ff926c28a3d602021-12-21 11:37:19.211root 11241100x8000000000000000550195Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.211{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.24935b012cc035b32021-12-21 11:37:19.211root 11241100x8000000000000000550196Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.211{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7aa06620588f9e9d2021-12-21 11:37:19.211root 11241100x8000000000000000550197Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.211{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e727f3d97f3dd3202021-12-21 11:37:19.211root 11241100x8000000000000000550198Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.211{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7e4e91c94154cf642021-12-21 11:37:19.211root 11241100x8000000000000000550199Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.212{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f5e3af68cde5fda32021-12-21 11:37:19.212root 11241100x8000000000000000550200Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.212{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5cfaf2744be7770b2021-12-21 11:37:19.212root 11241100x8000000000000000550201Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.212{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.89815546c76399ac2021-12-21 11:37:19.212root 11241100x8000000000000000550202Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.212{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.be1f0ebaabb263dd2021-12-21 11:37:19.212root 11241100x8000000000000000550203Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.212{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8acfb8b64eb805ad2021-12-21 11:37:19.212root 11241100x8000000000000000550204Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.212{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f790df7f526849db2021-12-21 11:37:19.212root 11241100x8000000000000000550205Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.212{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.355b72d57bc53c462021-12-21 11:37:19.212root 11241100x8000000000000000550206Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.212{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e6f3cebb6af6e2762021-12-21 11:37:19.212root 11241100x8000000000000000550207Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.212{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c7bab9eae452a0172021-12-21 11:37:19.212root 11241100x8000000000000000550208Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.212{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.cd66be7905f580e42021-12-21 11:37:19.212root 11241100x8000000000000000550209Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.212{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ed369f193e901ac62021-12-21 11:37:19.212root 11241100x8000000000000000550210Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.212{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0adf33f5aca0e8102021-12-21 11:37:19.212root 11241100x8000000000000000550211Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.213{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9dcc23669c3c314a2021-12-21 11:37:19.213root 11241100x8000000000000000550212Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.213{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.80059ec3339acf632021-12-21 11:37:19.213root 11241100x8000000000000000550213Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.213{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.006c0ff1ef9bc6f02021-12-21 11:37:19.213root 11241100x8000000000000000550214Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.213{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.bd4c2c23aeb637942021-12-21 11:37:19.213root 11241100x8000000000000000550215Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.213{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.fd77c159597ce06c2021-12-21 11:37:19.213root 11241100x8000000000000000550216Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.213{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.82000e05846e99842021-12-21 11:37:19.213root 11241100x8000000000000000550217Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.213{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.95060d514bfddf6a2021-12-21 11:37:19.213root 11241100x8000000000000000550218Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.213{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1bd68fd98bf5bfa82021-12-21 11:37:19.213root 11241100x8000000000000000550219Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.213{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.34062dee73b60ca92021-12-21 11:37:19.213root 11241100x8000000000000000550220Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.213{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.240ff576b89d1c392021-12-21 11:37:19.213root 11241100x8000000000000000550221Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.213{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.240ebef2722818002021-12-21 11:37:19.213root 11241100x8000000000000000550222Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.213{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b51b794f59b976bd2021-12-21 11:37:19.213root 11241100x8000000000000000550223Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.213{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7ee9e51c0de1b25a2021-12-21 11:37:19.213root 11241100x8000000000000000550224Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.214{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1720e872d884d1042021-12-21 11:37:19.214root 11241100x8000000000000000550225Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.214{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.855092720a6c491b2021-12-21 11:37:19.214root 11241100x8000000000000000550226Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.214{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e8c576691dc5b85a2021-12-21 11:37:19.214root 11241100x8000000000000000550227Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.214{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.11caf47f1b402a682021-12-21 11:37:19.214root 11241100x8000000000000000550228Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.214{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.21dae3b7cfecfdf02021-12-21 11:37:19.214root 11241100x8000000000000000550229Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.214{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.37b4ffdcb24b732a2021-12-21 11:37:19.214root 11241100x8000000000000000550230Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.214{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6331a51ca3be1ff02021-12-21 11:37:19.214root 11241100x8000000000000000550231Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.214{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3f39184c9780432f2021-12-21 11:37:19.214root 11241100x8000000000000000550232Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.214{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3187377bbf62dede2021-12-21 11:37:19.214root 11241100x8000000000000000550233Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.214{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.db3479ffa2a17ad62021-12-21 11:37:19.214root 11241100x8000000000000000550234Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.214{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0de93e0f7409ac952021-12-21 11:37:19.214root 11241100x8000000000000000550235Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.214{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a0b998277adb64b82021-12-21 11:37:19.214root 11241100x8000000000000000550236Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.214{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4893d141b210ae1b2021-12-21 11:37:19.214root 11241100x8000000000000000550237Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.215{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b786cc3d7e5559272021-12-21 11:37:19.215root 11241100x8000000000000000550238Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.215{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7898a2484cd1540f2021-12-21 11:37:19.215root 11241100x8000000000000000550239Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.215{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.bef6d61d9aa401c72021-12-21 11:37:19.215root 11241100x8000000000000000550240Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.215{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0edb737107d939332021-12-21 11:37:19.215root 11241100x8000000000000000550241Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.215{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.bfacd9417f780a162021-12-21 11:37:19.215root 11241100x8000000000000000550242Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.215{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.517616eb7db158802021-12-21 11:37:19.215root 11241100x8000000000000000550243Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.215{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4040239869daf53c2021-12-21 11:37:19.215root 11241100x8000000000000000550244Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.215{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6a42d419f5978d222021-12-21 11:37:19.215root 11241100x8000000000000000550245Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.215{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9009e31ea64261532021-12-21 11:37:19.215root 11241100x8000000000000000550246Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.215{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.50eb1faec3f809632021-12-21 11:37:19.215root 11241100x8000000000000000550247Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.215{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8622aea71f026f172021-12-21 11:37:19.215root 11241100x8000000000000000550248Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.215{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4bf13277b875b6db2021-12-21 11:37:19.215root 11241100x8000000000000000550249Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.215{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8fbab9c8646d24a52021-12-21 11:37:19.215root 11241100x8000000000000000550250Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.215{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0ea93866676d57912021-12-21 11:37:19.215root 11241100x8000000000000000550251Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.216{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b426edf1e07927552021-12-21 11:37:19.216root 11241100x8000000000000000550252Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.216{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a4092fca63b0e68f2021-12-21 11:37:19.216root 11241100x8000000000000000550253Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.216{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ad80c3c7fa6dc1df2021-12-21 11:37:19.216root 11241100x8000000000000000550254Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.216{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9ae3a7032b27dcb02021-12-21 11:37:19.216root 11241100x8000000000000000550255Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.216{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.dd96a4e9f53bf3a92021-12-21 11:37:19.216root 11241100x8000000000000000550256Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.216{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.353bd8ee558123f32021-12-21 11:37:19.216root 11241100x8000000000000000550257Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.216{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1a69cc1485c47baa2021-12-21 11:37:19.216root 11241100x8000000000000000550258Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.216{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.99512db06cab34082021-12-21 11:37:19.216root 11241100x8000000000000000550259Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.216{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7cf034200203d7e42021-12-21 11:37:19.216root 11241100x8000000000000000550260Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.216{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3e08d19afe6de5562021-12-21 11:37:19.216root 11241100x8000000000000000550261Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.217{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a69d730b8f819a532021-12-21 11:37:19.217root 11241100x8000000000000000550262Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.217{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b38d5d8f566890de2021-12-21 11:37:19.217root 11241100x8000000000000000550263Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.217{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a8ccb08811e937a92021-12-21 11:37:19.217root 11241100x8000000000000000550264Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.218{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.76bd224ded1749062021-12-21 11:37:19.218root 11241100x8000000000000000550265Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.218{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.819ab087440534092021-12-21 11:37:19.218root 11241100x8000000000000000550266Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.218{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.46072497fa628d302021-12-21 11:37:19.218root 11241100x8000000000000000550267Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.218{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.77d6a543f6e52d692021-12-21 11:37:19.218root 11241100x8000000000000000550268Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.218{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.84ac69fa69bc5d642021-12-21 11:37:19.218root 11241100x8000000000000000550269Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.218{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.67afcfaa75ffb48a2021-12-21 11:37:19.218root 11241100x8000000000000000550270Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.219{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6e76561c441a9daa2021-12-21 11:37:19.219root 11241100x8000000000000000550271Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.219{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f695b0d9c051367a2021-12-21 11:37:19.219root 11241100x8000000000000000550272Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.219{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e990915b05a3b1642021-12-21 11:37:19.219root 11241100x8000000000000000550273Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.219{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f00b45638d1666942021-12-21 11:37:19.219root 11241100x8000000000000000550274Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.219{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6141fd0f14f5731d2021-12-21 11:37:19.219root 11241100x8000000000000000550275Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.219{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3397d3577c32d8dc2021-12-21 11:37:19.219root 11241100x8000000000000000550276Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.219{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d93763fa8b40f6002021-12-21 11:37:19.219root 11241100x8000000000000000550277Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.219{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.504c87d3feae1e772021-12-21 11:37:19.219root 11241100x8000000000000000550278Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.219{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.291a4cc75bf97c9a2021-12-21 11:37:19.219root 11241100x8000000000000000550279Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.220{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.828ec9f6ea5354982021-12-21 11:37:19.220root 11241100x8000000000000000550280Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.220{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.05d7e9dfb00369a52021-12-21 11:37:19.220root 11241100x8000000000000000550281Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.220{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6f6745456c371bda2021-12-21 11:37:19.220root 11241100x8000000000000000550282Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.220{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1501ca01de3add3e2021-12-21 11:37:19.220root 11241100x8000000000000000550283Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.220{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d2536f9afd39c9fd2021-12-21 11:37:19.220root 11241100x8000000000000000550284Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.221{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5686e764c323243e2021-12-21 11:37:19.221root 11241100x8000000000000000550285Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.221{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.cdcd602a518a0a5c2021-12-21 11:37:19.221root 11241100x8000000000000000550286Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.221{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.bd6942fbd62282a82021-12-21 11:37:19.221root 11241100x8000000000000000550287Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.221{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3525b8c649f18cdb2021-12-21 11:37:19.221root 11241100x8000000000000000550288Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.221{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9e8729913ac73a482021-12-21 11:37:19.221root 11241100x8000000000000000550289Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.221{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.781ba2e7154c46172021-12-21 11:37:19.221root 11241100x8000000000000000550290Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.222{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0598d705abe739a72021-12-21 11:37:19.222root 11241100x8000000000000000550291Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.222{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ee034b13854cffa32021-12-21 11:37:19.222root 11241100x8000000000000000550292Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.222{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.53b0aa27f7665e572021-12-21 11:37:19.222root 11241100x8000000000000000550293Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.222{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.57bb5138a836efb62021-12-21 11:37:19.222root 11241100x8000000000000000550294Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.222{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.19505614d5644ac02021-12-21 11:37:19.222root 11241100x8000000000000000550295Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.222{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3d723e9f1d1b59ec2021-12-21 11:37:19.222root 11241100x8000000000000000550296Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.222{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.bf4aa5dd834545372021-12-21 11:37:19.222root 11241100x8000000000000000550297Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.222{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b9289f1fc2813c082021-12-21 11:37:19.222root 11241100x8000000000000000550298Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.222{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.32e3e8eec60d683c2021-12-21 11:37:19.222root 11241100x8000000000000000550299Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.223{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4f8908d443d722722021-12-21 11:37:19.223root 11241100x8000000000000000550300Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.223{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.831819882726abdd2021-12-21 11:37:19.223root 11241100x8000000000000000550301Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.223{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.840c3df40aba9c422021-12-21 11:37:19.223root 11241100x8000000000000000550302Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.223{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a56b8336b80e41d52021-12-21 11:37:19.223root 11241100x8000000000000000550303Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.223{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.903f2243a313790c2021-12-21 11:37:19.223root 11241100x8000000000000000550304Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.223{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.493f6d68d6efda362021-12-21 11:37:19.223root 11241100x8000000000000000550305Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.224{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d2dcbc1e3c9dee032021-12-21 11:37:19.224root 11241100x8000000000000000550306Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.224{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d21dc1ccbd4b67632021-12-21 11:37:19.224root 11241100x8000000000000000550307Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.224{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.edf138211e5ffdb82021-12-21 11:37:19.224root 11241100x8000000000000000550308Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.224{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.fa51b57b0c8b07122021-12-21 11:37:19.224root 11241100x8000000000000000550309Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.224{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0f6a568c8dda572b2021-12-21 11:37:19.224root 11241100x8000000000000000550310Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.224{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1e08a7b689e6e7a72021-12-21 11:37:19.224root 11241100x8000000000000000550311Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.224{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9e9e3614c54f67352021-12-21 11:37:19.224root 11241100x8000000000000000550312Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.224{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c26e9a0558c81cad2021-12-21 11:37:19.224root 11241100x8000000000000000550313Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.225{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.86524c0e86c4cfee2021-12-21 11:37:19.225root 11241100x8000000000000000550314Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.225{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c1048e29fe139e872021-12-21 11:37:19.225root 11241100x8000000000000000550315Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.225{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a549e51e5c64ec362021-12-21 11:37:19.225root 11241100x8000000000000000550316Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.225{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a94cf3870140883a2021-12-21 11:37:19.225root 11241100x8000000000000000550317Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.225{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6839a55408c5fa642021-12-21 11:37:19.225root 11241100x8000000000000000550318Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.225{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ad16803cb317a40b2021-12-21 11:37:19.225root 11241100x8000000000000000550319Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.226{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.61ddd036f9aa62432021-12-21 11:37:19.226root 11241100x8000000000000000550320Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.226{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ad9278aee83dad592021-12-21 11:37:19.226root 11241100x8000000000000000550321Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.226{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3ccf05321c5e10f22021-12-21 11:37:19.226root 11241100x8000000000000000550322Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.226{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.29d19f006f5176482021-12-21 11:37:19.226root 11241100x8000000000000000550323Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.226{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ad34ff14f5327c932021-12-21 11:37:19.226root 11241100x8000000000000000550324Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.226{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1114099d88af40582021-12-21 11:37:19.226root 11241100x8000000000000000550325Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.226{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2ee9675741d4b0812021-12-21 11:37:19.226root 11241100x8000000000000000550326Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.226{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ffa1c34ddc73638c2021-12-21 11:37:19.226root 11241100x8000000000000000550327Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.227{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8a8735d43e2c66d82021-12-21 11:37:19.227root 11241100x8000000000000000550328Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.227{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b098d139faae026e2021-12-21 11:37:19.227root 11241100x8000000000000000550329Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.227{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.479b6100559c88b92021-12-21 11:37:19.227root 11241100x8000000000000000550330Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.227{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d01f204c7202b36b2021-12-21 11:37:19.227root 11241100x8000000000000000550331Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.227{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8dc6a354b4e761fa2021-12-21 11:37:19.227root 11241100x8000000000000000550332Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.227{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4c71c12469e4bed62021-12-21 11:37:19.227root 11241100x8000000000000000550333Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.227{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2ff8374c2ccd2fcf2021-12-21 11:37:19.227root 11241100x8000000000000000550334Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.227{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.92634c196c0a763d2021-12-21 11:37:19.227root 11241100x8000000000000000550335Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.227{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ce7cb1a0d4eac74e2021-12-21 11:37:19.227root 11241100x8000000000000000550336Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.228{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.fab5e5025a83aa962021-12-21 11:37:19.228root 11241100x8000000000000000550337Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.228{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.79808cd43e9fdf492021-12-21 11:37:19.228root 11241100x8000000000000000550338Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.228{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9da3e8eb37854bb42021-12-21 11:37:19.228root 11241100x8000000000000000550339Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.228{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2a521a7564e33e352021-12-21 11:37:19.228root 11241100x8000000000000000550340Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.228{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.cdc11cadf109263e2021-12-21 11:37:19.228root 11241100x8000000000000000550341Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.228{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.32681be7226452882021-12-21 11:37:19.228root 11241100x8000000000000000550342Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.229{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7dd2e175990f7daf2021-12-21 11:37:19.229root 11241100x8000000000000000550343Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.229{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.86ff2217ed1427742021-12-21 11:37:19.229root 11241100x8000000000000000550344Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.229{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b7eca98b16b04e8a2021-12-21 11:37:19.229root 11241100x8000000000000000550345Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.229{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7490ef10beaae9272021-12-21 11:37:19.229root 11241100x8000000000000000550346Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.229{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e497da84926359602021-12-21 11:37:19.229root 11241100x8000000000000000550347Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.229{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e8385f18728158132021-12-21 11:37:19.229root 11241100x8000000000000000550348Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.229{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6badfa980503bd2f2021-12-21 11:37:19.229root 11241100x8000000000000000550349Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.229{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.15a44df796f44c162021-12-21 11:37:19.229root 11241100x8000000000000000550350Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.230{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1bf743ccfbbd965c2021-12-21 11:37:19.230root 11241100x8000000000000000550351Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.230{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4812476d38c4a0bb2021-12-21 11:37:19.230root 11241100x8000000000000000550352Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.230{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9e5cdb87cd25c1062021-12-21 11:37:19.230root 11241100x8000000000000000550353Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.230{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.92daf18c5ac9f4352021-12-21 11:37:19.230root 11241100x8000000000000000550354Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.230{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.bf7cd928456e7d4b2021-12-21 11:37:19.230root 11241100x8000000000000000550355Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.230{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4275d7ae26e5518d2021-12-21 11:37:19.230root 11241100x8000000000000000550356Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.230{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9363ed42c1b2a7a12021-12-21 11:37:19.230root 11241100x8000000000000000550357Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.231{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ce96d4f8419143ab2021-12-21 11:37:19.231root 11241100x8000000000000000550358Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.231{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9917015fb9ecbaaf2021-12-21 11:37:19.231root 11241100x8000000000000000550359Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.231{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4da1bd3498a8083c2021-12-21 11:37:19.231root 11241100x8000000000000000550360Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.231{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c0ac0279658ffffc2021-12-21 11:37:19.231root 11241100x8000000000000000550361Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.232{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.92958cc3e093c0862021-12-21 11:37:19.232root 11241100x8000000000000000550362Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.232{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.619b03120bdba80e2021-12-21 11:37:19.232root 11241100x8000000000000000550363Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.232{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5a79d04fe1a80b2b2021-12-21 11:37:19.232root 11241100x8000000000000000550364Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.232{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7ccea6ef0bf42c302021-12-21 11:37:19.232root 11241100x8000000000000000550365Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.232{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.394c0b3247d7b4902021-12-21 11:37:19.232root 11241100x8000000000000000550366Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.232{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.deffba0849d96f642021-12-21 11:37:19.232root 11241100x8000000000000000550367Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.232{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b9c9d37582ce4faf2021-12-21 11:37:19.232root 11241100x8000000000000000550368Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.233{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5ca1a4793f9a5e132021-12-21 11:37:19.233root 11241100x8000000000000000550369Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.233{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3e785b7815abd6162021-12-21 11:37:19.233root 11241100x8000000000000000550370Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.233{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.383e9ef6e9d0a2792021-12-21 11:37:19.233root 11241100x8000000000000000550371Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.233{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0a1291fd8d6f76c02021-12-21 11:37:19.233root 11241100x8000000000000000550372Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.233{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.66ebcfeae806e8752021-12-21 11:37:19.233root 11241100x8000000000000000550373Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.233{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b651f1681ed9f3d42021-12-21 11:37:19.233root 11241100x8000000000000000550374Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.233{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.356985f2ffbc795e2021-12-21 11:37:19.233root 11241100x8000000000000000550375Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.233{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d7c69c309dee8c482021-12-21 11:37:19.233root 11241100x8000000000000000550376Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.233{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e411ca60cb7303042021-12-21 11:37:19.233root 11241100x8000000000000000550377Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.234{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ddbf0b7e5258a9ee2021-12-21 11:37:19.234root 11241100x8000000000000000550378Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.234{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3d0a0d3c48cabe2e2021-12-21 11:37:19.234root 11241100x8000000000000000550379Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.234{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.90585ccbc18e43df2021-12-21 11:37:19.234root 11241100x8000000000000000550380Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.234{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.75289283823da94e2021-12-21 11:37:19.234root 11241100x8000000000000000550381Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.234{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.997df090490c4eef2021-12-21 11:37:19.234root 11241100x8000000000000000550382Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.234{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8957f10d1fe4988c2021-12-21 11:37:19.234root 11241100x8000000000000000550383Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.234{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.bd8ec899491809f92021-12-21 11:37:19.234root 11241100x8000000000000000550384Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.235{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.198c9aef9effd87b2021-12-21 11:37:19.235root 11241100x8000000000000000550385Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.235{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c463293cba5e334c2021-12-21 11:37:19.235root 11241100x8000000000000000550386Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.235{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.90e24950a1a5902b2021-12-21 11:37:19.235root 11241100x8000000000000000550387Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.235{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.03fb0a093d9f989f2021-12-21 11:37:19.235root 11241100x8000000000000000550388Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.235{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.dba3085bedf62c3f2021-12-21 11:37:19.235root 11241100x8000000000000000550389Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.236{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b3d20dbeb9cf84f52021-12-21 11:37:19.236root 11241100x8000000000000000550390Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.236{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1d856894267890e32021-12-21 11:37:19.236root 11241100x8000000000000000550391Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.236{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.50eaaf0e1043defe2021-12-21 11:37:19.236root 11241100x8000000000000000550392Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.236{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.541cc7201ab36e372021-12-21 11:37:19.236root 11241100x8000000000000000550393Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.236{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2e5dfb2aed6a35a12021-12-21 11:37:19.236root 11241100x8000000000000000550394Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.236{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b48f400e16d5db442021-12-21 11:37:19.236root 11241100x8000000000000000550395Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.237{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4ccf3ea48df58d442021-12-21 11:37:19.237root 11241100x8000000000000000550396Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.237{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.46e9d2c2893071d42021-12-21 11:37:19.237root 11241100x8000000000000000550397Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.237{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7acdb25bdfd89c1d2021-12-21 11:37:19.237root 11241100x8000000000000000550398Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.237{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ddb040862e55a01c2021-12-21 11:37:19.237root 11241100x8000000000000000550399Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.237{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.546fe18afedd36892021-12-21 11:37:19.237root 11241100x8000000000000000550400Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.237{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.667c7781253f779c2021-12-21 11:37:19.237root 11241100x8000000000000000550401Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.237{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1381d4992f0ca3922021-12-21 11:37:19.237root 11241100x8000000000000000550402Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.237{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.26ee4ec0baf68a3b2021-12-21 11:37:19.237root 11241100x8000000000000000550403Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.237{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4d9066b39f1fd34f2021-12-21 11:37:19.237root 11241100x8000000000000000550404Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.238{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.541209947473aa562021-12-21 11:37:19.238root 11241100x8000000000000000550405Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.238{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f546d66ac6aa3f0b2021-12-21 11:37:19.238root 11241100x8000000000000000550406Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.238{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.355bca818f3158582021-12-21 11:37:19.238root 11241100x8000000000000000550407Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.238{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4a1d4f9857f9d2aa2021-12-21 11:37:19.238root 11241100x8000000000000000550408Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.238{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f0c8a7efc7981e0d2021-12-21 11:37:19.238root 11241100x8000000000000000550409Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.238{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6224cd76485a91cd2021-12-21 11:37:19.238root 11241100x8000000000000000550410Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.238{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4ce2a4b007942ceb2021-12-21 11:37:19.238root 11241100x8000000000000000550411Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.238{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d4aeec121d9290c82021-12-21 11:37:19.238root 11241100x8000000000000000550412Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.239{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ef624dcec6d92bc72021-12-21 11:37:19.239root 11241100x8000000000000000550413Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.239{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.60269ce2461a1baa2021-12-21 11:37:19.239root 11241100x8000000000000000550414Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.239{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7ef8b1d5499594c72021-12-21 11:37:19.239root 11241100x8000000000000000550415Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.239{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1cd2e8cb7d77cc2f2021-12-21 11:37:19.239root 11241100x8000000000000000550416Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.239{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6fbd5e845b6d53b12021-12-21 11:37:19.239root 11241100x8000000000000000550417Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.239{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.64330eb3d560d3fa2021-12-21 11:37:19.239root 11241100x8000000000000000550418Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.239{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.544528a4ebb581ba2021-12-21 11:37:19.239root 11241100x8000000000000000550419Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.239{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.46a621baa0d014c82021-12-21 11:37:19.239root 11241100x8000000000000000550420Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.240{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2bcd24206fc996162021-12-21 11:37:19.240root 11241100x8000000000000000550421Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.240{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8bef26e1f3cda2972021-12-21 11:37:19.240root 11241100x8000000000000000550422Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.240{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f8a7ecc026bd48632021-12-21 11:37:19.240root 11241100x8000000000000000550423Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.240{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.24c60aaaf596d76b2021-12-21 11:37:19.240root 11241100x8000000000000000550424Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.240{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c3403ed7d910d6f62021-12-21 11:37:19.240root 11241100x8000000000000000550425Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.240{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9572e318356e91972021-12-21 11:37:19.240root 11241100x8000000000000000550426Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.240{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f5c5f1bd54a64a2b2021-12-21 11:37:19.240root 11241100x8000000000000000550427Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.240{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.061e0cd57c7736b92021-12-21 11:37:19.240root 11241100x8000000000000000550428Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.240{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ff117dd16ff3b54c2021-12-21 11:37:19.240root 11241100x8000000000000000550429Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.241{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.df59322885aef94a2021-12-21 11:37:19.241root 11241100x8000000000000000550430Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.241{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e361b1dcc1d27eae2021-12-21 11:37:19.241root 11241100x8000000000000000550431Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.241{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c1fab959c9c3326f2021-12-21 11:37:19.241root 11241100x8000000000000000550432Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.241{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.09ee0b7dbad67e752021-12-21 11:37:19.241root 11241100x8000000000000000550433Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.241{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3c6f36ff51b8249a2021-12-21 11:37:19.241root 11241100x8000000000000000550434Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.241{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.86e2d1d6dbae7e3b2021-12-21 11:37:19.241root 11241100x8000000000000000550435Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.241{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.82d09673aefb55402021-12-21 11:37:19.241root 11241100x8000000000000000550436Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.241{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d593dbd6e0bf92c22021-12-21 11:37:19.241root 11241100x8000000000000000550437Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.241{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c12a4bc061696d932021-12-21 11:37:19.241root 11241100x8000000000000000550438Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.241{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3da7c8b4adc277852021-12-21 11:37:19.241root 11241100x8000000000000000550439Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.242{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9c1b10a6d99b48072021-12-21 11:37:19.242root 11241100x8000000000000000550440Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.242{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1ec5ab034a4405162021-12-21 11:37:19.242root 11241100x8000000000000000550441Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.242{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b37012d8bf2f28d92021-12-21 11:37:19.242root 11241100x8000000000000000550442Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.242{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.54305022f8dc7f052021-12-21 11:37:19.242root 11241100x8000000000000000550443Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.242{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2e37b65c9ee82e732021-12-21 11:37:19.242root 11241100x8000000000000000550444Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.242{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5b5f46fa15ab1a262021-12-21 11:37:19.242root 11241100x8000000000000000550445Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.242{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9888d237bdc8b0772021-12-21 11:37:19.242root 11241100x8000000000000000550446Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.242{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.504665f3221737ce2021-12-21 11:37:19.242root 11241100x8000000000000000550447Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.242{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.40fbbcf88387064a2021-12-21 11:37:19.242root 11241100x8000000000000000550448Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.243{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.722966a6c7afd9ac2021-12-21 11:37:19.243root 11241100x8000000000000000550449Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.243{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ebc711d6b9804dd02021-12-21 11:37:19.243root 11241100x8000000000000000550450Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.243{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.442b780b44e76bfc2021-12-21 11:37:19.243root 11241100x8000000000000000550451Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.243{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0bf0ac95a1100e9c2021-12-21 11:37:19.243root 11241100x8000000000000000550452Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.243{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0dc2d84af714abc82021-12-21 11:37:19.243root 11241100x8000000000000000550453Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.243{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a77d5b29f42c44ee2021-12-21 11:37:19.243root 11241100x8000000000000000550454Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.243{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.30e944c9ad0891b02021-12-21 11:37:19.243root 11241100x8000000000000000550455Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.243{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2e459b165871cb762021-12-21 11:37:19.243root 11241100x8000000000000000550456Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.243{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ce6ea906388496242021-12-21 11:37:19.243root 11241100x8000000000000000550457Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.243{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.58483a7c3d0ea2d42021-12-21 11:37:19.243root 11241100x8000000000000000550458Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.243{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.bc5b3270637814582021-12-21 11:37:19.243root 11241100x8000000000000000550459Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.243{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.24fda8e0e48c9e772021-12-21 11:37:19.243root 11241100x8000000000000000550460Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.244{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.afb2f27ecf5953a02021-12-21 11:37:19.244root 11241100x8000000000000000550461Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.244{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.de5d0d192520a79e2021-12-21 11:37:19.244root 11241100x8000000000000000550462Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.244{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.be07826a6bd10c732021-12-21 11:37:19.244root 11241100x8000000000000000550463Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.244{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b257a3bd4df144b82021-12-21 11:37:19.244root 11241100x8000000000000000550464Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.244{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.78829022134bf17a2021-12-21 11:37:19.244root 11241100x8000000000000000550465Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.244{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.282c8f569cc4ca142021-12-21 11:37:19.244root 11241100x8000000000000000550466Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.244{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.cba8e27bbf39aab02021-12-21 11:37:19.244root 11241100x8000000000000000550467Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.244{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0d5e8461d252ca5d2021-12-21 11:37:19.244root 11241100x8000000000000000550468Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.245{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.17499b367c4b4d0d2021-12-21 11:37:19.245root 11241100x8000000000000000550469Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.245{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f6956f48a1feefe22021-12-21 11:37:19.245root 11241100x8000000000000000550470Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.245{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1542408efed0a2172021-12-21 11:37:19.245root 11241100x8000000000000000550471Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.245{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ae43db483baf1f842021-12-21 11:37:19.245root 11241100x8000000000000000550472Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.245{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.400827bf2be992492021-12-21 11:37:19.245root 11241100x8000000000000000550473Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.245{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f9ae3484464700112021-12-21 11:37:19.245root 11241100x8000000000000000550474Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.245{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.eb995b0d801805da2021-12-21 11:37:19.245root 11241100x8000000000000000550475Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.245{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f6ec817f0f8ca83d2021-12-21 11:37:19.245root 11241100x8000000000000000550476Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.245{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2ec90beec29d82c82021-12-21 11:37:19.245root 11241100x8000000000000000550477Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.245{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.13da1603ac773fde2021-12-21 11:37:19.245root 11241100x8000000000000000550478Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.245{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6933184d492b8fc42021-12-21 11:37:19.245root 11241100x8000000000000000550479Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.245{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.dc7a6a3cfdaaa5f02021-12-21 11:37:19.245root 11241100x8000000000000000550480Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.245{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f544ec69e79b7d682021-12-21 11:37:19.245root 11241100x8000000000000000550481Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.246{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.360e1bb64d9dc5882021-12-21 11:37:19.246root 11241100x8000000000000000550482Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.246{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c6dcafcb7cd4f11b2021-12-21 11:37:19.246root 11241100x8000000000000000550483Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.246{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f1a70012854157702021-12-21 11:37:19.246root 11241100x8000000000000000550484Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.246{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.269c4a949d1f5a432021-12-21 11:37:19.246root 11241100x8000000000000000550485Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.246{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5b32604e9b49de372021-12-21 11:37:19.246root 11241100x8000000000000000550486Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.246{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.34a59fed71227c432021-12-21 11:37:19.246root 354300x8000000000000000550487Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.249{ec2b6afe-95d9-61c1-5175-3a0400000000}5346/opt/splunkforwarder/etc/apps/Splunk_TA_stream/linux_x86_64/bin/streamfwdroottcptruefalse10.0.1.25-48808-false10.0.1.12-8000- 154100x8000000000000000550488Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.449{ec2b6afe-bc6f-61c1-e8a6-62973b560000}9926/bin/ls-----ls --color=auto -l/home/ubuntuubuntu{ec2b6afe-aacb-61c1-e803-000000000000}10006no level-{ec2b6afe-aacb-61c1-0834-fdd63c560000}5677/bin/bash-bashubuntu 11241100x8000000000000000550489Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.451{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0104c0e9822b02c12021-12-21 11:37:19.451root 11241100x8000000000000000550490Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.451{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.009244000581c3632021-12-21 11:37:19.451root 11241100x8000000000000000550491Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.451{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c30da0b68e668a082021-12-21 11:37:19.451root 11241100x8000000000000000550492Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.451{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ca8d6e45daf0d4f72021-12-21 11:37:19.451root 11241100x8000000000000000550493Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.451{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.010d83812ebf459e2021-12-21 11:37:19.451root 11241100x8000000000000000550494Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.451{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2857b37ab7398ae52021-12-21 11:37:19.451root 11241100x8000000000000000550495Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.451{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.68f43520f131d7ee2021-12-21 11:37:19.451root 11241100x8000000000000000550496Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.451{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c26898e27a23b5c02021-12-21 11:37:19.451root 11241100x8000000000000000550497Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.451{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0f00cc6c5cffa1e82021-12-21 11:37:19.451root 11241100x8000000000000000550498Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.451{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.40415d687401c4a12021-12-21 11:37:19.451root 11241100x8000000000000000550499Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.451{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4ef70d28b111a8072021-12-21 11:37:19.451root 11241100x8000000000000000550500Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.451{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c665bf4757a0b8802021-12-21 11:37:19.451root 11241100x8000000000000000550501Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.451{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.09eee30a4c1075902021-12-21 11:37:19.451root 11241100x8000000000000000550502Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.451{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.015e0813992ff2112021-12-21 11:37:19.451root 11241100x8000000000000000550503Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.452{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0acdc38eedc25ec52021-12-21 11:37:19.452root 11241100x8000000000000000550504Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.452{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2ed730a5cee9ee462021-12-21 11:37:19.452root 11241100x8000000000000000550505Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.452{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.dd117edecbbbe5072021-12-21 11:37:19.452root 11241100x8000000000000000550506Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.452{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a1df00f57a751eff2021-12-21 11:37:19.452root 11241100x8000000000000000550507Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.452{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.966050015ad7056a2021-12-21 11:37:19.452root 11241100x8000000000000000550508Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.452{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.884d88fec2e700a52021-12-21 11:37:19.452root 11241100x8000000000000000550509Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.452{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2e1c5d3146f3f7192021-12-21 11:37:19.452root 11241100x8000000000000000550510Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.452{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1c9905aa99073f3d2021-12-21 11:37:19.452root 11241100x8000000000000000550511Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.452{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.429a41230628f4062021-12-21 11:37:19.452root 11241100x8000000000000000550512Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.452{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.484337443ed93aa92021-12-21 11:37:19.452root 534500x8000000000000000550513Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.452{ec2b6afe-bc6f-61c1-e8a6-62973b560000}9926/bin/lsubuntu 11241100x8000000000000000550514Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.453{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.434fdd557ffe223b2021-12-21 11:37:19.453root 11241100x8000000000000000550515Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.453{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e12d31b36474ca972021-12-21 11:37:19.453root 11241100x8000000000000000550516Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.453{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.29550b0d561ab6ac2021-12-21 11:37:19.453root 11241100x8000000000000000550517Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.453{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.918277c5e9b1caa42021-12-21 11:37:19.453root 11241100x8000000000000000550518Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.453{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.40b8d54bc936f9cd2021-12-21 11:37:19.453root 11241100x8000000000000000550519Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.453{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.acd48b6dcf96988e2021-12-21 11:37:19.453root 11241100x8000000000000000550520Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.453{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.695e6549068953452021-12-21 11:37:19.453root 11241100x8000000000000000550521Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.453{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2f0e2af4d14443cd2021-12-21 11:37:19.453root 11241100x8000000000000000550522Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.453{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.cd4d7c0c80d492302021-12-21 11:37:19.453root 11241100x8000000000000000550523Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.454{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c9fd5b50b1f414122021-12-21 11:37:19.454root 11241100x8000000000000000550524Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.454{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8fa8c65c00f560052021-12-21 11:37:19.454root 11241100x8000000000000000550525Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.454{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5071a42a985a191e2021-12-21 11:37:19.454root 11241100x8000000000000000550526Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.454{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.79729fb56ff17fcf2021-12-21 11:37:19.454root 11241100x8000000000000000550527Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.454{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d3fee017cdf87ba42021-12-21 11:37:19.454root 11241100x8000000000000000550528Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.455{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b980daf653dc20ff2021-12-21 11:37:19.455root 11241100x8000000000000000550529Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.455{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5a13b3b982b4291c2021-12-21 11:37:19.455root 11241100x8000000000000000550530Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.455{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b043cb31fdb05bcf2021-12-21 11:37:19.455root 11241100x8000000000000000550531Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.455{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2471a5e04dfc7ae42021-12-21 11:37:19.455root 11241100x8000000000000000550532Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.455{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9d7e5bec8d0528eb2021-12-21 11:37:19.455root 11241100x8000000000000000550533Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.455{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.212e9b2bc72e31072021-12-21 11:37:19.455root 11241100x8000000000000000550534Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.456{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5aadf27fd0e2183f2021-12-21 11:37:19.456root 11241100x8000000000000000550535Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.456{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.baa31ce133cf6eeb2021-12-21 11:37:19.456root 11241100x8000000000000000550536Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.456{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.830434a71227d3422021-12-21 11:37:19.456root 11241100x8000000000000000550537Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.456{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.86dbfc2a528c536c2021-12-21 11:37:19.456root 11241100x8000000000000000550538Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.456{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.dbaf150417c3e5692021-12-21 11:37:19.456root 11241100x8000000000000000550539Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.456{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8c7be23a532cd1f42021-12-21 11:37:19.456root 11241100x8000000000000000550540Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.456{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.921d0b2d7e7505222021-12-21 11:37:19.456root 11241100x8000000000000000550541Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.457{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.cf83c95806ad2ec32021-12-21 11:37:19.457root 11241100x8000000000000000550542Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.457{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e7284e1e91b471c42021-12-21 11:37:19.457root 11241100x8000000000000000550543Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.457{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4d66adef1c9c6e1f2021-12-21 11:37:19.457root 11241100x8000000000000000550544Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.457{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e366bd3e9000d99b2021-12-21 11:37:19.457root 11241100x8000000000000000550545Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.457{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d41e83d36c61203e2021-12-21 11:37:19.457root 11241100x8000000000000000550546Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.457{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.dc64f49b030570b02021-12-21 11:37:19.457root 11241100x8000000000000000550547Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.457{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.378da4ec603b30992021-12-21 11:37:19.457root 11241100x8000000000000000550548Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.458{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4a87f0bc7e7d9d742021-12-21 11:37:19.458root 11241100x8000000000000000550549Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.458{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.be5843fdfad892d52021-12-21 11:37:19.458root 11241100x8000000000000000550550Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.458{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1671dd7f87327a222021-12-21 11:37:19.458root 11241100x8000000000000000550551Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.458{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7d9f5e2088a103ca2021-12-21 11:37:19.458root 11241100x8000000000000000550552Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.458{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f6207e99c19244fe2021-12-21 11:37:19.458root 11241100x8000000000000000550553Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.459{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e198786e55712f302021-12-21 11:37:19.459root 11241100x8000000000000000550554Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.460{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.49b78f717d35ceef2021-12-21 11:37:19.460root 11241100x8000000000000000550555Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.460{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0b71646a19e7f0242021-12-21 11:37:19.460root 11241100x8000000000000000550556Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.460{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d0495d9479b8ec072021-12-21 11:37:19.460root 11241100x8000000000000000550557Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.460{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c4b1775cbdf6bcd22021-12-21 11:37:19.460root 11241100x8000000000000000550558Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.461{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7876a5cea6b5471b2021-12-21 11:37:19.461root 11241100x8000000000000000550559Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.461{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f36d53eb2ec87d592021-12-21 11:37:19.461root 11241100x8000000000000000550560Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.462{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5b3cb9d9634b300c2021-12-21 11:37:19.462root 11241100x8000000000000000550561Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.462{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f0db27fd8317a3412021-12-21 11:37:19.462root 11241100x8000000000000000550562Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.462{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b25b2cec98ddf04b2021-12-21 11:37:19.462root 11241100x8000000000000000550563Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.463{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d708555963e9abe52021-12-21 11:37:19.463root 11241100x8000000000000000550564Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.463{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9fbdbc61599f98a02021-12-21 11:37:19.463root 11241100x8000000000000000550565Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.464{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9c78297f3183ad322021-12-21 11:37:19.464root 11241100x8000000000000000550566Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.464{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ee197ade229ef5e22021-12-21 11:37:19.464root 11241100x8000000000000000550567Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.465{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9f5226ff2df222db2021-12-21 11:37:19.465root 11241100x8000000000000000550568Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.465{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.38903918ed6afb6c2021-12-21 11:37:19.465root 11241100x8000000000000000550569Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.465{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4c84b67d23a784842021-12-21 11:37:19.465root 11241100x8000000000000000550570Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.465{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e26b516ffc2dc6692021-12-21 11:37:19.465root 11241100x8000000000000000550571Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.466{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a1c9b9621c5653432021-12-21 11:37:19.466root 11241100x8000000000000000550572Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.466{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b6c29cf33b140d082021-12-21 11:37:19.466root 11241100x8000000000000000550573Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.466{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.50690b2ca018117c2021-12-21 11:37:19.466root 11241100x8000000000000000550574Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.466{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.079610f89b4d963a2021-12-21 11:37:19.466root 11241100x8000000000000000550575Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.466{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5d9f29aec7c94bea2021-12-21 11:37:19.466root 11241100x8000000000000000550576Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.466{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3cf85efc33dba05f2021-12-21 11:37:19.466root 11241100x8000000000000000550577Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.466{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d757b9ea4d7ca20b2021-12-21 11:37:19.466root 11241100x8000000000000000550578Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.466{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.fd1b37b0cd66f66b2021-12-21 11:37:19.466root 11241100x8000000000000000550579Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.466{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2dc3112612bd3f562021-12-21 11:37:19.466root 11241100x8000000000000000550580Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.466{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ff090e69de133b992021-12-21 11:37:19.466root 11241100x8000000000000000550581Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.466{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.300f746cfdce299b2021-12-21 11:37:19.466root 11241100x8000000000000000550582Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.466{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7e3866eae2a41b0c2021-12-21 11:37:19.466root 11241100x8000000000000000550583Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.466{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.dd9acdc3c3abd9cc2021-12-21 11:37:19.466root 11241100x8000000000000000550584Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.466{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9a00acef98c60a912021-12-21 11:37:19.466root 11241100x8000000000000000550585Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.467{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b204809125be4f272021-12-21 11:37:19.467root 11241100x8000000000000000550586Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.467{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.708f18895996301f2021-12-21 11:37:19.467root 11241100x8000000000000000550587Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.467{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4ba2b12f17a527d72021-12-21 11:37:19.467root 11241100x8000000000000000550588Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.467{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.731281888a6cf36e2021-12-21 11:37:19.467root 11241100x8000000000000000550589Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.467{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2588f0e780f6477d2021-12-21 11:37:19.467root 11241100x8000000000000000550590Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.467{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.30f2cf9c69452a3e2021-12-21 11:37:19.467root 11241100x8000000000000000550591Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.467{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3167d6a50cacd4152021-12-21 11:37:19.467root 11241100x8000000000000000550592Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.467{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f1f20407bcb11f4b2021-12-21 11:37:19.467root 11241100x8000000000000000550593Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.467{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.532fc56e221520472021-12-21 11:37:19.467root 11241100x8000000000000000550594Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.467{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6b862aa4264da4982021-12-21 11:37:19.467root 11241100x8000000000000000550595Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.467{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1e24968e1fb361842021-12-21 11:37:19.467root 11241100x8000000000000000550596Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.468{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3d8c7b5a15be2b882021-12-21 11:37:19.468root 11241100x8000000000000000550597Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.468{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5417f615c3a350872021-12-21 11:37:19.468root 11241100x8000000000000000550598Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.468{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9b2ab925c716298f2021-12-21 11:37:19.468root 11241100x8000000000000000550599Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.468{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.35d16b2d311685532021-12-21 11:37:19.468root 11241100x8000000000000000550600Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.468{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.083c160d0c1499892021-12-21 11:37:19.468root 11241100x8000000000000000550601Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.468{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ded6a365e286161f2021-12-21 11:37:19.468root 11241100x8000000000000000550602Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.468{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.26bb99ab0d9b50752021-12-21 11:37:19.468root 11241100x8000000000000000550603Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.468{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e9692befc124fd692021-12-21 11:37:19.468root 11241100x8000000000000000550604Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.468{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.39403197d65c0b1f2021-12-21 11:37:19.468root 11241100x8000000000000000550605Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.468{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a5dbe4f333bcdb942021-12-21 11:37:19.468root 11241100x8000000000000000550606Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.468{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.86e9f7520f867fa22021-12-21 11:37:19.468root 11241100x8000000000000000550607Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.469{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.579ee550c9ebd9032021-12-21 11:37:19.469root 11241100x8000000000000000550608Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.469{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a4c4dbec427cba9e2021-12-21 11:37:19.469root 11241100x8000000000000000550609Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.469{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.904324e64adb43802021-12-21 11:37:19.469root 11241100x8000000000000000550610Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.469{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d6a5960714121a7f2021-12-21 11:37:19.469root 11241100x8000000000000000550611Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.469{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.303e773a393707bc2021-12-21 11:37:19.469root 11241100x8000000000000000550612Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.469{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3da2cc2de6d3f3662021-12-21 11:37:19.469root 11241100x8000000000000000550613Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.469{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1b2c898d7c687ca62021-12-21 11:37:19.469root 11241100x8000000000000000550614Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.469{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a9693b14408d617d2021-12-21 11:37:19.469root 11241100x8000000000000000550615Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.469{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.094fc5624665bba82021-12-21 11:37:19.469root 11241100x8000000000000000550616Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.469{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0acc3b4a33b61f262021-12-21 11:37:19.469root 11241100x8000000000000000550617Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.469{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d1b53803eefee5362021-12-21 11:37:19.469root 11241100x8000000000000000550618Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.469{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f70135e3a381c5aa2021-12-21 11:37:19.469root 11241100x8000000000000000550619Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.469{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7bd24d97748b87612021-12-21 11:37:19.469root 11241100x8000000000000000550620Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.469{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e61845ad1b5fc3522021-12-21 11:37:19.469root 11241100x8000000000000000550621Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.469{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.faa98bbb39f69dfb2021-12-21 11:37:19.469root 11241100x8000000000000000550622Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.470{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.45b480eb8cd1f8722021-12-21 11:37:19.470root 11241100x8000000000000000550623Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.470{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.896677b1cf254ceb2021-12-21 11:37:19.470root 11241100x8000000000000000550624Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.470{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.51f349af5a9f62222021-12-21 11:37:19.470root 11241100x8000000000000000550625Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.470{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3011e6f1589f98c12021-12-21 11:37:19.470root 11241100x8000000000000000550626Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.470{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.62c04c3d4b2e26d72021-12-21 11:37:19.470root 11241100x8000000000000000550627Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.470{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c6bf519b2da72f7f2021-12-21 11:37:19.470root 11241100x8000000000000000550628Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.470{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.07b1d80b508c56532021-12-21 11:37:19.470root 11241100x8000000000000000550629Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.470{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.40abea7560bb57d42021-12-21 11:37:19.470root 11241100x8000000000000000550630Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.470{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.887cd416bfbe8bb32021-12-21 11:37:19.470root 11241100x8000000000000000550631Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.470{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.67c072b7ae8641262021-12-21 11:37:19.470root 11241100x8000000000000000550632Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.471{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5c5f9ed489e0b2372021-12-21 11:37:19.471root 11241100x8000000000000000550633Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.471{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.29ee4e53b71f9ced2021-12-21 11:37:19.471root 11241100x8000000000000000550634Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.471{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d62a652526bf48862021-12-21 11:37:19.471root 11241100x8000000000000000550635Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.471{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1f999c2c47983d8c2021-12-21 11:37:19.471root 11241100x8000000000000000550636Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.471{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b4ec0d929fff4c052021-12-21 11:37:19.471root 11241100x8000000000000000550637Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.471{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f0187acfd7fe1b7f2021-12-21 11:37:19.471root 11241100x8000000000000000550638Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.471{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5ee147e738232e1d2021-12-21 11:37:19.471root 11241100x8000000000000000550639Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.471{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4ac64d6811ec19a42021-12-21 11:37:19.471root 11241100x8000000000000000550640Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.471{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.cc9f3ae5c8e0fe152021-12-21 11:37:19.471root 11241100x8000000000000000550641Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.471{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0d089644d0172f3f2021-12-21 11:37:19.471root 11241100x8000000000000000550642Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.471{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ec5fc96ef561b0412021-12-21 11:37:19.471root 11241100x8000000000000000550643Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.471{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4e1b46129224d7ad2021-12-21 11:37:19.471root 11241100x8000000000000000550644Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.472{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.22e7ee4a49eebfbe2021-12-21 11:37:19.472root 11241100x8000000000000000550645Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.472{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3813b0c38361e7e32021-12-21 11:37:19.472root 11241100x8000000000000000550646Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.472{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4329b06b139d83e02021-12-21 11:37:19.472root 11241100x8000000000000000550647Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.472{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f39ba91c67533e782021-12-21 11:37:19.472root 11241100x8000000000000000550648Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.472{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.546941664d16e8b32021-12-21 11:37:19.472root 11241100x8000000000000000550649Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.472{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.339ee5ce4bb5140d2021-12-21 11:37:19.472root 11241100x8000000000000000550650Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.472{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.423bdcb2370080302021-12-21 11:37:19.472root 11241100x8000000000000000550651Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.472{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c0981656b33577c02021-12-21 11:37:19.472root 11241100x8000000000000000550652Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.472{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.27b150e05caff5432021-12-21 11:37:19.472root 11241100x8000000000000000550653Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.472{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4c5f63c5c7f07c062021-12-21 11:37:19.472root 11241100x8000000000000000550654Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.472{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.072b81ce17ed3f2e2021-12-21 11:37:19.472root 11241100x8000000000000000550655Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.472{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d9a61ac590144a3a2021-12-21 11:37:19.472root 11241100x8000000000000000550656Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.472{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.05a9bb7e9662c2162021-12-21 11:37:19.472root 11241100x8000000000000000550657Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.472{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.cf210a0f7be798102021-12-21 11:37:19.472root 11241100x8000000000000000550658Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.473{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4d131cda87d10dcc2021-12-21 11:37:19.473root 11241100x8000000000000000550659Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.473{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a3b7859574f72f7c2021-12-21 11:37:19.473root 11241100x8000000000000000550660Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.473{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.39f70b785516f4da2021-12-21 11:37:19.473root 11241100x8000000000000000550661Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.473{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.14ca28602c592f092021-12-21 11:37:19.473root 11241100x8000000000000000550662Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.473{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6080f8fc7347670f2021-12-21 11:37:19.473root 11241100x8000000000000000550663Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.473{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0b6c5d1798fdb5ee2021-12-21 11:37:19.473root 11241100x8000000000000000550664Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d4082e8a1a199c9e2021-12-21 11:37:19.943root 11241100x8000000000000000550665Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.bfb9a7e64bd6713c2021-12-21 11:37:19.943root 11241100x8000000000000000550666Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.010522733c91b2b32021-12-21 11:37:19.943root 11241100x8000000000000000550667Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e2fe107a365b41282021-12-21 11:37:19.943root 11241100x8000000000000000550668Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8e63c66c0caa7c5f2021-12-21 11:37:19.944root 11241100x8000000000000000550669Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3c456f34c8bc2c572021-12-21 11:37:19.944root 11241100x8000000000000000550670Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.bbdca2dd53a5f8392021-12-21 11:37:19.944root 11241100x8000000000000000550671Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1dd935d5003345882021-12-21 11:37:19.944root 11241100x8000000000000000550672Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9bda0b9783f544952021-12-21 11:37:19.944root 11241100x8000000000000000550673Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.89bea262fa83f54f2021-12-21 11:37:19.944root 11241100x8000000000000000550674Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.386edfd9d7b11e472021-12-21 11:37:19.944root 11241100x8000000000000000550675Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3484e117cad7455c2021-12-21 11:37:19.944root 11241100x8000000000000000550676Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.82dd2fe2177776452021-12-21 11:37:19.944root 11241100x8000000000000000550677Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ece4d19683521c4f2021-12-21 11:37:19.944root 11241100x8000000000000000550678Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.fda179c3af7814d62021-12-21 11:37:19.944root 11241100x8000000000000000550679Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d75c7212e2618e752021-12-21 11:37:19.944root 11241100x8000000000000000550680Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.094d28330a59d5e32021-12-21 11:37:19.944root 11241100x8000000000000000550681Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7c134e7f38338f042021-12-21 11:37:19.944root 11241100x8000000000000000550682Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4f83450facb9cb2d2021-12-21 11:37:19.944root 11241100x8000000000000000550683Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ab4ab4ad09c4d6d62021-12-21 11:37:19.945root 11241100x8000000000000000550684Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.71613de4727a62ff2021-12-21 11:37:19.945root 11241100x8000000000000000550685Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.52c9e869ab09dcab2021-12-21 11:37:19.945root 11241100x8000000000000000550686Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ae99c18f760dbd122021-12-21 11:37:19.945root 11241100x8000000000000000550687Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a06a980b8b60ebc42021-12-21 11:37:19.945root 11241100x8000000000000000550688Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8a2ab55690dd2f892021-12-21 11:37:19.945root 11241100x8000000000000000550689Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.730d42dc0a66c22d2021-12-21 11:37:19.945root 11241100x8000000000000000550690Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b5f9360f5f3b9f882021-12-21 11:37:19.945root 11241100x8000000000000000550691Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.261992bd0e8755812021-12-21 11:37:19.945root 11241100x8000000000000000550692Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a5ba0ee8aab735b72021-12-21 11:37:19.945root 11241100x8000000000000000550693Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.43bd9686bbfe9c032021-12-21 11:37:19.945root 11241100x8000000000000000550694Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.946{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e5eb5fbde76a7a222021-12-21 11:37:19.946root 11241100x8000000000000000550695Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.946{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.45c784e7e5795b432021-12-21 11:37:19.946root 11241100x8000000000000000550696Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.946{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6b0c9bbc7a5181792021-12-21 11:37:19.946root 11241100x8000000000000000550697Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.946{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c08676e272eb14532021-12-21 11:37:19.946root 11241100x8000000000000000550698Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.946{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.87de78ad840c1ae82021-12-21 11:37:19.946root 11241100x8000000000000000550699Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.946{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.00d96fb718cd7ef42021-12-21 11:37:19.946root 11241100x8000000000000000550700Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.946{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.fdfab62811dbb1262021-12-21 11:37:19.946root 11241100x8000000000000000550701Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.946{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.520fa658928b0e982021-12-21 11:37:19.946root 11241100x8000000000000000550702Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.946{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2768f5f137765dc42021-12-21 11:37:19.946root 11241100x8000000000000000550703Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.946{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f592c27d08c365672021-12-21 11:37:19.946root 11241100x8000000000000000550704Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.946{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6e318b0229ff93712021-12-21 11:37:19.946root 11241100x8000000000000000550705Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.947{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.41258fd48cf894972021-12-21 11:37:19.947root 11241100x8000000000000000550706Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.947{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6e03bfa418156bb72021-12-21 11:37:19.947root 11241100x8000000000000000550707Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.947{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6bfe18469de9e3162021-12-21 11:37:19.947root 11241100x8000000000000000550708Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.947{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0b358dac86de51b82021-12-21 11:37:19.947root 11241100x8000000000000000550709Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.947{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4c81b7856c9ceef82021-12-21 11:37:19.947root 11241100x8000000000000000550710Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.947{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.365cbb7c61744d512021-12-21 11:37:19.947root 11241100x8000000000000000550711Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.947{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.550ad192fb1343e22021-12-21 11:37:19.947root 11241100x8000000000000000550712Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.947{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ec0e59c52ad0e28f2021-12-21 11:37:19.947root 11241100x8000000000000000550713Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.947{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8e9bd2dcbdc71b382021-12-21 11:37:19.947root 11241100x8000000000000000550714Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.947{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1c4e008855ff84952021-12-21 11:37:19.947root 11241100x8000000000000000550715Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.947{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.df93575b0bce843f2021-12-21 11:37:19.947root 11241100x8000000000000000550716Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.947{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e80dff3f0d42016b2021-12-21 11:37:19.947root 11241100x8000000000000000550717Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.947{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d0396ac7bf61ee5e2021-12-21 11:37:19.947root 11241100x8000000000000000550718Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.947{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.40e6dd986b326d702021-12-21 11:37:19.947root 11241100x8000000000000000550719Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.948{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.db79731ec49c4a3b2021-12-21 11:37:19.948root 11241100x8000000000000000550720Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.948{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.91f274dc2e00867d2021-12-21 11:37:19.948root 11241100x8000000000000000550721Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.948{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ac15d6f78f55e1502021-12-21 11:37:19.948root 11241100x8000000000000000550722Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.948{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.dcc2c6264d662a392021-12-21 11:37:19.948root 11241100x8000000000000000550723Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.948{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5c49ac4e53ec58b12021-12-21 11:37:19.948root 11241100x8000000000000000550724Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.948{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1ecc4ee0c6774b772021-12-21 11:37:19.948root 11241100x8000000000000000550725Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.950{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4180eea45a5f03512021-12-21 11:37:19.950root 11241100x8000000000000000550726Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.950{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.990fe2bc016660a92021-12-21 11:37:19.950root 11241100x8000000000000000550727Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.950{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.abdc79127952df862021-12-21 11:37:19.950root 11241100x8000000000000000550728Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.951{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5982776216151f4c2021-12-21 11:37:19.951root 11241100x8000000000000000550729Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.951{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.234fcadff9e26c1e2021-12-21 11:37:19.951root 11241100x8000000000000000550730Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.951{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.402e26961d27b34a2021-12-21 11:37:19.951root 11241100x8000000000000000550731Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.951{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.bf8c76d60f6118e02021-12-21 11:37:19.951root 11241100x8000000000000000550732Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.951{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c398ecb6e9f0ef552021-12-21 11:37:19.951root 11241100x8000000000000000550733Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.952{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4c3ba706c40ee3e22021-12-21 11:37:19.952root 11241100x8000000000000000550734Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.952{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0428ed4388eebd952021-12-21 11:37:19.952root 11241100x8000000000000000550735Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.952{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.32a17584a4ae05b12021-12-21 11:37:19.952root 11241100x8000000000000000550736Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.953{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.84adc81cb15eef9b2021-12-21 11:37:19.953root 11241100x8000000000000000550737Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.953{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8580a6244f7368d32021-12-21 11:37:19.953root 11241100x8000000000000000550738Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.953{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.293a8eceb9dad0af2021-12-21 11:37:19.953root 11241100x8000000000000000550739Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.953{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b9efc93f73f632e92021-12-21 11:37:19.953root 11241100x8000000000000000550740Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.953{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4f009cbd075877732021-12-21 11:37:19.953root 11241100x8000000000000000550741Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.954{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d55b141723bf67ab2021-12-21 11:37:19.954root 11241100x8000000000000000550742Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.954{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.46509b11bc6ce1652021-12-21 11:37:19.954root 11241100x8000000000000000550743Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.954{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7054b7f4c19753962021-12-21 11:37:19.954root 11241100x8000000000000000550744Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.956{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2f42ee19451076442021-12-21 11:37:19.956root 11241100x8000000000000000550745Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.956{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.aff3e6f031c370732021-12-21 11:37:19.956root 11241100x8000000000000000550746Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.956{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.188f5bee56287a6b2021-12-21 11:37:19.956root 11241100x8000000000000000550747Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.956{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.75b2e9d2fb0dc6892021-12-21 11:37:19.956root 11241100x8000000000000000550748Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.956{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9577c6961b23b29c2021-12-21 11:37:19.956root 11241100x8000000000000000550749Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.956{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.40e0902802d842192021-12-21 11:37:19.956root 11241100x8000000000000000550750Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.956{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.18092fab749252622021-12-21 11:37:19.956root 11241100x8000000000000000550751Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.956{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f472d1ec31d4d09c2021-12-21 11:37:19.956root 11241100x8000000000000000550752Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.957{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b86f7b38fb90756d2021-12-21 11:37:19.957root 11241100x8000000000000000550753Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:19.957{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a9bdef0fdadc22902021-12-21 11:37:19.957root 11241100x8000000000000000550754Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:20.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.22af574e7629d2402021-12-21 11:37:20.443root 11241100x8000000000000000550755Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:20.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9b7c29297ac623e52021-12-21 11:37:20.443root 11241100x8000000000000000550756Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:20.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6b836023e9ab8eb42021-12-21 11:37:20.443root 11241100x8000000000000000550757Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:20.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.de53a0568e26642a2021-12-21 11:37:20.443root 11241100x8000000000000000550758Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:20.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e3769c1acb82d65a2021-12-21 11:37:20.443root 11241100x8000000000000000550759Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:20.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b2ac85cd1b2ed06f2021-12-21 11:37:20.443root 11241100x8000000000000000550760Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:20.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.85d2d4386e0181202021-12-21 11:37:20.443root 11241100x8000000000000000550761Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:20.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5e25f7948e21276b2021-12-21 11:37:20.443root 11241100x8000000000000000550762Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:20.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9032eb17af57125e2021-12-21 11:37:20.444root 11241100x8000000000000000550763Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:20.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a0e2305832445fb92021-12-21 11:37:20.444root 11241100x8000000000000000550764Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:20.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.896256ee93429e6e2021-12-21 11:37:20.444root 11241100x8000000000000000550765Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:20.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a5bb577c7a5975d82021-12-21 11:37:20.444root 11241100x8000000000000000550766Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:20.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b8104354b7a668922021-12-21 11:37:20.444root 11241100x8000000000000000550767Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:20.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.263694613cf7ef672021-12-21 11:37:20.444root 11241100x8000000000000000550768Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:20.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0a8caec053da8e0e2021-12-21 11:37:20.444root 11241100x8000000000000000550769Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:20.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.47849a0acaed1e802021-12-21 11:37:20.444root 11241100x8000000000000000550770Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:20.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.86cee5a5971230172021-12-21 11:37:20.444root 11241100x8000000000000000550771Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:20.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.32c01ab2a42cfb232021-12-21 11:37:20.444root 11241100x8000000000000000550772Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:20.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c83315f81f194ed32021-12-21 11:37:20.444root 11241100x8000000000000000550773Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:20.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2c0329ebe94f0d9d2021-12-21 11:37:20.444root 11241100x8000000000000000550774Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:20.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ace4415615844f1b2021-12-21 11:37:20.445root 11241100x8000000000000000550775Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:20.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a23328610ee117762021-12-21 11:37:20.445root 11241100x8000000000000000550776Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:20.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4ce6fe28dad85eff2021-12-21 11:37:20.445root 11241100x8000000000000000550777Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:20.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7fa957a87f1c01b62021-12-21 11:37:20.445root 11241100x8000000000000000550778Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:20.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.890dd4274a2baf782021-12-21 11:37:20.445root 11241100x8000000000000000550779Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:20.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d0c741f90c0cab962021-12-21 11:37:20.445root 11241100x8000000000000000550780Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:20.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e556b24223a17d832021-12-21 11:37:20.445root 11241100x8000000000000000550781Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:20.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.bbdc10a82cb88d862021-12-21 11:37:20.445root 11241100x8000000000000000550782Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:20.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.80c264bc9b2abc742021-12-21 11:37:20.445root 11241100x8000000000000000550783Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:20.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5cf139f275ffd25d2021-12-21 11:37:20.445root 11241100x8000000000000000550784Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:20.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0affd739257461792021-12-21 11:37:20.445root 11241100x8000000000000000550785Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:20.446{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c1a9de8ef5a30df42021-12-21 11:37:20.446root 11241100x8000000000000000550786Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:20.446{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1b8c426a2b5a60322021-12-21 11:37:20.446root 11241100x8000000000000000550787Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:20.446{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9cbf82ea8f08fe7f2021-12-21 11:37:20.446root 11241100x8000000000000000550788Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:20.446{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9ea3be32a24fa3162021-12-21 11:37:20.446root 11241100x8000000000000000550789Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:20.446{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.780af214b2ca7b5c2021-12-21 11:37:20.446root 11241100x8000000000000000550790Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:20.446{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.09d75b57169803a12021-12-21 11:37:20.446root 11241100x8000000000000000550791Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:20.446{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.47c92882bdbb46892021-12-21 11:37:20.446root 11241100x8000000000000000550792Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:20.446{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f85536486be834d52021-12-21 11:37:20.446root 11241100x8000000000000000550793Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:20.446{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b760aec1717bb4fe2021-12-21 11:37:20.446root 11241100x8000000000000000550794Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:20.446{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7760d0b4fd9453ea2021-12-21 11:37:20.446root 11241100x8000000000000000550795Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:20.447{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b3d9e1a489ae8f912021-12-21 11:37:20.447root 11241100x8000000000000000550796Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:20.447{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b65cd3f538f93ea42021-12-21 11:37:20.447root 11241100x8000000000000000550797Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:20.447{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.409a770d71a3ecf92021-12-21 11:37:20.447root 11241100x8000000000000000550798Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:20.447{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f3167838daa3b6e92021-12-21 11:37:20.447root 11241100x8000000000000000550799Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:20.447{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ea83308b10a90d7e2021-12-21 11:37:20.447root 11241100x8000000000000000550800Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:20.447{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f755f8d4c41282792021-12-21 11:37:20.447root 11241100x8000000000000000550801Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:20.447{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.fda22ccbf2acdcd42021-12-21 11:37:20.447root 11241100x8000000000000000550802Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:20.447{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.18734fb7e4e0c9452021-12-21 11:37:20.447root 11241100x8000000000000000550803Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:20.447{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f5a935a16c6b5e5e2021-12-21 11:37:20.447root 11241100x8000000000000000550804Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:20.447{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.144c434f947d9a762021-12-21 11:37:20.447root 11241100x8000000000000000550805Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:20.448{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d0b0581c4289fa052021-12-21 11:37:20.448root 11241100x8000000000000000550806Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:20.448{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7baad6c59b9eb97a2021-12-21 11:37:20.448root 11241100x8000000000000000550807Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:20.448{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b82cf3ffe84bab7a2021-12-21 11:37:20.448root 11241100x8000000000000000550808Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:20.448{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.67804c0c0f491e552021-12-21 11:37:20.448root 11241100x8000000000000000550809Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:20.448{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ff2a4a7e7825c42c2021-12-21 11:37:20.448root 11241100x8000000000000000550810Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:20.448{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6e54c4f06e4e4a1f2021-12-21 11:37:20.448root 11241100x8000000000000000550811Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:20.448{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a614041ed02c51662021-12-21 11:37:20.448root 11241100x8000000000000000550812Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:20.448{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.79c9563e8a6a009b2021-12-21 11:37:20.448root 11241100x8000000000000000550813Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:20.448{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2f7bdf8806a4ceba2021-12-21 11:37:20.448root 11241100x8000000000000000550814Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:20.448{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4eff28a4334905db2021-12-21 11:37:20.448root 11241100x8000000000000000550815Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:20.449{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f4d43b6c3c5ff6252021-12-21 11:37:20.449root 11241100x8000000000000000550816Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:20.449{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.68f8a0db7ece5e5c2021-12-21 11:37:20.449root 11241100x8000000000000000550817Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:20.449{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.34a1c608e1c31da42021-12-21 11:37:20.449root 11241100x8000000000000000550818Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:20.449{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e4953a17cd0a7b632021-12-21 11:37:20.449root 11241100x8000000000000000550819Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:20.449{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b84950b343bcf4712021-12-21 11:37:20.449root 11241100x8000000000000000550820Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:20.449{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.16f5212060c544562021-12-21 11:37:20.449root 11241100x8000000000000000550821Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:20.449{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8de1b64e4c66f0d12021-12-21 11:37:20.449root 11241100x8000000000000000550822Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:20.449{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.84f8db347b27b1ff2021-12-21 11:37:20.449root 11241100x8000000000000000550823Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:20.449{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.844fc50bc5d9cd232021-12-21 11:37:20.449root 11241100x8000000000000000550824Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:20.449{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b8f48ec74c44707b2021-12-21 11:37:20.449root 11241100x8000000000000000550825Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:20.449{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.422f1f6933f20ade2021-12-21 11:37:20.449root 11241100x8000000000000000550826Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:20.450{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.11b8e1e9a43ff43f2021-12-21 11:37:20.450root 11241100x8000000000000000550827Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:20.450{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5fd8d1476b4bc4ed2021-12-21 11:37:20.450root 11241100x8000000000000000550828Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:20.450{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.558aaabb271736102021-12-21 11:37:20.450root 11241100x8000000000000000550829Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:20.450{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8e02c10434d415942021-12-21 11:37:20.450root 11241100x8000000000000000550830Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:20.450{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.06461c32327022c72021-12-21 11:37:20.450root 11241100x8000000000000000550831Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:20.450{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c379b17900177dd72021-12-21 11:37:20.450root 11241100x8000000000000000550832Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:20.450{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5122a8bb59e886152021-12-21 11:37:20.450root 11241100x8000000000000000550833Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:20.450{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.97d5a74654eb9ddc2021-12-21 11:37:20.450root 11241100x8000000000000000550834Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:20.450{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0e126c140d40bc682021-12-21 11:37:20.450root 11241100x8000000000000000550835Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:20.450{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.fe1dec28a69e0b502021-12-21 11:37:20.450root 11241100x8000000000000000550836Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:20.451{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.73264e7d03c92c582021-12-21 11:37:20.451root 11241100x8000000000000000550837Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:20.451{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ea1f6a6423e665d12021-12-21 11:37:20.451root 11241100x8000000000000000550838Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:20.451{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.36032c924a3a5fe32021-12-21 11:37:20.451root 11241100x8000000000000000550839Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:20.451{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.14ba1701d9b170b92021-12-21 11:37:20.451root 11241100x8000000000000000550840Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:20.451{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.029e74d405fab4572021-12-21 11:37:20.451root 11241100x8000000000000000550841Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:20.451{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.85169dce6ab005842021-12-21 11:37:20.451root 11241100x8000000000000000550842Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:20.451{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b32bd5619a5f0d4e2021-12-21 11:37:20.451root 11241100x8000000000000000550843Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:20.451{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7303de1e7bd1c0d12021-12-21 11:37:20.451root 11241100x8000000000000000550844Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:20.451{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3fe55faabd37c2b72021-12-21 11:37:20.451root 11241100x8000000000000000550845Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:20.451{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d857eee7b72c64ac2021-12-21 11:37:20.451root 11241100x8000000000000000550846Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:20.451{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.cc6daf46aff20fe72021-12-21 11:37:20.451root 11241100x8000000000000000550847Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:20.452{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.454434f782e128aa2021-12-21 11:37:20.452root 11241100x8000000000000000550848Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:20.452{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.933b9e6cb6fc70e32021-12-21 11:37:20.452root 11241100x8000000000000000550849Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:20.452{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d15f6a5deca4642d2021-12-21 11:37:20.452root 11241100x8000000000000000550850Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:20.452{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.383143e0b880bc872021-12-21 11:37:20.452root 11241100x8000000000000000550851Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:20.452{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.58a93a73b8c4caa02021-12-21 11:37:20.452root 11241100x8000000000000000550852Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:20.452{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3cf2076724ef33482021-12-21 11:37:20.452root 11241100x8000000000000000550853Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:20.452{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.26da5a650cab67e82021-12-21 11:37:20.452root 11241100x8000000000000000550854Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:20.452{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.fa3867286c7946a52021-12-21 11:37:20.452root 11241100x8000000000000000550855Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:20.452{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7f10f5171f335b922021-12-21 11:37:20.452root 11241100x8000000000000000550856Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:20.453{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.fe32fcb0a7008a9a2021-12-21 11:37:20.453root 11241100x8000000000000000550857Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:20.453{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.06d4973833eb60912021-12-21 11:37:20.453root 11241100x8000000000000000550858Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:20.453{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e7aeaa4d22f1c2c42021-12-21 11:37:20.453root 11241100x8000000000000000550859Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:20.453{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b4502338f37915da2021-12-21 11:37:20.453root 11241100x8000000000000000550860Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:20.453{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.aed646971ebffcc32021-12-21 11:37:20.453root 11241100x8000000000000000550861Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:20.453{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c6fdf9936f2162922021-12-21 11:37:20.453root 11241100x8000000000000000550862Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:20.454{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.888ac3388c1ee3ef2021-12-21 11:37:20.454root 11241100x8000000000000000550863Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:20.454{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.15d1f75de7f55d2e2021-12-21 11:37:20.454root 11241100x8000000000000000550864Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:20.454{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.664df0ac4f82e7a82021-12-21 11:37:20.454root 11241100x8000000000000000550865Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:20.454{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e443215b0177d8922021-12-21 11:37:20.454root 11241100x8000000000000000550866Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:20.454{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.68cc002da4f059052021-12-21 11:37:20.454root 11241100x8000000000000000550867Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:20.454{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2504934599058bf22021-12-21 11:37:20.454root 11241100x8000000000000000550868Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:20.455{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0edd3f7fdfae91372021-12-21 11:37:20.455root 11241100x8000000000000000550869Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:20.455{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a985f99ba6d1ec272021-12-21 11:37:20.455root 11241100x8000000000000000550870Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:20.455{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e7c2c5ec3bfbdcaa2021-12-21 11:37:20.455root 11241100x8000000000000000550871Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:20.456{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c970e566d3ca05402021-12-21 11:37:20.456root 11241100x8000000000000000550872Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:20.456{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.14e6782d1708e99d2021-12-21 11:37:20.456root 11241100x8000000000000000550873Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:20.456{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ae3775207df44e0a2021-12-21 11:37:20.456root 11241100x8000000000000000550874Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:20.457{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.077ce997a59290f22021-12-21 11:37:20.457root 11241100x8000000000000000550875Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:20.457{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9a4ee2e99f6114682021-12-21 11:37:20.457root 11241100x8000000000000000550876Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:20.457{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.35a37a67d959d38c2021-12-21 11:37:20.457root 11241100x8000000000000000550877Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:20.457{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.94c462f1124aeb9f2021-12-21 11:37:20.457root 11241100x8000000000000000550878Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:20.457{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.edad0d7d94c279ce2021-12-21 11:37:20.457root 11241100x8000000000000000550879Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:20.457{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.df968c4a17bf26952021-12-21 11:37:20.457root 11241100x8000000000000000550880Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:20.457{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.deae477e205891b42021-12-21 11:37:20.457root 11241100x8000000000000000550881Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:20.457{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3d08d6bcaaabc1612021-12-21 11:37:20.457root 11241100x8000000000000000550882Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:20.457{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.dffce5a14b71f1192021-12-21 11:37:20.457root 11241100x8000000000000000550883Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:20.458{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ac9aba75c4b2bc662021-12-21 11:37:20.458root 11241100x8000000000000000550884Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:20.458{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f9c0ee4c42cb4e482021-12-21 11:37:20.458root 11241100x8000000000000000550885Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:20.458{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d63ea571e0fb1c512021-12-21 11:37:20.458root 11241100x8000000000000000550886Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:20.458{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5f4f380bed0121ef2021-12-21 11:37:20.458root 11241100x8000000000000000550887Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:20.458{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.77cb7b186b40c9b12021-12-21 11:37:20.458root 11241100x8000000000000000550888Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:20.458{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a03840697d22f4642021-12-21 11:37:20.458root 11241100x8000000000000000550889Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:20.458{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.cbe24a4fa72c63032021-12-21 11:37:20.458root 11241100x8000000000000000550890Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:20.458{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e60991e6b9ee6df22021-12-21 11:37:20.458root 11241100x8000000000000000550891Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:20.458{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.50b66b7bb7f97afa2021-12-21 11:37:20.458root 11241100x8000000000000000550892Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:20.458{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c3c52fcd0003ab572021-12-21 11:37:20.458root 11241100x8000000000000000550893Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:20.458{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1b4e0f166b284d6d2021-12-21 11:37:20.458root 11241100x8000000000000000550894Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:20.459{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ca5a9a4ae3942a872021-12-21 11:37:20.459root 11241100x8000000000000000550895Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:20.459{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0145995296660d602021-12-21 11:37:20.459root 11241100x8000000000000000550896Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:20.459{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.33dd057e47f1cf642021-12-21 11:37:20.459root 11241100x8000000000000000550897Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:20.459{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.960745570ea6cee72021-12-21 11:37:20.459root 11241100x8000000000000000550898Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:20.459{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.84703de68e1a39f62021-12-21 11:37:20.459root 11241100x8000000000000000550899Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:20.459{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.34e92b3a85b2e15c2021-12-21 11:37:20.459root 11241100x8000000000000000550900Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:20.459{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.bdddb5a3ad83113a2021-12-21 11:37:20.459root 11241100x8000000000000000550901Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:20.459{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e078f900649bafa72021-12-21 11:37:20.459root 11241100x8000000000000000550902Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:20.459{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.86a5795b9efb70b52021-12-21 11:37:20.459root 11241100x8000000000000000550903Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:20.459{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.24604e6dd9ac05f22021-12-21 11:37:20.459root 11241100x8000000000000000550904Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:20.460{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.dac7e1a8e86744782021-12-21 11:37:20.460root 11241100x8000000000000000550905Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:20.460{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e01ad5814d79d0972021-12-21 11:37:20.460root 11241100x8000000000000000550906Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:20.460{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1d88f4a8177ad2d62021-12-21 11:37:20.460root 11241100x8000000000000000550907Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:20.461{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9b08edc3e30944fb2021-12-21 11:37:20.461root 11241100x8000000000000000550908Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:20.461{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.92445322df48523f2021-12-21 11:37:20.461root 11241100x8000000000000000550909Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:20.461{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.dc3770e1867c4e682021-12-21 11:37:20.461root 11241100x8000000000000000550910Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:20.461{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8c7515dbd70668402021-12-21 11:37:20.461root 11241100x8000000000000000550911Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:20.462{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5915d50488500d7f2021-12-21 11:37:20.462root 11241100x8000000000000000550912Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:20.462{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.cd7a94a8638ca2cc2021-12-21 11:37:20.462root 11241100x8000000000000000550913Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:20.462{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ee58eb0277afb3a32021-12-21 11:37:20.462root 11241100x8000000000000000550914Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:20.462{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1dbf5e9d793e9dac2021-12-21 11:37:20.462root 11241100x8000000000000000550915Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:20.462{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f0330b85046652cf2021-12-21 11:37:20.462root 11241100x8000000000000000550916Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:20.462{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1156c4dc5f3df7232021-12-21 11:37:20.462root 11241100x8000000000000000550917Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:20.462{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.08a367ab8fea7c652021-12-21 11:37:20.462root 11241100x8000000000000000550918Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:20.462{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7a83b3bab981571c2021-12-21 11:37:20.462root 11241100x8000000000000000550919Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:20.463{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a14ec10f218a10d12021-12-21 11:37:20.463root 11241100x8000000000000000550920Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:20.463{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.81b8d52b1201661c2021-12-21 11:37:20.463root 11241100x8000000000000000550921Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:20.463{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b071e486f55b08542021-12-21 11:37:20.463root 11241100x8000000000000000550922Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:20.463{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.38d12af5abdd360f2021-12-21 11:37:20.463root 11241100x8000000000000000550923Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:20.463{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1fc873e8f5422fe92021-12-21 11:37:20.463root 11241100x8000000000000000550924Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:20.463{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c025a12a483ee0de2021-12-21 11:37:20.463root 11241100x8000000000000000550925Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:20.463{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.416d3d36e9a028552021-12-21 11:37:20.463root 11241100x8000000000000000550926Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:20.463{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9b561d205cf4751f2021-12-21 11:37:20.463root 11241100x8000000000000000550927Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:20.464{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.37876bedf2b85ce22021-12-21 11:37:20.464root 11241100x8000000000000000550928Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:20.464{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5ed6cbc780eb28a92021-12-21 11:37:20.464root 11241100x8000000000000000550929Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:20.464{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.eeaa2ab15ccfc6e82021-12-21 11:37:20.464root 11241100x8000000000000000550930Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:20.464{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.69f7e802e7cfc5482021-12-21 11:37:20.464root 11241100x8000000000000000550931Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:20.464{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4a156a492b884c022021-12-21 11:37:20.464root 11241100x8000000000000000550932Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:20.464{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.59bfda5fdf43ba202021-12-21 11:37:20.464root 11241100x8000000000000000550933Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:20.464{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.35c1e37639e369322021-12-21 11:37:20.464root 11241100x8000000000000000550934Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:20.464{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a2139198893ce0332021-12-21 11:37:20.464root 11241100x8000000000000000550935Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:20.464{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9a3582489846c9bc2021-12-21 11:37:20.464root 11241100x8000000000000000550936Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:20.464{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.031b825ba296e5a82021-12-21 11:37:20.464root 11241100x8000000000000000550937Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:20.465{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9e189273da2ce1782021-12-21 11:37:20.465root 11241100x8000000000000000550938Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:20.465{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.05db20fce34a37562021-12-21 11:37:20.465root 11241100x8000000000000000550939Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:20.465{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e0758b592711f8752021-12-21 11:37:20.465root 11241100x8000000000000000550940Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:20.465{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.67dc91cc7511be072021-12-21 11:37:20.465root 11241100x8000000000000000550941Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:20.466{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.356bb2f01057d0bf2021-12-21 11:37:20.466root 11241100x8000000000000000550942Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:20.466{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.75822d01ae35ae002021-12-21 11:37:20.466root 11241100x8000000000000000550943Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:20.466{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.847fe10954b705672021-12-21 11:37:20.466root 11241100x8000000000000000550944Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:20.466{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.89b0d7592b3167bd2021-12-21 11:37:20.466root 11241100x8000000000000000550945Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:20.466{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.fae37687cbcaf40d2021-12-21 11:37:20.466root 11241100x8000000000000000550946Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:20.466{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6c6b74b4affee1eb2021-12-21 11:37:20.466root 11241100x8000000000000000550947Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:20.466{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0a60007e11c8389b2021-12-21 11:37:20.466root 11241100x8000000000000000550948Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:20.466{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6b7199221dfebc922021-12-21 11:37:20.466root 11241100x8000000000000000550949Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:20.466{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7856a08f3a78ebfe2021-12-21 11:37:20.466root 11241100x8000000000000000550950Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:20.466{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.122211b49bf4544c2021-12-21 11:37:20.466root 11241100x8000000000000000550951Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:20.466{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f09dc4989c4951e22021-12-21 11:37:20.466root 11241100x8000000000000000550952Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:20.467{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.24525405f7407c5c2021-12-21 11:37:20.467root 11241100x8000000000000000550953Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:20.467{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.cdef7d153de8f3b82021-12-21 11:37:20.467root 11241100x8000000000000000550954Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:20.942{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.30bffbede82ef0182021-12-21 11:37:20.942root 11241100x8000000000000000550955Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:20.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.960ff53db10344a02021-12-21 11:37:20.943root 11241100x8000000000000000550956Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:20.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.098c95300a21f7ed2021-12-21 11:37:20.943root 11241100x8000000000000000550957Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:20.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.89314a82443a31812021-12-21 11:37:20.943root 11241100x8000000000000000550958Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:20.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1aaa49a65db75afa2021-12-21 11:37:20.943root 11241100x8000000000000000550959Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:20.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.680110bea407338e2021-12-21 11:37:20.943root 11241100x8000000000000000550960Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:20.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.eac055e0161bafc32021-12-21 11:37:20.943root 11241100x8000000000000000550961Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:20.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7969ae7e0b86e6c02021-12-21 11:37:20.943root 11241100x8000000000000000550962Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:20.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2186570b51df207d2021-12-21 11:37:20.943root 11241100x8000000000000000550963Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:20.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4ce495f2e0370e0e2021-12-21 11:37:20.943root 11241100x8000000000000000550964Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:20.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.04c2cb64f270ad7e2021-12-21 11:37:20.943root 11241100x8000000000000000550965Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:20.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ea62a7007c2ab51f2021-12-21 11:37:20.943root 11241100x8000000000000000550966Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:20.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7ac4d4b12f0711482021-12-21 11:37:20.944root 11241100x8000000000000000550967Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:20.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.95fab3470d8012202021-12-21 11:37:20.944root 11241100x8000000000000000550968Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:20.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9567cc4a63d0d02a2021-12-21 11:37:20.944root 11241100x8000000000000000550969Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:20.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5c245a78148fade82021-12-21 11:37:20.944root 11241100x8000000000000000550970Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:20.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2b73d8b21cc8f4772021-12-21 11:37:20.944root 11241100x8000000000000000550971Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:20.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.adb565d23af045472021-12-21 11:37:20.944root 11241100x8000000000000000550972Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:20.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4a2aba1bd43f4a1b2021-12-21 11:37:20.944root 11241100x8000000000000000550973Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:20.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.245c2e8881393b3a2021-12-21 11:37:20.944root 11241100x8000000000000000550974Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:20.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3d8174eec3647f752021-12-21 11:37:20.944root 11241100x8000000000000000550975Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:20.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.62541749b15f4b9e2021-12-21 11:37:20.945root 11241100x8000000000000000550976Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:20.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2c1b12ec71ef87b32021-12-21 11:37:20.945root 11241100x8000000000000000550977Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:20.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8eb476871c772c092021-12-21 11:37:20.945root 11241100x8000000000000000550978Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:20.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3a1030909e23833d2021-12-21 11:37:20.945root 11241100x8000000000000000550979Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:20.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.20aaa1fd7699acad2021-12-21 11:37:20.945root 11241100x8000000000000000550980Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:20.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e39c6977b3673f232021-12-21 11:37:20.945root 11241100x8000000000000000550981Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:20.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.86f7fd79d9e7f9692021-12-21 11:37:20.945root 11241100x8000000000000000550982Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:20.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.adb7e7e59cbb55202021-12-21 11:37:20.945root 11241100x8000000000000000550983Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:20.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e5ab6b316f6ecad22021-12-21 11:37:20.945root 11241100x8000000000000000550984Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:20.946{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d66d98c1fa2011092021-12-21 11:37:20.946root 11241100x8000000000000000550985Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:20.946{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.cc19e8d59adb4a432021-12-21 11:37:20.946root 11241100x8000000000000000550986Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:20.946{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.486844dd2166bc772021-12-21 11:37:20.946root 11241100x8000000000000000550987Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:20.946{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8d52b7a20753d3f32021-12-21 11:37:20.946root 11241100x8000000000000000550988Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:20.946{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.220c9e5dc447b8012021-12-21 11:37:20.946root 11241100x8000000000000000550989Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:20.946{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.31173add6f0858c72021-12-21 11:37:20.946root 11241100x8000000000000000550990Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:20.946{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.cffc7eb63c2b93d62021-12-21 11:37:20.946root 11241100x8000000000000000550991Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:20.946{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a371e1c4d32263472021-12-21 11:37:20.946root 11241100x8000000000000000550992Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:20.946{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d6b3fe3a97e4f93f2021-12-21 11:37:20.946root 11241100x8000000000000000550993Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:20.947{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3b50b863598cd5452021-12-21 11:37:20.947root 11241100x8000000000000000550994Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:20.947{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c1dd24b7b8eec5a72021-12-21 11:37:20.947root 11241100x8000000000000000550995Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:20.947{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6902b7e11b445d922021-12-21 11:37:20.947root 11241100x8000000000000000550996Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:20.947{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c3d28e60e82618152021-12-21 11:37:20.947root 11241100x8000000000000000550997Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:20.947{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.935023defc0192f72021-12-21 11:37:20.947root 11241100x8000000000000000550998Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:20.947{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e390741b63f782a02021-12-21 11:37:20.947root 11241100x8000000000000000550999Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:20.947{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.47a9a811f422b9672021-12-21 11:37:20.947root 11241100x8000000000000000551000Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:20.947{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0e0d3d79382e13c62021-12-21 11:37:20.947root 11241100x8000000000000000551001Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:20.948{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.22f6b87a7c069e662021-12-21 11:37:20.948root 11241100x8000000000000000551002Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:20.948{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d3b8d661dd245dd32021-12-21 11:37:20.948root 11241100x8000000000000000551003Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:20.948{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.34970b94cc7dc10c2021-12-21 11:37:20.948root 11241100x8000000000000000551004Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:20.948{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4d620124be55a67f2021-12-21 11:37:20.948root 11241100x8000000000000000551005Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:20.948{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3c08d5b339650bc72021-12-21 11:37:20.948root 11241100x8000000000000000551006Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:20.948{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f9a93d44f8f002402021-12-21 11:37:20.948root 11241100x8000000000000000551007Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:20.948{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.aa8ef69fe5c82fb92021-12-21 11:37:20.948root 11241100x8000000000000000551008Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:20.948{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0282c6287c03a38c2021-12-21 11:37:20.948root 11241100x8000000000000000551009Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:20.948{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.717cc76a343ff0bb2021-12-21 11:37:20.948root 11241100x8000000000000000551010Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:20.949{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4e2f9984649372c12021-12-21 11:37:20.949root 11241100x8000000000000000551011Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:20.949{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.80b255a0a431e8022021-12-21 11:37:20.949root 11241100x8000000000000000551012Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:20.949{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7db427324a33f6712021-12-21 11:37:20.949root 11241100x8000000000000000551013Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:20.949{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.89ea5ee6e44616842021-12-21 11:37:20.949root 11241100x8000000000000000551014Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:20.949{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.276c76afb249ec492021-12-21 11:37:20.949root 11241100x8000000000000000551015Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:20.949{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.24bf1c9b8f36409d2021-12-21 11:37:20.949root 11241100x8000000000000000551016Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:20.949{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3e9d63f7196a36722021-12-21 11:37:20.949root 11241100x8000000000000000551017Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:20.949{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.97dbb90ab18c23c32021-12-21 11:37:20.949root 11241100x8000000000000000551018Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:20.949{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ff9b02a25cbe2fb12021-12-21 11:37:20.949root 11241100x8000000000000000551019Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:20.950{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.fe420d97505e97cf2021-12-21 11:37:20.950root 11241100x8000000000000000551020Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:20.950{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7a00fb3c913421442021-12-21 11:37:20.950root 11241100x8000000000000000551021Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:20.950{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.07ed72f11b7294652021-12-21 11:37:20.950root 11241100x8000000000000000551022Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:20.950{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0adb5c7c5b084efd2021-12-21 11:37:20.950root 11241100x8000000000000000551023Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:20.950{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.baeeee469f8b70692021-12-21 11:37:20.950root 11241100x8000000000000000551024Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:20.950{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b3dfa11cf487280d2021-12-21 11:37:20.950root 11241100x8000000000000000551025Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:20.950{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9d15e57447f4ca5e2021-12-21 11:37:20.950root 11241100x8000000000000000551026Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:20.950{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.245a07fdfcc60d4e2021-12-21 11:37:20.950root 11241100x8000000000000000551027Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:20.951{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7483a12d310379162021-12-21 11:37:20.951root 11241100x8000000000000000551028Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:20.951{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a1d8591c25c13f4b2021-12-21 11:37:20.951root 11241100x8000000000000000551029Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:20.951{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.bb83da8d9016a2cc2021-12-21 11:37:20.951root 11241100x8000000000000000551030Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:20.951{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.388aa633580d94102021-12-21 11:37:20.951root 11241100x8000000000000000551031Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:20.951{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4d5363c01ddc64df2021-12-21 11:37:20.951root 11241100x8000000000000000551032Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:20.951{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.17cb4b808cf796262021-12-21 11:37:20.951root 11241100x8000000000000000551033Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:20.951{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6ba40b9aa03016c22021-12-21 11:37:20.951root 11241100x8000000000000000551034Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:20.952{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0db910da68a676202021-12-21 11:37:20.952root 11241100x8000000000000000551035Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:20.952{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.62a1f4a664d926f62021-12-21 11:37:20.952root 11241100x8000000000000000551036Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:20.952{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2c7e491ff41960fd2021-12-21 11:37:20.952root 11241100x8000000000000000551037Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:20.952{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.dddf6b62f4f19a3f2021-12-21 11:37:20.952root 11241100x8000000000000000551038Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:20.952{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c73b8ded5c4666be2021-12-21 11:37:20.952root 11241100x8000000000000000551039Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:20.952{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ea404d60d41cd9bc2021-12-21 11:37:20.952root 11241100x8000000000000000551040Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:20.952{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a764dbb6d9287e9b2021-12-21 11:37:20.952root 11241100x8000000000000000551041Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:20.952{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.77dbd4f4a7390a822021-12-21 11:37:20.952root 11241100x8000000000000000551042Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:20.953{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.20ce9095a84084c72021-12-21 11:37:20.953root 11241100x8000000000000000551043Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:20.953{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.64104f4ef49f6e862021-12-21 11:37:20.953root 11241100x8000000000000000551044Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:20.953{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f287105eb9ef15c52021-12-21 11:37:20.953root 11241100x8000000000000000551045Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:20.953{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.44726678ca380b222021-12-21 11:37:20.953root 11241100x8000000000000000551046Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:20.953{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.971ec9e42545829f2021-12-21 11:37:20.953root 11241100x8000000000000000551047Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:20.953{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a85f05066e86f47f2021-12-21 11:37:20.953root 11241100x8000000000000000551048Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:20.953{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9b226fc9404076b52021-12-21 11:37:20.953root 11241100x8000000000000000551049Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:20.953{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.baaed00d50c6f1df2021-12-21 11:37:20.953root 11241100x8000000000000000551050Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:20.954{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4b7aafe81729d1342021-12-21 11:37:20.954root 11241100x8000000000000000551051Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:20.954{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e23177f2f16800492021-12-21 11:37:20.954root 11241100x8000000000000000551052Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:20.954{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.215c99811951d6aa2021-12-21 11:37:20.954root 11241100x8000000000000000551053Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:20.954{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6ae5ac3a955ca3682021-12-21 11:37:20.954root 11241100x8000000000000000551054Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:20.954{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.96c8c28f0fa85b452021-12-21 11:37:20.954root 11241100x8000000000000000551055Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:20.955{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.62ee4f1d206628a02021-12-21 11:37:20.955root 11241100x8000000000000000551056Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:20.955{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.cb0b378f9e9660f92021-12-21 11:37:20.955root 11241100x8000000000000000551057Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:20.955{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6d1b51e973b203112021-12-21 11:37:20.955root 11241100x8000000000000000551058Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:20.955{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.236cd39596ea226b2021-12-21 11:37:20.955root 11241100x8000000000000000551059Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:20.956{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6e8ba83526332ae42021-12-21 11:37:20.956root 11241100x8000000000000000551060Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:20.956{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a37c54286c6a37de2021-12-21 11:37:20.956root 11241100x8000000000000000551061Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:20.956{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e3dd9489575a01542021-12-21 11:37:20.956root 11241100x8000000000000000551062Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:20.956{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.10c9e2b4fa6f90a22021-12-21 11:37:20.956root 11241100x8000000000000000551063Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:20.956{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6a843d320d4d85a22021-12-21 11:37:20.956root 11241100x8000000000000000551064Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:20.956{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c00e058745046cf12021-12-21 11:37:20.956root 11241100x8000000000000000551065Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:20.957{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.411a5dda940342ad2021-12-21 11:37:20.957root 11241100x8000000000000000551066Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:20.957{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.103c144698569a462021-12-21 11:37:20.957root 11241100x8000000000000000551067Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:20.957{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.809d19c558d6adac2021-12-21 11:37:20.957root 11241100x8000000000000000551068Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:20.957{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.bf3d2c746521d1ca2021-12-21 11:37:20.957root 11241100x8000000000000000551069Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:20.957{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.08637c449c8a6efa2021-12-21 11:37:20.957root 11241100x8000000000000000551070Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:20.957{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.155710c8133e7dd02021-12-21 11:37:20.957root 11241100x8000000000000000551071Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:20.958{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f4a3e241f525c3492021-12-21 11:37:20.958root 11241100x8000000000000000551072Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:20.958{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4721992cd8176e672021-12-21 11:37:20.958root 11241100x8000000000000000551073Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:20.958{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.eb14f609d9619bc52021-12-21 11:37:20.958root 11241100x8000000000000000551074Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:20.958{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b7376fbfa7d8af6d2021-12-21 11:37:20.958root 11241100x8000000000000000551075Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:20.958{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.27749ce08df7621c2021-12-21 11:37:20.958root 11241100x8000000000000000551076Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:20.959{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.33a44913923a02dc2021-12-21 11:37:20.959root 11241100x8000000000000000551077Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:20.959{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.bcf5a20692beb06c2021-12-21 11:37:20.959root 11241100x8000000000000000551078Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:20.959{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6714f3c61a905fd12021-12-21 11:37:20.959root 11241100x8000000000000000551079Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:20.959{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a710349bbabffa412021-12-21 11:37:20.959root 11241100x8000000000000000551080Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:20.959{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2ff4c1889bc6de972021-12-21 11:37:20.959root 11241100x8000000000000000551081Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:20.960{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7ab26fe562a0d3612021-12-21 11:37:20.960root 11241100x8000000000000000551082Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:20.960{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.256c60e8d325eae62021-12-21 11:37:20.960root 11241100x8000000000000000551083Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:20.960{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.35bc57140881034c2021-12-21 11:37:20.960root 11241100x8000000000000000551084Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:20.960{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.880a3091d3604fd52021-12-21 11:37:20.960root 11241100x8000000000000000551085Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:20.960{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.faa3b10f9232e3472021-12-21 11:37:20.960root 11241100x8000000000000000551086Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:20.961{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5ed94d318b003f092021-12-21 11:37:20.961root 11241100x8000000000000000551087Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:20.961{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6b05e83ad29e1b702021-12-21 11:37:20.961root 11241100x8000000000000000551088Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:20.961{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5e07f91019ae8d132021-12-21 11:37:20.961root 11241100x8000000000000000551089Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:20.961{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b13d9591c45577062021-12-21 11:37:20.961root 11241100x8000000000000000551090Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:20.961{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.98bfb05bf1466dee2021-12-21 11:37:20.961root 11241100x8000000000000000551091Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:20.962{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5397d590c4cd167c2021-12-21 11:37:20.962root 11241100x8000000000000000551092Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:20.962{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6da04f0250e3030c2021-12-21 11:37:20.962root 11241100x8000000000000000551093Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:20.962{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.575bee8c815ef6f22021-12-21 11:37:20.962root 11241100x8000000000000000551094Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:20.962{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b3b8fb9559c616042021-12-21 11:37:20.962root 11241100x8000000000000000551095Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:20.962{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7ba978d5e0f78a202021-12-21 11:37:20.962root 11241100x8000000000000000551096Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:20.962{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6c3f9d8455c02c4a2021-12-21 11:37:20.962root 11241100x8000000000000000551097Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:20.963{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8f482000c0877ecb2021-12-21 11:37:20.963root 11241100x8000000000000000551098Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:20.963{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4dbf41a562949c7e2021-12-21 11:37:20.963root 11241100x8000000000000000551099Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:20.963{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.867202c59109a6012021-12-21 11:37:20.963root 11241100x8000000000000000551100Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:20.963{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.485be5ab0dff04ce2021-12-21 11:37:20.963root 11241100x8000000000000000551101Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:20.963{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ad5c3b8a419ca66d2021-12-21 11:37:20.963root 11241100x8000000000000000551102Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:20.963{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9c72b5e9107e7f6f2021-12-21 11:37:20.963root 11241100x8000000000000000551103Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:20.963{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ddfc6e0318e4bd362021-12-21 11:37:20.963root 11241100x8000000000000000551104Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:20.963{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f70479ee16d824532021-12-21 11:37:20.963root 11241100x8000000000000000551105Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:20.963{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c24ca2a437303ef72021-12-21 11:37:20.963root 11241100x8000000000000000551106Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:20.964{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.294b9c18aa72fc562021-12-21 11:37:20.964root 11241100x8000000000000000551107Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:20.964{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4a433907337b13ea2021-12-21 11:37:20.964root 11241100x8000000000000000551108Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:20.964{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.26e09dc59bc68a722021-12-21 11:37:20.964root 11241100x8000000000000000551109Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:20.964{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7009b5929579e50b2021-12-21 11:37:20.964root 11241100x8000000000000000551110Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:20.964{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9d63c546ee9715342021-12-21 11:37:20.964root 11241100x8000000000000000551111Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:20.964{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5d9865b0224cc7fd2021-12-21 11:37:20.964root 11241100x8000000000000000551112Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:20.964{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b7c44cd2bce4ee442021-12-21 11:37:20.964root 11241100x8000000000000000551113Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:20.964{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.58c5e3f33d0988f42021-12-21 11:37:20.964root 11241100x8000000000000000551114Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:20.964{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7e2770fa1112be192021-12-21 11:37:20.964root 11241100x8000000000000000551115Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:20.964{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ff86721b6f6440982021-12-21 11:37:20.964root 11241100x8000000000000000551116Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:20.964{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.996c9f0590f576112021-12-21 11:37:20.964root 11241100x8000000000000000551117Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:20.965{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e2efc93e0a67465a2021-12-21 11:37:20.965root 11241100x8000000000000000551118Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:20.965{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.21ff5e93ec5d09632021-12-21 11:37:20.965root 11241100x8000000000000000551119Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:20.965{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d91fa1fc34f53cd12021-12-21 11:37:20.965root 11241100x8000000000000000551120Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:20.965{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e6a492bd98edba2b2021-12-21 11:37:20.965root 11241100x8000000000000000551121Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:20.965{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.01be11aa5bcc1bb82021-12-21 11:37:20.965root 11241100x8000000000000000551122Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:20.965{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4476c61bf57aa38f2021-12-21 11:37:20.965root 11241100x8000000000000000551123Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:20.965{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.728a87db8104ee592021-12-21 11:37:20.965root 11241100x8000000000000000551124Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:20.965{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.31aaa5841f8785982021-12-21 11:37:20.965root 11241100x8000000000000000551125Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:20.965{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a874099964d0a6822021-12-21 11:37:20.965root 11241100x8000000000000000551126Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:20.965{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.fbe858f55416b6492021-12-21 11:37:20.965root 11241100x8000000000000000551127Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:20.965{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4cec8b8ada8045b42021-12-21 11:37:20.965root 11241100x8000000000000000551128Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:20.965{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8626a33df1e9fe1d2021-12-21 11:37:20.965root 11241100x8000000000000000551129Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:20.966{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e33600c9edc6ef382021-12-21 11:37:20.966root 11241100x8000000000000000551130Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:20.966{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.385eff5603635c3d2021-12-21 11:37:20.966root 11241100x8000000000000000551131Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:20.966{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5df323079a539ed92021-12-21 11:37:20.966root 11241100x8000000000000000551132Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:20.966{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4c421f37475c89192021-12-21 11:37:20.966root 11241100x8000000000000000551133Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:20.966{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b157591c454cfd932021-12-21 11:37:20.966root 11241100x8000000000000000551134Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:20.966{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.064db6cdf968ebad2021-12-21 11:37:20.966root 11241100x8000000000000000551135Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:20.966{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.aad191dbeb15ff072021-12-21 11:37:20.966root 11241100x8000000000000000551136Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:20.966{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.525d25f7df35872c2021-12-21 11:37:20.966root 11241100x8000000000000000551137Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:20.966{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4e1804018e5031222021-12-21 11:37:20.966root 11241100x8000000000000000551138Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:20.966{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ed313e5c1f3fb0392021-12-21 11:37:20.966root 11241100x8000000000000000551139Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:20.966{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.475ed003da06d3fc2021-12-21 11:37:20.966root 11241100x8000000000000000551140Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:20.967{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.df12c7a79c990f3b2021-12-21 11:37:20.967root 11241100x8000000000000000551141Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:20.967{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e15c4165a16f3d862021-12-21 11:37:20.967root 11241100x8000000000000000551142Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:20.967{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1464c08208a4e3282021-12-21 11:37:20.967root 11241100x8000000000000000551143Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:20.967{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3d9e07482e95eb432021-12-21 11:37:20.967root 11241100x8000000000000000551144Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:20.967{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c81968d027628d4e2021-12-21 11:37:20.967root 11241100x8000000000000000551145Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:20.967{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.231743006aa05ba62021-12-21 11:37:20.967root 11241100x8000000000000000551146Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:20.967{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4e613a4ab8c8719b2021-12-21 11:37:20.967root 11241100x8000000000000000551147Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:20.967{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5e0d0d1dcd250e392021-12-21 11:37:20.967root 11241100x8000000000000000551148Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:20.967{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d302d944153c14812021-12-21 11:37:20.967root 11241100x8000000000000000551149Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:20.967{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.263d0da1d4c18b1d2021-12-21 11:37:20.967root 11241100x8000000000000000551150Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:20.967{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.921f98054db166a62021-12-21 11:37:20.967root 11241100x8000000000000000551151Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:20.968{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4e13fa6072befe472021-12-21 11:37:20.968root 11241100x8000000000000000551152Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:20.968{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.31ff58e5ccc9822b2021-12-21 11:37:20.968root 11241100x8000000000000000551153Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:20.968{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.bd8b2e7cfee42ab82021-12-21 11:37:20.968root 11241100x8000000000000000551154Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:20.968{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1213dee67e4c8cb62021-12-21 11:37:20.968root 11241100x8000000000000000551155Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:20.968{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.23852d9722487ba92021-12-21 11:37:20.968root 11241100x8000000000000000551156Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:20.968{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d010a3a661f3ebbb2021-12-21 11:37:20.968root 11241100x8000000000000000551157Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:20.968{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0e9d3b96d78ea3832021-12-21 11:37:20.968root 11241100x8000000000000000551158Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:20.968{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.403fb6ddfd62fbcb2021-12-21 11:37:20.968root 11241100x8000000000000000551159Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:20.968{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3c04c1e772f49dcf2021-12-21 11:37:20.968root 11241100x8000000000000000551160Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:20.968{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4311a7c8fbb04a682021-12-21 11:37:20.968root 11241100x8000000000000000551161Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:20.968{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9926fff1e3fb36dc2021-12-21 11:37:20.968root 11241100x8000000000000000551162Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:20.968{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4fe74a4705c4074c2021-12-21 11:37:20.968root 11241100x8000000000000000551163Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:20.968{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7afd8d3baa23389e2021-12-21 11:37:20.968root 11241100x8000000000000000551164Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:20.968{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.63629e4535e929f32021-12-21 11:37:20.968root 11241100x8000000000000000551165Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:20.968{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c3e166b1b6d6cc382021-12-21 11:37:20.968root 11241100x8000000000000000551166Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:20.969{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d9bffa0fee55744f2021-12-21 11:37:20.969root 11241100x8000000000000000551167Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:20.969{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1ca08ce56e36f26b2021-12-21 11:37:20.969root 11241100x8000000000000000551168Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:20.969{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.39a56ba83da210e12021-12-21 11:37:20.969root 11241100x8000000000000000551169Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:20.969{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f9b1cfe8c68f278c2021-12-21 11:37:20.969root 11241100x8000000000000000551170Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:20.969{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5c18d70071d656c22021-12-21 11:37:20.969root 11241100x8000000000000000551171Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:20.969{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7145ac4f39a7034e2021-12-21 11:37:20.969root 11241100x8000000000000000551172Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:20.969{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.61a489158778c2472021-12-21 11:37:20.969root 11241100x8000000000000000551173Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:20.969{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f8bb820bdfd295922021-12-21 11:37:20.969root 11241100x8000000000000000551174Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:20.969{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c44c9f505d8679742021-12-21 11:37:20.969root 11241100x8000000000000000551175Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:20.969{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ec59943b6ad6d6d42021-12-21 11:37:20.969root 11241100x8000000000000000551176Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:21.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.fa95dddc93c79b4a2021-12-21 11:37:21.443root 11241100x8000000000000000551177Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:21.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.112d1cc6098c2eb82021-12-21 11:37:21.443root 11241100x8000000000000000551178Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:21.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3bca299fb2e401d12021-12-21 11:37:21.443root 11241100x8000000000000000551179Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:21.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3e93f8f8581ea4b22021-12-21 11:37:21.444root 11241100x8000000000000000551180Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:21.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7b1e2b18309581402021-12-21 11:37:21.444root 11241100x8000000000000000551181Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:21.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.72d6bcdd1b3f86b02021-12-21 11:37:21.444root 11241100x8000000000000000551182Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:21.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d442cd8c415adc462021-12-21 11:37:21.444root 11241100x8000000000000000551183Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:21.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3cc738d73ef74bfd2021-12-21 11:37:21.444root 11241100x8000000000000000551184Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:21.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1ce8ae1502bcfb002021-12-21 11:37:21.444root 11241100x8000000000000000551185Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:21.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a38a8cd70d305a5e2021-12-21 11:37:21.444root 11241100x8000000000000000551186Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:21.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9aad874eac2eb20f2021-12-21 11:37:21.445root 11241100x8000000000000000551187Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:21.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a3e2ae52fbe645f42021-12-21 11:37:21.445root 11241100x8000000000000000551188Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:21.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0393ad974df1c4e12021-12-21 11:37:21.445root 11241100x8000000000000000551189Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:21.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5821046b135325e62021-12-21 11:37:21.445root 11241100x8000000000000000551190Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:21.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.12f0de3c9f6ba7002021-12-21 11:37:21.445root 11241100x8000000000000000551191Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:21.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9422e219a4c0193d2021-12-21 11:37:21.445root 11241100x8000000000000000551192Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:21.446{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.89bcaa495e8aa2712021-12-21 11:37:21.446root 11241100x8000000000000000551193Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:21.446{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8c26e400f977939b2021-12-21 11:37:21.446root 11241100x8000000000000000551194Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:21.446{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.40ae7aaa51829ebe2021-12-21 11:37:21.446root 11241100x8000000000000000551195Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:21.446{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e1400c11b5f102b22021-12-21 11:37:21.446root 11241100x8000000000000000551196Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:21.446{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1286cd95c3b2f14c2021-12-21 11:37:21.446root 11241100x8000000000000000551197Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:21.446{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.111634c4b0f9ceff2021-12-21 11:37:21.446root 11241100x8000000000000000551198Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:21.446{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c6f61bc787877c8e2021-12-21 11:37:21.446root 11241100x8000000000000000551199Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:21.447{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2ae1d55f57575da52021-12-21 11:37:21.447root 11241100x8000000000000000551200Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:21.447{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.90f4dc24a478f91b2021-12-21 11:37:21.447root 11241100x8000000000000000551201Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:21.447{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d4be6a4546c4fae32021-12-21 11:37:21.447root 11241100x8000000000000000551202Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:21.447{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6d1814fe1d6dc77a2021-12-21 11:37:21.447root 11241100x8000000000000000551203Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:21.448{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.89397f309bd5d2552021-12-21 11:37:21.448root 11241100x8000000000000000551204Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:21.448{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b95def22d81921e02021-12-21 11:37:21.448root 11241100x8000000000000000551205Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:21.448{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d39ac66a92c193902021-12-21 11:37:21.448root 11241100x8000000000000000551206Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:21.448{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.48c88582572999802021-12-21 11:37:21.448root 11241100x8000000000000000551207Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:21.448{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.652ccae41ebdb4322021-12-21 11:37:21.448root 11241100x8000000000000000551208Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:21.448{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.577229b2dfd4bd042021-12-21 11:37:21.448root 11241100x8000000000000000551209Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:21.448{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4bae98ffb13125cd2021-12-21 11:37:21.448root 11241100x8000000000000000551210Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:21.448{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6f4ef78ea9ad66ca2021-12-21 11:37:21.448root 11241100x8000000000000000551211Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:21.449{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f6cb88d422b3072d2021-12-21 11:37:21.449root 11241100x8000000000000000551212Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:21.449{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.26dc6474b13cf3832021-12-21 11:37:21.449root 11241100x8000000000000000551213Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:21.449{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.dc4c9b801a9900092021-12-21 11:37:21.449root 11241100x8000000000000000551214Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:21.449{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f6d30857b14e36142021-12-21 11:37:21.449root 11241100x8000000000000000551215Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:21.449{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.27f707808a9125582021-12-21 11:37:21.449root 11241100x8000000000000000551216Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:21.449{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.bd968719f9e7cab42021-12-21 11:37:21.449root 11241100x8000000000000000551217Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:21.449{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b17712744c2083762021-12-21 11:37:21.449root 11241100x8000000000000000551218Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:21.449{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6e3d4e7ece47f3b62021-12-21 11:37:21.449root 11241100x8000000000000000551219Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:21.449{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.93d5d6dbe94342012021-12-21 11:37:21.449root 11241100x8000000000000000551220Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:21.450{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7ad1ec2a3d8fa49a2021-12-21 11:37:21.450root 11241100x8000000000000000551221Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:21.450{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d0a27a212f8abe0b2021-12-21 11:37:21.450root 11241100x8000000000000000551222Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:21.450{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.291d3ff8f53e664c2021-12-21 11:37:21.450root 11241100x8000000000000000551223Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:21.450{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e9cc88fa4e8498642021-12-21 11:37:21.450root 11241100x8000000000000000551224Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:21.450{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c5e2c83b40dddee02021-12-21 11:37:21.450root 11241100x8000000000000000551225Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:21.450{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d829449b83b5b2d42021-12-21 11:37:21.450root 11241100x8000000000000000551226Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:21.450{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2aafdcc72bb3f5ff2021-12-21 11:37:21.450root 11241100x8000000000000000551227Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:21.451{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c6c03a08ebfa0b4b2021-12-21 11:37:21.451root 11241100x8000000000000000551228Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:21.452{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.fcb7b8ee07e910d22021-12-21 11:37:21.452root 11241100x8000000000000000551229Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:21.452{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.09da6798b82b1d992021-12-21 11:37:21.452root 11241100x8000000000000000551230Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:21.452{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0f78d263773635a82021-12-21 11:37:21.452root 11241100x8000000000000000551231Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:21.453{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c09d665ed9fa15f12021-12-21 11:37:21.453root 11241100x8000000000000000551232Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:21.453{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2736654e04abb27d2021-12-21 11:37:21.453root 11241100x8000000000000000551233Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:21.453{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6cc9301355c643612021-12-21 11:37:21.453root 11241100x8000000000000000551234Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:21.453{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.deb1861d3a343b772021-12-21 11:37:21.453root 11241100x8000000000000000551235Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:21.454{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3952fcd428b242db2021-12-21 11:37:21.454root 11241100x8000000000000000551236Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:21.454{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e0c2533408a3e2d52021-12-21 11:37:21.454root 11241100x8000000000000000551237Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:21.454{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7adc506325ba34a52021-12-21 11:37:21.454root 11241100x8000000000000000551238Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:21.454{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.287513d22b10f8d82021-12-21 11:37:21.454root 11241100x8000000000000000551239Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:21.454{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5b856445a1df209f2021-12-21 11:37:21.454root 11241100x8000000000000000551240Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:21.455{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8e62a5f721ae04652021-12-21 11:37:21.455root 11241100x8000000000000000551241Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:21.455{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f9d5454e3d735e812021-12-21 11:37:21.455root 11241100x8000000000000000551242Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:21.455{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2a3ec06a2b89bee22021-12-21 11:37:21.455root 11241100x8000000000000000551243Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:21.455{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a259a3fc496408672021-12-21 11:37:21.455root 11241100x8000000000000000551244Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:21.455{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e038ea2ef51f83482021-12-21 11:37:21.455root 11241100x8000000000000000551245Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:21.456{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2256e0a3d24864d22021-12-21 11:37:21.456root 11241100x8000000000000000551246Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:21.456{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f749d663bc68e96a2021-12-21 11:37:21.456root 11241100x8000000000000000551247Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:21.456{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7162f541032f14c82021-12-21 11:37:21.456root 11241100x8000000000000000551248Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:21.456{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5aa1df8019e2d7df2021-12-21 11:37:21.456root 11241100x8000000000000000551249Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:21.457{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9d500634639e57822021-12-21 11:37:21.457root 11241100x8000000000000000551250Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:21.457{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b1ea905fd6d61f392021-12-21 11:37:21.457root 11241100x8000000000000000551251Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:21.458{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.688a8fa5065756bc2021-12-21 11:37:21.458root 11241100x8000000000000000551252Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:21.459{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3e1569ce7197b32c2021-12-21 11:37:21.459root 11241100x8000000000000000551253Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:21.459{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.390ff849d36b43c72021-12-21 11:37:21.459root 11241100x8000000000000000551254Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:21.459{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e7b7f12a4bf772582021-12-21 11:37:21.459root 11241100x8000000000000000551255Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:21.459{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f7ee6a7cd1ec443c2021-12-21 11:37:21.459root 11241100x8000000000000000551256Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:21.459{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5b8ab5461dd057402021-12-21 11:37:21.459root 11241100x8000000000000000551257Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:21.459{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.00cff4604a1796162021-12-21 11:37:21.459root 11241100x8000000000000000551258Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:21.460{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.816c848f276994a32021-12-21 11:37:21.460root 11241100x8000000000000000551259Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:21.460{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.792cc6ecc93ad6822021-12-21 11:37:21.460root 11241100x8000000000000000551260Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:21.460{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4b39377c8a4920ce2021-12-21 11:37:21.460root 11241100x8000000000000000551261Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:21.460{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0e3fd3a8504b18792021-12-21 11:37:21.460root 11241100x8000000000000000551262Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:21.461{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.595cefb4fdf73a002021-12-21 11:37:21.461root 11241100x8000000000000000551263Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:21.461{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c996b71a3218b8ff2021-12-21 11:37:21.461root 11241100x8000000000000000551264Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:21.461{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e4c53a49279165ae2021-12-21 11:37:21.461root 11241100x8000000000000000551265Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:21.461{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d7a3f993a8c98bc82021-12-21 11:37:21.461root 11241100x8000000000000000551266Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:21.461{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.257cfc3f5895b3a42021-12-21 11:37:21.461root 11241100x8000000000000000551267Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:21.461{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5c36689cd6271fc02021-12-21 11:37:21.461root 11241100x8000000000000000551268Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:21.461{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0d85cb248a3459462021-12-21 11:37:21.461root 11241100x8000000000000000551269Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:21.461{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.67795b6078cada2a2021-12-21 11:37:21.461root 11241100x8000000000000000551270Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:21.464{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.386bde8f602890af2021-12-21 11:37:21.464root 11241100x8000000000000000551271Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:21.464{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2587c4ec350517872021-12-21 11:37:21.464root 11241100x8000000000000000551272Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:21.464{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d2dcfed67de9e0cc2021-12-21 11:37:21.464root 11241100x8000000000000000551273Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:21.464{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6e6f8cdda86a661f2021-12-21 11:37:21.464root 11241100x8000000000000000551274Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:21.464{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.db87a26e2888a4432021-12-21 11:37:21.464root 11241100x8000000000000000551275Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:21.466{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.de46949a4dba38c12021-12-21 11:37:21.466root 11241100x8000000000000000551276Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:21.466{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.545b8612d24e27912021-12-21 11:37:21.466root 11241100x8000000000000000551277Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:21.466{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.cf74947a2c1ab2e52021-12-21 11:37:21.466root 11241100x8000000000000000551278Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:21.466{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.facd2661996568782021-12-21 11:37:21.466root 11241100x8000000000000000551279Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:21.466{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5134cd7d6eb1ae1d2021-12-21 11:37:21.466root 11241100x8000000000000000551280Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:21.466{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3714d7015b8bac6e2021-12-21 11:37:21.466root 11241100x8000000000000000551281Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:21.466{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f9fd8318b4f259972021-12-21 11:37:21.466root 11241100x8000000000000000551282Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:21.467{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.213f160b377c0b792021-12-21 11:37:21.467root 11241100x8000000000000000551283Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:21.467{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.60c93ea1ea93f2802021-12-21 11:37:21.467root 11241100x8000000000000000551284Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:21.468{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.477bc8f123dc180c2021-12-21 11:37:21.468root 11241100x8000000000000000551285Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:21.468{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f351b09db998f06e2021-12-21 11:37:21.468root 11241100x8000000000000000551286Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:21.468{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.dac2081d0d543a082021-12-21 11:37:21.468root 11241100x8000000000000000551287Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:21.468{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.cca447343f703fce2021-12-21 11:37:21.468root 11241100x8000000000000000551288Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:21.469{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ab1f72ef2dcce5442021-12-21 11:37:21.469root 11241100x8000000000000000551289Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:21.469{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7b67f38841a0d24d2021-12-21 11:37:21.469root 11241100x8000000000000000551290Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:21.470{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6a894157426f365b2021-12-21 11:37:21.470root 11241100x8000000000000000551291Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:21.470{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f18a25a499c013fb2021-12-21 11:37:21.470root 11241100x8000000000000000551292Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:21.470{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.fb6d24beb69cdca92021-12-21 11:37:21.470root 11241100x8000000000000000551293Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:21.470{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.25c5375ec77bc4a02021-12-21 11:37:21.470root 11241100x8000000000000000551294Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:21.470{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3c31263125d948512021-12-21 11:37:21.470root 11241100x8000000000000000551295Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:21.471{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6e5c79d8aedd90f72021-12-21 11:37:21.471root 11241100x8000000000000000551296Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:21.471{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9580170ef9db82252021-12-21 11:37:21.471root 11241100x8000000000000000551297Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:21.471{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0bebe20f545f81752021-12-21 11:37:21.471root 11241100x8000000000000000551298Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:21.472{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f5ffbc2e212123382021-12-21 11:37:21.472root 11241100x8000000000000000551299Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:21.472{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.37b4c6e7af5d2e392021-12-21 11:37:21.472root 11241100x8000000000000000551300Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:21.472{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2dcb044acc8c86df2021-12-21 11:37:21.472root 11241100x8000000000000000551301Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:21.472{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b1542d8748615fb12021-12-21 11:37:21.472root 11241100x8000000000000000551302Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:21.472{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.61dc125b35192bc72021-12-21 11:37:21.472root 11241100x8000000000000000551303Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:21.472{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9a38b119dabe6e592021-12-21 11:37:21.472root 11241100x8000000000000000551304Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:21.473{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1debb1a9396cfa212021-12-21 11:37:21.473root 11241100x8000000000000000551305Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:21.473{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.fe73c0db2afc913e2021-12-21 11:37:21.473root 11241100x8000000000000000551306Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:21.473{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ff2dee635ef53e1e2021-12-21 11:37:21.473root 11241100x8000000000000000551307Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:21.474{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3200d12944d765f62021-12-21 11:37:21.474root 11241100x8000000000000000551308Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:21.474{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.78d93178807076bb2021-12-21 11:37:21.474root 11241100x8000000000000000551309Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:21.475{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.928a1b62a5a479ee2021-12-21 11:37:21.475root 11241100x8000000000000000551310Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:21.475{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f5471d1695cbbd4c2021-12-21 11:37:21.475root 11241100x8000000000000000551311Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:21.476{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.13d903755e2e2b7e2021-12-21 11:37:21.476root 11241100x8000000000000000551312Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:21.476{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.bd2da93d1814969e2021-12-21 11:37:21.476root 11241100x8000000000000000551313Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:21.476{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.cb6f78818738886b2021-12-21 11:37:21.476root 11241100x8000000000000000551314Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:21.477{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.773afbf87492a2b92021-12-21 11:37:21.477root 11241100x8000000000000000551315Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:21.477{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d7aae91d690b70a62021-12-21 11:37:21.477root 11241100x8000000000000000551316Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:21.477{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b10a638e705c51c62021-12-21 11:37:21.477root 11241100x8000000000000000551317Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:21.477{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e38e67bd638f1bd72021-12-21 11:37:21.477root 11241100x8000000000000000551318Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:21.479{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b4a29748746261c72021-12-21 11:37:21.479root 11241100x8000000000000000551319Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:21.479{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ae0e3dba4a49452b2021-12-21 11:37:21.479root 11241100x8000000000000000551320Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:21.479{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d42e10d8aee238612021-12-21 11:37:21.479root 11241100x8000000000000000551321Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:21.479{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5c527d41365461952021-12-21 11:37:21.479root 11241100x8000000000000000551322Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:21.479{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c846b29a388331712021-12-21 11:37:21.479root 11241100x8000000000000000551323Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:21.480{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7763fe236c4f9af42021-12-21 11:37:21.480root 11241100x8000000000000000551324Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:21.480{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1b1bac09c3ac87772021-12-21 11:37:21.480root 11241100x8000000000000000551325Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:21.480{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.26dc5df8284d28bb2021-12-21 11:37:21.480root 11241100x8000000000000000551326Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:21.480{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.006f9a33b5748def2021-12-21 11:37:21.480root 11241100x8000000000000000551327Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:21.480{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.84f5010614aeb76d2021-12-21 11:37:21.480root 11241100x8000000000000000551328Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:21.480{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ee3d78b3ab3007932021-12-21 11:37:21.480root 11241100x8000000000000000551329Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:21.480{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c027864ed86d5e702021-12-21 11:37:21.480root 11241100x8000000000000000551330Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:21.480{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e4803469288f2cd22021-12-21 11:37:21.480root 11241100x8000000000000000551331Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:21.481{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2f9e984b25ecc3ff2021-12-21 11:37:21.481root 11241100x8000000000000000551332Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:21.481{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.bad7510637e77cd12021-12-21 11:37:21.481root 11241100x8000000000000000551333Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:21.481{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1b3014ab03dd3e382021-12-21 11:37:21.481root 11241100x8000000000000000551334Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:21.481{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.796f467d570c20652021-12-21 11:37:21.481root 11241100x8000000000000000551335Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:21.481{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5dccb0e703fa2b742021-12-21 11:37:21.481root 11241100x8000000000000000551336Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:21.481{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1a7e232d28803c672021-12-21 11:37:21.481root 11241100x8000000000000000551337Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:21.481{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.09ebc086de2d888a2021-12-21 11:37:21.481root 11241100x8000000000000000551338Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:21.481{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8e0bc4ce6c1fab2b2021-12-21 11:37:21.481root 11241100x8000000000000000551339Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:21.481{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.58432b5414e96a7f2021-12-21 11:37:21.481root 11241100x8000000000000000551340Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:21.481{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9cb2b914edf3276a2021-12-21 11:37:21.481root 11241100x8000000000000000551341Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:21.482{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a6ae1143209ad56a2021-12-21 11:37:21.482root 11241100x8000000000000000551342Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:21.482{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7daf2751ec7805a52021-12-21 11:37:21.482root 11241100x8000000000000000551343Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:21.482{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b0debafaedbc60d22021-12-21 11:37:21.482root 11241100x8000000000000000551344Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:21.482{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ced0e638643d10e72021-12-21 11:37:21.482root 11241100x8000000000000000551345Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:21.482{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.723143541e8570a32021-12-21 11:37:21.482root 11241100x8000000000000000551346Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:21.482{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.fad0a8498f67f3332021-12-21 11:37:21.482root 11241100x8000000000000000551347Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:21.482{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.cb8bc1e47b56d8032021-12-21 11:37:21.482root 11241100x8000000000000000551348Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:21.482{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5641574b171623da2021-12-21 11:37:21.482root 11241100x8000000000000000551349Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:21.482{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.20c6ed241d993ee22021-12-21 11:37:21.482root 11241100x8000000000000000551350Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:21.482{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.940e383c36f18b292021-12-21 11:37:21.482root 11241100x8000000000000000551351Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:21.483{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.29440f1e5e3aa7c92021-12-21 11:37:21.483root 11241100x8000000000000000551352Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:21.483{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.575f71d04477ef0d2021-12-21 11:37:21.483root 11241100x8000000000000000551353Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:21.483{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.99fae45b48f6ccab2021-12-21 11:37:21.483root 11241100x8000000000000000551354Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:21.483{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d8c2d29849bd55db2021-12-21 11:37:21.483root 11241100x8000000000000000551355Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:21.483{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0e1f59804884abdc2021-12-21 11:37:21.483root 11241100x8000000000000000551356Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:21.484{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9bcc1f1c355f85a82021-12-21 11:37:21.484root 11241100x8000000000000000551357Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:21.484{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ba630798abf9a5982021-12-21 11:37:21.484root 11241100x8000000000000000551358Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:21.484{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c70714f06ff4772c2021-12-21 11:37:21.484root 11241100x8000000000000000551359Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:21.484{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0f1dd684cc802e0c2021-12-21 11:37:21.484root 11241100x8000000000000000551360Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:21.484{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0c5fc7d04de6489a2021-12-21 11:37:21.484root 11241100x8000000000000000551361Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:21.485{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.53889930fe9d8c442021-12-21 11:37:21.485root 11241100x8000000000000000551362Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:21.485{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.20537f17d9f38b412021-12-21 11:37:21.485root 11241100x8000000000000000551363Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:21.485{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4d8ec987e4484f072021-12-21 11:37:21.485root 11241100x8000000000000000551364Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:21.485{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.58884f49fb0524bd2021-12-21 11:37:21.485root 11241100x8000000000000000551365Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:21.485{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7197d9c609984b152021-12-21 11:37:21.485root 11241100x8000000000000000551366Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:21.485{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.daa06c7d13e049562021-12-21 11:37:21.485root 11241100x8000000000000000551367Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:21.485{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b02c9f890f5a35532021-12-21 11:37:21.485root 11241100x8000000000000000551368Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:21.485{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.84c0a450f29bfd1e2021-12-21 11:37:21.485root 11241100x8000000000000000551369Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:21.486{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.780ed103a394df302021-12-21 11:37:21.486root 11241100x8000000000000000551370Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:21.486{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.461641797bd2239b2021-12-21 11:37:21.486root 11241100x8000000000000000551371Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:21.486{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.68782cf2b12d15992021-12-21 11:37:21.486root 11241100x8000000000000000551372Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:21.486{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.cdd8c2fd43f86d4d2021-12-21 11:37:21.486root 11241100x8000000000000000551373Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:21.486{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ebfcff1cac73ae262021-12-21 11:37:21.486root 11241100x8000000000000000551374Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:21.486{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.daf15720f37651472021-12-21 11:37:21.486root 11241100x8000000000000000551375Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:21.487{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f12b79f2281e63d22021-12-21 11:37:21.487root 11241100x8000000000000000551376Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:21.487{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.bb91332fde9b59a32021-12-21 11:37:21.487root 11241100x8000000000000000551377Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:21.487{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b7242aafae4324122021-12-21 11:37:21.487root 11241100x8000000000000000551378Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:21.487{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d420e4725c71843f2021-12-21 11:37:21.487root 11241100x8000000000000000551379Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:21.487{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6f467e54d9f4e8182021-12-21 11:37:21.487root 11241100x8000000000000000551380Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:21.488{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.17bb1562c46f5d262021-12-21 11:37:21.488root 11241100x8000000000000000551381Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:21.488{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.61c653c3431c4e842021-12-21 11:37:21.488root 11241100x8000000000000000551382Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:21.488{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.cbe385f15237197f2021-12-21 11:37:21.488root 11241100x8000000000000000551383Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:21.488{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.61da0c8a94ac2d022021-12-21 11:37:21.488root 11241100x8000000000000000551384Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:21.488{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.32edaa00a23ac8b02021-12-21 11:37:21.488root 11241100x8000000000000000551385Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:21.488{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.58f39a6ae58064652021-12-21 11:37:21.488root 11241100x8000000000000000551386Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:21.488{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2d475103aa213d712021-12-21 11:37:21.488root 11241100x8000000000000000551387Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:21.489{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ef60f54179e3e1f92021-12-21 11:37:21.489root 11241100x8000000000000000551388Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:21.489{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a479c267ad36aa732021-12-21 11:37:21.489root 11241100x8000000000000000551389Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:21.489{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8e884e96cdc181ad2021-12-21 11:37:21.489root 11241100x8000000000000000551390Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:21.489{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0b8abe923acbfc182021-12-21 11:37:21.489root 11241100x8000000000000000551391Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:21.489{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c775e4b0cd2bf8c72021-12-21 11:37:21.489root 11241100x8000000000000000551392Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:21.489{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b28cf18c1c1124492021-12-21 11:37:21.489root 11241100x8000000000000000551393Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:21.489{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4bd7f351bd9683912021-12-21 11:37:21.489root 11241100x8000000000000000551394Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:21.489{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e867cd6e67b902c82021-12-21 11:37:21.489root 11241100x8000000000000000551395Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:21.489{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6d82b279143022812021-12-21 11:37:21.489root 11241100x8000000000000000551396Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:21.490{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.dfe418747beef7062021-12-21 11:37:21.490root 11241100x8000000000000000551397Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:21.490{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.bfe4a3e1d2c4a0702021-12-21 11:37:21.490root 11241100x8000000000000000551398Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:21.490{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1a6d404bcbaf2f1b2021-12-21 11:37:21.490root 11241100x8000000000000000551399Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:21.490{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5da5a905129034402021-12-21 11:37:21.490root 11241100x8000000000000000551400Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:21.490{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9b2f1c7672272fd42021-12-21 11:37:21.490root 11241100x8000000000000000551401Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:21.490{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3c8ddaa587e20e642021-12-21 11:37:21.490root 11241100x8000000000000000551402Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:21.490{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8b792b97705182a92021-12-21 11:37:21.490root 11241100x8000000000000000551403Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:21.490{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1e3a55a6123d70302021-12-21 11:37:21.490root 11241100x8000000000000000551404Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:21.490{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a827845f0c6d8d422021-12-21 11:37:21.490root 11241100x8000000000000000551405Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:21.491{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f2776b968f69d1f22021-12-21 11:37:21.491root 11241100x8000000000000000551406Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:21.491{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d90d24a4b395f7192021-12-21 11:37:21.491root 11241100x8000000000000000551407Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:21.491{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3555daf3bdadcc0a2021-12-21 11:37:21.491root 11241100x8000000000000000551408Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:21.491{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2a3a1aad3b12f0502021-12-21 11:37:21.491root 11241100x8000000000000000551409Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:21.492{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.131aabfb33b29d652021-12-21 11:37:21.492root 11241100x8000000000000000551410Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:21.492{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0c924b4fc0770e802021-12-21 11:37:21.492root 11241100x8000000000000000551411Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:21.492{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.911d2ee74852607d2021-12-21 11:37:21.492root 11241100x8000000000000000551412Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:21.492{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.741104ee27dcfb072021-12-21 11:37:21.492root 11241100x8000000000000000551413Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:21.492{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c928872ee49a8c0a2021-12-21 11:37:21.492root 11241100x8000000000000000551414Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:21.492{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4ba4d6b4088c7d252021-12-21 11:37:21.492root 11241100x8000000000000000551415Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:21.492{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.cab27f482c47c18a2021-12-21 11:37:21.492root 11241100x8000000000000000551416Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:21.493{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.bcd4585abd481f962021-12-21 11:37:21.493root 11241100x8000000000000000551417Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:21.493{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4a375c51ba8c8aa12021-12-21 11:37:21.493root 11241100x8000000000000000551418Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:21.493{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.910ec3e2f5122fc22021-12-21 11:37:21.493root 11241100x8000000000000000551419Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:21.493{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.fe4b7b6d5e3907952021-12-21 11:37:21.493root 11241100x8000000000000000551420Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:21.493{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.33f9132587950e602021-12-21 11:37:21.493root 11241100x8000000000000000551421Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:21.493{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.dcd1f9671179fcf72021-12-21 11:37:21.493root 11241100x8000000000000000551422Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:21.493{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f83e5454a8ea579c2021-12-21 11:37:21.493root 11241100x8000000000000000551423Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:21.493{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9605464910b95cda2021-12-21 11:37:21.493root 11241100x8000000000000000551424Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:21.493{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c0001991329117fe2021-12-21 11:37:21.493root 11241100x8000000000000000551425Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:21.494{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a23a73efa78b75472021-12-21 11:37:21.494root 11241100x8000000000000000551426Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:21.494{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7f7f0c996385077f2021-12-21 11:37:21.494root 11241100x8000000000000000551427Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:21.494{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7bb81a299edfcbbe2021-12-21 11:37:21.494root 11241100x8000000000000000551428Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:21.494{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.41466925f889b9682021-12-21 11:37:21.494root 11241100x8000000000000000551429Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:21.494{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7306ee6ab5a847032021-12-21 11:37:21.494root 11241100x8000000000000000551430Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:21.494{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5a05e49d649057892021-12-21 11:37:21.494root 11241100x8000000000000000551431Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:21.494{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.351a63fafbf66b942021-12-21 11:37:21.494root 11241100x8000000000000000551432Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:21.494{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3315d6d54127112d2021-12-21 11:37:21.494root 11241100x8000000000000000551433Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:21.494{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.dad6104cee5e0d852021-12-21 11:37:21.494root 11241100x8000000000000000551434Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:21.494{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.378645ce9baeaec12021-12-21 11:37:21.494root 11241100x8000000000000000551435Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:21.494{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1fa15db8b5b8afa42021-12-21 11:37:21.494root 11241100x8000000000000000551436Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:21.495{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3c26eeea12c999bc2021-12-21 11:37:21.495root 11241100x8000000000000000551437Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:21.495{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.04bcdb4c8960dc272021-12-21 11:37:21.495root 11241100x8000000000000000551438Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:21.495{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2df04526805e56392021-12-21 11:37:21.495root 11241100x8000000000000000551439Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:21.495{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.db2ec7d43735441c2021-12-21 11:37:21.495root 11241100x8000000000000000551440Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:21.495{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.519e7f32769e6b882021-12-21 11:37:21.495root 11241100x8000000000000000551441Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:21.495{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1dbcdaaa8225162d2021-12-21 11:37:21.495root 11241100x8000000000000000551442Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:21.495{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d6395c8dca4e0b242021-12-21 11:37:21.495root 11241100x8000000000000000551443Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:21.495{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6e5955b7245dbf382021-12-21 11:37:21.495root 11241100x8000000000000000551444Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:21.495{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.34cc6fe413ca2eee2021-12-21 11:37:21.495root 11241100x8000000000000000551445Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:21.495{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4dc3c7617dda70252021-12-21 11:37:21.495root 11241100x8000000000000000551446Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:21.496{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ba02f3e7986f9ae82021-12-21 11:37:21.496root 11241100x8000000000000000551447Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:21.496{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.01a3d9b38a6b19d02021-12-21 11:37:21.496root 11241100x8000000000000000551448Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:21.496{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6fa1888c5d9a3f422021-12-21 11:37:21.496root 11241100x8000000000000000551449Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:21.496{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0e898f7d283e4c702021-12-21 11:37:21.496root 11241100x8000000000000000551450Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:21.496{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4062453d9416fe082021-12-21 11:37:21.496root 11241100x8000000000000000551451Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:21.496{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7e7592ee455679122021-12-21 11:37:21.496root 11241100x8000000000000000551452Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:21.496{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d3cf2da79b4a011e2021-12-21 11:37:21.496root 11241100x8000000000000000551453Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:21.496{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.865d02138eaa1f872021-12-21 11:37:21.496root 11241100x8000000000000000551454Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:21.496{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.af9e51076f8036a02021-12-21 11:37:21.496root 11241100x8000000000000000551455Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:21.496{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0f90c78f84f24d7d2021-12-21 11:37:21.496root 11241100x8000000000000000551456Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:21.496{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.83f2294f90e9005a2021-12-21 11:37:21.496root 11241100x8000000000000000551457Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:21.496{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1a205c24ed3743a52021-12-21 11:37:21.496root 11241100x8000000000000000551458Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:21.496{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ff2d7f57dc97d6322021-12-21 11:37:21.496root 11241100x8000000000000000551459Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:21.499{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6a6f632d0394c7ca2021-12-21 11:37:21.499root 11241100x8000000000000000551460Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:21.499{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.80f694daf6993a8a2021-12-21 11:37:21.499root 11241100x8000000000000000551461Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:21.499{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.18f596fdb94341022021-12-21 11:37:21.499root 11241100x8000000000000000551462Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:21.499{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a6fe161f9082e4432021-12-21 11:37:21.499root 11241100x8000000000000000551463Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:21.499{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f525b15a4f330d782021-12-21 11:37:21.499root 11241100x8000000000000000551464Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:21.499{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4ebbd26811e598272021-12-21 11:37:21.499root 11241100x8000000000000000551465Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:21.499{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.eb862954195ea4342021-12-21 11:37:21.499root 11241100x8000000000000000551466Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:21.499{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d8ef7f324b6f7d172021-12-21 11:37:21.499root 11241100x8000000000000000551467Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:21.499{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.de196ef7a538e0e92021-12-21 11:37:21.499root 11241100x8000000000000000551468Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:21.500{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.00eb1bf4a18d7b782021-12-21 11:37:21.500root 11241100x8000000000000000551469Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:21.500{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9d66a5d20d02282f2021-12-21 11:37:21.500root 11241100x8000000000000000551470Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:21.500{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1b1a6eae83557ab52021-12-21 11:37:21.500root 11241100x8000000000000000551471Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:21.500{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1da5db120c62c6a52021-12-21 11:37:21.500root 11241100x8000000000000000551472Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:21.500{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.371f16ecfff9ec082021-12-21 11:37:21.500root 11241100x8000000000000000551473Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:21.500{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.05005bfe034179232021-12-21 11:37:21.500root 11241100x8000000000000000551474Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:21.500{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a6ec9ef5d02fb0d52021-12-21 11:37:21.500root 11241100x8000000000000000551475Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:21.500{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.bfcd515f510b8de02021-12-21 11:37:21.500root 11241100x8000000000000000551476Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:21.500{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2c793283fb23280c2021-12-21 11:37:21.500root 11241100x8000000000000000551477Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:21.500{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8aac0311aa6975082021-12-21 11:37:21.500root 11241100x8000000000000000551478Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:21.501{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.331b2da7bd11525e2021-12-21 11:37:21.501root 11241100x8000000000000000551479Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:21.501{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.154fccfeab7ad1612021-12-21 11:37:21.501root 11241100x8000000000000000551480Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:21.501{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6eada6f6ad74aa8f2021-12-21 11:37:21.501root 11241100x8000000000000000551481Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:21.501{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a01b1eca240bb0cc2021-12-21 11:37:21.501root 11241100x8000000000000000551482Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:21.501{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b9e514307c55b57a2021-12-21 11:37:21.501root 11241100x8000000000000000551483Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:21.501{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c8f47866217ef3772021-12-21 11:37:21.501root 11241100x8000000000000000551484Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:21.501{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c394a5ad200778472021-12-21 11:37:21.501root 11241100x8000000000000000551485Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:21.501{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.498a1cd61b7643812021-12-21 11:37:21.501root 11241100x8000000000000000551486Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:21.501{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0726c663dfcb65322021-12-21 11:37:21.501root 11241100x8000000000000000551487Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:21.501{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3b7e25dd5d461f192021-12-21 11:37:21.501root 11241100x8000000000000000551488Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:21.501{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.750d51c186f405502021-12-21 11:37:21.501root 11241100x8000000000000000551489Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:21.501{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f765fa8e784ce8682021-12-21 11:37:21.501root 11241100x8000000000000000551490Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:21.502{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.01290d20978a1a4e2021-12-21 11:37:21.502root 11241100x8000000000000000551491Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:21.502{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.89ba486a6cbec8122021-12-21 11:37:21.502root 11241100x8000000000000000551492Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:21.502{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.57ed0a01233378702021-12-21 11:37:21.502root 11241100x8000000000000000551493Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:21.502{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8b00a9b3f3db2d492021-12-21 11:37:21.502root 11241100x8000000000000000551494Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:21.502{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5fac82b300ef21bb2021-12-21 11:37:21.502root 11241100x8000000000000000551495Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:21.502{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.bdfe1d77b703e20d2021-12-21 11:37:21.502root 11241100x8000000000000000551496Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:21.502{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2deb70625ac627452021-12-21 11:37:21.502root 11241100x8000000000000000551497Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:21.503{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b6b9fca8fd84b1482021-12-21 11:37:21.503root 11241100x8000000000000000551498Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:21.503{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f4c0636c894944762021-12-21 11:37:21.503root 11241100x8000000000000000551499Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:21.504{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.87803673c67750472021-12-21 11:37:21.504root 11241100x8000000000000000551500Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:21.504{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6fc98e8d7792740c2021-12-21 11:37:21.504root 11241100x8000000000000000551501Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:21.504{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c7d17765d7fcd6092021-12-21 11:37:21.504root 11241100x8000000000000000551502Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:21.504{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.54e1826272fa8cce2021-12-21 11:37:21.504root 11241100x8000000000000000551503Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:21.504{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7184c334199408672021-12-21 11:37:21.504root 11241100x8000000000000000551504Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:21.504{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ee623b88bcf40a572021-12-21 11:37:21.504root 11241100x8000000000000000551505Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:21.505{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4ad4a9ecacfdfeaf2021-12-21 11:37:21.505root 11241100x8000000000000000551506Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:21.505{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0496a113bc93c5c22021-12-21 11:37:21.505root 11241100x8000000000000000551507Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:21.505{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c4c904642936ac702021-12-21 11:37:21.505root 11241100x8000000000000000551508Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:21.505{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3716c4e5a43e87732021-12-21 11:37:21.505root 11241100x8000000000000000551509Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:21.505{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3e4bc852ec76067a2021-12-21 11:37:21.505root 11241100x8000000000000000551510Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:21.505{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d498ee0ad044111d2021-12-21 11:37:21.505root 11241100x8000000000000000551511Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:21.505{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3e590dcc4fe4cfff2021-12-21 11:37:21.505root 11241100x8000000000000000551512Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:21.506{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.280a144b391f14c02021-12-21 11:37:21.506root 11241100x8000000000000000551513Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:21.506{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4fca8877803a73ec2021-12-21 11:37:21.506root 11241100x8000000000000000551514Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:21.506{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8a3f33916986c33e2021-12-21 11:37:21.506root 354300x8000000000000000551599Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:46.236{ec2b6afe-95d9-61c1-5175-3a0400000000}5346/opt/splunkforwarder/etc/apps/Splunk_TA_stream/linux_x86_64/bin/streamfwdroottcptruefalse10.0.1.25-48820-false10.0.1.12-8000- 11241100x8000000000000000551600Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:46.692{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.98badae1e4830b182021-12-21 11:37:46.692root 11241100x8000000000000000551601Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:47.192{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f374d87fa34a285e2021-12-21 11:37:47.192root 11241100x8000000000000000551602Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:47.692{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.14033be25c348a162021-12-21 11:37:47.692root 11241100x8000000000000000551603Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:48.192{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a9bef57650ac73fe2021-12-21 11:37:48.192root 11241100x8000000000000000551604Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:48.692{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.81f44bad7b3a32262021-12-21 11:37:48.692root 11241100x8000000000000000551605Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:49.192{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.093bf53b6aed2bcb2021-12-21 11:37:49.192root 11241100x8000000000000000551606Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:49.692{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4a5fe979706647fe2021-12-21 11:37:49.692root 11241100x8000000000000000551607Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:50.192{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4e5a4d756ccdcde32021-12-21 11:37:50.192root 11241100x8000000000000000551608Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:50.692{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d4fbd80b184effb62021-12-21 11:37:50.692root 11241100x8000000000000000551609Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:51.192{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7908a9ef0aa2d5b92021-12-21 11:37:51.192root 11241100x8000000000000000551610Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:51.692{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b2790429c1968ad82021-12-21 11:37:51.692root 354300x8000000000000000551611Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:52.058{ec2b6afe-95d9-61c1-5175-3a0400000000}5346/opt/splunkforwarder/etc/apps/Splunk_TA_stream/linux_x86_64/bin/streamfwdroottcptruefalse10.0.1.25-48822-false10.0.1.12-8000- 11241100x8000000000000000551612Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:52.059{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.bb88bc4e7580072b2021-12-21 11:37:52.059root 11241100x8000000000000000551613Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:52.059{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c4d8b18c7409a1df2021-12-21 11:37:52.059root 11241100x8000000000000000551614Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:52.442{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5bac5e2c36243b3b2021-12-21 11:37:52.442root 11241100x8000000000000000551615Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:52.442{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e5d03116ea45e3352021-12-21 11:37:52.442root 11241100x8000000000000000551616Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:52.942{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8d51dd87b3eb08b82021-12-21 11:37:52.942root 11241100x8000000000000000551617Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:52.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c174e972366557042021-12-21 11:37:52.943root 11241100x8000000000000000551618Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:53.442{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a6170b167cb1b8dc2021-12-21 11:37:53.442root 11241100x8000000000000000551619Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:53.442{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.be031b944bfa279d2021-12-21 11:37:53.442root 11241100x8000000000000000551620Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:53.942{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0947a0479e0decab2021-12-21 11:37:53.942root 11241100x8000000000000000551621Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:53.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.fdc6b68ba4ec724c2021-12-21 11:37:53.943root 534500x8000000000000000551622Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:54.113{ec2b6afe-bc92-61c1-0000-000000000000}9932-ubuntu 534500x8000000000000000551623Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:54.115{00000000-0000-0000-0000-000000000000}9933<unknown process>ubuntu 11241100x8000000000000000551624Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:54.115{ec2b6afe-aacb-61c1-0834-fdd63c560000}5677/bin/bash/tmp/sh-thd.bprImf2021-12-21 11:37:54.115ubuntu 23542300x8000000000000000551625Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:54.115{ec2b6afe-aacb-61c1-0834-fdd63c560000}5677ubuntu/bin/bash/tmp/sh-thd.bprImf--- 11241100x8000000000000000551626Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:54.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7d844aa48bed8b752021-12-21 11:37:54.443root 11241100x8000000000000000551627Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:54.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f7b0d4293b984f752021-12-21 11:37:54.443root 11241100x8000000000000000551628Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:54.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.bf4fdef5257821d52021-12-21 11:37:54.443root 11241100x8000000000000000551629Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:54.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.72ef14ee8ee0b2cd2021-12-21 11:37:54.443root 11241100x8000000000000000551630Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:54.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.19c2092f1d389af82021-12-21 11:37:54.443root 11241100x8000000000000000551631Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:54.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0cf31a01020250c12021-12-21 11:37:54.444root 11241100x8000000000000000551632Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:54.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8b66e1e87c1ed56d2021-12-21 11:37:54.943root 11241100x8000000000000000551633Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:54.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f5c6a5a1cf8297242021-12-21 11:37:54.943root 11241100x8000000000000000551634Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:54.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2f42bbdd99e113f42021-12-21 11:37:54.943root 11241100x8000000000000000551635Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:54.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.435cb22818d6b9a02021-12-21 11:37:54.943root 11241100x8000000000000000551636Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:54.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9a6bdb48468c793b2021-12-21 11:37:54.943root 11241100x8000000000000000551637Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:54.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.eb45069b040f39b82021-12-21 11:37:54.944root 11241100x8000000000000000551638Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:55.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3f0164cc5788a3ba2021-12-21 11:37:55.443root 11241100x8000000000000000551639Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:55.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.fb6454e563ec27862021-12-21 11:37:55.443root 11241100x8000000000000000551640Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:55.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7466a4cd6a951e832021-12-21 11:37:55.443root 11241100x8000000000000000551641Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:55.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.87150a28425db4362021-12-21 11:37:55.443root 11241100x8000000000000000551642Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:55.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.be381013efc024f82021-12-21 11:37:55.443root 11241100x8000000000000000551643Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:55.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3df2219d3738508b2021-12-21 11:37:55.443root 534500x8000000000000000551644Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:55.448{ec2b6afe-bc92-61c1-0000-000000000000}9934-ubuntu 534500x8000000000000000551645Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:55.449{00000000-0000-0000-0000-000000000000}9935<unknown process>ubuntu 11241100x8000000000000000551646Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:55.449{ec2b6afe-aacb-61c1-0834-fdd63c560000}5677/bin/bash/tmp/sh-thd.uQc7Ie2021-12-21 11:37:55.449ubuntu 23542300x8000000000000000551647Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:55.449{ec2b6afe-aacb-61c1-0834-fdd63c560000}5677ubuntu/bin/bash/tmp/sh-thd.uQc7Ie--- 154100x8000000000000000551648Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:55.829{ec2b6afe-bc93-61c1-e0c1-4a1019560000}9936/bin/chmod-----chmod u+s mod_sudoer.sh/home/ubuntuubuntu{ec2b6afe-aacb-61c1-e803-000000000000}10006no level-{ec2b6afe-aacb-61c1-0834-fdd63c560000}5677/bin/bash-bashubuntu 534500x8000000000000000551649Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:55.831{ec2b6afe-bc93-61c1-e0c1-4a1019560000}9936/bin/chmodubuntu 11241100x8000000000000000551650Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:55.831{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d3b6068f404aa86e2021-12-21 11:37:55.831root 11241100x8000000000000000551651Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:55.831{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.debb24b8b545cc022021-12-21 11:37:55.831root 11241100x8000000000000000551652Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:55.831{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3f4f943bbf00ab062021-12-21 11:37:55.831root 11241100x8000000000000000551653Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:55.831{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d71cca3e29a3a9262021-12-21 11:37:55.831root 11241100x8000000000000000551654Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:55.831{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9a118dabf6a1e2c22021-12-21 11:37:55.831root 11241100x8000000000000000551655Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:55.831{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.48bb14587a25514a2021-12-21 11:37:55.831root 11241100x8000000000000000551656Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:55.831{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8f4be1e540acb70c2021-12-21 11:37:55.831root 11241100x8000000000000000551657Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:55.831{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.15f5eb895b9d8ffc2021-12-21 11:37:55.831root 11241100x8000000000000000551658Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:55.831{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e122af258a77013a2021-12-21 11:37:55.831root 11241100x8000000000000000551659Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:55.831{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f88af1897ef11db02021-12-21 11:37:55.831root 11241100x8000000000000000551660Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:55.831{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.79abad29ab4c10ca2021-12-21 11:37:55.831root 11241100x8000000000000000551661Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:55.831{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8ea948705adcc0772021-12-21 11:37:55.831root 11241100x8000000000000000551662Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:55.831{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.01de9e513cc3d64c2021-12-21 11:37:55.831root 11241100x8000000000000000551663Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:56.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.cba326a0b0a10c7f2021-12-21 11:37:56.193root 11241100x8000000000000000551664Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:56.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6c01c70b472873cd2021-12-21 11:37:56.193root 11241100x8000000000000000551665Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:56.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7f284d078e426b972021-12-21 11:37:56.193root 11241100x8000000000000000551666Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:56.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.51c5912bc536c0bd2021-12-21 11:37:56.193root 11241100x8000000000000000551667Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:56.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.019ddc2833b0d4ba2021-12-21 11:37:56.193root 11241100x8000000000000000551668Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:56.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.84c528ac6430d44c2021-12-21 11:37:56.194root 11241100x8000000000000000551669Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:56.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.fa21cd97600abab62021-12-21 11:37:56.194root 11241100x8000000000000000551670Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:56.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4c54b2f3eb047ae42021-12-21 11:37:56.194root 11241100x8000000000000000551671Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:56.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2507b2766ea099422021-12-21 11:37:56.194root 11241100x8000000000000000551672Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:56.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6b54525bf2cc18982021-12-21 11:37:56.194root 11241100x8000000000000000551673Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:56.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.62150b0bb5ecfda32021-12-21 11:37:56.194root 11241100x8000000000000000551674Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:56.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ffd096be38ca8cf72021-12-21 11:37:56.194root 11241100x8000000000000000551675Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:56.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.fb24852e5b25418e2021-12-21 11:37:56.693root 11241100x8000000000000000551676Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:56.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6564ca11015ab23c2021-12-21 11:37:56.693root 11241100x8000000000000000551677Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:56.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.72dd9e487286ce9c2021-12-21 11:37:56.693root 11241100x8000000000000000551678Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:56.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d38681c5a1860ad12021-12-21 11:37:56.694root 11241100x8000000000000000551679Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:56.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9b7580351f8988f72021-12-21 11:37:56.694root 11241100x8000000000000000551680Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:56.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.34938242ef5e85f42021-12-21 11:37:56.694root 11241100x8000000000000000551681Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:56.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.699ec7c696f71cba2021-12-21 11:37:56.694root 11241100x8000000000000000551682Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:56.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.cf090384c8b525072021-12-21 11:37:56.694root 11241100x8000000000000000551683Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:56.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8d5f1aadf1b42da82021-12-21 11:37:56.694root 11241100x8000000000000000551684Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:56.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.fd6eb4d3a9b211a92021-12-21 11:37:56.694root 11241100x8000000000000000551685Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:56.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5efdf2255ce7d23f2021-12-21 11:37:56.694root 11241100x8000000000000000551686Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:56.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6faf20bd4c7bef9c2021-12-21 11:37:56.694root 154100x8000000000000000551687Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:56.967{ec2b6afe-bc94-61c1-e836-bc38a3550000}9937/bin/ls-----ls --color=auto -l/home/ubuntuubuntu{ec2b6afe-aacb-61c1-e803-000000000000}10006no level-{ec2b6afe-aacb-61c1-0834-fdd63c560000}5677/bin/bash-bashubuntu 11241100x8000000000000000551688Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:56.969{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c5ef7ef3bd1295fb2021-12-21 11:37:56.969root 11241100x8000000000000000551689Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:56.969{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.28cc349689148bcd2021-12-21 11:37:56.969root 11241100x8000000000000000551690Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:56.969{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3fe80fad740b922e2021-12-21 11:37:56.969root 11241100x8000000000000000551691Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:56.969{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7c15284c059b92572021-12-21 11:37:56.969root 11241100x8000000000000000551692Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:56.969{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9b453a2a7705da902021-12-21 11:37:56.969root 11241100x8000000000000000551693Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:56.969{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9590d1d3787ec18a2021-12-21 11:37:56.969root 11241100x8000000000000000551694Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:56.970{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.fe0de834f8e2a5b42021-12-21 11:37:56.970root 11241100x8000000000000000551695Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:56.970{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5380146fd24a24fd2021-12-21 11:37:56.970root 534500x8000000000000000551696Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:56.970{ec2b6afe-bc94-61c1-e836-bc38a3550000}9937/bin/lsubuntu 11241100x8000000000000000551697Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:56.970{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f2d5c219dc93c3dc2021-12-21 11:37:56.970root 11241100x8000000000000000551698Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:56.971{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.04c5e266874bb7672021-12-21 11:37:56.971root 11241100x8000000000000000551699Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:56.971{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.518c967f6dafa7162021-12-21 11:37:56.971root 11241100x8000000000000000551700Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:56.971{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6ebf4cf5658e46c52021-12-21 11:37:56.971root 11241100x8000000000000000551701Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:56.971{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.aac1d1bf344162932021-12-21 11:37:56.971root 11241100x8000000000000000551702Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:56.971{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.033a69a6749d62332021-12-21 11:37:56.971root 354300x8000000000000000551703Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:57.172{ec2b6afe-95d9-61c1-5175-3a0400000000}5346/opt/splunkforwarder/etc/apps/Splunk_TA_stream/linux_x86_64/bin/streamfwdroottcptruefalse10.0.1.25-48824-false10.0.1.12-8000- 11241100x8000000000000000551704Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:57.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4d56bfd2e836ff252021-12-21 11:37:57.443root 11241100x8000000000000000551705Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:57.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9dacb27bd49a23582021-12-21 11:37:57.443root 11241100x8000000000000000551706Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:57.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.de359e40fa86b5e82021-12-21 11:37:57.443root 11241100x8000000000000000551707Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:57.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.fca4403a699639692021-12-21 11:37:57.443root 11241100x8000000000000000551708Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:57.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5561e45020fbff832021-12-21 11:37:57.443root 11241100x8000000000000000551709Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:57.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8dc7797d6f4fbe6c2021-12-21 11:37:57.444root 11241100x8000000000000000551710Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:57.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d43483f287a7f2402021-12-21 11:37:57.444root 11241100x8000000000000000551711Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:57.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2863de722e0544b02021-12-21 11:37:57.444root 11241100x8000000000000000551712Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:57.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2c9bf9c64d966faa2021-12-21 11:37:57.444root 11241100x8000000000000000551713Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:57.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5e6aaf0dbc699eef2021-12-21 11:37:57.444root 11241100x8000000000000000551714Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:57.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6aae08152106a35e2021-12-21 11:37:57.444root 11241100x8000000000000000551715Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:57.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5aa8204f24fc88932021-12-21 11:37:57.444root 11241100x8000000000000000551716Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:57.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.85bd1a64ca731e6d2021-12-21 11:37:57.444root 11241100x8000000000000000551717Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:57.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1eb6eaa5cf3fe4bf2021-12-21 11:37:57.444root 11241100x8000000000000000551718Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:57.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f43f7712956a69b42021-12-21 11:37:57.445root 11241100x8000000000000000551719Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:57.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.35cc096f3553bcff2021-12-21 11:37:57.943root 11241100x8000000000000000551720Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:57.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.852b5c13078afa9a2021-12-21 11:37:57.943root 11241100x8000000000000000551721Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:57.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.15ccbcd7de254df22021-12-21 11:37:57.943root 11241100x8000000000000000551722Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:57.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b790d9873a0a8a2f2021-12-21 11:37:57.943root 11241100x8000000000000000551723Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:57.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.41ffaf6c4435504a2021-12-21 11:37:57.944root 11241100x8000000000000000551724Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:57.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b7e088870088ec7c2021-12-21 11:37:57.944root 11241100x8000000000000000551725Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:57.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c1dd3547f9484dc72021-12-21 11:37:57.944root 11241100x8000000000000000551726Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:57.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.db6c0900566afa012021-12-21 11:37:57.944root 11241100x8000000000000000551727Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:57.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.911b77357638e8622021-12-21 11:37:57.944root 11241100x8000000000000000551728Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:57.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.47628a3ba403959a2021-12-21 11:37:57.944root 11241100x8000000000000000551729Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:57.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.789441ac5ef1ea772021-12-21 11:37:57.944root 11241100x8000000000000000551730Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:57.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.27e4508aa80fdb1b2021-12-21 11:37:57.944root 11241100x8000000000000000551731Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:57.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f127a8943e2333612021-12-21 11:37:57.944root 11241100x8000000000000000551732Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:57.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.347e552c78840dd12021-12-21 11:37:57.945root 11241100x8000000000000000551733Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:57.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d8a0a1ecfe903afe2021-12-21 11:37:57.945root 11241100x8000000000000000551734Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:58.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3f7574f9ac0576d42021-12-21 11:37:58.443root 11241100x8000000000000000551735Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:58.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6b36a2fd5062b1422021-12-21 11:37:58.443root 11241100x8000000000000000551736Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:58.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6c66e88e07e705b92021-12-21 11:37:58.444root 11241100x8000000000000000551737Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:58.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.62eaac8d6b8410a32021-12-21 11:37:58.445root 11241100x8000000000000000551738Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:58.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.84e1c96de83ffd402021-12-21 11:37:58.445root 11241100x8000000000000000551739Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:58.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.70bbfe22f04119f62021-12-21 11:37:58.445root 11241100x8000000000000000551740Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:58.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7a182560406ef2672021-12-21 11:37:58.445root 11241100x8000000000000000551741Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:58.446{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.fe9b17500088fcfe2021-12-21 11:37:58.446root 11241100x8000000000000000551742Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:58.446{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.dd55882648f6aa322021-12-21 11:37:58.446root 11241100x8000000000000000551743Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:58.446{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.15a89901ef24b4dd2021-12-21 11:37:58.446root 11241100x8000000000000000551744Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:58.447{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c2fd95f3f77868e02021-12-21 11:37:58.447root 11241100x8000000000000000551745Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:58.447{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ffc4323eb98bff5d2021-12-21 11:37:58.447root 11241100x8000000000000000551746Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:58.447{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b5f9992442c0a4ad2021-12-21 11:37:58.447root 11241100x8000000000000000551747Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:58.447{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0fe5c34642ec9f7f2021-12-21 11:37:58.447root 11241100x8000000000000000551748Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:58.448{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f40945d7911b524e2021-12-21 11:37:58.448root 11241100x8000000000000000551749Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:58.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.362c818996627a2b2021-12-21 11:37:58.943root 11241100x8000000000000000551750Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:58.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.48d4fbaef5cceb122021-12-21 11:37:58.944root 11241100x8000000000000000551751Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:58.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.015731919de30acc2021-12-21 11:37:58.944root 11241100x8000000000000000551752Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:58.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ac18312c100f432e2021-12-21 11:37:58.944root 11241100x8000000000000000551753Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:58.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.cac8b50fb1de31fb2021-12-21 11:37:58.944root 11241100x8000000000000000551754Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:58.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.cfd146d69eed71b62021-12-21 11:37:58.944root 11241100x8000000000000000551755Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:58.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8cd653e87a9c56722021-12-21 11:37:58.944root 11241100x8000000000000000551756Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:58.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.eb811d160a75e3b12021-12-21 11:37:58.944root 11241100x8000000000000000551757Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:58.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7cd94aa92e0842ba2021-12-21 11:37:58.945root 11241100x8000000000000000551758Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:58.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.79e671946d783dfd2021-12-21 11:37:58.945root 11241100x8000000000000000551759Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:58.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b06c746ce50c053c2021-12-21 11:37:58.945root 11241100x8000000000000000551760Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:58.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.03738dc215c672f82021-12-21 11:37:58.945root 11241100x8000000000000000551761Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:58.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d460fd6ec78f56812021-12-21 11:37:58.945root 11241100x8000000000000000551762Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:58.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d33ac22da0079d542021-12-21 11:37:58.945root 11241100x8000000000000000551763Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:58.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.60bb5a05bd6ee13b2021-12-21 11:37:58.945root 11241100x8000000000000000551764Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:59.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c07424447b319fc82021-12-21 11:37:59.443root 11241100x8000000000000000551765Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:59.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ea8422af20ef2a962021-12-21 11:37:59.443root 11241100x8000000000000000551766Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:59.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.63d2b8036aa7e71e2021-12-21 11:37:59.443root 11241100x8000000000000000551767Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:59.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c6ab7f5ff59fbcec2021-12-21 11:37:59.443root 11241100x8000000000000000551768Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:59.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.418d37f5316c373d2021-12-21 11:37:59.443root 11241100x8000000000000000551769Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:59.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3e7be67de649246a2021-12-21 11:37:59.443root 11241100x8000000000000000551770Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:59.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0d8f097337e4bff12021-12-21 11:37:59.443root 11241100x8000000000000000551771Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:59.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.237c4c242483ba0e2021-12-21 11:37:59.444root 11241100x8000000000000000551772Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:59.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.900b877fe7974d2f2021-12-21 11:37:59.444root 11241100x8000000000000000551773Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:59.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d2cf146bddfac5ce2021-12-21 11:37:59.444root 11241100x8000000000000000551774Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:59.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6066bf503cc737d72021-12-21 11:37:59.444root 11241100x8000000000000000551775Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:59.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.83dc4147904d01c72021-12-21 11:37:59.444root 11241100x8000000000000000551776Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:59.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e149f60ef641b48f2021-12-21 11:37:59.444root 11241100x8000000000000000551777Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:59.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.dd1f2ab87683f6732021-12-21 11:37:59.444root 11241100x8000000000000000551778Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:59.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a27ade6c371237c52021-12-21 11:37:59.444root 11241100x8000000000000000551779Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:59.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5086005aa7322fd42021-12-21 11:37:59.943root 11241100x8000000000000000551780Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:59.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d00fcc52a06a6f0d2021-12-21 11:37:59.943root 11241100x8000000000000000551781Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:59.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6e108e5b6e3d5d982021-12-21 11:37:59.943root 11241100x8000000000000000551782Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:59.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b3d27f76298a8c522021-12-21 11:37:59.943root 11241100x8000000000000000551783Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:59.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e905a9ae51c4343e2021-12-21 11:37:59.943root 11241100x8000000000000000551784Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:59.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.339c26928db9a8402021-12-21 11:37:59.943root 11241100x8000000000000000551785Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:59.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2b1377560c68d6222021-12-21 11:37:59.943root 11241100x8000000000000000551786Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:59.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d33d32b0f85bd2302021-12-21 11:37:59.944root 11241100x8000000000000000551787Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:59.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a5cf28a23c4689cd2021-12-21 11:37:59.944root 11241100x8000000000000000551788Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:59.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.490280d86d8689872021-12-21 11:37:59.944root 11241100x8000000000000000551789Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:59.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.57208c970a00ac102021-12-21 11:37:59.944root 11241100x8000000000000000551790Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:59.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.129c40e783f24e3f2021-12-21 11:37:59.944root 11241100x8000000000000000551791Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:59.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1782fc9f860440432021-12-21 11:37:59.944root 11241100x8000000000000000551792Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:59.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d8b29f468a62eac72021-12-21 11:37:59.944root 11241100x8000000000000000551793Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:37:59.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0603b6001ed9f7092021-12-21 11:37:59.944root 11241100x8000000000000000551794Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:00.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0725a9a6a35764272021-12-21 11:38:00.443root 11241100x8000000000000000551795Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:00.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f2e505e2fd07803f2021-12-21 11:38:00.443root 11241100x8000000000000000551796Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:00.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.aabe7dcdfb7b09e22021-12-21 11:38:00.443root 11241100x8000000000000000551797Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:00.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4045b80f3d3c94c22021-12-21 11:38:00.443root 11241100x8000000000000000551798Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:00.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7e9eed4986415bbf2021-12-21 11:38:00.443root 11241100x8000000000000000551799Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:00.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f83f1d7f3ba260762021-12-21 11:38:00.443root 11241100x8000000000000000551800Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:00.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d0347570aec5059b2021-12-21 11:38:00.443root 11241100x8000000000000000551801Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:00.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5839a6f4828407d52021-12-21 11:38:00.444root 11241100x8000000000000000551802Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:00.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.adad17fdecf8ccb22021-12-21 11:38:00.444root 11241100x8000000000000000551803Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:00.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9916d3990775eb132021-12-21 11:38:00.444root 11241100x8000000000000000551804Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:00.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.59dbfe84a7d3ecec2021-12-21 11:38:00.444root 11241100x8000000000000000551805Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:00.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e57c913e6b93b2122021-12-21 11:38:00.444root 11241100x8000000000000000551806Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:00.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9950b703fed91e932021-12-21 11:38:00.444root 11241100x8000000000000000551807Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:00.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2ddfa2337d4f78d82021-12-21 11:38:00.444root 11241100x8000000000000000551808Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:00.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1104d695d7b847352021-12-21 11:38:00.444root 11241100x8000000000000000551809Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:00.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9d273a36e2dbd22e2021-12-21 11:38:00.943root 11241100x8000000000000000551810Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:00.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.29c47381945767272021-12-21 11:38:00.943root 11241100x8000000000000000551811Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:00.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.85c1b186492303852021-12-21 11:38:00.943root 11241100x8000000000000000551812Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:00.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5be6628a3de6f6ee2021-12-21 11:38:00.943root 11241100x8000000000000000551813Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:00.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.211466c58826e1962021-12-21 11:38:00.943root 11241100x8000000000000000551814Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:00.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4372323767bb94332021-12-21 11:38:00.943root 11241100x8000000000000000551815Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:00.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d556bbc1ef0cb2a32021-12-21 11:38:00.943root 11241100x8000000000000000551816Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:00.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b47adc904d854f1d2021-12-21 11:38:00.943root 11241100x8000000000000000551817Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:00.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.aca362b52a79d9052021-12-21 11:38:00.944root 11241100x8000000000000000551818Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:00.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.34a9c6f36be33e922021-12-21 11:38:00.944root 11241100x8000000000000000551819Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:00.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.66ef60cc8d1a793d2021-12-21 11:38:00.944root 11241100x8000000000000000551820Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:00.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.48cfe4f48c86c9af2021-12-21 11:38:00.944root 11241100x8000000000000000551821Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:00.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c8e5f2c99bd79f822021-12-21 11:38:00.944root 11241100x8000000000000000551822Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:00.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.03bb7ba9e065fc462021-12-21 11:38:00.944root 11241100x8000000000000000551823Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:00.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.97bf7d23ecebe81b2021-12-21 11:38:00.944root 11241100x8000000000000000551824Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:01.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6b525e13043a5a052021-12-21 11:38:01.443root 11241100x8000000000000000551825Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:01.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5c241035c7c3555d2021-12-21 11:38:01.443root 11241100x8000000000000000551826Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:01.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8ee5d624dd5032392021-12-21 11:38:01.443root 11241100x8000000000000000551827Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:01.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.15abbd1dd4e5eddc2021-12-21 11:38:01.443root 11241100x8000000000000000551828Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:01.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d5475e4a31c802052021-12-21 11:38:01.443root 11241100x8000000000000000551829Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:01.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3bb1ade5eff1d77f2021-12-21 11:38:01.443root 11241100x8000000000000000551830Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:01.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.653395e24f0a1d1e2021-12-21 11:38:01.443root 11241100x8000000000000000551831Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:01.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c597b0b6e071ea312021-12-21 11:38:01.444root 11241100x8000000000000000551832Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:01.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.62ae3c0c20635ebf2021-12-21 11:38:01.444root 11241100x8000000000000000551833Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:01.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a1dfec78ea71c2732021-12-21 11:38:01.444root 11241100x8000000000000000551834Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:01.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.18dacdc861ee37632021-12-21 11:38:01.444root 11241100x8000000000000000551835Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:01.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b01c16519a720d2a2021-12-21 11:38:01.444root 11241100x8000000000000000551836Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:01.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4447154747d4eb802021-12-21 11:38:01.444root 11241100x8000000000000000551837Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:01.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.fd277c66f81602492021-12-21 11:38:01.444root 11241100x8000000000000000551838Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:01.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.598d3c5b0d4a8c772021-12-21 11:38:01.444root 11241100x8000000000000000551839Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:01.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.80b9e14173cb6b4e2021-12-21 11:38:01.943root 11241100x8000000000000000551840Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:01.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a2e08a4f9e969e7f2021-12-21 11:38:01.943root 11241100x8000000000000000551841Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:01.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ed92fc5120ddea712021-12-21 11:38:01.943root 11241100x8000000000000000551842Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:01.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.829cde71049a0f322021-12-21 11:38:01.943root 11241100x8000000000000000551843Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:01.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7f069e74f51077c02021-12-21 11:38:01.943root 11241100x8000000000000000551844Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:01.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.29b4b55ce85f83302021-12-21 11:38:01.943root 11241100x8000000000000000551845Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:01.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c28174654ad2fd342021-12-21 11:38:01.943root 11241100x8000000000000000551846Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:01.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0a103019e12eaaff2021-12-21 11:38:01.944root 11241100x8000000000000000551847Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:01.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4cba8af494f330532021-12-21 11:38:01.944root 11241100x8000000000000000551848Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:01.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9775fe717de82a662021-12-21 11:38:01.944root 11241100x8000000000000000551849Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:01.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.648b79e716bb86d32021-12-21 11:38:01.944root 11241100x8000000000000000551850Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:01.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.61f68543cda4399c2021-12-21 11:38:01.944root 11241100x8000000000000000551851Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:01.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0dc003c83e826d902021-12-21 11:38:01.944root 11241100x8000000000000000551852Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:01.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1e9e4ab3b2c71d342021-12-21 11:38:01.944root 11241100x8000000000000000551853Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:01.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.07b47494ac54744b2021-12-21 11:38:01.944root 11241100x8000000000000000551854Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:02.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.28694c9b272bf6102021-12-21 11:38:02.443root 11241100x8000000000000000551855Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:02.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a19db25e14484c152021-12-21 11:38:02.443root 11241100x8000000000000000551856Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:02.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7ab891e0c7bedf7f2021-12-21 11:38:02.443root 11241100x8000000000000000551857Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:02.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.871c07e4283ee6c52021-12-21 11:38:02.443root 11241100x8000000000000000551858Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:02.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.629de04959c75b992021-12-21 11:38:02.443root 11241100x8000000000000000551859Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:02.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.04f2e98b08383b802021-12-21 11:38:02.444root 11241100x8000000000000000551860Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:02.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.14889891454e4eda2021-12-21 11:38:02.444root 11241100x8000000000000000551861Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:02.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.015927dd867616392021-12-21 11:38:02.444root 11241100x8000000000000000551862Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:02.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.67b362eb883a414e2021-12-21 11:38:02.444root 11241100x8000000000000000551863Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:02.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c4508da8e5047cf82021-12-21 11:38:02.444root 11241100x8000000000000000551864Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:02.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0b591ca886ad91112021-12-21 11:38:02.444root 11241100x8000000000000000551865Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:02.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f9722962837104572021-12-21 11:38:02.444root 11241100x8000000000000000551866Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:02.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1b60b8a18456701b2021-12-21 11:38:02.444root 11241100x8000000000000000551867Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:02.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.73e48c88dc3a233c2021-12-21 11:38:02.444root 11241100x8000000000000000551868Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:02.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.594a8697e31a581d2021-12-21 11:38:02.444root 11241100x8000000000000000551869Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:02.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3d348aa5fdeaa5122021-12-21 11:38:02.943root 11241100x8000000000000000551870Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:02.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d7649218442a0c832021-12-21 11:38:02.943root 11241100x8000000000000000551871Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:02.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.27d8ac57a5a561d82021-12-21 11:38:02.943root 11241100x8000000000000000551872Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:02.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.99d7500db4a8a9f32021-12-21 11:38:02.943root 11241100x8000000000000000551873Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:02.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.65f4df10df7fe53f2021-12-21 11:38:02.943root 11241100x8000000000000000551874Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:02.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a81b975723449d372021-12-21 11:38:02.944root 11241100x8000000000000000551875Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:02.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c379137ede670ea82021-12-21 11:38:02.944root 11241100x8000000000000000551876Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:02.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9abd38354dfddee32021-12-21 11:38:02.944root 11241100x8000000000000000551877Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:02.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8bdf13c3ab7e64152021-12-21 11:38:02.944root 11241100x8000000000000000551878Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:02.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4d55d7d6b3d4aa732021-12-21 11:38:02.944root 11241100x8000000000000000551879Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:02.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b74d72a2f82a174a2021-12-21 11:38:02.944root 11241100x8000000000000000551880Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:02.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c2f6d95b7747561e2021-12-21 11:38:02.944root 11241100x8000000000000000551881Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:02.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8ad92214c33d7f702021-12-21 11:38:02.944root 11241100x8000000000000000551882Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:02.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.95073bde25355f322021-12-21 11:38:02.944root 11241100x8000000000000000551883Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:02.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3acaae9f6bc89b7f2021-12-21 11:38:02.944root 354300x8000000000000000551884Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:03.091{ec2b6afe-95d9-61c1-5175-3a0400000000}5346/opt/splunkforwarder/etc/apps/Splunk_TA_stream/linux_x86_64/bin/streamfwdroottcptruefalse10.0.1.25-48826-false10.0.1.12-8000- 11241100x8000000000000000551885Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:03.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.cf32bb4faa7fa9a72021-12-21 11:38:03.443root 11241100x8000000000000000551886Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:03.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.06ee3161675f3ddd2021-12-21 11:38:03.443root 11241100x8000000000000000551887Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:03.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6e02431164b5c8052021-12-21 11:38:03.443root 11241100x8000000000000000551888Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:03.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a2ada42cb712bb7d2021-12-21 11:38:03.443root 11241100x8000000000000000551889Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:03.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.201ef8a65d6b79882021-12-21 11:38:03.443root 11241100x8000000000000000551890Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:03.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a8ecf4f04abc8fda2021-12-21 11:38:03.443root 11241100x8000000000000000551891Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:03.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c5b27c1c04a4a8b82021-12-21 11:38:03.443root 11241100x8000000000000000551892Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:03.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9f3df5e341fd5b3e2021-12-21 11:38:03.444root 11241100x8000000000000000551893Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:03.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.83c7ae7be641de602021-12-21 11:38:03.444root 11241100x8000000000000000551894Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:03.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b54a74fd1e7b21b82021-12-21 11:38:03.444root 11241100x8000000000000000551895Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:03.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.945934f61e24e1932021-12-21 11:38:03.444root 11241100x8000000000000000551896Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:03.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d31df9a4f881638a2021-12-21 11:38:03.444root 11241100x8000000000000000551897Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:03.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a707435cbdbbde202021-12-21 11:38:03.444root 11241100x8000000000000000551898Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:03.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c97e4c467d6bc81c2021-12-21 11:38:03.444root 11241100x8000000000000000551899Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:03.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.91b8d5164e8644452021-12-21 11:38:03.444root 11241100x8000000000000000551900Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:03.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b36e42dcbc096ad22021-12-21 11:38:03.444root 11241100x8000000000000000551901Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:03.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.34e0949d21be6f5a2021-12-21 11:38:03.943root 11241100x8000000000000000551902Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:03.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.41c1c37db95ff5b72021-12-21 11:38:03.943root 11241100x8000000000000000551903Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:03.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f284f32f4d623fee2021-12-21 11:38:03.943root 11241100x8000000000000000551904Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:03.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7a557d17827cb4532021-12-21 11:38:03.943root 11241100x8000000000000000551905Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:03.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3c49b8cad6da874c2021-12-21 11:38:03.943root 11241100x8000000000000000551906Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:03.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0193a19f905b49d92021-12-21 11:38:03.943root 11241100x8000000000000000551907Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:03.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3e0450da5da6a4f12021-12-21 11:38:03.944root 11241100x8000000000000000551908Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:03.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7a4ab1291b430ecf2021-12-21 11:38:03.944root 11241100x8000000000000000551909Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:03.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e2f85577ea8816802021-12-21 11:38:03.944root 11241100x8000000000000000551910Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:03.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9743eeefa516f2202021-12-21 11:38:03.944root 11241100x8000000000000000551911Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:03.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.254def055e3e0d962021-12-21 11:38:03.944root 11241100x8000000000000000551912Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:03.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e89de85add4585322021-12-21 11:38:03.944root 11241100x8000000000000000551913Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:03.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8f8a568027c283df2021-12-21 11:38:03.944root 11241100x8000000000000000551914Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:03.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a8cbf72f839fa6322021-12-21 11:38:03.944root 11241100x8000000000000000551915Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:03.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a42148a8dc82fc772021-12-21 11:38:03.944root 11241100x8000000000000000551916Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:03.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2bf947972e433fb92021-12-21 11:38:03.944root 11241100x8000000000000000551917Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:04.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.45e37de6cbea9fc92021-12-21 11:38:04.443root 11241100x8000000000000000551918Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:04.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9540148057a265952021-12-21 11:38:04.443root 11241100x8000000000000000551919Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:04.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.724fb7550282efa42021-12-21 11:38:04.443root 11241100x8000000000000000551920Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:04.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.06013a179b8c151c2021-12-21 11:38:04.443root 11241100x8000000000000000551921Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:04.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5cce172a5f1a0d6f2021-12-21 11:38:04.444root 11241100x8000000000000000551922Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:04.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.af67d2daf93154452021-12-21 11:38:04.444root 11241100x8000000000000000551923Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:04.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a3ab36758b88af412021-12-21 11:38:04.444root 11241100x8000000000000000551924Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:04.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f4dfee1b07e0b93e2021-12-21 11:38:04.444root 11241100x8000000000000000551925Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:04.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b9d0d1f3d3570eb72021-12-21 11:38:04.444root 11241100x8000000000000000551926Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:04.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.679f9ce6fcf91e9d2021-12-21 11:38:04.444root 11241100x8000000000000000551927Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:04.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.43af182c32c7ea9d2021-12-21 11:38:04.444root 11241100x8000000000000000551928Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:04.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.18d714604e2a1b4b2021-12-21 11:38:04.444root 11241100x8000000000000000551929Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:04.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5de8cab09b2b5b002021-12-21 11:38:04.444root 11241100x8000000000000000551930Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:04.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c90db3748b4498c32021-12-21 11:38:04.444root 11241100x8000000000000000551931Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:04.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c42ca9c03f41ef092021-12-21 11:38:04.444root 11241100x8000000000000000551932Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:04.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7d64f1d261e4237d2021-12-21 11:38:04.445root 11241100x8000000000000000551933Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:04.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c8687a06399802e42021-12-21 11:38:04.943root 11241100x8000000000000000551934Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:04.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b9dd067bb35dc90a2021-12-21 11:38:04.943root 11241100x8000000000000000551935Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:04.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.43dcc567c719a4ea2021-12-21 11:38:04.943root 11241100x8000000000000000551936Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:04.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5fc89333333bcf1d2021-12-21 11:38:04.943root 11241100x8000000000000000551937Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:04.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b7f466dbc552387c2021-12-21 11:38:04.944root 11241100x8000000000000000551938Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:04.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.58322ad290a5330f2021-12-21 11:38:04.944root 11241100x8000000000000000551939Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:04.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c607432e1ba2d73a2021-12-21 11:38:04.944root 11241100x8000000000000000551940Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:04.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6d11a94825338a9c2021-12-21 11:38:04.944root 11241100x8000000000000000551941Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:04.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8ca6fa06caf9d0fd2021-12-21 11:38:04.944root 11241100x8000000000000000551942Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:04.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a1520f93be1aa6c12021-12-21 11:38:04.944root 11241100x8000000000000000551943Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:04.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1114cdfadff4e7fd2021-12-21 11:38:04.944root 11241100x8000000000000000551944Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:04.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.633ba345ec9246bf2021-12-21 11:38:04.944root 11241100x8000000000000000551945Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:04.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.41a8587409b24eeb2021-12-21 11:38:04.944root 11241100x8000000000000000551946Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:04.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2085e26607a7776d2021-12-21 11:38:04.944root 11241100x8000000000000000551947Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:04.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9c554130e7af373d2021-12-21 11:38:04.944root 11241100x8000000000000000551948Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:04.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8d9ca28ef2d94c772021-12-21 11:38:04.944root 11241100x8000000000000000551949Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:05.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.695c44acb258ee352021-12-21 11:38:05.443root 11241100x8000000000000000551950Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:05.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.acdf19a52d057c852021-12-21 11:38:05.443root 11241100x8000000000000000551951Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:05.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.bd15637f1c5ab6d22021-12-21 11:38:05.443root 11241100x8000000000000000551952Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:05.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9c37a991d1db474d2021-12-21 11:38:05.443root 11241100x8000000000000000551953Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:05.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f97ab116b423ef9c2021-12-21 11:38:05.443root 11241100x8000000000000000551954Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:05.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ca3bd81c343c71f42021-12-21 11:38:05.443root 11241100x8000000000000000551955Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:05.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.cb02f2d5d15e212e2021-12-21 11:38:05.444root 11241100x8000000000000000551956Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:05.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c6a27dee9079da352021-12-21 11:38:05.444root 11241100x8000000000000000551957Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:05.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.bff5a8a9948afc122021-12-21 11:38:05.444root 11241100x8000000000000000551958Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:05.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.cf6bf98c602b0edc2021-12-21 11:38:05.444root 11241100x8000000000000000551959Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:05.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.fb04a7691963bec62021-12-21 11:38:05.444root 11241100x8000000000000000551960Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:05.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.58802a1189823d0d2021-12-21 11:38:05.444root 11241100x8000000000000000551961Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:05.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3de820ce97c54be02021-12-21 11:38:05.444root 11241100x8000000000000000551962Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:05.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.be3b71fc03512bf72021-12-21 11:38:05.444root 11241100x8000000000000000551963Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:05.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3a9033c35b6e31212021-12-21 11:38:05.444root 11241100x8000000000000000551964Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:05.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f8e6b52ba390b7c52021-12-21 11:38:05.444root 11241100x8000000000000000551965Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:05.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d163dfe91b2bda3b2021-12-21 11:38:05.943root 11241100x8000000000000000551966Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:05.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7efc073993ed4b202021-12-21 11:38:05.943root 11241100x8000000000000000551967Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:05.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e967a89a11e9f6f72021-12-21 11:38:05.943root 11241100x8000000000000000551968Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:05.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3bf2ee18dc8bc0e42021-12-21 11:38:05.943root 11241100x8000000000000000551969Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:05.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c7c35da27da9c8872021-12-21 11:38:05.943root 11241100x8000000000000000551970Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:05.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1c0fac529f7ce9c62021-12-21 11:38:05.943root 11241100x8000000000000000551971Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:05.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0f2e5b4455d463612021-12-21 11:38:05.943root 11241100x8000000000000000551972Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:05.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6aa4605880a4ee782021-12-21 11:38:05.944root 11241100x8000000000000000551973Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:05.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e29b0bb9ec1677892021-12-21 11:38:05.944root 11241100x8000000000000000551974Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:05.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.db3a9a02114acc992021-12-21 11:38:05.944root 11241100x8000000000000000551975Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:05.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.80894170c57490a92021-12-21 11:38:05.944root 11241100x8000000000000000551976Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:05.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3cccd34a4e53de592021-12-21 11:38:05.944root 11241100x8000000000000000551977Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:05.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a6aa1e685e00a3072021-12-21 11:38:05.944root 11241100x8000000000000000551978Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:05.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.dd5a45b081ad033a2021-12-21 11:38:05.944root 11241100x8000000000000000551979Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:05.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e4c8bb9a1ac2d7772021-12-21 11:38:05.944root 11241100x8000000000000000551980Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:05.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8771dd2079c7c7e32021-12-21 11:38:05.944root 11241100x8000000000000000551981Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:06.326{ec2b6afe-95d2-61c1-3038-b84203560000}5272/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/spool/splunk/tracker.log2021-12-21 11:38:06.326root 11241100x8000000000000000551982Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:06.328{ec2b6afe-95d2-61c1-3038-b84203560000}5272/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/fishbucket/splunk_private_db/snapshot.tmp/btree_index.dat2021-12-21 11:38:06.328root 11241100x8000000000000000551983Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:06.328{ec2b6afe-95d2-61c1-3038-b84203560000}5272/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/fishbucket/splunk_private_db/snapshot.tmp/btree_records.dat2021-12-21 11:38:06.328root 23542300x8000000000000000551984Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:06.328{ec2b6afe-95d2-61c1-3038-b84203560000}5272root/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/fishbucket/splunk_private_db/snapshot.old/btree_index.dat--- 23542300x8000000000000000551985Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:06.328{ec2b6afe-95d2-61c1-3038-b84203560000}5272root/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/fishbucket/splunk_private_db/snapshot.old/snap.dat--- 23542300x8000000000000000551986Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:06.328{ec2b6afe-95d2-61c1-3038-b84203560000}5272root/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/fishbucket/splunk_private_db/snapshot.old/btree_records.dat--- 11241100x8000000000000000551987Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:06.328{ec2b6afe-95d2-61c1-3038-b84203560000}5272/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/fishbucket/splunk_private_db/snapshot/snap.dat2021-12-21 11:38:06.328root 11241100x8000000000000000551988Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:06.328{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b85b7eb5047017412021-12-21 11:38:06.328root 11241100x8000000000000000551989Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:06.328{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.271aa597a40fce272021-12-21 11:38:06.328root 11241100x8000000000000000551990Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:06.328{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.cccf746c2c5f44de2021-12-21 11:38:06.328root 11241100x8000000000000000551991Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:06.328{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.55fd9178ad9514152021-12-21 11:38:06.328root 11241100x8000000000000000551992Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:06.328{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0f3ab051180e3ac92021-12-21 11:38:06.328root 11241100x8000000000000000551993Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:06.329{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9735c9c40aa7a4132021-12-21 11:38:06.329root 11241100x8000000000000000551994Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:06.329{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.562ccf7c70964c4a2021-12-21 11:38:06.329root 11241100x8000000000000000551995Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:06.329{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8e4090488ac322cb2021-12-21 11:38:06.329root 11241100x8000000000000000551996Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:06.329{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.fbd865b876e20b9f2021-12-21 11:38:06.329root 11241100x8000000000000000551997Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:06.329{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.56be2210e621472a2021-12-21 11:38:06.329root 11241100x8000000000000000551998Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:06.329{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.217bdc2351d7ef342021-12-21 11:38:06.329root 11241100x8000000000000000551999Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:06.329{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.da478f7947fa427f2021-12-21 11:38:06.329root 11241100x8000000000000000552000Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:06.329{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9d3a90bee2fb87ee2021-12-21 11:38:06.329root 11241100x8000000000000000552001Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:06.329{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.70e61573c118c2bd2021-12-21 11:38:06.329root 11241100x8000000000000000552002Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:06.329{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.934bb5f56365fb732021-12-21 11:38:06.329root 11241100x8000000000000000552003Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:06.329{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b324e25c7cb62ed72021-12-21 11:38:06.329root 11241100x8000000000000000552004Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:06.329{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d1dd9ae1a4094be12021-12-21 11:38:06.329root 11241100x8000000000000000552005Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:06.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3d845f891f6904af2021-12-21 11:38:06.693root 11241100x8000000000000000552006Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:06.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.675106df792ba45e2021-12-21 11:38:06.693root 11241100x8000000000000000552007Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:06.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.59a1a1ad5c370fc62021-12-21 11:38:06.694root 11241100x8000000000000000552008Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:06.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c7f51a1fe6c0e42e2021-12-21 11:38:06.694root 11241100x8000000000000000552009Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:06.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0e5e335e425daa262021-12-21 11:38:06.694root 11241100x8000000000000000552010Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:06.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.fd55d3c6ca7eab422021-12-21 11:38:06.694root 11241100x8000000000000000552011Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:06.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e279e24624f08d9b2021-12-21 11:38:06.694root 11241100x8000000000000000552012Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:06.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1a15ea826a03beba2021-12-21 11:38:06.694root 11241100x8000000000000000552013Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:06.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a0ce485198c758fe2021-12-21 11:38:06.694root 11241100x8000000000000000552014Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:06.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ab7ea82f5db6b3a32021-12-21 11:38:06.694root 11241100x8000000000000000552015Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:06.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.40d611d67f0ecb2c2021-12-21 11:38:06.694root 11241100x8000000000000000552016Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:06.695{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5b6fe74153f759d12021-12-21 11:38:06.695root 11241100x8000000000000000552017Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:06.695{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c701f3cfc773d5c02021-12-21 11:38:06.695root 11241100x8000000000000000552018Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:06.695{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a96523913ee26f622021-12-21 11:38:06.695root 11241100x8000000000000000552019Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:06.695{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5e33aeb3a5c4a8c62021-12-21 11:38:06.695root 11241100x8000000000000000552020Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:06.695{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.01749fde3d75eca82021-12-21 11:38:06.695root 11241100x8000000000000000552021Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:06.695{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c543ccb9f8965b3a2021-12-21 11:38:06.695root 11241100x8000000000000000552022Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:06.695{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5db3901260fbc1bb2021-12-21 11:38:06.695root 11241100x8000000000000000552023Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:06.695{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a1959d74b6d6e4602021-12-21 11:38:06.695root 11241100x8000000000000000552024Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:06.695{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.bf5b00a34d7c6aef2021-12-21 11:38:06.695root 11241100x8000000000000000552025Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:06.695{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.204bbc67c4cfe5bf2021-12-21 11:38:06.695root 11241100x8000000000000000552026Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:06.695{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1854c84533c3f5df2021-12-21 11:38:06.695root 11241100x8000000000000000552027Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:06.696{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0fd5cae70677ba132021-12-21 11:38:06.696root 11241100x8000000000000000552028Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:07.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ef771e949a4bf2572021-12-21 11:38:07.193root 11241100x8000000000000000552029Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:07.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.81ccc42fe81c7d732021-12-21 11:38:07.193root 11241100x8000000000000000552030Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:07.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e951e64a7b99f48e2021-12-21 11:38:07.194root 11241100x8000000000000000552031Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:07.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f34a138caf9249252021-12-21 11:38:07.194root 11241100x8000000000000000552032Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:07.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2990d89f6e69da7e2021-12-21 11:38:07.194root 11241100x8000000000000000552033Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:07.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8660ab118da25ca22021-12-21 11:38:07.194root 11241100x8000000000000000552034Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:07.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6a4124d34f758e842021-12-21 11:38:07.194root 11241100x8000000000000000552035Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:07.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.95755e6bc09a95fe2021-12-21 11:38:07.194root 11241100x8000000000000000552036Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:07.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.48947243fd862d9e2021-12-21 11:38:07.194root 11241100x8000000000000000552037Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:07.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b0ee3aadac34077b2021-12-21 11:38:07.194root 11241100x8000000000000000552038Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:07.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.72ee2b1fb3b564e72021-12-21 11:38:07.194root 11241100x8000000000000000552039Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:07.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.fd6aaab3a0eb5e7b2021-12-21 11:38:07.194root 11241100x8000000000000000552040Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:07.195{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.047589e4d85429402021-12-21 11:38:07.195root 11241100x8000000000000000552041Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:07.195{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4a254ba956b2dec22021-12-21 11:38:07.195root 11241100x8000000000000000552042Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:07.195{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5c28edb711d887a42021-12-21 11:38:07.195root 11241100x8000000000000000552043Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:07.195{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.19d6ae941aa31cae2021-12-21 11:38:07.195root 11241100x8000000000000000552044Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:07.195{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.fb8f684ce84cc3f02021-12-21 11:38:07.195root 11241100x8000000000000000552045Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:07.196{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8fef35f4bbc501922021-12-21 11:38:07.196root 11241100x8000000000000000552046Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:07.196{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4c09c924e8690ffd2021-12-21 11:38:07.196root 11241100x8000000000000000552047Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:07.196{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.114c53ec0d09f3882021-12-21 11:38:07.196root 11241100x8000000000000000552048Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:07.196{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e3c9e8bd31d909d52021-12-21 11:38:07.196root 11241100x8000000000000000552049Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:07.196{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.dd7d957d6ccc592b2021-12-21 11:38:07.196root 11241100x8000000000000000552050Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:07.196{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9bc9278e0d53594a2021-12-21 11:38:07.196root 11241100x8000000000000000552051Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:07.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9b1cd8702c143d9e2021-12-21 11:38:07.693root 11241100x8000000000000000552052Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:07.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.01cba1cdd61774342021-12-21 11:38:07.693root 11241100x8000000000000000552053Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:07.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.53e05af4b91a6db62021-12-21 11:38:07.694root 11241100x8000000000000000552054Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:07.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c5e38c329559c7472021-12-21 11:38:07.694root 11241100x8000000000000000552055Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:07.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7c90dd68829a7cbe2021-12-21 11:38:07.694root 11241100x8000000000000000552056Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:07.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e84199372fa253432021-12-21 11:38:07.694root 11241100x8000000000000000552057Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:07.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3cbdbb82bb3155bf2021-12-21 11:38:07.694root 11241100x8000000000000000552058Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:07.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2a3b35efc1e76ed22021-12-21 11:38:07.694root 11241100x8000000000000000552059Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:07.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c18d9ee0c13213182021-12-21 11:38:07.694root 11241100x8000000000000000552060Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:07.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.472eb519a18baa472021-12-21 11:38:07.694root 11241100x8000000000000000552061Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:07.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b319e814c38b346e2021-12-21 11:38:07.694root 11241100x8000000000000000552062Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:07.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7240386d16ab98782021-12-21 11:38:07.694root 11241100x8000000000000000552063Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:07.695{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.59f78f08af3e10692021-12-21 11:38:07.695root 11241100x8000000000000000552064Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:07.695{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.183ca210c964a4682021-12-21 11:38:07.695root 11241100x8000000000000000552065Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:07.695{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3b96d3133ab01b632021-12-21 11:38:07.695root 11241100x8000000000000000552066Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:07.695{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f8ca614377d8e7512021-12-21 11:38:07.695root 11241100x8000000000000000552067Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:07.695{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0ab3825dbc22ef6c2021-12-21 11:38:07.695root 11241100x8000000000000000552068Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:07.695{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.34137540c59536392021-12-21 11:38:07.695root 11241100x8000000000000000552069Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:07.695{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a1af597bdee42acc2021-12-21 11:38:07.695root 11241100x8000000000000000552070Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:07.695{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7fade479751f67942021-12-21 11:38:07.695root 11241100x8000000000000000552071Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:07.695{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4fb6e21bce2c34ad2021-12-21 11:38:07.695root 11241100x8000000000000000552072Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:07.695{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b15de3656af1dffc2021-12-21 11:38:07.695root 11241100x8000000000000000552073Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:07.696{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9564460bad0a32a22021-12-21 11:38:07.696root 11241100x8000000000000000552074Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:08.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.96d55493f0c1ebb32021-12-21 11:38:08.193root 11241100x8000000000000000552075Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:08.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8f5b894b84ce65532021-12-21 11:38:08.193root 11241100x8000000000000000552076Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:08.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.da2637af9b779b7b2021-12-21 11:38:08.194root 11241100x8000000000000000552077Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:08.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.69472005e532c8f72021-12-21 11:38:08.194root 11241100x8000000000000000552078Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:08.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.189c6620f62ddbf82021-12-21 11:38:08.194root 11241100x8000000000000000552079Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:08.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e65f59d3aedf1cf42021-12-21 11:38:08.194root 11241100x8000000000000000552080Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:08.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4a2c506d53eed7292021-12-21 11:38:08.194root 11241100x8000000000000000552081Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:08.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5772b071270c18902021-12-21 11:38:08.194root 11241100x8000000000000000552082Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:08.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.fcb4af074b41c73e2021-12-21 11:38:08.194root 11241100x8000000000000000552083Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:08.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d34120f91d44ab682021-12-21 11:38:08.194root 11241100x8000000000000000552084Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:08.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5d5c4c97bf24ce362021-12-21 11:38:08.194root 11241100x8000000000000000552085Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:08.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1fc60071a6c989072021-12-21 11:38:08.194root 11241100x8000000000000000552086Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:08.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0c39094bbc19f2c02021-12-21 11:38:08.194root 11241100x8000000000000000552087Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:08.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ee1b4f2aa41adeba2021-12-21 11:38:08.194root 11241100x8000000000000000552088Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:08.195{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4690394152d0ebe12021-12-21 11:38:08.195root 11241100x8000000000000000552089Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:08.195{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.324ac1198a1f1d0c2021-12-21 11:38:08.195root 11241100x8000000000000000552090Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:08.195{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b1b355407a4f8d502021-12-21 11:38:08.195root 11241100x8000000000000000552091Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:08.195{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9661e52edd7b62f92021-12-21 11:38:08.195root 11241100x8000000000000000552092Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:08.195{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6c8df09b911fbd7a2021-12-21 11:38:08.195root 11241100x8000000000000000552093Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:08.195{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9594b3455739b5d12021-12-21 11:38:08.195root 11241100x8000000000000000552094Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:08.197{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1ad4247753a1b87c2021-12-21 11:38:08.197root 11241100x8000000000000000552095Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:08.197{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.95d2aa144c82270d2021-12-21 11:38:08.197root 11241100x8000000000000000552096Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:08.198{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a986bf3a073cdb082021-12-21 11:38:08.198root 354300x8000000000000000552097Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:08.220{ec2b6afe-95d9-61c1-5175-3a0400000000}5346/opt/splunkforwarder/etc/apps/Splunk_TA_stream/linux_x86_64/bin/streamfwdroottcptruefalse10.0.1.25-48828-false10.0.1.12-8000- 11241100x8000000000000000552098Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:08.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2e03872e9745c2122021-12-21 11:38:08.693root 11241100x8000000000000000552099Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:08.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a281390b2e5ce3082021-12-21 11:38:08.694root 11241100x8000000000000000552100Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:08.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0bb72d1702f840052021-12-21 11:38:08.694root 11241100x8000000000000000552101Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:08.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ae84f4fc562b6b0a2021-12-21 11:38:08.694root 11241100x8000000000000000552102Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:08.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a10d7772448385752021-12-21 11:38:08.694root 11241100x8000000000000000552103Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:08.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3a2daf7964318f4d2021-12-21 11:38:08.694root 11241100x8000000000000000552104Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:08.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.40b27c77c8dfe4c12021-12-21 11:38:08.694root 11241100x8000000000000000552105Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:08.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a736f309c60350a62021-12-21 11:38:08.694root 11241100x8000000000000000552106Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:08.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9edc18a4b6c5f9d12021-12-21 11:38:08.694root 11241100x8000000000000000552107Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:08.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a643565d67a532512021-12-21 11:38:08.694root 11241100x8000000000000000552108Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:08.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ea1f431e762038e62021-12-21 11:38:08.694root 11241100x8000000000000000552109Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:08.695{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0b53465afa26bd9a2021-12-21 11:38:08.695root 11241100x8000000000000000552110Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:08.695{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.66db99306e4a89062021-12-21 11:38:08.695root 11241100x8000000000000000552111Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:08.695{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e03694a4c2362ef22021-12-21 11:38:08.695root 11241100x8000000000000000552112Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:08.696{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a5a1b8271b7647252021-12-21 11:38:08.696root 11241100x8000000000000000552113Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:08.696{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.44e49f7a35b793c52021-12-21 11:38:08.696root 11241100x8000000000000000552114Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:08.696{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.aac4cf9ed5b3179d2021-12-21 11:38:08.696root 11241100x8000000000000000552115Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:08.696{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5176f0d6479339302021-12-21 11:38:08.696root 11241100x8000000000000000552116Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:08.696{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6223ba35888a35bb2021-12-21 11:38:08.696root 11241100x8000000000000000552117Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:08.696{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2e164f06849cd1872021-12-21 11:38:08.696root 11241100x8000000000000000552118Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:08.696{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.116eb504e166f8fc2021-12-21 11:38:08.696root 11241100x8000000000000000552119Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:08.696{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2c408bda7c1520872021-12-21 11:38:08.696root 11241100x8000000000000000552120Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:08.697{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3d21965ca574fc6f2021-12-21 11:38:08.697root 11241100x8000000000000000552121Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:08.697{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9d0748af22d95c902021-12-21 11:38:08.697root 11241100x8000000000000000552122Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:09.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.260c7ef38f1ae46d2021-12-21 11:38:09.193root 11241100x8000000000000000552123Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:09.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0807e5b064ca16892021-12-21 11:38:09.194root 11241100x8000000000000000552124Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:09.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.28f19450515a43cf2021-12-21 11:38:09.194root 11241100x8000000000000000552125Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:09.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.fffc9c963a3776a82021-12-21 11:38:09.194root 11241100x8000000000000000552126Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:09.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a0260b98f7e392e72021-12-21 11:38:09.194root 11241100x8000000000000000552127Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:09.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8b4d8b420843f0cd2021-12-21 11:38:09.194root 11241100x8000000000000000552128Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:09.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c5e40da3397e47492021-12-21 11:38:09.194root 11241100x8000000000000000552129Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:09.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e1b4dd588b5ab29c2021-12-21 11:38:09.194root 11241100x8000000000000000552130Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:09.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.92858796e88dd7c62021-12-21 11:38:09.194root 11241100x8000000000000000552131Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:09.195{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0421d505d5aa48e72021-12-21 11:38:09.195root 11241100x8000000000000000552132Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:09.195{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a6fa2d3795fc9fa42021-12-21 11:38:09.195root 11241100x8000000000000000552133Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:09.195{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1150333c5fbbfb482021-12-21 11:38:09.195root 11241100x8000000000000000552134Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:09.195{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.68fc37405a670a4a2021-12-21 11:38:09.195root 11241100x8000000000000000552135Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:09.195{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.72c47331129851d12021-12-21 11:38:09.195root 11241100x8000000000000000552136Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:09.195{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.38f0661afa7534d82021-12-21 11:38:09.195root 11241100x8000000000000000552137Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:09.195{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b726ae942a4cfcf12021-12-21 11:38:09.195root 11241100x8000000000000000552138Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:09.195{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.cbaa66d38b475cc42021-12-21 11:38:09.195root 11241100x8000000000000000552139Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:09.195{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.872a9d5ab0f823032021-12-21 11:38:09.195root 11241100x8000000000000000552140Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:09.196{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4878216c7bd3ccd42021-12-21 11:38:09.196root 11241100x8000000000000000552141Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:09.196{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.bc0faa634ac2c8192021-12-21 11:38:09.196root 11241100x8000000000000000552142Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:09.196{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e04d3f5a83c489352021-12-21 11:38:09.196root 11241100x8000000000000000552143Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:09.196{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.24702c0315896e312021-12-21 11:38:09.196root 11241100x8000000000000000552144Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:09.196{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.44200dc70c445de82021-12-21 11:38:09.196root 11241100x8000000000000000552145Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:09.196{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.162ffdfa2763a2542021-12-21 11:38:09.196root 23542300x8000000000000000552146Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:09.330{ec2b6afe-95d2-61c1-3038-b84203560000}5272root/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/spool/splunk/tracker.log--- 11241100x8000000000000000552147Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:09.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c74635328485716b2021-12-21 11:38:09.693root 11241100x8000000000000000552148Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:09.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3acfa081c5ffc0e42021-12-21 11:38:09.694root 11241100x8000000000000000552149Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:09.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8613fc2dd1d9ee942021-12-21 11:38:09.694root 11241100x8000000000000000552150Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:09.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b4b49b1a227adbd42021-12-21 11:38:09.694root 11241100x8000000000000000552151Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:09.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7e43f8a5b76ce7862021-12-21 11:38:09.694root 11241100x8000000000000000552152Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:09.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0f768c8a629eddcf2021-12-21 11:38:09.694root 11241100x8000000000000000552153Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:09.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b57464a6ed32cbb72021-12-21 11:38:09.694root 11241100x8000000000000000552154Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:09.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a8bc262deec889df2021-12-21 11:38:09.694root 11241100x8000000000000000552155Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:09.695{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f8b93a700e1d558b2021-12-21 11:38:09.695root 11241100x8000000000000000552156Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:09.696{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.22b74c31a9b8b0a42021-12-21 11:38:09.696root 11241100x8000000000000000552157Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:09.696{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.018cc3d059ecd2352021-12-21 11:38:09.696root 11241100x8000000000000000552158Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:09.696{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.24b146ae7f5af84d2021-12-21 11:38:09.696root 11241100x8000000000000000552159Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:09.696{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e7d45768a0204a272021-12-21 11:38:09.696root 11241100x8000000000000000552160Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:09.696{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8f99dce37cd6e1e92021-12-21 11:38:09.696root 11241100x8000000000000000552161Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:09.696{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a42e36e62b01344f2021-12-21 11:38:09.696root 11241100x8000000000000000552162Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:09.696{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0352478441268b172021-12-21 11:38:09.696root 11241100x8000000000000000552163Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:09.696{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1e1c1d6c13673ccf2021-12-21 11:38:09.696root 11241100x8000000000000000552164Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:09.696{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.82f948457599e48a2021-12-21 11:38:09.696root 11241100x8000000000000000552165Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:09.697{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c7bd1a0a75102d6f2021-12-21 11:38:09.697root 11241100x8000000000000000552166Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:09.697{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0db20cb756bb64ae2021-12-21 11:38:09.697root 11241100x8000000000000000552167Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:09.697{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.fa36e54c37a87e562021-12-21 11:38:09.697root 11241100x8000000000000000552168Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:09.697{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.68a55a544f4a6a782021-12-21 11:38:09.697root 11241100x8000000000000000552169Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:09.697{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e7a40a904c10a8bb2021-12-21 11:38:09.697root 11241100x8000000000000000552170Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:09.697{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.45d69e04cc35ff722021-12-21 11:38:09.697root 11241100x8000000000000000552171Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:09.697{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1973300076c251e22021-12-21 11:38:09.697root 11241100x8000000000000000552172Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:10.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.040476e2b48a91a82021-12-21 11:38:10.193root 11241100x8000000000000000552173Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:10.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.02024f9935ae54432021-12-21 11:38:10.194root 11241100x8000000000000000552174Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:10.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.67e91735dafa55882021-12-21 11:38:10.194root 11241100x8000000000000000552175Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:10.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e52a0d87b23929a32021-12-21 11:38:10.194root 11241100x8000000000000000552176Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:10.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7a1c06f6cc6294fd2021-12-21 11:38:10.194root 11241100x8000000000000000552177Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:10.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ef53bb230fbf8e362021-12-21 11:38:10.194root 11241100x8000000000000000552178Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:10.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ed741e12151b34192021-12-21 11:38:10.194root 11241100x8000000000000000552179Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:10.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0e000e954ad40df72021-12-21 11:38:10.194root 11241100x8000000000000000552180Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:10.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d9633772bada4b212021-12-21 11:38:10.194root 11241100x8000000000000000552181Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:10.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1f28b30a90a5ad892021-12-21 11:38:10.194root 11241100x8000000000000000552182Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:10.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b91ea01f4abcf03c2021-12-21 11:38:10.194root 11241100x8000000000000000552183Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:10.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.91b19b8ebe2f0bca2021-12-21 11:38:10.194root 11241100x8000000000000000552184Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:10.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ef20b3cf2902ceb22021-12-21 11:38:10.194root 11241100x8000000000000000552185Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:10.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.520959b5a12b147c2021-12-21 11:38:10.194root 11241100x8000000000000000552186Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:10.195{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.452f4055f63373092021-12-21 11:38:10.195root 11241100x8000000000000000552187Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:10.195{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.13d0ff8bf5bae2362021-12-21 11:38:10.195root 11241100x8000000000000000552188Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:10.195{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7f2a2e21598aac2e2021-12-21 11:38:10.195root 11241100x8000000000000000552189Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:10.195{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.47998da75619f6652021-12-21 11:38:10.195root 11241100x8000000000000000552190Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:10.195{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c9e0c480f0bdf92a2021-12-21 11:38:10.195root 11241100x8000000000000000552191Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:10.195{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b9f8c58a2f5e1a522021-12-21 11:38:10.195root 11241100x8000000000000000552192Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:10.195{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.06cf69ba40721ad22021-12-21 11:38:10.195root 11241100x8000000000000000552193Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:10.195{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ed1f48b08f7237cf2021-12-21 11:38:10.195root 11241100x8000000000000000552194Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:10.195{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.fc86b99d3b9e23d22021-12-21 11:38:10.195root 11241100x8000000000000000552195Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:10.196{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.180fc6f536dfbcd02021-12-21 11:38:10.196root 11241100x8000000000000000552196Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:10.196{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e4003b97fa2afd002021-12-21 11:38:10.196root 11241100x8000000000000000552197Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:10.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1b49473c8085deaf2021-12-21 11:38:10.693root 11241100x8000000000000000552198Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:10.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9be72f67343fa5062021-12-21 11:38:10.694root 11241100x8000000000000000552199Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:10.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5047e913a662526f2021-12-21 11:38:10.694root 11241100x8000000000000000552200Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:10.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2e5f33271fd87e0a2021-12-21 11:38:10.694root 11241100x8000000000000000552201Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:10.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f8a37b386687a4892021-12-21 11:38:10.694root 11241100x8000000000000000552202Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:10.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.200764d01fab76022021-12-21 11:38:10.694root 11241100x8000000000000000552203Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:10.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e62f93acf62af4192021-12-21 11:38:10.694root 11241100x8000000000000000552204Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:10.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.414e594450a0ca1d2021-12-21 11:38:10.694root 11241100x8000000000000000552205Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:10.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8c8def4332b8d0cc2021-12-21 11:38:10.694root 11241100x8000000000000000552206Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:10.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c3907c414090a7c32021-12-21 11:38:10.694root 11241100x8000000000000000552207Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:10.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3b28952a0bba92582021-12-21 11:38:10.694root 11241100x8000000000000000552208Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:10.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.87e8a8acdbe293c22021-12-21 11:38:10.694root 11241100x8000000000000000552209Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:10.695{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3ad331e8bc466f6e2021-12-21 11:38:10.695root 11241100x8000000000000000552210Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:10.695{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1a91f8738e1ccaac2021-12-21 11:38:10.695root 11241100x8000000000000000552211Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:10.695{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2e3ea02f86910c312021-12-21 11:38:10.695root 11241100x8000000000000000552212Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:10.695{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d2661ae84b8e4c0d2021-12-21 11:38:10.695root 11241100x8000000000000000552213Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:10.695{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5fe6cf0148d389512021-12-21 11:38:10.695root 11241100x8000000000000000552214Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:10.695{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.047dd7751cc763432021-12-21 11:38:10.695root 11241100x8000000000000000552215Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:10.695{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ecc8255ae0a195ac2021-12-21 11:38:10.695root 11241100x8000000000000000552216Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:10.695{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4f7f6c76a1801b292021-12-21 11:38:10.695root 11241100x8000000000000000552217Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:10.695{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.79a7b02eb185c0512021-12-21 11:38:10.695root 11241100x8000000000000000552218Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:10.695{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b3e8eb73330a74222021-12-21 11:38:10.695root 11241100x8000000000000000552219Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:10.695{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d7cf56df3273aa142021-12-21 11:38:10.695root 11241100x8000000000000000552220Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:10.696{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ef72f308ee2acda22021-12-21 11:38:10.696root 11241100x8000000000000000552221Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:10.696{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1cd862af80a972dc2021-12-21 11:38:10.696root 11241100x8000000000000000552222Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:11.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.699cfb456b13fed92021-12-21 11:38:11.193root 11241100x8000000000000000552223Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:11.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b9e8de853d0762f82021-12-21 11:38:11.194root 11241100x8000000000000000552224Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:11.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1307c03fa7c20cf32021-12-21 11:38:11.194root 11241100x8000000000000000552225Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:11.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5197bfebca828ad22021-12-21 11:38:11.194root 11241100x8000000000000000552226Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:11.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.738b95db42b34d982021-12-21 11:38:11.194root 11241100x8000000000000000552227Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:11.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.21b7f1d087fc27162021-12-21 11:38:11.194root 11241100x8000000000000000552228Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:11.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.fa41a8bb15f1a18c2021-12-21 11:38:11.194root 11241100x8000000000000000552229Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:11.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.355319f5c8a8fe1f2021-12-21 11:38:11.194root 11241100x8000000000000000552230Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:11.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c63d1ed139bde0022021-12-21 11:38:11.194root 11241100x8000000000000000552231Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:11.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.be021c5812aa2f5b2021-12-21 11:38:11.194root 11241100x8000000000000000552232Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:11.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.714931f83aa0b9072021-12-21 11:38:11.194root 11241100x8000000000000000552233Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:11.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c7f410248bbeb7122021-12-21 11:38:11.194root 11241100x8000000000000000552234Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:11.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.cb863546745d7e882021-12-21 11:38:11.194root 11241100x8000000000000000552235Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:11.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.39f91e76ba2bd0ec2021-12-21 11:38:11.194root 11241100x8000000000000000552236Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:11.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f62aa884f35bb5a92021-12-21 11:38:11.194root 11241100x8000000000000000552237Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:11.195{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e57ecb8fb50c36232021-12-21 11:38:11.195root 11241100x8000000000000000552238Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:11.195{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.dfa3ccf489ae9d6d2021-12-21 11:38:11.195root 11241100x8000000000000000552239Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:11.195{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6218c62ee9efbad72021-12-21 11:38:11.195root 11241100x8000000000000000552240Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:11.195{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.15136af8aefed7532021-12-21 11:38:11.195root 11241100x8000000000000000552241Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:11.195{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1275b068cb83ef732021-12-21 11:38:11.195root 11241100x8000000000000000552242Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:11.195{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e424f469347e1d712021-12-21 11:38:11.195root 11241100x8000000000000000552243Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:11.195{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f105abb49b280e2b2021-12-21 11:38:11.195root 11241100x8000000000000000552244Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:11.195{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b45eebf7eed004b42021-12-21 11:38:11.195root 11241100x8000000000000000552245Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:11.195{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0f4fb487ee41793f2021-12-21 11:38:11.195root 11241100x8000000000000000552246Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:11.195{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4d09fd25b5ff2e452021-12-21 11:38:11.195root 11241100x8000000000000000552247Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:11.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.417dc79e1a7cdbd22021-12-21 11:38:11.694root 11241100x8000000000000000552248Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:11.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.020b77b76de5039d2021-12-21 11:38:11.694root 11241100x8000000000000000552249Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:11.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d2d91a64c16af05d2021-12-21 11:38:11.694root 11241100x8000000000000000552250Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:11.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.05561ce9123297082021-12-21 11:38:11.694root 11241100x8000000000000000552251Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:11.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.950e97d54689044d2021-12-21 11:38:11.694root 11241100x8000000000000000552252Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:11.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d87c4f3e8afab6df2021-12-21 11:38:11.694root 11241100x8000000000000000552253Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:11.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.60fdcc4eefc088e72021-12-21 11:38:11.694root 11241100x8000000000000000552254Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:11.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.10c815f3f563f9ea2021-12-21 11:38:11.694root 11241100x8000000000000000552255Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:11.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c7babeb1362c2d532021-12-21 11:38:11.694root 11241100x8000000000000000552256Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:11.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3c8e3e266a6815e62021-12-21 11:38:11.694root 11241100x8000000000000000552257Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:11.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ddc62f3d75c08d972021-12-21 11:38:11.694root 11241100x8000000000000000552258Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:11.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5ddaff2094e99e332021-12-21 11:38:11.694root 11241100x8000000000000000552259Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:11.695{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9588b8e281ce6df22021-12-21 11:38:11.695root 11241100x8000000000000000552260Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:11.695{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.dadb393c9fcc427e2021-12-21 11:38:11.695root 11241100x8000000000000000552261Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:11.695{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.00a0e8f5203d9e612021-12-21 11:38:11.695root 11241100x8000000000000000552262Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:11.695{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1bd68ad54e9505412021-12-21 11:38:11.695root 11241100x8000000000000000552263Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:11.695{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5e63c9dabb309d2b2021-12-21 11:38:11.695root 11241100x8000000000000000552264Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:11.695{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3d06f3ae15c0a04a2021-12-21 11:38:11.695root 11241100x8000000000000000552265Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:11.695{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1c012f736dfe56442021-12-21 11:38:11.695root 11241100x8000000000000000552266Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:11.695{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8ba76c4143a20efd2021-12-21 11:38:11.695root 11241100x8000000000000000552267Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:11.695{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e00dc58a2e005c592021-12-21 11:38:11.695root 11241100x8000000000000000552268Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:11.695{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c9b2cfc8f3a26bf22021-12-21 11:38:11.695root 11241100x8000000000000000552269Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:11.695{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6adc5838eb4b72a12021-12-21 11:38:11.695root 11241100x8000000000000000552270Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:11.695{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ee34e35a1b4ca6742021-12-21 11:38:11.695root 11241100x8000000000000000552271Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:11.696{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.193536800b157d482021-12-21 11:38:11.696root 11241100x8000000000000000552272Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:12.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8574eeea6eddfe8a2021-12-21 11:38:12.193root 11241100x8000000000000000552273Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:12.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.911c620c71184b512021-12-21 11:38:12.194root 11241100x8000000000000000552274Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:12.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1bfac10e2fe186fc2021-12-21 11:38:12.194root 11241100x8000000000000000552275Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:12.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a589c4c55a9799732021-12-21 11:38:12.194root 11241100x8000000000000000552276Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:12.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.338a9e52a4892c572021-12-21 11:38:12.194root 11241100x8000000000000000552277Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:12.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2ce0a11e3e9c2ae02021-12-21 11:38:12.194root 11241100x8000000000000000552278Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:12.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.923adcafec04ac102021-12-21 11:38:12.194root 11241100x8000000000000000552279Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:12.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0f30ff522ede57e92021-12-21 11:38:12.194root 11241100x8000000000000000552280Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:12.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d127f984878834882021-12-21 11:38:12.194root 11241100x8000000000000000552281Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:12.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9e132a1533a2e6992021-12-21 11:38:12.194root 11241100x8000000000000000552282Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:12.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ff0ecd62c232c3182021-12-21 11:38:12.194root 11241100x8000000000000000552283Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:12.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4f8da29f7f4b05c62021-12-21 11:38:12.194root 11241100x8000000000000000552284Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:12.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1cb01ac43164171b2021-12-21 11:38:12.194root 11241100x8000000000000000552285Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:12.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.15a85ccb5ab34a5c2021-12-21 11:38:12.194root 11241100x8000000000000000552286Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:12.195{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.62f1e99b01da18c82021-12-21 11:38:12.195root 11241100x8000000000000000552287Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:12.195{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.eab4a4c801bd841e2021-12-21 11:38:12.195root 11241100x8000000000000000552288Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:12.195{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e08a456d57bb3c632021-12-21 11:38:12.195root 11241100x8000000000000000552289Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:12.195{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7cad1de539fbf9de2021-12-21 11:38:12.195root 11241100x8000000000000000552290Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:12.195{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.66144f523db5b6302021-12-21 11:38:12.195root 11241100x8000000000000000552291Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:12.195{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6e0837364508bebf2021-12-21 11:38:12.195root 11241100x8000000000000000552292Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:12.195{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e077d958092a249c2021-12-21 11:38:12.195root 11241100x8000000000000000552293Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:12.195{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c0cb0c0c01177d162021-12-21 11:38:12.195root 11241100x8000000000000000552294Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:12.195{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.fc4ca01973c81d972021-12-21 11:38:12.195root 11241100x8000000000000000552295Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:12.196{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b3a9b2d902b89a972021-12-21 11:38:12.196root 11241100x8000000000000000552296Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:12.196{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2aaa6a59bca31fd52021-12-21 11:38:12.196root 11241100x8000000000000000552297Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:12.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b00d0ceb56bdaf8e2021-12-21 11:38:12.693root 11241100x8000000000000000552298Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:12.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1edd5299657bb9ff2021-12-21 11:38:12.694root 11241100x8000000000000000552299Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:12.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f4e5a6f7450e88fb2021-12-21 11:38:12.694root 11241100x8000000000000000552300Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:12.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.135aa5c1699099112021-12-21 11:38:12.694root 11241100x8000000000000000552301Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:12.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c33ef0e8fa821e9a2021-12-21 11:38:12.694root 11241100x8000000000000000552302Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:12.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.fd6142751669855d2021-12-21 11:38:12.694root 11241100x8000000000000000552303Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:12.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.12dd67686a3e4e142021-12-21 11:38:12.694root 11241100x8000000000000000552304Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:12.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f5109ef5d5c6d7ed2021-12-21 11:38:12.694root 11241100x8000000000000000552305Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:12.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ade9767d489a351d2021-12-21 11:38:12.694root 11241100x8000000000000000552306Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:12.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9e5510c9d17d2ed92021-12-21 11:38:12.694root 11241100x8000000000000000552307Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:12.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5fcde2364f4853ff2021-12-21 11:38:12.694root 11241100x8000000000000000552308Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:12.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2b4912d255759bcc2021-12-21 11:38:12.694root 11241100x8000000000000000552309Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:12.695{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.39f02791b621f6fd2021-12-21 11:38:12.695root 11241100x8000000000000000552310Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:12.695{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.80fd5ddce8ec538e2021-12-21 11:38:12.695root 11241100x8000000000000000552311Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:12.695{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6ab0f10504611b052021-12-21 11:38:12.695root 11241100x8000000000000000552312Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:12.695{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c71f8ab737400df92021-12-21 11:38:12.695root 11241100x8000000000000000552313Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:12.695{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.85b7960d4ae205b12021-12-21 11:38:12.695root 11241100x8000000000000000552314Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:12.695{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c75dcbdd534b1b9e2021-12-21 11:38:12.695root 11241100x8000000000000000552315Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:12.695{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.be6dfecad552f2ea2021-12-21 11:38:12.695root 11241100x8000000000000000552316Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:12.695{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ac60ee6a4e9e1ede2021-12-21 11:38:12.695root 11241100x8000000000000000552317Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:12.695{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.32f59479250a42352021-12-21 11:38:12.695root 11241100x8000000000000000552318Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:12.696{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ee8810d94e1ce8e52021-12-21 11:38:12.696root 11241100x8000000000000000552319Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:12.696{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.03d7aca3949ab38a2021-12-21 11:38:12.696root 11241100x8000000000000000552320Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:12.696{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.55fe2a74d4fe20332021-12-21 11:38:12.696root 11241100x8000000000000000552321Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:12.696{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.72ce9aaed42fb5472021-12-21 11:38:12.696root 11241100x8000000000000000552322Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:13.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.65c51df0239998ed2021-12-21 11:38:13.193root 11241100x8000000000000000552323Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:13.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.bd47d4171653696d2021-12-21 11:38:13.194root 11241100x8000000000000000552324Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:13.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a0787ce077d77d2b2021-12-21 11:38:13.194root 11241100x8000000000000000552325Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:13.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.75d18736288fd31c2021-12-21 11:38:13.194root 11241100x8000000000000000552326Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:13.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.239a3f810dfd94972021-12-21 11:38:13.194root 11241100x8000000000000000552327Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:13.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f5ed2b74b48e6b432021-12-21 11:38:13.194root 11241100x8000000000000000552328Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:13.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7e8a78c1666e264e2021-12-21 11:38:13.194root 11241100x8000000000000000552329Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:13.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9418a2beed3efb352021-12-21 11:38:13.194root 11241100x8000000000000000552330Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:13.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a5df272c64208e5d2021-12-21 11:38:13.194root 11241100x8000000000000000552331Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:13.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.42b448c465aaab242021-12-21 11:38:13.194root 11241100x8000000000000000552332Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:13.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0babadd3ebbf1a3c2021-12-21 11:38:13.194root 11241100x8000000000000000552333Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:13.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7c4e75f3511e107d2021-12-21 11:38:13.194root 11241100x8000000000000000552334Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:13.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a3df12c049ec113b2021-12-21 11:38:13.194root 11241100x8000000000000000552335Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:13.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c3715a09913b0bc32021-12-21 11:38:13.194root 11241100x8000000000000000552336Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:13.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.cc97c1584b614b422021-12-21 11:38:13.194root 11241100x8000000000000000552337Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:13.195{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d217d48d59dc29612021-12-21 11:38:13.195root 11241100x8000000000000000552338Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:13.195{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d6366cc0caa8da232021-12-21 11:38:13.195root 11241100x8000000000000000552339Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:13.195{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.35a33d926ef72c862021-12-21 11:38:13.195root 11241100x8000000000000000552340Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:13.195{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.50ffc606a92d79e22021-12-21 11:38:13.195root 11241100x8000000000000000552341Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:13.195{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.47b8afcfd02c9a152021-12-21 11:38:13.195root 11241100x8000000000000000552342Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:13.195{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.385f1e9453d89fa62021-12-21 11:38:13.195root 11241100x8000000000000000552343Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:13.195{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1fb3e9c30c272dc82021-12-21 11:38:13.195root 11241100x8000000000000000552344Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:13.196{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3022006fb59e24d22021-12-21 11:38:13.196root 11241100x8000000000000000552345Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:13.196{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a791c040d5a017f82021-12-21 11:38:13.196root 11241100x8000000000000000552346Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:13.196{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.35fbfe98bd8fb9e12021-12-21 11:38:13.196root 11241100x8000000000000000552347Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:13.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a23a459e7a9a39bf2021-12-21 11:38:13.694root 11241100x8000000000000000552348Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:13.695{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d9f722ff7199d35c2021-12-21 11:38:13.695root 11241100x8000000000000000552349Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:13.695{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f1ee037e272b5ca82021-12-21 11:38:13.695root 11241100x8000000000000000552350Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:13.695{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.20de57aad4c10aa52021-12-21 11:38:13.695root 11241100x8000000000000000552351Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:13.695{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f6720c8aed0ef2b12021-12-21 11:38:13.695root 11241100x8000000000000000552352Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:13.695{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.fe4346d6d4e9f30f2021-12-21 11:38:13.695root 11241100x8000000000000000552353Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:13.695{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e05abd24f05c43c92021-12-21 11:38:13.695root 11241100x8000000000000000552354Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:13.695{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.37e67a1ce36fe6ff2021-12-21 11:38:13.695root 11241100x8000000000000000552355Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:13.695{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.dd8678c2bbc0ced92021-12-21 11:38:13.695root 11241100x8000000000000000552356Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:13.695{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4d687e4dbe5b552b2021-12-21 11:38:13.695root 11241100x8000000000000000552357Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:13.696{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c5650c3ce625e88b2021-12-21 11:38:13.696root 11241100x8000000000000000552358Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:13.696{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b8379ca262775dcd2021-12-21 11:38:13.696root 11241100x8000000000000000552359Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:13.696{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ee8ae68f2618217f2021-12-21 11:38:13.696root 11241100x8000000000000000552360Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:13.696{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f23b8b9a65558dda2021-12-21 11:38:13.696root 11241100x8000000000000000552361Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:13.696{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d09c4336f94c32312021-12-21 11:38:13.696root 11241100x8000000000000000552362Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:13.696{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b309ffad5d37d39c2021-12-21 11:38:13.696root 11241100x8000000000000000552363Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:13.696{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a3d499935e340eb52021-12-21 11:38:13.696root 11241100x8000000000000000552364Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:13.696{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.14c173f4db06ce372021-12-21 11:38:13.696root 11241100x8000000000000000552365Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:13.696{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.13a3d693d914c9132021-12-21 11:38:13.696root 11241100x8000000000000000552366Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:13.696{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.cbfe3a9f18da18b22021-12-21 11:38:13.696root 11241100x8000000000000000552367Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:13.696{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.889be3794511dbed2021-12-21 11:38:13.696root 11241100x8000000000000000552368Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:13.697{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.939bf819723e004b2021-12-21 11:38:13.697root 11241100x8000000000000000552369Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:13.697{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.dc5f591e31bca6ca2021-12-21 11:38:13.697root 11241100x8000000000000000552370Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:13.697{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f488fd94c0b6d86a2021-12-21 11:38:13.697root 11241100x8000000000000000552371Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:13.697{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.bd8546459d9f3c222021-12-21 11:38:13.697root 354300x8000000000000000552372Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:14.031{ec2b6afe-95d9-61c1-5175-3a0400000000}5346/opt/splunkforwarder/etc/apps/Splunk_TA_stream/linux_x86_64/bin/streamfwdroottcptruefalse10.0.1.25-48830-false10.0.1.12-8000- 11241100x8000000000000000552373Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:14.033{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.eb1c298e7c7458b12021-12-21 11:38:14.033root 11241100x8000000000000000552374Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:14.033{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.941a5c2818f551f32021-12-21 11:38:14.033root 11241100x8000000000000000552375Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:14.033{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d7dfef21e48fc7bd2021-12-21 11:38:14.033root 11241100x8000000000000000552376Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:14.034{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.87d34accff3194a92021-12-21 11:38:14.034root 11241100x8000000000000000552377Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:14.034{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.610a190db7fbff592021-12-21 11:38:14.034root 11241100x8000000000000000552378Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:14.034{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2104ecc5fe38b0e12021-12-21 11:38:14.034root 11241100x8000000000000000552379Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:14.034{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.591f1a365e6ea64a2021-12-21 11:38:14.034root 11241100x8000000000000000552380Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:14.034{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.45e17acfce917b232021-12-21 11:38:14.034root 11241100x8000000000000000552381Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:14.034{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f344355d0b17000e2021-12-21 11:38:14.034root 11241100x8000000000000000552382Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:14.034{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.fe6130676aa59e792021-12-21 11:38:14.034root 11241100x8000000000000000552383Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:14.034{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.09899df95ebad6ac2021-12-21 11:38:14.034root 11241100x8000000000000000552384Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:14.034{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8c5c4bc57c5cab072021-12-21 11:38:14.034root 11241100x8000000000000000552385Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:14.035{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f4117904a3ce1ab72021-12-21 11:38:14.035root 11241100x8000000000000000552386Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:14.035{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4c200f5f15161dab2021-12-21 11:38:14.035root 11241100x8000000000000000552387Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:14.035{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1a0d1a6a14d265ae2021-12-21 11:38:14.035root 11241100x8000000000000000552388Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:14.035{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.bfdcc2a4e24e9a6e2021-12-21 11:38:14.035root 11241100x8000000000000000552389Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:14.035{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b6ce9faa48d6539f2021-12-21 11:38:14.035root 11241100x8000000000000000552390Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:14.035{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7df929d2739459f52021-12-21 11:38:14.035root 11241100x8000000000000000552391Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:14.035{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.aac27b1dfb77515c2021-12-21 11:38:14.035root 11241100x8000000000000000552392Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:14.035{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7b0fdea3df08372a2021-12-21 11:38:14.035root 11241100x8000000000000000552393Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:14.036{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b63cf31392d47f912021-12-21 11:38:14.036root 11241100x8000000000000000552394Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:14.036{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9c229ec3322e27332021-12-21 11:38:14.036root 11241100x8000000000000000552395Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:14.036{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.375a06fda40c954a2021-12-21 11:38:14.036root 11241100x8000000000000000552396Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:14.036{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e5702537cd78a9912021-12-21 11:38:14.036root 11241100x8000000000000000552397Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:14.036{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1c93b2064b93adbc2021-12-21 11:38:14.036root 11241100x8000000000000000552398Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:14.036{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4aaf5eea3208d4e82021-12-21 11:38:14.036root 11241100x8000000000000000552399Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:14.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6ad3e4cef93313492021-12-21 11:38:14.443root 11241100x8000000000000000552400Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:14.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.108a5e96dd8f5f242021-12-21 11:38:14.443root 11241100x8000000000000000552401Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:14.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ffd7f37ad4de7d262021-12-21 11:38:14.443root 11241100x8000000000000000552402Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:14.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0fc7e2862e9db4d22021-12-21 11:38:14.444root 11241100x8000000000000000552403Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:14.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5d309588d46c064d2021-12-21 11:38:14.444root 11241100x8000000000000000552404Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:14.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d03d6cf0c3a3a5072021-12-21 11:38:14.444root 11241100x8000000000000000552405Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:14.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ca1d6d60f5e886eb2021-12-21 11:38:14.444root 11241100x8000000000000000552406Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:14.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.eee66281b0cf601a2021-12-21 11:38:14.444root 11241100x8000000000000000552407Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:14.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.826b1e7164e19b732021-12-21 11:38:14.444root 11241100x8000000000000000552408Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:14.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b684197ea81dc5512021-12-21 11:38:14.444root 11241100x8000000000000000552409Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:14.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.79a59e9d4ce099512021-12-21 11:38:14.444root 11241100x8000000000000000552410Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:14.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.efa82aea9acf832a2021-12-21 11:38:14.445root 11241100x8000000000000000552411Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:14.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f0bd344a31b3e5792021-12-21 11:38:14.445root 11241100x8000000000000000552412Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:14.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ed42cfc2a46c95b52021-12-21 11:38:14.445root 11241100x8000000000000000552413Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:14.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.be1429a6f3ecb9412021-12-21 11:38:14.445root 11241100x8000000000000000552414Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:14.446{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e28c55d13f1f25072021-12-21 11:38:14.446root 11241100x8000000000000000552415Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:14.446{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.bb94c798a90bb31e2021-12-21 11:38:14.446root 11241100x8000000000000000552416Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:14.446{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a078d3a44102d7352021-12-21 11:38:14.446root 11241100x8000000000000000552417Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:14.446{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.69870e12c96aac442021-12-21 11:38:14.446root 11241100x8000000000000000552418Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:14.446{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.91df283cfe6cd5f92021-12-21 11:38:14.446root 11241100x8000000000000000552419Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:14.446{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.686ff73bdf0158512021-12-21 11:38:14.446root 11241100x8000000000000000552420Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:14.446{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3212c36da94954ad2021-12-21 11:38:14.446root 11241100x8000000000000000552421Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:14.446{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.cbf694613b254e1c2021-12-21 11:38:14.446root 11241100x8000000000000000552422Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:14.447{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.bc384af202c1a3302021-12-21 11:38:14.447root 11241100x8000000000000000552423Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:14.447{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.985792b0f0a7009e2021-12-21 11:38:14.447root 11241100x8000000000000000552424Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:14.448{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b47b42955ff492892021-12-21 11:38:14.448root 11241100x8000000000000000552425Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:14.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e4ab9c52c5e1c3422021-12-21 11:38:14.943root 11241100x8000000000000000552426Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:14.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.bdf8ec1bb00b23162021-12-21 11:38:14.943root 11241100x8000000000000000552427Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:14.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3187d9fa7d96e3e22021-12-21 11:38:14.943root 11241100x8000000000000000552428Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:14.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e47c78a5fcb1bf1e2021-12-21 11:38:14.944root 11241100x8000000000000000552429Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:14.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8065e1dc77b84f612021-12-21 11:38:14.944root 11241100x8000000000000000552430Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:14.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8fc81639f4c9c39a2021-12-21 11:38:14.944root 11241100x8000000000000000552431Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:14.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.216a6fab9605c8842021-12-21 11:38:14.944root 11241100x8000000000000000552432Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:14.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4f893f5e4c43a1be2021-12-21 11:38:14.944root 11241100x8000000000000000552433Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:14.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ae268189d5af16942021-12-21 11:38:14.944root 11241100x8000000000000000552434Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:14.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.96c0120cf36089e82021-12-21 11:38:14.944root 11241100x8000000000000000552435Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:14.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7a1d91b7b98d1d1a2021-12-21 11:38:14.944root 11241100x8000000000000000552436Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:14.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9a26f49333546d6f2021-12-21 11:38:14.944root 11241100x8000000000000000552437Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:14.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7d90a6ff02cb3b212021-12-21 11:38:14.945root 11241100x8000000000000000552438Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:14.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.05746f92c8c107662021-12-21 11:38:14.945root 11241100x8000000000000000552439Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:14.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.fc44e671cab4a5d82021-12-21 11:38:14.945root 11241100x8000000000000000552440Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:14.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c9663f34ef264b462021-12-21 11:38:14.945root 11241100x8000000000000000552441Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:14.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e88395994562f4412021-12-21 11:38:14.945root 11241100x8000000000000000552442Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:14.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4bf6744b766d46a22021-12-21 11:38:14.945root 11241100x8000000000000000552443Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:14.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7b5437d9551b23592021-12-21 11:38:14.945root 11241100x8000000000000000552444Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:14.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.617feb71fb3f8ecf2021-12-21 11:38:14.945root 11241100x8000000000000000552445Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:14.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.09f6b86d6844d8902021-12-21 11:38:14.945root 11241100x8000000000000000552446Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:14.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.44499988d6b53ee72021-12-21 11:38:14.945root 11241100x8000000000000000552447Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:14.946{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a5f6f74e65092c492021-12-21 11:38:14.946root 11241100x8000000000000000552448Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:14.946{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.24f013e65935a0eb2021-12-21 11:38:14.946root 11241100x8000000000000000552449Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:14.946{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9cc9fcf69da12ea82021-12-21 11:38:14.946root 11241100x8000000000000000552450Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:14.946{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.073f3f524a8535202021-12-21 11:38:14.946root 11241100x8000000000000000552451Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:15.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ed879c1a3951e3112021-12-21 11:38:15.443root 11241100x8000000000000000552452Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:15.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1f397099734b59e02021-12-21 11:38:15.443root 11241100x8000000000000000552453Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:15.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4ecbea59d6a28b312021-12-21 11:38:15.443root 11241100x8000000000000000552454Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:15.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0f0076580b11aa792021-12-21 11:38:15.443root 11241100x8000000000000000552455Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:15.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ac9b31e892c55d622021-12-21 11:38:15.444root 11241100x8000000000000000552456Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:15.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.06bc030ca2a7bf282021-12-21 11:38:15.444root 11241100x8000000000000000552457Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:15.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.284a1dc4e592641d2021-12-21 11:38:15.444root 11241100x8000000000000000552458Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:15.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ce89c5dd6246867e2021-12-21 11:38:15.444root 11241100x8000000000000000552459Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:15.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.dd4df90133edea4d2021-12-21 11:38:15.444root 11241100x8000000000000000552460Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:15.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b4ff5fdc9df967472021-12-21 11:38:15.444root 11241100x8000000000000000552461Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:15.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.926f123277f662572021-12-21 11:38:15.444root 11241100x8000000000000000552462Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:15.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b8c7094b887bf8e72021-12-21 11:38:15.444root 11241100x8000000000000000552463Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:15.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.520f391d4d99ad8f2021-12-21 11:38:15.444root 11241100x8000000000000000552464Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:15.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.fffdc6d56a01c18c2021-12-21 11:38:15.444root 11241100x8000000000000000552465Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:15.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4e0ba6b68c38e0f32021-12-21 11:38:15.444root 11241100x8000000000000000552466Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:15.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.cb7ab64a86c375da2021-12-21 11:38:15.444root 11241100x8000000000000000552467Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:15.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6c22e09f6c5e496a2021-12-21 11:38:15.444root 11241100x8000000000000000552468Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:15.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5022c0c8146d8c792021-12-21 11:38:15.444root 11241100x8000000000000000552469Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:15.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d6be09e9e2ea6e5b2021-12-21 11:38:15.444root 11241100x8000000000000000552470Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:15.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.dd61b96c14a9ed042021-12-21 11:38:15.444root 11241100x8000000000000000552471Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:15.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.19c7713970fdef992021-12-21 11:38:15.445root 11241100x8000000000000000552472Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:15.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.af6e45862a86b5852021-12-21 11:38:15.445root 11241100x8000000000000000552473Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:15.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b7a9e5a118b9e3bd2021-12-21 11:38:15.445root 11241100x8000000000000000552474Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:15.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8a9eaed683112e012021-12-21 11:38:15.445root 11241100x8000000000000000552475Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:15.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.011bcbba5e7fe3a62021-12-21 11:38:15.445root 11241100x8000000000000000552476Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:15.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0b651278e30215952021-12-21 11:38:15.445root 11241100x8000000000000000552477Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:15.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8637b97e0003ce572021-12-21 11:38:15.943root 11241100x8000000000000000552478Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:15.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.70c5817e626145952021-12-21 11:38:15.943root 11241100x8000000000000000552479Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:15.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ca860ecefcf0b7862021-12-21 11:38:15.943root 11241100x8000000000000000552480Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:15.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0dbc9fed53ec51c92021-12-21 11:38:15.944root 11241100x8000000000000000552481Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:15.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a8814e48f9d453f92021-12-21 11:38:15.944root 11241100x8000000000000000552482Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:15.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d7c6bd2275ade7ad2021-12-21 11:38:15.944root 11241100x8000000000000000552483Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:15.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.eb1a15dabaa5da522021-12-21 11:38:15.944root 11241100x8000000000000000552484Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:15.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3cd4b4968e53eedf2021-12-21 11:38:15.944root 11241100x8000000000000000552485Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:15.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d5cac4e4293fcf502021-12-21 11:38:15.944root 11241100x8000000000000000552486Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:15.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.22d7956730b451f92021-12-21 11:38:15.944root 11241100x8000000000000000552487Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:15.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6cf0aa4c71fd196c2021-12-21 11:38:15.944root 11241100x8000000000000000552488Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:15.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.fac586194008054a2021-12-21 11:38:15.944root 11241100x8000000000000000552489Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:15.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.01735916ff5ef5682021-12-21 11:38:15.944root 11241100x8000000000000000552490Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:15.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.51cdb4540818039b2021-12-21 11:38:15.944root 11241100x8000000000000000552491Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:15.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.27fc4b41e24540332021-12-21 11:38:15.944root 11241100x8000000000000000552492Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:15.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.bdb5b91aa31df0442021-12-21 11:38:15.944root 11241100x8000000000000000552493Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:15.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a91244327f11a9ed2021-12-21 11:38:15.944root 11241100x8000000000000000552494Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:15.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8ef1626dbaed10c02021-12-21 11:38:15.944root 11241100x8000000000000000552495Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:15.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.42f1535f95be2fca2021-12-21 11:38:15.944root 11241100x8000000000000000552496Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:15.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.15dc3825e0c97e732021-12-21 11:38:15.945root 11241100x8000000000000000552497Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:15.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8baf080a3a3c7c252021-12-21 11:38:15.945root 11241100x8000000000000000552498Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:15.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.bb36b43b01818b972021-12-21 11:38:15.945root 11241100x8000000000000000552499Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:15.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.31d8dc21ade102f42021-12-21 11:38:15.945root 11241100x8000000000000000552500Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:15.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.caffda3f41c4439e2021-12-21 11:38:15.945root 11241100x8000000000000000552501Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:15.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.464ffceb9b727fa82021-12-21 11:38:15.945root 11241100x8000000000000000552502Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:15.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7ec83d23e29ea3b92021-12-21 11:38:15.945root 11241100x8000000000000000552503Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:16.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d6bcf6d1a3dee3832021-12-21 11:38:16.443root 11241100x8000000000000000552504Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:16.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2e91f527c3a5c5062021-12-21 11:38:16.443root 11241100x8000000000000000552505Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:16.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.bdb81fa6e2a406fb2021-12-21 11:38:16.443root 11241100x8000000000000000552506Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:16.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.74cc0bf55e2c4a0b2021-12-21 11:38:16.443root 11241100x8000000000000000552507Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:16.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7076c6372e9c6c662021-12-21 11:38:16.444root 11241100x8000000000000000552508Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:16.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.eeba83d3c226f6792021-12-21 11:38:16.444root 11241100x8000000000000000552509Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:16.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1084697c6932a3db2021-12-21 11:38:16.444root 11241100x8000000000000000552510Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:16.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ead2ef07ec36ad082021-12-21 11:38:16.444root 11241100x8000000000000000552511Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:16.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.704ac949ce6aa9bb2021-12-21 11:38:16.444root 11241100x8000000000000000552512Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:16.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.783efb9271b8b3ba2021-12-21 11:38:16.444root 11241100x8000000000000000552513Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:16.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ca4bdecaf24e2fe92021-12-21 11:38:16.444root 11241100x8000000000000000552514Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:16.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e70bcc6c036bf56a2021-12-21 11:38:16.444root 11241100x8000000000000000552515Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:16.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5c5073475de3ba792021-12-21 11:38:16.444root 11241100x8000000000000000552516Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:16.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.00c90e566589f3e52021-12-21 11:38:16.444root 11241100x8000000000000000552517Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:16.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f997336f2a21fbe32021-12-21 11:38:16.444root 11241100x8000000000000000552518Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:16.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.29ae42bd8868066f2021-12-21 11:38:16.444root 11241100x8000000000000000552519Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:16.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5fc203804c84a7072021-12-21 11:38:16.444root 11241100x8000000000000000552520Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:16.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2051393c0be6c3d22021-12-21 11:38:16.444root 11241100x8000000000000000552521Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:16.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.46a98bfa1d13d2302021-12-21 11:38:16.444root 11241100x8000000000000000552522Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:16.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c0be5c3f72fe37d52021-12-21 11:38:16.444root 11241100x8000000000000000552523Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:16.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5238dd964b13f1fa2021-12-21 11:38:16.445root 11241100x8000000000000000552524Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:16.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6d1ce82d0064e2b72021-12-21 11:38:16.445root 11241100x8000000000000000552525Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:16.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1248a951dd77e2472021-12-21 11:38:16.445root 11241100x8000000000000000552526Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:16.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4e28a482bb4518a62021-12-21 11:38:16.445root 11241100x8000000000000000552527Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:16.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3a0c6d74919cd7232021-12-21 11:38:16.445root 11241100x8000000000000000552528Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:16.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.079382135e4aeea02021-12-21 11:38:16.445root 11241100x8000000000000000552529Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:16.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.962a21921b91365d2021-12-21 11:38:16.943root 11241100x8000000000000000552530Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:16.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0125d190f5cc0cda2021-12-21 11:38:16.943root 11241100x8000000000000000552531Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:16.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7e3698f9bc07c53e2021-12-21 11:38:16.943root 11241100x8000000000000000552532Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:16.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3e22f5b7022dd95f2021-12-21 11:38:16.943root 11241100x8000000000000000552533Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:16.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c9cb2c565e35a4c32021-12-21 11:38:16.944root 11241100x8000000000000000552534Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:16.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0432c66fbe86fe342021-12-21 11:38:16.944root 11241100x8000000000000000552535Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:16.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c34d080f4eefb8aa2021-12-21 11:38:16.944root 11241100x8000000000000000552536Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:16.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2378f2ed353881882021-12-21 11:38:16.944root 11241100x8000000000000000552537Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:16.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.13551c64140d36552021-12-21 11:38:16.944root 11241100x8000000000000000552538Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:16.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.227ab12fc37eab092021-12-21 11:38:16.944root 11241100x8000000000000000552539Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:16.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0085b4aef75057c22021-12-21 11:38:16.944root 11241100x8000000000000000552540Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:16.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.fcf8c3bf9220417b2021-12-21 11:38:16.944root 11241100x8000000000000000552541Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:16.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e48711bd8136b2a92021-12-21 11:38:16.944root 11241100x8000000000000000552542Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:16.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.99f0fba37764b9842021-12-21 11:38:16.944root 11241100x8000000000000000552543Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:16.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a427bb7b05c6cd472021-12-21 11:38:16.944root 11241100x8000000000000000552544Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:16.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.16a47c99de54ca662021-12-21 11:38:16.944root 11241100x8000000000000000552545Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:16.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.118b7dbc8185096c2021-12-21 11:38:16.944root 11241100x8000000000000000552546Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:16.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b8630f515d6d147a2021-12-21 11:38:16.945root 11241100x8000000000000000552547Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:16.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4f24f831c8873d362021-12-21 11:38:16.945root 11241100x8000000000000000552548Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:16.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.697aa5d7f1f69d5d2021-12-21 11:38:16.945root 11241100x8000000000000000552549Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:16.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.cc940c49907f1b472021-12-21 11:38:16.945root 11241100x8000000000000000552550Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:16.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b0461d043a3df4f72021-12-21 11:38:16.945root 11241100x8000000000000000552551Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:16.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a10470bfa3fa08fc2021-12-21 11:38:16.945root 11241100x8000000000000000552552Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:16.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.df8045777dcdb4ca2021-12-21 11:38:16.945root 11241100x8000000000000000552553Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:16.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b96f679220be68882021-12-21 11:38:16.945root 11241100x8000000000000000552554Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:16.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c0e5e153d423f0192021-12-21 11:38:16.945root 11241100x8000000000000000552555Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:17.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9798bf6d6c733dca2021-12-21 11:38:17.443root 11241100x8000000000000000552556Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:17.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.056d9acdd30a10a22021-12-21 11:38:17.443root 11241100x8000000000000000552557Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:17.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.977d387118b38ce52021-12-21 11:38:17.443root 11241100x8000000000000000552558Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:17.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4ab6c6074c40bb8e2021-12-21 11:38:17.443root 11241100x8000000000000000552559Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:17.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.cdc6ff577ebe1ceb2021-12-21 11:38:17.444root 11241100x8000000000000000552560Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:17.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b912c3769f79fe8d2021-12-21 11:38:17.444root 11241100x8000000000000000552561Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:17.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8e08d060fedf0f792021-12-21 11:38:17.444root 11241100x8000000000000000552562Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:17.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9f3f7a5003e46a952021-12-21 11:38:17.444root 11241100x8000000000000000552563Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:17.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.788ba67c93af38a02021-12-21 11:38:17.444root 11241100x8000000000000000552564Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:17.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4bc79158b5450dc32021-12-21 11:38:17.444root 11241100x8000000000000000552565Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:17.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.023ba82c770b4ad82021-12-21 11:38:17.444root 11241100x8000000000000000552566Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:17.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.20367aa62bdc0ab92021-12-21 11:38:17.444root 11241100x8000000000000000552567Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:17.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e311138c521c3bcf2021-12-21 11:38:17.444root 11241100x8000000000000000552568Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:17.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.54b6ad72ff61b1ef2021-12-21 11:38:17.444root 11241100x8000000000000000552569Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:17.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e23a81e8a23d73b92021-12-21 11:38:17.444root 11241100x8000000000000000552570Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:17.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3e4d88d8526ffbd52021-12-21 11:38:17.444root 11241100x8000000000000000552571Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:17.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.292897849bbdd9012021-12-21 11:38:17.444root 11241100x8000000000000000552572Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:17.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b1d6a1e2079283622021-12-21 11:38:17.444root 11241100x8000000000000000552573Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:17.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ceb7c360cc9c7e202021-12-21 11:38:17.445root 11241100x8000000000000000552574Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:17.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.bfb668422bf1b6bf2021-12-21 11:38:17.445root 11241100x8000000000000000552575Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:17.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.13325341d542c9482021-12-21 11:38:17.445root 11241100x8000000000000000552576Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:17.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b77af286e06fb6ab2021-12-21 11:38:17.445root 11241100x8000000000000000552577Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:17.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3067fab1341a97a42021-12-21 11:38:17.445root 11241100x8000000000000000552578Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:17.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.88ab3378ae3a87642021-12-21 11:38:17.445root 11241100x8000000000000000552579Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:17.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5b9b23a8a59b9c632021-12-21 11:38:17.445root 11241100x8000000000000000552580Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:17.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.378b96cc2e999ac52021-12-21 11:38:17.445root 11241100x8000000000000000552581Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:17.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5e6b8bfe67aa63aa2021-12-21 11:38:17.943root 11241100x8000000000000000552582Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:17.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c9efe13356290c0e2021-12-21 11:38:17.943root 11241100x8000000000000000552583Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:17.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.facce90264a0daf02021-12-21 11:38:17.943root 11241100x8000000000000000552584Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:17.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.48f489486c2b54c72021-12-21 11:38:17.943root 11241100x8000000000000000552585Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:17.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e9843b3fcdac67222021-12-21 11:38:17.944root 11241100x8000000000000000552586Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:17.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.579e9a1978047c632021-12-21 11:38:17.944root 11241100x8000000000000000552587Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:17.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f3c3c9db020d89802021-12-21 11:38:17.944root 11241100x8000000000000000552588Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:17.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3db5ee25dc6275bb2021-12-21 11:38:17.944root 11241100x8000000000000000552589Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:17.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c35b08d0a45175202021-12-21 11:38:17.944root 11241100x8000000000000000552590Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:17.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6ca89dc99817c8a72021-12-21 11:38:17.944root 11241100x8000000000000000552591Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:17.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.182cd9af3886a62b2021-12-21 11:38:17.944root 11241100x8000000000000000552592Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:17.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9e8f56e025300a4a2021-12-21 11:38:17.944root 11241100x8000000000000000552593Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:17.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.26e061efe8a298412021-12-21 11:38:17.944root 11241100x8000000000000000552594Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:17.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.94d89f5fbcd0a9a32021-12-21 11:38:17.944root 11241100x8000000000000000552595Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:17.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.fc55103beea6cb7e2021-12-21 11:38:17.944root 11241100x8000000000000000552596Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:17.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5e58b228063836c12021-12-21 11:38:17.944root 11241100x8000000000000000552597Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:17.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.143167ac5c9352be2021-12-21 11:38:17.944root 11241100x8000000000000000552598Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:17.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2ec2d471f23a5c512021-12-21 11:38:17.944root 11241100x8000000000000000552599Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:17.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.42b4ef2d76eb01082021-12-21 11:38:17.945root 11241100x8000000000000000552600Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:17.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0dc99ba3ac3b2a2d2021-12-21 11:38:17.945root 11241100x8000000000000000552601Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:17.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5c6d13a1a7a254cd2021-12-21 11:38:17.945root 11241100x8000000000000000552602Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:17.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.11730a45a5adbd592021-12-21 11:38:17.945root 11241100x8000000000000000552603Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:17.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b69963323d5105302021-12-21 11:38:17.945root 11241100x8000000000000000552604Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:17.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.439c3fbe7cf07b142021-12-21 11:38:17.945root 11241100x8000000000000000552605Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:17.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3a5f4f962f62e3022021-12-21 11:38:17.945root 11241100x8000000000000000552606Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:17.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.bbbcdd0df4f388a62021-12-21 11:38:17.945root 11241100x8000000000000000552607Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:18.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4c57fe533a9b39802021-12-21 11:38:18.443root 11241100x8000000000000000552608Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:18.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.732a745c3463f0962021-12-21 11:38:18.443root 11241100x8000000000000000552609Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:18.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5efef27509834e0d2021-12-21 11:38:18.443root 11241100x8000000000000000552610Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:18.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d438c2ad3f1ee77b2021-12-21 11:38:18.443root 11241100x8000000000000000552611Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:18.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.cc5291973b2dc2282021-12-21 11:38:18.444root 11241100x8000000000000000552612Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:18.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c9e9b14a114141772021-12-21 11:38:18.444root 11241100x8000000000000000552613Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:18.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.23110f60c4b85dfb2021-12-21 11:38:18.444root 11241100x8000000000000000552614Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:18.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.632303563320997e2021-12-21 11:38:18.444root 11241100x8000000000000000552615Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:18.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0be75f0e4ac332b42021-12-21 11:38:18.444root 11241100x8000000000000000552616Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:18.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d27b1bafee19c9022021-12-21 11:38:18.444root 11241100x8000000000000000552617Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:18.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.24397b864e1956a32021-12-21 11:38:18.444root 11241100x8000000000000000552618Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:18.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9284212aed43be042021-12-21 11:38:18.444root 11241100x8000000000000000552619Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:18.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a65e72db651669b22021-12-21 11:38:18.444root 11241100x8000000000000000552620Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:18.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.26eacf4def4f8d262021-12-21 11:38:18.444root 11241100x8000000000000000552621Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:18.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.10db8bb96037e3662021-12-21 11:38:18.444root 11241100x8000000000000000552622Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:18.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e13692eacce05e692021-12-21 11:38:18.444root 11241100x8000000000000000552623Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:18.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1c49053ae9fa70152021-12-21 11:38:18.444root 11241100x8000000000000000552624Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:18.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.61df4c202a0810b32021-12-21 11:38:18.444root 11241100x8000000000000000552625Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:18.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f9d187d577b868d32021-12-21 11:38:18.445root 11241100x8000000000000000552626Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:18.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0c0d98c56dafe7c82021-12-21 11:38:18.445root 11241100x8000000000000000552627Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:18.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e70b3a635273662b2021-12-21 11:38:18.445root 11241100x8000000000000000552628Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:18.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.203ab3b3b107ec5e2021-12-21 11:38:18.445root 11241100x8000000000000000552629Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:18.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e2e123d0fc1a665b2021-12-21 11:38:18.445root 11241100x8000000000000000552630Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:18.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a1e70a68bf3252bf2021-12-21 11:38:18.445root 11241100x8000000000000000552631Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:18.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7a5adfa126fd16342021-12-21 11:38:18.445root 11241100x8000000000000000552632Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:18.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.beadfb0edf261e802021-12-21 11:38:18.445root 11241100x8000000000000000552633Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:18.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d6667bb0d94422742021-12-21 11:38:18.943root 11241100x8000000000000000552634Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:18.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.bd5924c7ec83a0b52021-12-21 11:38:18.943root 11241100x8000000000000000552635Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:18.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f287fd4a566ef7552021-12-21 11:38:18.943root 11241100x8000000000000000552636Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:18.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d666bce3b3f95abe2021-12-21 11:38:18.944root 11241100x8000000000000000552637Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:18.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c98ed344d95396852021-12-21 11:38:18.944root 11241100x8000000000000000552638Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:18.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.34e4a2941f3335c02021-12-21 11:38:18.944root 11241100x8000000000000000552639Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:18.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.665707dc679aef752021-12-21 11:38:18.944root 11241100x8000000000000000552640Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:18.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.581043972370a5982021-12-21 11:38:18.944root 11241100x8000000000000000552641Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:18.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e3362a9fb73955fa2021-12-21 11:38:18.944root 11241100x8000000000000000552642Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:18.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.361283bb81e851b72021-12-21 11:38:18.944root 11241100x8000000000000000552643Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:18.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9d362a8d678ecece2021-12-21 11:38:18.944root 11241100x8000000000000000552644Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:18.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9f5180f5f54f7f302021-12-21 11:38:18.944root 11241100x8000000000000000552645Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:18.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9e4fbab8ef6be85a2021-12-21 11:38:18.944root 11241100x8000000000000000552646Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:18.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e28fae2c3147b6dc2021-12-21 11:38:18.944root 11241100x8000000000000000552647Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:18.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.765beb4db0ced52b2021-12-21 11:38:18.944root 11241100x8000000000000000552648Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:18.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.bcd9c98f2751b3fc2021-12-21 11:38:18.944root 11241100x8000000000000000552649Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:18.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d6e63a044b99cc9c2021-12-21 11:38:18.944root 11241100x8000000000000000552650Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:18.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.de4dc5871d6777532021-12-21 11:38:18.944root 11241100x8000000000000000552651Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:18.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.bde69330572b83232021-12-21 11:38:18.945root 11241100x8000000000000000552652Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:18.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d3f63be588e952432021-12-21 11:38:18.945root 11241100x8000000000000000552653Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:18.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6d58cb9f5a1129f42021-12-21 11:38:18.945root 11241100x8000000000000000552654Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:18.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ffb4a07b9d93a33f2021-12-21 11:38:18.945root 11241100x8000000000000000552655Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:18.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.53b7683576d5b08c2021-12-21 11:38:18.945root 11241100x8000000000000000552656Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:18.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9cf1685d70d7f4362021-12-21 11:38:18.945root 11241100x8000000000000000552657Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:18.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f21a36fcc4b127242021-12-21 11:38:18.945root 11241100x8000000000000000552658Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:18.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4fa0da2c60fca3312021-12-21 11:38:18.945root 354300x8000000000000000552659Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:19.096{ec2b6afe-95d9-61c1-5175-3a0400000000}5346/opt/splunkforwarder/etc/apps/Splunk_TA_stream/linux_x86_64/bin/streamfwdroottcptruefalse10.0.1.25-48832-false10.0.1.12-8000- 11241100x8000000000000000552660Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:19.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.12c462fe367e4b532021-12-21 11:38:19.443root 11241100x8000000000000000552661Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:19.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5435e5b61daf3ff62021-12-21 11:38:19.443root 11241100x8000000000000000552662Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:19.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3a055f9c5659abc72021-12-21 11:38:19.443root 11241100x8000000000000000552663Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:19.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6c9972bc8d4e0ffe2021-12-21 11:38:19.443root 11241100x8000000000000000552664Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:19.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.deb77d4aa572cd902021-12-21 11:38:19.444root 11241100x8000000000000000552665Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:19.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2a25b9b682baeadd2021-12-21 11:38:19.444root 11241100x8000000000000000552666Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:19.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f6c4f6a8df0b16882021-12-21 11:38:19.444root 11241100x8000000000000000552667Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:19.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.82c39e41f331138b2021-12-21 11:38:19.444root 11241100x8000000000000000552668Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:19.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9e8f49c4d71b40972021-12-21 11:38:19.444root 11241100x8000000000000000552669Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:19.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ce933cc6b5cefcad2021-12-21 11:38:19.444root 11241100x8000000000000000552670Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:19.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1ee57e0c8a3158562021-12-21 11:38:19.444root 11241100x8000000000000000552671Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:19.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.19b76e7bdfd4c6c92021-12-21 11:38:19.444root 11241100x8000000000000000552672Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:19.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f318f7893e82af4f2021-12-21 11:38:19.444root 11241100x8000000000000000552673Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:19.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8be47d64e6cf5a492021-12-21 11:38:19.444root 11241100x8000000000000000552674Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:19.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.106d09b40f42782d2021-12-21 11:38:19.444root 11241100x8000000000000000552675Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:19.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.be16ebf0748a83a62021-12-21 11:38:19.444root 11241100x8000000000000000552676Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:19.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.41c9ff448fd6b8ef2021-12-21 11:38:19.444root 11241100x8000000000000000552677Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:19.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b5e6b3c63c94f4e02021-12-21 11:38:19.444root 11241100x8000000000000000552678Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:19.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8495053ad0c2fe212021-12-21 11:38:19.444root 11241100x8000000000000000552679Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:19.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c78142cabd191b672021-12-21 11:38:19.444root 11241100x8000000000000000552680Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:19.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1349d8de412681682021-12-21 11:38:19.445root 11241100x8000000000000000552681Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:19.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a977a63120294f1e2021-12-21 11:38:19.445root 11241100x8000000000000000552682Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:19.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f8bd0c4c96da8be32021-12-21 11:38:19.445root 11241100x8000000000000000552683Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:19.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.28e1512fceef468f2021-12-21 11:38:19.445root 11241100x8000000000000000552684Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:19.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f317e1a4419060c62021-12-21 11:38:19.445root 11241100x8000000000000000552685Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:19.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0855bd24c713c9492021-12-21 11:38:19.445root 11241100x8000000000000000552686Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:19.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.570790d61280473f2021-12-21 11:38:19.445root 11241100x8000000000000000552687Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:19.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6bb1eb622f4f91f22021-12-21 11:38:19.943root 11241100x8000000000000000552688Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:19.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e798b77b4ae592902021-12-21 11:38:19.943root 11241100x8000000000000000552689Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:19.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5e0ec23a15394ef32021-12-21 11:38:19.943root 11241100x8000000000000000552690Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:19.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.99875e13fc95dfa42021-12-21 11:38:19.943root 11241100x8000000000000000552691Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:19.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d72fa23e2e6559a32021-12-21 11:38:19.943root 11241100x8000000000000000552692Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:19.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ffcb5ce951549e772021-12-21 11:38:19.943root 11241100x8000000000000000552693Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:19.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2a0b33aa86a7ed312021-12-21 11:38:19.943root 11241100x8000000000000000552694Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:19.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ec5f5af5afb5a9ee2021-12-21 11:38:19.943root 11241100x8000000000000000552695Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:19.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.31f96a530ade48fc2021-12-21 11:38:19.944root 11241100x8000000000000000552696Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:19.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ab9db45c4a0755692021-12-21 11:38:19.944root 11241100x8000000000000000552697Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:19.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.adb12d2044bec9a32021-12-21 11:38:19.944root 11241100x8000000000000000552698Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:19.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b4e9974a3a0a1b652021-12-21 11:38:19.944root 11241100x8000000000000000552699Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:19.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3e848ac3443b50f52021-12-21 11:38:19.944root 11241100x8000000000000000552700Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:19.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2d94214f8ccba8be2021-12-21 11:38:19.944root 11241100x8000000000000000552701Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:19.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.bbf4404d937ab5f82021-12-21 11:38:19.944root 11241100x8000000000000000552702Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:19.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.466234d677b9ac5b2021-12-21 11:38:19.944root 11241100x8000000000000000552703Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:19.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2e94694dc5a7e4812021-12-21 11:38:19.944root 11241100x8000000000000000552704Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:19.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.59f721143c8f80fb2021-12-21 11:38:19.944root 11241100x8000000000000000552705Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:19.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f5ccba948dba6a0e2021-12-21 11:38:19.944root 11241100x8000000000000000552706Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:19.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7362dbf04be69ed82021-12-21 11:38:19.944root 11241100x8000000000000000552707Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:19.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2f43f5daa95682a02021-12-21 11:38:19.945root 11241100x8000000000000000552708Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:19.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0753cca4bb59f53a2021-12-21 11:38:19.945root 11241100x8000000000000000552709Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:19.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5b1060151a527ecb2021-12-21 11:38:19.945root 11241100x8000000000000000552710Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:19.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4fb7d8b9a66948792021-12-21 11:38:19.945root 11241100x8000000000000000552711Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:19.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3b8a08519825ab372021-12-21 11:38:19.945root 11241100x8000000000000000552712Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:19.946{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.48c97c361dff1e012021-12-21 11:38:19.946root 11241100x8000000000000000552713Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:19.946{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c71a499f2a39d6842021-12-21 11:38:19.946root 11241100x8000000000000000552714Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:19.946{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.70ce18af17d745312021-12-21 11:38:19.946root 11241100x8000000000000000552715Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:19.946{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ee9fee3ece7662c02021-12-21 11:38:19.946root 11241100x8000000000000000552716Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:19.946{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e1a79c40ad05138c2021-12-21 11:38:19.946root 11241100x8000000000000000552717Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:19.946{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5e2249795b8807c72021-12-21 11:38:19.946root 11241100x8000000000000000552718Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:19.946{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.31ec9668ebdc22582021-12-21 11:38:19.946root 11241100x8000000000000000552719Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:19.946{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.bf1fe4deed5100f62021-12-21 11:38:19.946root 11241100x8000000000000000552720Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:19.946{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e5ea41248345e97e2021-12-21 11:38:19.946root 11241100x8000000000000000552721Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:19.946{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f957ae72db24b90e2021-12-21 11:38:19.946root 11241100x8000000000000000552722Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:19.946{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1932db4bfbf7586f2021-12-21 11:38:19.946root 11241100x8000000000000000552723Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:20.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1bb0ab4156b140cf2021-12-21 11:38:20.443root 11241100x8000000000000000552724Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:20.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.555a17d9e73448062021-12-21 11:38:20.444root 11241100x8000000000000000552725Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:20.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6a049fa5ed8e807f2021-12-21 11:38:20.444root 11241100x8000000000000000552726Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:20.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c682ee03428d2dbd2021-12-21 11:38:20.444root 11241100x8000000000000000552727Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:20.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f8707428c2caa94e2021-12-21 11:38:20.444root 11241100x8000000000000000552728Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:20.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.bb23237694652c4c2021-12-21 11:38:20.444root 11241100x8000000000000000552729Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:20.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.609d03322ec130202021-12-21 11:38:20.444root 11241100x8000000000000000552730Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:20.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e3cf4215651d8f892021-12-21 11:38:20.444root 11241100x8000000000000000552731Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:20.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.97ad911d74bf84392021-12-21 11:38:20.444root 11241100x8000000000000000552732Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:20.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4c86085d25b6a3942021-12-21 11:38:20.444root 11241100x8000000000000000552733Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:20.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4a3e438f0c9f4ba52021-12-21 11:38:20.444root 11241100x8000000000000000552734Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:20.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1002bbdc9b97b5cc2021-12-21 11:38:20.444root 11241100x8000000000000000552735Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:20.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.613185b8acf73c1d2021-12-21 11:38:20.444root 11241100x8000000000000000552736Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:20.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7332b4cd4e3083332021-12-21 11:38:20.444root 11241100x8000000000000000552737Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:20.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.907021d5c10671ee2021-12-21 11:38:20.444root 11241100x8000000000000000552738Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:20.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.913bf53ba6d2938a2021-12-21 11:38:20.445root 11241100x8000000000000000552739Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:20.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e5388360e7d966d02021-12-21 11:38:20.445root 11241100x8000000000000000552740Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:20.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.326fbeb3b92a58822021-12-21 11:38:20.445root 11241100x8000000000000000552741Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:20.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4b796e0fde06144d2021-12-21 11:38:20.445root 11241100x8000000000000000552742Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:20.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.dcf9fadf95d3dac72021-12-21 11:38:20.445root 11241100x8000000000000000552743Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:20.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ff1da92923ed9ad02021-12-21 11:38:20.445root 11241100x8000000000000000552744Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:20.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.346ff29c164075802021-12-21 11:38:20.445root 11241100x8000000000000000552745Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:20.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1f99f521edfd01d42021-12-21 11:38:20.445root 11241100x8000000000000000552746Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:20.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.39f7eae981cd4b772021-12-21 11:38:20.445root 11241100x8000000000000000552747Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:20.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f1d0c80f06d9277b2021-12-21 11:38:20.445root 11241100x8000000000000000552748Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:20.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.da9d90f3d29049632021-12-21 11:38:20.445root 11241100x8000000000000000552749Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:20.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7350864e4895bce12021-12-21 11:38:20.445root 11241100x8000000000000000552750Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:20.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.62fbffa69372145f2021-12-21 11:38:20.943root 11241100x8000000000000000552751Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:20.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.27278725f5bd61a32021-12-21 11:38:20.943root 11241100x8000000000000000552752Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:20.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8f045df645b9e3f12021-12-21 11:38:20.943root 11241100x8000000000000000552753Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:20.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4c0cd7acd828d8772021-12-21 11:38:20.943root 11241100x8000000000000000552754Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:20.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.551312c0edb35f872021-12-21 11:38:20.943root 11241100x8000000000000000552755Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:20.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.927886dbd92cde3c2021-12-21 11:38:20.944root 11241100x8000000000000000552756Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:20.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.353571b65f2476f62021-12-21 11:38:20.944root 11241100x8000000000000000552757Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:20.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.93a948a5deefdcb62021-12-21 11:38:20.944root 11241100x8000000000000000552758Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:20.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.caee47eff8bfc8312021-12-21 11:38:20.944root 11241100x8000000000000000552759Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:20.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ef2c62a9a7ca57a12021-12-21 11:38:20.944root 11241100x8000000000000000552760Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:20.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ce6268a19b8ef9df2021-12-21 11:38:20.944root 11241100x8000000000000000552761Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:20.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8304a66569cbdd202021-12-21 11:38:20.944root 11241100x8000000000000000552762Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:20.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.31c063839fd1dd802021-12-21 11:38:20.944root 11241100x8000000000000000552763Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:20.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d0554df43cf31d062021-12-21 11:38:20.944root 11241100x8000000000000000552764Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:20.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e6e184f251a1335b2021-12-21 11:38:20.944root 11241100x8000000000000000552765Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:20.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.45e4a302ebece4bb2021-12-21 11:38:20.944root 11241100x8000000000000000552766Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:20.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.880d3229f9f7d1bf2021-12-21 11:38:20.944root 11241100x8000000000000000552767Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:20.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.cd99aeec1595ee4a2021-12-21 11:38:20.944root 11241100x8000000000000000552768Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:20.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6bd559213e5317222021-12-21 11:38:20.944root 11241100x8000000000000000552769Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:20.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.84bdbb7231a7a0682021-12-21 11:38:20.944root 11241100x8000000000000000552770Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:20.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9fef9f05b17b16032021-12-21 11:38:20.945root 11241100x8000000000000000552771Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:20.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9e1eb88350712d842021-12-21 11:38:20.945root 11241100x8000000000000000552772Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:20.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2141f48445a7cdc82021-12-21 11:38:20.945root 11241100x8000000000000000552773Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:20.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d28b3d62723be9352021-12-21 11:38:20.945root 11241100x8000000000000000552774Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:20.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.bb2b33182fb5d5142021-12-21 11:38:20.945root 11241100x8000000000000000552775Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:20.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.db36cf000a191e6e2021-12-21 11:38:20.945root 11241100x8000000000000000552776Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:20.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6bacc7ce8db116822021-12-21 11:38:20.945root 11241100x8000000000000000552777Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:21.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6fa792815af845b22021-12-21 11:38:21.443root 11241100x8000000000000000552778Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:21.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d1cc2a46707019d92021-12-21 11:38:21.443root 11241100x8000000000000000552779Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:21.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.30bbb4f0e6f7f0492021-12-21 11:38:21.443root 11241100x8000000000000000552780Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:21.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c973dd8ed7c601962021-12-21 11:38:21.443root 11241100x8000000000000000552781Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:21.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c29e98bc61faa4f52021-12-21 11:38:21.443root 11241100x8000000000000000552782Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:21.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.12d8e6db0f75a2672021-12-21 11:38:21.443root 11241100x8000000000000000552783Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:21.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2305633aa1df45aa2021-12-21 11:38:21.443root 11241100x8000000000000000552784Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:21.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.063d240cbe128a422021-12-21 11:38:21.444root 11241100x8000000000000000552785Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:21.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.bca34c92351fcbdf2021-12-21 11:38:21.444root 11241100x8000000000000000552786Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:21.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a4eeb9ae1c53095e2021-12-21 11:38:21.444root 11241100x8000000000000000552787Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:21.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1d036be815f6bad02021-12-21 11:38:21.444root 11241100x8000000000000000552788Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:21.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3f2f339a2ffc5c852021-12-21 11:38:21.444root 11241100x8000000000000000552789Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:21.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f84050544b4b019d2021-12-21 11:38:21.444root 11241100x8000000000000000552790Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:21.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d1cd8d528b44c0202021-12-21 11:38:21.444root 11241100x8000000000000000552791Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:21.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c04625ee93cb30472021-12-21 11:38:21.444root 11241100x8000000000000000552792Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:21.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f708f31962e126a72021-12-21 11:38:21.444root 11241100x8000000000000000552793Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:21.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.df5df4c8968b2ffd2021-12-21 11:38:21.444root 11241100x8000000000000000552794Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:21.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.73257583f10e96122021-12-21 11:38:21.444root 11241100x8000000000000000552795Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:21.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1c0ce62b515d54182021-12-21 11:38:21.444root 11241100x8000000000000000552796Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:21.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.dbee0e7ef1560d612021-12-21 11:38:21.444root 11241100x8000000000000000552797Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:21.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.52518395fb57d5a52021-12-21 11:38:21.444root 11241100x8000000000000000552798Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:21.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c7166fcceb36b5632021-12-21 11:38:21.444root 11241100x8000000000000000552799Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:21.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.567867bf261a9b7c2021-12-21 11:38:21.445root 11241100x8000000000000000552800Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:21.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7547883e6a99d3232021-12-21 11:38:21.445root 11241100x8000000000000000552801Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:21.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6bfb07b3dc8af4722021-12-21 11:38:21.445root 11241100x8000000000000000552802Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:21.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.72abcb1fbfcf6ee62021-12-21 11:38:21.445root 11241100x8000000000000000552803Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:21.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3b30ce807fbadc892021-12-21 11:38:21.445root 11241100x8000000000000000552804Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:21.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.237d6d88c52ce35e2021-12-21 11:38:21.943root 11241100x8000000000000000552805Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:21.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9bee964e8f39f9922021-12-21 11:38:21.943root 11241100x8000000000000000552806Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:21.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6057d3a1576e62742021-12-21 11:38:21.943root 11241100x8000000000000000552807Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:21.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d33394868528b5bf2021-12-21 11:38:21.944root 11241100x8000000000000000552808Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:21.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.005e00a4ee941cd02021-12-21 11:38:21.944root 11241100x8000000000000000552809Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:21.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.bfdb76b157d28a252021-12-21 11:38:21.944root 11241100x8000000000000000552810Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:21.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0abdc7ea3d171f0e2021-12-21 11:38:21.944root 11241100x8000000000000000552811Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:21.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7aac6df2efc8e5922021-12-21 11:38:21.944root 11241100x8000000000000000552812Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:21.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1e82ab3a917c3d292021-12-21 11:38:21.945root 11241100x8000000000000000552813Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:21.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ac7165a4495b1c662021-12-21 11:38:21.945root 11241100x8000000000000000552814Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:21.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0ac1f5306699e0052021-12-21 11:38:21.945root 11241100x8000000000000000552815Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:21.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a4c3363213a7bd232021-12-21 11:38:21.945root 11241100x8000000000000000552816Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:21.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d4ca7ad03c57c4b92021-12-21 11:38:21.945root 11241100x8000000000000000552817Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:21.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c3fd0596a82f3bfe2021-12-21 11:38:21.945root 11241100x8000000000000000552818Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:21.946{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.45f0ced0f61b1c752021-12-21 11:38:21.946root 11241100x8000000000000000552819Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:21.946{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a8cc920fcee197ef2021-12-21 11:38:21.946root 11241100x8000000000000000552820Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:21.946{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.03eaa0d8079f93642021-12-21 11:38:21.946root 11241100x8000000000000000552821Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:21.946{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.bf88901a81d336932021-12-21 11:38:21.946root 11241100x8000000000000000552822Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:21.946{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.009f1a4469bc89b62021-12-21 11:38:21.946root 11241100x8000000000000000552823Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:21.947{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.502315a2cbc921002021-12-21 11:38:21.947root 11241100x8000000000000000552824Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:21.947{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9d28c6088eb4d6572021-12-21 11:38:21.947root 11241100x8000000000000000552825Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:21.947{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.85bbde9bad2ffeaa2021-12-21 11:38:21.947root 11241100x8000000000000000552826Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:21.947{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.de8dd333184c62502021-12-21 11:38:21.947root 11241100x8000000000000000552827Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:21.947{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e4f7c460fe867de82021-12-21 11:38:21.947root 11241100x8000000000000000552828Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:21.947{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d5ba85dccfb5ebb92021-12-21 11:38:21.947root 11241100x8000000000000000552829Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:21.947{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.71f2852c5f1822b22021-12-21 11:38:21.947root 11241100x8000000000000000552830Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:21.948{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9fd1082d31a868022021-12-21 11:38:21.948root 11241100x8000000000000000552831Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:21.948{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d38c805ba94d06bb2021-12-21 11:38:21.948root 11241100x8000000000000000552832Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:21.948{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ca3f0164751723dd2021-12-21 11:38:21.948root 11241100x8000000000000000552833Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:21.948{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.79a3adc089c7b22f2021-12-21 11:38:21.948root 11241100x8000000000000000552834Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:22.442{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.eed67f953d98f7c92021-12-21 11:38:22.442root 11241100x8000000000000000552835Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:22.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e91d41f7a2eddb042021-12-21 11:38:22.443root 11241100x8000000000000000552836Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:22.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.fdc318b8a7caf4852021-12-21 11:38:22.443root 11241100x8000000000000000552837Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:22.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c291a107acb250052021-12-21 11:38:22.443root 11241100x8000000000000000552838Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:22.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.cf7b81fb667927c22021-12-21 11:38:22.443root 11241100x8000000000000000552839Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:22.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.05f594d6c2ddae172021-12-21 11:38:22.443root 11241100x8000000000000000552840Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:22.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ced516319df678962021-12-21 11:38:22.443root 11241100x8000000000000000552841Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:22.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d98d4e917aa8c6272021-12-21 11:38:22.443root 11241100x8000000000000000552842Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:22.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2773a8592e80c4422021-12-21 11:38:22.443root 11241100x8000000000000000552843Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:22.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.28d4a5c042b9f27d2021-12-21 11:38:22.444root 11241100x8000000000000000552844Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:22.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7846729e806a984d2021-12-21 11:38:22.444root 11241100x8000000000000000552845Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:22.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c474a4e318840fcb2021-12-21 11:38:22.444root 11241100x8000000000000000552846Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:22.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0143808a8ceaf23a2021-12-21 11:38:22.444root 11241100x8000000000000000552847Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:22.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.56efe9d7bfb464882021-12-21 11:38:22.444root 11241100x8000000000000000552848Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:22.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8c6a0ca67042283c2021-12-21 11:38:22.444root 11241100x8000000000000000552849Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:22.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9e95f477339d723c2021-12-21 11:38:22.444root 11241100x8000000000000000552850Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:22.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f0e896465910b2082021-12-21 11:38:22.444root 11241100x8000000000000000552851Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:22.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3d21f76df17f03ba2021-12-21 11:38:22.444root 11241100x8000000000000000552852Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:22.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6bfe0530af41f53e2021-12-21 11:38:22.444root 11241100x8000000000000000552853Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:22.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5dd00e5ec55a05ab2021-12-21 11:38:22.444root 11241100x8000000000000000552854Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:22.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d45ef01c2e4e85202021-12-21 11:38:22.444root 11241100x8000000000000000552855Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:22.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c188021c4e5cf57f2021-12-21 11:38:22.444root 11241100x8000000000000000552856Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:22.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4ea093bd3a26a9752021-12-21 11:38:22.445root 11241100x8000000000000000552857Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:22.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a2e2d68e48255d2d2021-12-21 11:38:22.445root 11241100x8000000000000000552858Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:22.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.921b1d907bbb13fb2021-12-21 11:38:22.445root 11241100x8000000000000000552859Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:22.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a9a998e7dc8e6eb92021-12-21 11:38:22.445root 11241100x8000000000000000552860Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:22.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1129b2c7e835a7242021-12-21 11:38:22.445root 11241100x8000000000000000552861Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:22.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6665759006157a172021-12-21 11:38:22.445root 11241100x8000000000000000552862Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:22.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b6d5b7eaa09ab96e2021-12-21 11:38:22.445root 11241100x8000000000000000552863Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:22.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.88d1d8796701ac932021-12-21 11:38:22.445root 11241100x8000000000000000552864Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:22.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.47e90777800b43c42021-12-21 11:38:22.445root 11241100x8000000000000000552865Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:22.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c0662df1beea13bd2021-12-21 11:38:22.445root 11241100x8000000000000000552866Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:22.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a27531bee9391e0d2021-12-21 11:38:22.445root 11241100x8000000000000000552867Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:22.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.912328295c5f02592021-12-21 11:38:22.943root 11241100x8000000000000000552868Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:22.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e165b5bc98bca2642021-12-21 11:38:22.943root 11241100x8000000000000000552869Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:22.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b905735516564d6b2021-12-21 11:38:22.943root 11241100x8000000000000000552870Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:22.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4e776105f48c7d0b2021-12-21 11:38:22.943root 11241100x8000000000000000552871Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:22.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0547ae78550133582021-12-21 11:38:22.943root 11241100x8000000000000000552872Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:22.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c23b3ccb50d927f22021-12-21 11:38:22.944root 11241100x8000000000000000552873Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:22.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7a46dae1c2cf30b32021-12-21 11:38:22.944root 11241100x8000000000000000552874Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:22.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.fb51f78c30d3d8852021-12-21 11:38:22.944root 11241100x8000000000000000552875Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:22.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a15ba5ec73ca63522021-12-21 11:38:22.944root 11241100x8000000000000000552876Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:22.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d2c1c885e8ca25f02021-12-21 11:38:22.944root 11241100x8000000000000000552877Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:22.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.57e8bdbe514e57be2021-12-21 11:38:22.944root 11241100x8000000000000000552878Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:22.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6d153955c11eec5d2021-12-21 11:38:22.944root 11241100x8000000000000000552879Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:22.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d38b0d8d752d29bc2021-12-21 11:38:22.944root 11241100x8000000000000000552880Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:22.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.20461e160677abc02021-12-21 11:38:22.944root 11241100x8000000000000000552881Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:22.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a4cf06bfca59a0cc2021-12-21 11:38:22.944root 11241100x8000000000000000552882Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:22.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b1f674c1c0a0acf32021-12-21 11:38:22.944root 11241100x8000000000000000552883Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:22.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2193a447ac33ea452021-12-21 11:38:22.944root 11241100x8000000000000000552884Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:22.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3801ac20851273e52021-12-21 11:38:22.944root 11241100x8000000000000000552885Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:22.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.fe880767411994eb2021-12-21 11:38:22.944root 11241100x8000000000000000552886Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:22.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a672e09b187eef142021-12-21 11:38:22.944root 11241100x8000000000000000552887Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:22.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.271ac8657bb1d2ab2021-12-21 11:38:22.945root 11241100x8000000000000000552888Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:22.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1fd17f251dd868572021-12-21 11:38:22.945root 11241100x8000000000000000552889Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:22.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.87aa5da2ff4c35f82021-12-21 11:38:22.945root 11241100x8000000000000000552890Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:22.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2017f51415a158b42021-12-21 11:38:22.945root 11241100x8000000000000000552891Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:22.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ab2ea51c94bfb9e72021-12-21 11:38:22.945root 11241100x8000000000000000552892Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:22.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d6c6f38519a137352021-12-21 11:38:22.945root 11241100x8000000000000000552893Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:22.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f4a4a895799a694b2021-12-21 11:38:22.945root 11241100x8000000000000000552894Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:23.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0a4eab4255ecea362021-12-21 11:38:23.443root 11241100x8000000000000000552895Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:23.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a8428d6ab17ea57f2021-12-21 11:38:23.443root 11241100x8000000000000000552896Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:23.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ba92f8c58a9dc2292021-12-21 11:38:23.443root 11241100x8000000000000000552897Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:23.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.fb5b45b48970b6b72021-12-21 11:38:23.443root 11241100x8000000000000000552898Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:23.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.53ae031d71aaf9b42021-12-21 11:38:23.444root 11241100x8000000000000000552899Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:23.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.68fca0bfbda0f2542021-12-21 11:38:23.444root 11241100x8000000000000000552900Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:23.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.572ec150f28b0f672021-12-21 11:38:23.444root 11241100x8000000000000000552901Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:23.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5982552a44b64d912021-12-21 11:38:23.444root 11241100x8000000000000000552902Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:23.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e56e78461ee03fb12021-12-21 11:38:23.444root 11241100x8000000000000000552903Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:23.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.313835e8a47587c82021-12-21 11:38:23.444root 11241100x8000000000000000552904Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:23.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.df978457ee225c532021-12-21 11:38:23.444root 11241100x8000000000000000552905Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:23.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9411b915088d23ad2021-12-21 11:38:23.444root 11241100x8000000000000000552906Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:23.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.fa399a8348843ac72021-12-21 11:38:23.444root 11241100x8000000000000000552907Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:23.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.aa88748746f67b912021-12-21 11:38:23.444root 11241100x8000000000000000552908Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:23.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c6f9718a4132791f2021-12-21 11:38:23.444root 11241100x8000000000000000552909Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:23.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.704e1b1176ce0f192021-12-21 11:38:23.444root 11241100x8000000000000000552910Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:23.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.547a1dd58c3c6f152021-12-21 11:38:23.444root 11241100x8000000000000000552911Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:23.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.14e68e87947611492021-12-21 11:38:23.444root 11241100x8000000000000000552912Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:23.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1eb595e134c54d692021-12-21 11:38:23.445root 11241100x8000000000000000552913Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:23.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.218ee0494901af142021-12-21 11:38:23.445root 11241100x8000000000000000552914Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:23.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.49d8f5cf1d792ac12021-12-21 11:38:23.445root 11241100x8000000000000000552915Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:23.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e8bf3f112fbdee932021-12-21 11:38:23.445root 11241100x8000000000000000552916Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:23.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f3e9fde2fedd661a2021-12-21 11:38:23.445root 11241100x8000000000000000552917Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:23.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.102f2491a9a7c67c2021-12-21 11:38:23.445root 11241100x8000000000000000552918Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:23.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a8c496e31a9e403e2021-12-21 11:38:23.445root 11241100x8000000000000000552919Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:23.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.71ba3ff59f8f17f62021-12-21 11:38:23.445root 11241100x8000000000000000552920Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:23.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e74864ca722b87be2021-12-21 11:38:23.445root 11241100x8000000000000000552921Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:23.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e2baf8571c743f7b2021-12-21 11:38:23.943root 11241100x8000000000000000552922Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:23.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9d1a9d7af20ab7682021-12-21 11:38:23.943root 11241100x8000000000000000552923Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:23.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.895e1a9d7183f64a2021-12-21 11:38:23.943root 11241100x8000000000000000552924Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:23.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5d9b6410080e737a2021-12-21 11:38:23.943root 11241100x8000000000000000552925Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:23.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.cd3d24af9881a3022021-12-21 11:38:23.944root 11241100x8000000000000000552926Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:23.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5497af0d7a259e022021-12-21 11:38:23.944root 11241100x8000000000000000552927Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:23.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.874590427e416da42021-12-21 11:38:23.944root 11241100x8000000000000000552928Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:23.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7af200e88d8bb5072021-12-21 11:38:23.944root 11241100x8000000000000000552929Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:23.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4e8fb6d670f92d622021-12-21 11:38:23.944root 11241100x8000000000000000552930Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:23.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c9b557fe0036468a2021-12-21 11:38:23.944root 11241100x8000000000000000552931Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:23.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1dea85ac75edb0aa2021-12-21 11:38:23.944root 11241100x8000000000000000552932Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:23.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.973d70874c9b99172021-12-21 11:38:23.944root 11241100x8000000000000000552933Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:23.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.df577b9180ffcba92021-12-21 11:38:23.944root 11241100x8000000000000000552934Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:23.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.27b36f095a2062d32021-12-21 11:38:23.944root 11241100x8000000000000000552935Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:23.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9a71977829c02d822021-12-21 11:38:23.944root 11241100x8000000000000000552936Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:23.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.baab67cbeedfbe822021-12-21 11:38:23.944root 11241100x8000000000000000552937Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:23.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.baaf4b1cb1206d732021-12-21 11:38:23.944root 11241100x8000000000000000552938Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:23.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.717404f74cc704f12021-12-21 11:38:23.944root 11241100x8000000000000000552939Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:23.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f30b358ffd04e9d32021-12-21 11:38:23.944root 11241100x8000000000000000552940Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:23.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.14020ed47379b82a2021-12-21 11:38:23.945root 11241100x8000000000000000552941Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:23.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4bb7750bdeefa8392021-12-21 11:38:23.945root 11241100x8000000000000000552942Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:23.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1cf6d01430836bcd2021-12-21 11:38:23.945root 11241100x8000000000000000552943Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:23.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e654331866544f582021-12-21 11:38:23.945root 11241100x8000000000000000552944Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:23.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3ed2c5a14c387f9e2021-12-21 11:38:23.945root 11241100x8000000000000000552945Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:23.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.467951a5a55290f52021-12-21 11:38:23.945root 11241100x8000000000000000552946Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:23.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6a21d185d7aca4752021-12-21 11:38:23.945root 11241100x8000000000000000552947Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:23.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a745cb86c234398e2021-12-21 11:38:23.945root 354300x8000000000000000552948Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:24.149{ec2b6afe-95d9-61c1-5175-3a0400000000}5346/opt/splunkforwarder/etc/apps/Splunk_TA_stream/linux_x86_64/bin/streamfwdroottcptruefalse10.0.1.25-48834-false10.0.1.12-8000- 11241100x8000000000000000552949Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:24.442{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.24197507a845731e2021-12-21 11:38:24.442root 11241100x8000000000000000552950Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:24.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e2f725189cbe25622021-12-21 11:38:24.443root 11241100x8000000000000000552951Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:24.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.82c6d0d51b8b779d2021-12-21 11:38:24.443root 11241100x8000000000000000552952Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:24.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c86d1bebce9324e42021-12-21 11:38:24.444root 11241100x8000000000000000552953Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:24.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ce4054b7ab56fd502021-12-21 11:38:24.444root 11241100x8000000000000000552954Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:24.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d4f6427b0c129bc42021-12-21 11:38:24.444root 11241100x8000000000000000552955Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:24.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f526008093079fb52021-12-21 11:38:24.444root 11241100x8000000000000000552956Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:24.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b94b3aa4f4b0426d2021-12-21 11:38:24.444root 11241100x8000000000000000552957Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:24.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4205471534f0c2c72021-12-21 11:38:24.444root 11241100x8000000000000000552958Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:24.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.fea4ffdecc04504e2021-12-21 11:38:24.444root 11241100x8000000000000000552959Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:24.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4c45c4b4b851fc4c2021-12-21 11:38:24.444root 11241100x8000000000000000552960Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:24.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c2b2e6a235a49b682021-12-21 11:38:24.445root 11241100x8000000000000000552961Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:24.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.92b2dd179c4522cd2021-12-21 11:38:24.445root 11241100x8000000000000000552962Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:24.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.874be6b645d1d6682021-12-21 11:38:24.445root 11241100x8000000000000000552963Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:24.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8ef0727b961720442021-12-21 11:38:24.445root 11241100x8000000000000000552964Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:24.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3ae7155c883f324a2021-12-21 11:38:24.445root 11241100x8000000000000000552965Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:24.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e012900071f22dea2021-12-21 11:38:24.445root 11241100x8000000000000000552966Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:24.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.374f39e74fcc168e2021-12-21 11:38:24.445root 11241100x8000000000000000552967Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:24.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f57b67666030e6a92021-12-21 11:38:24.445root 11241100x8000000000000000552968Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:24.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0316662a74d45b0d2021-12-21 11:38:24.445root 11241100x8000000000000000552969Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:24.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.fb615330cd9aed5d2021-12-21 11:38:24.445root 11241100x8000000000000000552970Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:24.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.772e617f14ad167e2021-12-21 11:38:24.445root 11241100x8000000000000000552971Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:24.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6f283b54313108562021-12-21 11:38:24.445root 11241100x8000000000000000552972Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:24.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a8711e534f0d70eb2021-12-21 11:38:24.445root 11241100x8000000000000000552973Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:24.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.69f04a2d9c6914532021-12-21 11:38:24.445root 11241100x8000000000000000552974Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:24.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e257d038a87a0e9c2021-12-21 11:38:24.445root 11241100x8000000000000000552975Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:24.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.21c65414979616bb2021-12-21 11:38:24.445root 11241100x8000000000000000552976Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:24.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c21051b6d4db43a82021-12-21 11:38:24.445root 11241100x8000000000000000552977Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:24.446{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.961290cce32f30762021-12-21 11:38:24.446root 11241100x8000000000000000552978Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:24.446{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9ff007e92d0762862021-12-21 11:38:24.446root 11241100x8000000000000000552979Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:24.446{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3064d32cba0a8f6f2021-12-21 11:38:24.446root 11241100x8000000000000000552980Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:24.446{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.091457d25b0089302021-12-21 11:38:24.446root 11241100x8000000000000000552981Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:24.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.02ff8edec7d371c32021-12-21 11:38:24.943root 11241100x8000000000000000552982Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:24.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.fb86e51a6c2748682021-12-21 11:38:24.943root 11241100x8000000000000000552983Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:24.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6ac563350551aad22021-12-21 11:38:24.944root 11241100x8000000000000000552984Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:24.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.75e8354f5f82fc1d2021-12-21 11:38:24.944root 11241100x8000000000000000552985Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:24.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.71b5baf264b561bf2021-12-21 11:38:24.944root 11241100x8000000000000000552986Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:24.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.850beaaf465b617a2021-12-21 11:38:24.944root 11241100x8000000000000000552987Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:24.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0539e5ba1d13409a2021-12-21 11:38:24.944root 11241100x8000000000000000552988Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:24.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.df3262e703ecf7b32021-12-21 11:38:24.944root 11241100x8000000000000000552989Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:24.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c4f3babf50e2b06e2021-12-21 11:38:24.944root 11241100x8000000000000000552990Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:24.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a80c743c3c4b41b72021-12-21 11:38:24.945root 11241100x8000000000000000552991Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:24.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b6f782a7bf06d40e2021-12-21 11:38:24.945root 11241100x8000000000000000552992Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:24.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.593f7af6fdc3a9d22021-12-21 11:38:24.945root 11241100x8000000000000000552993Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:24.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.cf34934afd5136c02021-12-21 11:38:24.945root 11241100x8000000000000000552994Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:24.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e1b5099cd5a2e5f22021-12-21 11:38:24.945root 11241100x8000000000000000552995Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:24.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7c0c5b5c44511d562021-12-21 11:38:24.945root 11241100x8000000000000000552996Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:24.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.cf47655f7cce7c342021-12-21 11:38:24.945root 11241100x8000000000000000552997Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:24.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.18ab2142ef0ed2492021-12-21 11:38:24.945root 11241100x8000000000000000552998Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:24.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ccb5132c8e76b5442021-12-21 11:38:24.945root 11241100x8000000000000000552999Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:24.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f20dc7321e79dd352021-12-21 11:38:24.945root 11241100x8000000000000000553000Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:24.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d799dbbfc0b559ca2021-12-21 11:38:24.945root 11241100x8000000000000000553001Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:24.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.489b605288a090932021-12-21 11:38:24.945root 11241100x8000000000000000553002Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:24.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.00450c27adade4112021-12-21 11:38:24.945root 11241100x8000000000000000553003Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:24.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.666f4aeb7d6b5ac02021-12-21 11:38:24.945root 11241100x8000000000000000553004Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:24.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7d5398583bd8b9142021-12-21 11:38:24.945root 11241100x8000000000000000553005Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:24.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1e251cb41640042d2021-12-21 11:38:24.945root 11241100x8000000000000000553006Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:24.946{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.66cfe7953eecc1012021-12-21 11:38:24.946root 11241100x8000000000000000553007Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:24.946{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4091755ee2cc3f592021-12-21 11:38:24.946root 11241100x8000000000000000553008Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:24.946{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4c9dac62d4f4bdb22021-12-21 11:38:24.946root 11241100x8000000000000000553009Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:25.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.17a238da33735cc72021-12-21 11:38:25.443root 11241100x8000000000000000553010Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:25.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7b7ad08e3f9404452021-12-21 11:38:25.443root 11241100x8000000000000000553011Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:25.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6861a7179423172c2021-12-21 11:38:25.443root 11241100x8000000000000000553012Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:25.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e85694a45f47bd0c2021-12-21 11:38:25.443root 11241100x8000000000000000553013Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:25.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9d523157ebb3b0162021-12-21 11:38:25.443root 11241100x8000000000000000553014Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:25.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.89569753dba2e5c62021-12-21 11:38:25.444root 11241100x8000000000000000553015Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:25.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5e5f9636763286f02021-12-21 11:38:25.444root 11241100x8000000000000000553016Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:25.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.65e746d6571df87e2021-12-21 11:38:25.444root 11241100x8000000000000000553017Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:25.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.511ac6b015ddd6f12021-12-21 11:38:25.444root 11241100x8000000000000000553018Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:25.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ca98763367d93f1f2021-12-21 11:38:25.444root 11241100x8000000000000000553019Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:25.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a942fc863461fc152021-12-21 11:38:25.444root 11241100x8000000000000000553020Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:25.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0e63fa3f865522622021-12-21 11:38:25.444root 11241100x8000000000000000553021Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:25.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3ae77a6f7c3648ae2021-12-21 11:38:25.445root 11241100x8000000000000000553022Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:25.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1ddbdc74fcd780a52021-12-21 11:38:25.445root 11241100x8000000000000000553023Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:25.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.737ba5cc7602b2502021-12-21 11:38:25.445root 11241100x8000000000000000553024Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:25.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e093fdad9a94203d2021-12-21 11:38:25.445root 11241100x8000000000000000553025Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:25.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c0ce1cd62ff7c0d72021-12-21 11:38:25.445root 11241100x8000000000000000553026Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:25.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e62980b59442b02b2021-12-21 11:38:25.445root 11241100x8000000000000000553027Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:25.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7d78575ee30cd3e52021-12-21 11:38:25.445root 11241100x8000000000000000553028Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:25.446{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.64de1c072cd1e3432021-12-21 11:38:25.446root 11241100x8000000000000000553029Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:25.446{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4588fca8182effa52021-12-21 11:38:25.446root 11241100x8000000000000000553030Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:25.446{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.60ed261a81e84dd02021-12-21 11:38:25.446root 11241100x8000000000000000553031Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:25.446{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.94deed6c036a50752021-12-21 11:38:25.446root 11241100x8000000000000000553032Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:25.446{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6fafd530af689df22021-12-21 11:38:25.446root 11241100x8000000000000000553033Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:25.446{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8596e90c5dfab69f2021-12-21 11:38:25.446root 11241100x8000000000000000553034Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:25.446{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.650de0be174fbb502021-12-21 11:38:25.446root 11241100x8000000000000000553035Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:25.446{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4db4be8f3a7093da2021-12-21 11:38:25.446root 11241100x8000000000000000553036Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:25.446{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ce2d666d0c6ab3a52021-12-21 11:38:25.446root 11241100x8000000000000000553037Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:25.446{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.75218b9e6f68fc472021-12-21 11:38:25.446root 11241100x8000000000000000553038Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:25.446{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9c0d868e04bf63ee2021-12-21 11:38:25.446root 11241100x8000000000000000553039Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:25.446{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5c75f08b3984654e2021-12-21 11:38:25.446root 11241100x8000000000000000553040Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:25.446{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f8f96c73418fdc742021-12-21 11:38:25.446root 11241100x8000000000000000553041Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:25.446{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0c234260f5dd2b232021-12-21 11:38:25.446root 11241100x8000000000000000553042Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:25.447{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1ba1527df671287c2021-12-21 11:38:25.447root 11241100x8000000000000000553043Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:25.447{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.dd9bdafac16bf7ab2021-12-21 11:38:25.447root 11241100x8000000000000000553044Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:25.447{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.43ca9d7586d792e32021-12-21 11:38:25.447root 11241100x8000000000000000553045Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:25.447{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c4dba1ce32552f372021-12-21 11:38:25.447root 11241100x8000000000000000553046Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:25.447{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.dd7fb6eb6f11d4d52021-12-21 11:38:25.447root 11241100x8000000000000000553047Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:25.447{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2212a658931957df2021-12-21 11:38:25.447root 11241100x8000000000000000553048Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:25.447{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.190a346ec2afb8072021-12-21 11:38:25.447root 11241100x8000000000000000553049Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:25.447{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.122823c8cc09a0632021-12-21 11:38:25.447root 11241100x8000000000000000553050Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:25.447{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d816c2ce85f437042021-12-21 11:38:25.447root 11241100x8000000000000000553051Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:25.447{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b167158d17f189642021-12-21 11:38:25.447root 11241100x8000000000000000553052Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:25.447{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e89be53a5776b0452021-12-21 11:38:25.447root 11241100x8000000000000000553053Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:25.447{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.be23b28f1a6017142021-12-21 11:38:25.447root 11241100x8000000000000000553054Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:25.447{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1daab3194932ce572021-12-21 11:38:25.447root 11241100x8000000000000000553055Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:25.447{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d8bacb355c7669812021-12-21 11:38:25.447root 11241100x8000000000000000553056Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:25.447{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d06c28496b7011682021-12-21 11:38:25.447root 354300x8000000000000000553057Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:25.523{ec2b6afe-95d2-61c1-3038-b84203560000}5272/opt/splunkforwarder/bin/splunkdroottcptruefalse10.0.1.25-35900-false10.0.1.12-8089- 11241100x8000000000000000553058Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:25.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f6c782ef92a153172021-12-21 11:38:25.943root 11241100x8000000000000000553059Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:25.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1e6690b8e3ac61c32021-12-21 11:38:25.943root 11241100x8000000000000000553060Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:25.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3444369b1f6cb6892021-12-21 11:38:25.943root 11241100x8000000000000000553061Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:25.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.cde00c82f7fe069e2021-12-21 11:38:25.943root 11241100x8000000000000000553062Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:25.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0c8249ddcba8edcd2021-12-21 11:38:25.943root 11241100x8000000000000000553063Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:25.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ccd6d6f022a83fc62021-12-21 11:38:25.943root 11241100x8000000000000000553064Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:25.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.16a56467414992aa2021-12-21 11:38:25.943root 11241100x8000000000000000553065Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:25.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.49011d62cbf57e9b2021-12-21 11:38:25.943root 11241100x8000000000000000553066Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:25.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3f688fd490d1e9c42021-12-21 11:38:25.943root 11241100x8000000000000000553067Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:25.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.342c45abac709cbf2021-12-21 11:38:25.943root 11241100x8000000000000000553068Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:25.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ecc51a39ef27b62c2021-12-21 11:38:25.943root 11241100x8000000000000000553069Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:25.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b8611f39e2dbe1d92021-12-21 11:38:25.943root 11241100x8000000000000000553070Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:25.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7544fb37db76476e2021-12-21 11:38:25.944root 11241100x8000000000000000553071Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:25.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e327909f2ff164052021-12-21 11:38:25.944root 11241100x8000000000000000553072Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:25.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1fcdcfe42ce69fb62021-12-21 11:38:25.944root 11241100x8000000000000000553073Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:25.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7078a07ce59306b72021-12-21 11:38:25.944root 11241100x8000000000000000553074Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:25.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0c381e9620e586f52021-12-21 11:38:25.944root 11241100x8000000000000000553075Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:25.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.fee7171fe9332e512021-12-21 11:38:25.944root 11241100x8000000000000000553076Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:25.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.98db57d8e66b0eb82021-12-21 11:38:25.944root 11241100x8000000000000000553077Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:25.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.217943e59dfd90de2021-12-21 11:38:25.944root 11241100x8000000000000000553078Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:25.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6a0d0849e67e99522021-12-21 11:38:25.945root 11241100x8000000000000000553079Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:25.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0ff2ee5135117bab2021-12-21 11:38:25.945root 11241100x8000000000000000553080Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:25.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6ef75ff2823c47612021-12-21 11:38:25.945root 11241100x8000000000000000553081Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:25.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.24e72d0facb57dc72021-12-21 11:38:25.945root 11241100x8000000000000000553082Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:25.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.52b3918820dd98492021-12-21 11:38:25.945root 11241100x8000000000000000553083Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:25.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7ca85f0a1d0024992021-12-21 11:38:25.945root 11241100x8000000000000000553084Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:25.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.23b26e47ecba8bb62021-12-21 11:38:25.945root 11241100x8000000000000000553085Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:25.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.cc38fc174ec1282b2021-12-21 11:38:25.945root 11241100x8000000000000000553086Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:25.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f54c218a182325172021-12-21 11:38:25.945root 11241100x8000000000000000553087Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:25.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a6a3fc6303200ed22021-12-21 11:38:25.945root 11241100x8000000000000000553088Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:25.946{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ae421e00b2195e1c2021-12-21 11:38:25.946root 11241100x8000000000000000553089Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:25.946{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a4374f59be69131c2021-12-21 11:38:25.946root 11241100x8000000000000000553090Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:25.946{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d85fc76ac52585c22021-12-21 11:38:25.946root 11241100x8000000000000000553091Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:25.946{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7de8678827fc3bf72021-12-21 11:38:25.946root 11241100x8000000000000000553092Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:25.946{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f018c9417c1180872021-12-21 11:38:25.946root 11241100x8000000000000000553093Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:25.947{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9c79d93e8c77623b2021-12-21 11:38:25.947root 11241100x8000000000000000553094Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:25.947{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7128ffc8769e60c02021-12-21 11:38:25.947root 11241100x8000000000000000553095Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:25.948{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d6bf20179cff80bf2021-12-21 11:38:25.948root 11241100x8000000000000000553096Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:25.948{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.23b561da3f67b4902021-12-21 11:38:25.948root 11241100x8000000000000000553097Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:25.948{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.210065d26341d04e2021-12-21 11:38:25.948root 11241100x8000000000000000553098Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:25.948{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2205af80ae0b0ebc2021-12-21 11:38:25.948root 11241100x8000000000000000553099Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:25.948{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.782d0662338cabb82021-12-21 11:38:25.948root 11241100x8000000000000000553100Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:25.948{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6762e64f8c6936ed2021-12-21 11:38:25.948root 11241100x8000000000000000553101Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:25.948{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1630f06bfacba8c22021-12-21 11:38:25.948root 11241100x8000000000000000553102Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:26.442{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1c038ba722befaac2021-12-21 11:38:26.442root 11241100x8000000000000000553103Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:26.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.47b0c55734a06af22021-12-21 11:38:26.443root 11241100x8000000000000000553104Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:26.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0358bd660b365dcc2021-12-21 11:38:26.443root 11241100x8000000000000000553105Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:26.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.648d69faacecda612021-12-21 11:38:26.443root 11241100x8000000000000000553106Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:26.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f096847a04a3b2fd2021-12-21 11:38:26.443root 11241100x8000000000000000553107Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:26.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e6366418adc839c62021-12-21 11:38:26.444root 11241100x8000000000000000553108Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:26.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3d3e758e0aef6c5f2021-12-21 11:38:26.444root 11241100x8000000000000000553109Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:26.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2a5eb8019d9902972021-12-21 11:38:26.444root 11241100x8000000000000000553110Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:26.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.da25ca6019e9b2e82021-12-21 11:38:26.445root 11241100x8000000000000000553111Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:26.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.59d93cd75c2234d92021-12-21 11:38:26.445root 11241100x8000000000000000553112Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:26.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c86e730f8ff5b6b22021-12-21 11:38:26.445root 11241100x8000000000000000553113Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:26.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8c661c603c5dbf302021-12-21 11:38:26.445root 11241100x8000000000000000553114Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:26.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7a16537ec21588ee2021-12-21 11:38:26.445root 11241100x8000000000000000553115Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:26.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d6ba7cbd2d27c40d2021-12-21 11:38:26.445root 11241100x8000000000000000553116Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:26.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0aea3b4fcf7556822021-12-21 11:38:26.445root 11241100x8000000000000000553117Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:26.446{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.844cec75ff9f08262021-12-21 11:38:26.446root 11241100x8000000000000000553118Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:26.446{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c728ac320cb8e64a2021-12-21 11:38:26.446root 11241100x8000000000000000553119Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:26.446{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.dfcf810249b960662021-12-21 11:38:26.446root 11241100x8000000000000000553120Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:26.446{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8c8857fb980ab6c92021-12-21 11:38:26.446root 11241100x8000000000000000553121Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:26.446{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d1784810bf5f60d62021-12-21 11:38:26.446root 11241100x8000000000000000553122Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:26.446{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.031e347baa87650c2021-12-21 11:38:26.446root 11241100x8000000000000000553123Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:26.446{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.58412697f3f667272021-12-21 11:38:26.446root 11241100x8000000000000000553124Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:26.448{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.edace3ae021e6b122021-12-21 11:38:26.448root 11241100x8000000000000000553125Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:26.449{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.95a4374a08825b7b2021-12-21 11:38:26.449root 11241100x8000000000000000553126Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:26.449{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.11bb795d3a99b0e52021-12-21 11:38:26.449root 11241100x8000000000000000553127Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:26.450{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9ba09e1b1b39fe6a2021-12-21 11:38:26.450root 11241100x8000000000000000553128Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:26.450{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.080d82ee7e1c97eb2021-12-21 11:38:26.450root 11241100x8000000000000000553129Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:26.450{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.89d165bf370eb3ba2021-12-21 11:38:26.450root 11241100x8000000000000000553130Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:26.450{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5ac9599d7edf82232021-12-21 11:38:26.450root 11241100x8000000000000000553131Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:26.451{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5da091845219651e2021-12-21 11:38:26.451root 11241100x8000000000000000553132Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:26.451{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3a4dd89f55ae8f2a2021-12-21 11:38:26.451root 11241100x8000000000000000553133Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:26.451{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6e50bbe921160d582021-12-21 11:38:26.451root 11241100x8000000000000000553134Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:26.451{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ea750edc519724562021-12-21 11:38:26.451root 11241100x8000000000000000553135Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:26.451{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9ffb0631abf263372021-12-21 11:38:26.451root 11241100x8000000000000000553136Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:26.453{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9e667e6b38ea38792021-12-21 11:38:26.453root 11241100x8000000000000000553137Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:26.453{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0715c955e0ea06512021-12-21 11:38:26.453root 11241100x8000000000000000553138Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:26.453{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2140277be8c4cc222021-12-21 11:38:26.453root 11241100x8000000000000000553139Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:26.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f8d91ecb3f76b1fc2021-12-21 11:38:26.943root 11241100x8000000000000000553140Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:26.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ca5c976119d841e02021-12-21 11:38:26.943root 11241100x8000000000000000553141Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:26.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f7b4b7b77d5494482021-12-21 11:38:26.943root 11241100x8000000000000000553142Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:26.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5a08e806470e54d42021-12-21 11:38:26.944root 11241100x8000000000000000553143Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:26.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7ed2cdc1c8e7845f2021-12-21 11:38:26.944root 11241100x8000000000000000553144Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:26.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e7ca30a9d41b9d7f2021-12-21 11:38:26.944root 11241100x8000000000000000553145Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:26.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.905dbc46cdf7b1f92021-12-21 11:38:26.944root 11241100x8000000000000000553146Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:26.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e98e074d29bc6a2e2021-12-21 11:38:26.945root 11241100x8000000000000000553147Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:26.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.01c375cf13ad89a62021-12-21 11:38:26.945root 11241100x8000000000000000553148Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:26.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ff19d6f62b78c9ae2021-12-21 11:38:26.945root 11241100x8000000000000000553149Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:26.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2b787ce9f680954b2021-12-21 11:38:26.945root 11241100x8000000000000000553150Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:26.946{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a8b344dd43bca1482021-12-21 11:38:26.946root 11241100x8000000000000000553151Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:26.946{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4d41c894cb4604892021-12-21 11:38:26.946root 11241100x8000000000000000553152Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:26.946{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b0c4b376964ecdc82021-12-21 11:38:26.946root 11241100x8000000000000000553153Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:26.947{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f457b5d0a62586d62021-12-21 11:38:26.947root 11241100x8000000000000000553154Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:26.947{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6304189908d3bb242021-12-21 11:38:26.947root 11241100x8000000000000000553155Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:26.947{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0c7ebca5800ce00d2021-12-21 11:38:26.947root 11241100x8000000000000000553156Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:26.948{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b9ecf67cd58bae962021-12-21 11:38:26.948root 11241100x8000000000000000553157Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:26.948{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a46c9f592f2335092021-12-21 11:38:26.948root 11241100x8000000000000000553158Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:26.948{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5817b78b926ee20c2021-12-21 11:38:26.948root 11241100x8000000000000000553159Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:26.948{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d609678c747ebba62021-12-21 11:38:26.948root 11241100x8000000000000000553160Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:26.949{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.589f48700af063f42021-12-21 11:38:26.949root 11241100x8000000000000000553161Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:26.949{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.59ea815ae61593d82021-12-21 11:38:26.949root 11241100x8000000000000000553162Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:26.949{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9b660ddf8ad49b372021-12-21 11:38:26.949root 11241100x8000000000000000553163Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:26.949{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b3fee1412a94373b2021-12-21 11:38:26.949root 11241100x8000000000000000553164Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:26.950{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1a8b8e76720098892021-12-21 11:38:26.950root 11241100x8000000000000000553165Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:26.950{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d87a2120732a90df2021-12-21 11:38:26.950root 11241100x8000000000000000553166Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:26.950{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8c481fced2c5373e2021-12-21 11:38:26.950root 11241100x8000000000000000553167Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:26.950{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.07ac2390f59e08322021-12-21 11:38:26.950root 11241100x8000000000000000553168Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:26.951{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8f9413552cbc06042021-12-21 11:38:26.951root 154100x8000000000000000553169Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:27.060{ec2b6afe-bcb3-61c1-6814-375f9e550000}9938/bin/ps-----ps -e -o pid,ppid,state,command/var/snap/amazon-ssm-agent/4046root{ec2b6afe-0000-0000-0000-000000000000}04294967295no level-{00000000-0000-0000-0000-000000000000}2319--- 534500x8000000000000000553170Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:27.082{ec2b6afe-bcb3-61c1-6814-375f9e550000}9938/bin/psroot 11241100x8000000000000000553171Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:27.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.12a7efedeb9364102021-12-21 11:38:27.443root 11241100x8000000000000000553172Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:27.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1f2c8127b0a70ded2021-12-21 11:38:27.443root 11241100x8000000000000000553173Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:27.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.bf631603e869fdbe2021-12-21 11:38:27.443root 11241100x8000000000000000553174Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:27.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3624f6eae804192c2021-12-21 11:38:27.443root 11241100x8000000000000000553175Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:27.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.cce0b9a4631611152021-12-21 11:38:27.443root 11241100x8000000000000000553176Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:27.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.cc4eef5f08074d992021-12-21 11:38:27.443root 11241100x8000000000000000553177Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:27.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1ba900571c9970622021-12-21 11:38:27.443root 11241100x8000000000000000553178Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:27.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.cde62599a185aa8a2021-12-21 11:38:27.443root 11241100x8000000000000000553179Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:27.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ffa1a9333b24495f2021-12-21 11:38:27.443root 11241100x8000000000000000553180Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:27.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.de45457abce727502021-12-21 11:38:27.444root 11241100x8000000000000000553181Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:27.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ad632d738a0e189b2021-12-21 11:38:27.444root 11241100x8000000000000000553182Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:27.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d231609938f61f942021-12-21 11:38:27.444root 11241100x8000000000000000553183Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:27.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3934542067b380272021-12-21 11:38:27.444root 11241100x8000000000000000553184Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:27.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.96570662a649e4212021-12-21 11:38:27.444root 11241100x8000000000000000553185Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:27.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c1a5dd9bccfa7be22021-12-21 11:38:27.444root 11241100x8000000000000000553186Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:27.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7d9be1cfde6069182021-12-21 11:38:27.445root 11241100x8000000000000000553187Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:27.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.01ce0d24afbf69ef2021-12-21 11:38:27.445root 11241100x8000000000000000553188Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:27.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.33959eb39d7fc81e2021-12-21 11:38:27.445root 11241100x8000000000000000553189Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:27.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b76e19e7d6f88d6b2021-12-21 11:38:27.445root 11241100x8000000000000000553190Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:27.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.66dadaed0b658bd82021-12-21 11:38:27.445root 11241100x8000000000000000553191Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:27.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1f9d5c54b154914a2021-12-21 11:38:27.445root 11241100x8000000000000000553192Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:27.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.641801bc7b57e9342021-12-21 11:38:27.445root 11241100x8000000000000000553193Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:27.446{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.58b0f8e01371e1c62021-12-21 11:38:27.446root 11241100x8000000000000000553194Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:27.446{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.26eefff6b94f88ca2021-12-21 11:38:27.446root 11241100x8000000000000000553195Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:27.446{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ccfdf1a34482f1662021-12-21 11:38:27.446root 11241100x8000000000000000553196Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:27.446{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.46f956aaba0506452021-12-21 11:38:27.446root 11241100x8000000000000000553197Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:27.446{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ab24ddfbf39ae3c82021-12-21 11:38:27.446root 11241100x8000000000000000553198Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:27.446{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.10d571104c1636542021-12-21 11:38:27.446root 11241100x8000000000000000553199Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:27.446{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.39d75b6812e0608c2021-12-21 11:38:27.446root 11241100x8000000000000000553200Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:27.446{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4f86449c4929413b2021-12-21 11:38:27.446root 11241100x8000000000000000553201Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:27.446{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5dd8c1f04e7cadb62021-12-21 11:38:27.446root 11241100x8000000000000000553202Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:27.446{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6dde8d4728635d892021-12-21 11:38:27.446root 11241100x8000000000000000553203Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:27.447{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0b724a074f84ade42021-12-21 11:38:27.447root 11241100x8000000000000000553204Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:27.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ebe129c59fd78b662021-12-21 11:38:27.943root 11241100x8000000000000000553205Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:27.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.fca766ffc7d470a82021-12-21 11:38:27.943root 11241100x8000000000000000553206Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:27.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e78cde1558c066a72021-12-21 11:38:27.943root 11241100x8000000000000000553207Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:27.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.bf7fecc26aab3d592021-12-21 11:38:27.943root 11241100x8000000000000000553208Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:27.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a3f85f3b62c843c12021-12-21 11:38:27.943root 11241100x8000000000000000553209Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:27.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0f6c10eabe659d112021-12-21 11:38:27.943root 11241100x8000000000000000553210Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:27.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.23c5dbd1c63e6ca32021-12-21 11:38:27.944root 11241100x8000000000000000553211Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:27.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.26c1e547b36a13dd2021-12-21 11:38:27.944root 11241100x8000000000000000553212Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:27.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a27a66b3a439a03c2021-12-21 11:38:27.944root 11241100x8000000000000000553213Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:27.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.56b11ed2abfd17fd2021-12-21 11:38:27.944root 11241100x8000000000000000553214Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:27.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c31f47c1c7c60f792021-12-21 11:38:27.944root 11241100x8000000000000000553215Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:27.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ce2eaccae7c705352021-12-21 11:38:27.944root 11241100x8000000000000000553216Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:27.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e48d8ef4d66020692021-12-21 11:38:27.944root 11241100x8000000000000000553217Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:27.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.37155648865c48dc2021-12-21 11:38:27.944root 11241100x8000000000000000553218Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:27.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d8ea3718c23eae142021-12-21 11:38:27.944root 11241100x8000000000000000553219Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:27.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.069a50c19b178cce2021-12-21 11:38:27.944root 11241100x8000000000000000553220Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:27.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ed0cfb86142093fa2021-12-21 11:38:27.944root 11241100x8000000000000000553221Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:27.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2fef2957a298fc842021-12-21 11:38:27.944root 11241100x8000000000000000553222Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:27.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7d2e4524578700c72021-12-21 11:38:27.944root 11241100x8000000000000000553223Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:27.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.244c2818c5eff6262021-12-21 11:38:27.944root 11241100x8000000000000000553224Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:27.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0b68d4c2a3e396f22021-12-21 11:38:27.945root 11241100x8000000000000000553225Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:27.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ff03a041b078e7242021-12-21 11:38:27.945root 11241100x8000000000000000553226Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:27.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0633eda421f9d2d92021-12-21 11:38:27.945root 11241100x8000000000000000553227Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:27.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.93e87e68da9920532021-12-21 11:38:27.945root 11241100x8000000000000000553228Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:27.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4006e7613a320bbb2021-12-21 11:38:27.945root 11241100x8000000000000000553229Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:27.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.721154d25e1c10f52021-12-21 11:38:27.945root 11241100x8000000000000000553230Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:27.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8e98a8f91b84199c2021-12-21 11:38:27.945root 11241100x8000000000000000553231Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:27.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.575dfd3b96944a7f2021-12-21 11:38:27.945root 11241100x8000000000000000553232Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:27.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.aaf82d9ea8196dce2021-12-21 11:38:27.945root 11241100x8000000000000000553233Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:27.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1d54750812f170f62021-12-21 11:38:27.945root 11241100x8000000000000000553234Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:27.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8335fa1dd089e0b62021-12-21 11:38:27.945root 11241100x8000000000000000553235Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:27.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.cafb4f43200486432021-12-21 11:38:27.945root 11241100x8000000000000000553236Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:27.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.61a3c48cd33d6e962021-12-21 11:38:27.945root 11241100x8000000000000000553237Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:27.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.df71d4a4aa68659f2021-12-21 11:38:27.945root 11241100x8000000000000000553238Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:27.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b85a1cef33bb8a1d2021-12-21 11:38:27.945root 11241100x8000000000000000553239Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:28.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1ae73b50e51750fa2021-12-21 11:38:28.443root 11241100x8000000000000000553240Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:28.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.393a6f872cbb01db2021-12-21 11:38:28.443root 11241100x8000000000000000553241Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:28.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d84509598c8951052021-12-21 11:38:28.443root 11241100x8000000000000000553242Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:28.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f6b0e1679169f87c2021-12-21 11:38:28.443root 11241100x8000000000000000553243Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:28.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6c2009a4c4074ea42021-12-21 11:38:28.444root 11241100x8000000000000000553244Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:28.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.191a4d08364d69532021-12-21 11:38:28.444root 11241100x8000000000000000553245Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:28.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2d75b30ae9b626602021-12-21 11:38:28.444root 11241100x8000000000000000553246Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:28.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f5cc0edb32fbcab02021-12-21 11:38:28.444root 11241100x8000000000000000553247Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:28.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.759ce9ee698741252021-12-21 11:38:28.444root 11241100x8000000000000000553248Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:28.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d62d1870db14d6f02021-12-21 11:38:28.444root 11241100x8000000000000000553249Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:28.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b8b6767b1ae5db612021-12-21 11:38:28.444root 11241100x8000000000000000553250Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:28.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.516c58e1810e283c2021-12-21 11:38:28.444root 11241100x8000000000000000553251Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:28.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.23446524734596bc2021-12-21 11:38:28.444root 11241100x8000000000000000553252Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:28.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e17e2c0117a575a52021-12-21 11:38:28.444root 11241100x8000000000000000553253Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:28.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.caa0e98c40f3217a2021-12-21 11:38:28.444root 11241100x8000000000000000553254Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:28.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a086ee26ca4afcf72021-12-21 11:38:28.444root 11241100x8000000000000000553255Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:28.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5f3e3d9647fd88702021-12-21 11:38:28.444root 11241100x8000000000000000553256Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:28.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e9cb5e63e3fad2f62021-12-21 11:38:28.444root 11241100x8000000000000000553257Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:28.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7f0f21ffeca55a572021-12-21 11:38:28.444root 11241100x8000000000000000553258Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:28.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.93e06e2c736462fe2021-12-21 11:38:28.444root 11241100x8000000000000000553259Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:28.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1a08957b8af38f342021-12-21 11:38:28.445root 11241100x8000000000000000553260Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:28.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d7c8816f43d8e71b2021-12-21 11:38:28.445root 11241100x8000000000000000553261Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:28.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0b1347292162b4d12021-12-21 11:38:28.445root 11241100x8000000000000000553262Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:28.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6ba612301e32060c2021-12-21 11:38:28.445root 11241100x8000000000000000553263Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:28.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c9042fde65fec1742021-12-21 11:38:28.445root 11241100x8000000000000000553264Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:28.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.259b85fdf6fc307e2021-12-21 11:38:28.445root 11241100x8000000000000000553265Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:28.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.95b6acf506c770132021-12-21 11:38:28.445root 11241100x8000000000000000553266Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:28.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.65ea1d3b4f1821f12021-12-21 11:38:28.445root 11241100x8000000000000000553267Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:28.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a97a77c31a28277c2021-12-21 11:38:28.445root 11241100x8000000000000000553268Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:28.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.189d778cbc8e212f2021-12-21 11:38:28.445root 11241100x8000000000000000553269Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:28.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4b3a36168334823d2021-12-21 11:38:28.445root 11241100x8000000000000000553270Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:28.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4fc5e9fb2ee21bb32021-12-21 11:38:28.943root 11241100x8000000000000000553271Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:28.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.372307ba621188ea2021-12-21 11:38:28.943root 11241100x8000000000000000553272Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:28.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5d5d72b377f055632021-12-21 11:38:28.943root 11241100x8000000000000000553273Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:28.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.af1a90a42f1b5c0e2021-12-21 11:38:28.943root 11241100x8000000000000000553274Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:28.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0b7cae1484a6042a2021-12-21 11:38:28.944root 11241100x8000000000000000553275Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:28.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.71f51a1dcd0a4fa02021-12-21 11:38:28.944root 11241100x8000000000000000553276Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:28.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4751f4a77551b4f02021-12-21 11:38:28.944root 11241100x8000000000000000553277Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:28.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.79620e6ab5e5a7852021-12-21 11:38:28.944root 11241100x8000000000000000553278Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:28.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.cb0f2f60516a21f92021-12-21 11:38:28.944root 11241100x8000000000000000553279Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:28.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ba8673750f682aa12021-12-21 11:38:28.944root 11241100x8000000000000000553280Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:28.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7e4e3ebe1dc5ffa92021-12-21 11:38:28.944root 11241100x8000000000000000553281Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:28.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d33b0b5054010b102021-12-21 11:38:28.944root 11241100x8000000000000000553282Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:28.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9022b4b934e2ae7c2021-12-21 11:38:28.944root 11241100x8000000000000000553283Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:28.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.95f191c6030d5aed2021-12-21 11:38:28.944root 11241100x8000000000000000553284Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:28.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.cae37894b49c33432021-12-21 11:38:28.944root 11241100x8000000000000000553285Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:28.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1b3eb319875994562021-12-21 11:38:28.944root 11241100x8000000000000000553286Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:28.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.bbe122ede5eb28cd2021-12-21 11:38:28.944root 11241100x8000000000000000553287Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:28.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.837b01861c7224c92021-12-21 11:38:28.944root 11241100x8000000000000000553288Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:28.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.eebb6b388b75847a2021-12-21 11:38:28.945root 11241100x8000000000000000553289Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:28.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a5d62a25189da3f02021-12-21 11:38:28.945root 11241100x8000000000000000553290Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:28.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b133f0f4077292772021-12-21 11:38:28.945root 11241100x8000000000000000553291Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:28.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5e14cc3c250ee1dc2021-12-21 11:38:28.945root 11241100x8000000000000000553292Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:28.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.96772e552057f4262021-12-21 11:38:28.945root 11241100x8000000000000000553293Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:28.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.71a7fa817b1488972021-12-21 11:38:28.945root 11241100x8000000000000000553294Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:28.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8a4f075ce8e005762021-12-21 11:38:28.945root 11241100x8000000000000000553295Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:28.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.13aecccf21f556d42021-12-21 11:38:28.945root 11241100x8000000000000000553296Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:28.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.57831312dd5904c42021-12-21 11:38:28.945root 11241100x8000000000000000553297Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:28.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ac6bcae081b144622021-12-21 11:38:28.945root 11241100x8000000000000000553298Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:28.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1a79665bcc71693d2021-12-21 11:38:28.945root 11241100x8000000000000000553299Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:28.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.968c4bb83a6459762021-12-21 11:38:28.945root 11241100x8000000000000000553300Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:28.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e02184f8772e2d182021-12-21 11:38:28.945root 11241100x8000000000000000553301Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:29.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9d13d5dd49dd119b2021-12-21 11:38:29.443root 11241100x8000000000000000553302Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:29.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3da90955ffc6fe1a2021-12-21 11:38:29.443root 11241100x8000000000000000553303Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:29.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.14b42204b40ba6d22021-12-21 11:38:29.443root 11241100x8000000000000000553304Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:29.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3f03b55e9470ee212021-12-21 11:38:29.443root 11241100x8000000000000000553305Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:29.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.844a2d35515be4122021-12-21 11:38:29.443root 11241100x8000000000000000553306Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:29.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7102007b72bb23fa2021-12-21 11:38:29.443root 11241100x8000000000000000553307Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:29.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6b76b8322a6084392021-12-21 11:38:29.443root 11241100x8000000000000000553308Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:29.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.90e1364d9f2bdaf12021-12-21 11:38:29.443root 11241100x8000000000000000553309Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:29.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.365e33eb1a85f3902021-12-21 11:38:29.444root 11241100x8000000000000000553310Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:29.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a383c30b88621bd02021-12-21 11:38:29.444root 11241100x8000000000000000553311Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:29.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c023446e67c199ab2021-12-21 11:38:29.444root 11241100x8000000000000000553312Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:29.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f49ba134a4a9621c2021-12-21 11:38:29.444root 11241100x8000000000000000553313Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:29.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c16fe9778fd516042021-12-21 11:38:29.444root 11241100x8000000000000000553314Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:29.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ff00ebf73ce30bb92021-12-21 11:38:29.444root 11241100x8000000000000000553315Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:29.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e1d98d029bb860a82021-12-21 11:38:29.444root 11241100x8000000000000000553316Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:29.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.30ca7266cfd5aa802021-12-21 11:38:29.444root 11241100x8000000000000000553317Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:29.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a91425904a5804ba2021-12-21 11:38:29.444root 11241100x8000000000000000553318Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:29.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.95ebea2cf1a2c9e22021-12-21 11:38:29.444root 11241100x8000000000000000553319Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:29.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5d217192621c77f02021-12-21 11:38:29.444root 11241100x8000000000000000553320Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:29.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0d6e074f88fc1ea12021-12-21 11:38:29.444root 11241100x8000000000000000553321Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:29.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.02b11cdf402cbdda2021-12-21 11:38:29.444root 11241100x8000000000000000553322Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:29.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.50a69072a99f30f72021-12-21 11:38:29.444root 11241100x8000000000000000553323Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:29.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.fc4c3340dd2c1d192021-12-21 11:38:29.444root 11241100x8000000000000000553324Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:29.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2538aeac21c8ba4c2021-12-21 11:38:29.445root 11241100x8000000000000000553325Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:29.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.dececdc7343260182021-12-21 11:38:29.445root 11241100x8000000000000000553326Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:29.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e9fa213ba41bcb752021-12-21 11:38:29.445root 11241100x8000000000000000553327Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:29.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.851eec0aa833de862021-12-21 11:38:29.445root 11241100x8000000000000000553328Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:29.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ce2ee008558fe93f2021-12-21 11:38:29.445root 11241100x8000000000000000553329Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:29.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1175ef7e635002432021-12-21 11:38:29.445root 11241100x8000000000000000553330Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:29.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a6ba267a1dff0a592021-12-21 11:38:29.445root 11241100x8000000000000000553331Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:29.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5aba3119a69eded62021-12-21 11:38:29.445root 11241100x8000000000000000553332Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:29.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d95afb1ca81310cd2021-12-21 11:38:29.445root 11241100x8000000000000000553333Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:29.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.af997fdd2a6816f02021-12-21 11:38:29.943root 11241100x8000000000000000553334Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:29.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e3a026bca51738b82021-12-21 11:38:29.943root 11241100x8000000000000000553335Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:29.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f55c0557e2d2942a2021-12-21 11:38:29.943root 11241100x8000000000000000553336Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:29.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8f17ce6b6c4566482021-12-21 11:38:29.943root 11241100x8000000000000000553337Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:29.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d8acc288282d09332021-12-21 11:38:29.944root 11241100x8000000000000000553338Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:29.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.275b68648a9b5ae32021-12-21 11:38:29.944root 11241100x8000000000000000553339Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:29.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b1974bde802a92232021-12-21 11:38:29.944root 11241100x8000000000000000553340Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:29.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c3ccd0c4084945a02021-12-21 11:38:29.944root 11241100x8000000000000000553341Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:29.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.279cc576de6178cc2021-12-21 11:38:29.944root 11241100x8000000000000000553342Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:29.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f98ae5ee958ab0c62021-12-21 11:38:29.944root 11241100x8000000000000000553343Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:29.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.39d5b45dcda9c2542021-12-21 11:38:29.944root 11241100x8000000000000000553344Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:29.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2dcbb38f1b9ea1182021-12-21 11:38:29.944root 11241100x8000000000000000553345Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:29.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.cc4eb8664b4382112021-12-21 11:38:29.944root 11241100x8000000000000000553346Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:29.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.303b6b108fa991392021-12-21 11:38:29.944root 11241100x8000000000000000553347Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:29.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f3c6b58138ed5d852021-12-21 11:38:29.944root 11241100x8000000000000000553348Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:29.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3f0727cc6fd3dc912021-12-21 11:38:29.944root 11241100x8000000000000000553349Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:29.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a24760be8959a3bf2021-12-21 11:38:29.944root 11241100x8000000000000000553350Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:29.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4fa9db840d1ece332021-12-21 11:38:29.944root 11241100x8000000000000000553351Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:29.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d4908b0fb36d897d2021-12-21 11:38:29.944root 11241100x8000000000000000553352Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:29.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.49f95571aff507752021-12-21 11:38:29.944root 11241100x8000000000000000553353Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:29.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d775799de7ef03862021-12-21 11:38:29.945root 11241100x8000000000000000553354Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:29.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a5691685755eaa842021-12-21 11:38:29.945root 11241100x8000000000000000553355Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:29.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e580c6f1ba950dbe2021-12-21 11:38:29.945root 11241100x8000000000000000553356Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:29.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7a16217b020be39f2021-12-21 11:38:29.945root 11241100x8000000000000000553357Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:29.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.df870627162e90882021-12-21 11:38:29.945root 11241100x8000000000000000553358Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:29.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d9a906536abcc7912021-12-21 11:38:29.945root 11241100x8000000000000000553359Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:29.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.94332f7c21a593c82021-12-21 11:38:29.945root 11241100x8000000000000000553360Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:29.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e8fd429d22d4883f2021-12-21 11:38:29.945root 11241100x8000000000000000553361Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:29.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.661c9ad0b7faa1682021-12-21 11:38:29.945root 11241100x8000000000000000553362Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:29.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b91ce9de64f8c4ea2021-12-21 11:38:29.945root 11241100x8000000000000000553363Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:29.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e4c0e7203e5f23272021-12-21 11:38:29.945root 354300x8000000000000000553364Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:30.035{ec2b6afe-95d9-61c1-5175-3a0400000000}5346/opt/splunkforwarder/etc/apps/Splunk_TA_stream/linux_x86_64/bin/streamfwdroottcptruefalse10.0.1.25-48838-false10.0.1.12-8000- 11241100x8000000000000000553365Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:30.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.39dd6f5350dc7e9f2021-12-21 11:38:30.443root 11241100x8000000000000000553366Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:30.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.87dd1e3281585bae2021-12-21 11:38:30.443root 11241100x8000000000000000553367Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:30.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.bacfd0a81f707dfe2021-12-21 11:38:30.443root 11241100x8000000000000000553368Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:30.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d3706a53d1beeba72021-12-21 11:38:30.443root 11241100x8000000000000000553369Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:30.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f37a5d1a19345d692021-12-21 11:38:30.444root 11241100x8000000000000000553370Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:30.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0608e349cc4e24912021-12-21 11:38:30.444root 11241100x8000000000000000553371Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:30.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4d331abc6de0c1cd2021-12-21 11:38:30.444root 11241100x8000000000000000553372Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:30.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7b3bbccb24d5f26d2021-12-21 11:38:30.444root 11241100x8000000000000000553373Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:30.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5d63313c638779a42021-12-21 11:38:30.444root 11241100x8000000000000000553374Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:30.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.537ea7b6040c32052021-12-21 11:38:30.444root 11241100x8000000000000000553375Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:30.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5072aaa5f9d7b1f32021-12-21 11:38:30.444root 11241100x8000000000000000553376Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:30.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.94d4bbd7e0de99a52021-12-21 11:38:30.444root 11241100x8000000000000000553377Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:30.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.31e3bae9b2e581cc2021-12-21 11:38:30.444root 11241100x8000000000000000553378Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:30.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.cb62f577133bed5d2021-12-21 11:38:30.444root 11241100x8000000000000000553379Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:30.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.723e5528f307f5712021-12-21 11:38:30.444root 11241100x8000000000000000553380Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:30.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.bc2d26a36cb3b7862021-12-21 11:38:30.444root 11241100x8000000000000000553381Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:30.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c810a5ae9d791ed52021-12-21 11:38:30.444root 11241100x8000000000000000553382Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:30.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0a19e5ccd45340222021-12-21 11:38:30.444root 11241100x8000000000000000553383Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:30.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.650be62cbf273b352021-12-21 11:38:30.444root 11241100x8000000000000000553384Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:30.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f9f53ab73ffadabd2021-12-21 11:38:30.444root 11241100x8000000000000000553385Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:30.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b8524e0b7f311a5f2021-12-21 11:38:30.445root 11241100x8000000000000000553386Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:30.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2aa9b045fe7af0b42021-12-21 11:38:30.445root 11241100x8000000000000000553387Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:30.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3187bd45842a843e2021-12-21 11:38:30.445root 11241100x8000000000000000553388Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:30.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.df0cdf07a5ac757b2021-12-21 11:38:30.445root 11241100x8000000000000000553389Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:30.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ea2e7b4abb38730a2021-12-21 11:38:30.445root 11241100x8000000000000000553390Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:30.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.085e024492006cb42021-12-21 11:38:30.445root 11241100x8000000000000000553391Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:30.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3343c15e929e77d42021-12-21 11:38:30.445root 11241100x8000000000000000553392Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:30.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d895c487663b07422021-12-21 11:38:30.445root 11241100x8000000000000000553393Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:30.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a2bea5472c7101242021-12-21 11:38:30.445root 11241100x8000000000000000553394Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:30.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d51503e699e0ff0e2021-12-21 11:38:30.445root 11241100x8000000000000000553395Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:30.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a2d9a6e76ca2f4652021-12-21 11:38:30.445root 11241100x8000000000000000553396Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:30.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2af66be486596a1e2021-12-21 11:38:30.445root 11241100x8000000000000000553397Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:30.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ef0b8f7e074538362021-12-21 11:38:30.943root 11241100x8000000000000000553398Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:30.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.fdb24d8bf9e270ca2021-12-21 11:38:30.943root 11241100x8000000000000000553399Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:30.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.830487e7f7e323f22021-12-21 11:38:30.944root 11241100x8000000000000000553400Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:30.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.cfe3b7d9a33c644f2021-12-21 11:38:30.944root 11241100x8000000000000000553401Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:30.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0ed4e3296e9b99b32021-12-21 11:38:30.944root 11241100x8000000000000000553402Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:30.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ad11b1c40487f20d2021-12-21 11:38:30.945root 11241100x8000000000000000553403Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:30.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b35b957dd61d79972021-12-21 11:38:30.945root 11241100x8000000000000000553404Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:30.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e88ee7e4b80baeee2021-12-21 11:38:30.945root 11241100x8000000000000000553405Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:30.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.81aca5065d7772022021-12-21 11:38:30.945root 11241100x8000000000000000553406Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:30.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d622eb0d114f556e2021-12-21 11:38:30.945root 11241100x8000000000000000553407Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:30.946{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.938c597cb92c50822021-12-21 11:38:30.946root 11241100x8000000000000000553408Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:30.946{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7b80a0a3b16de31c2021-12-21 11:38:30.946root 11241100x8000000000000000553409Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:30.946{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.45a94c2c6a654f7e2021-12-21 11:38:30.946root 11241100x8000000000000000553410Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:30.947{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.fb96ee0bb92245042021-12-21 11:38:30.947root 11241100x8000000000000000553411Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:30.947{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6b1867050c87577c2021-12-21 11:38:30.947root 11241100x8000000000000000553412Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:30.947{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.61d4c6048f639a162021-12-21 11:38:30.947root 11241100x8000000000000000553413Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:30.947{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8b41a7cb4d48bbef2021-12-21 11:38:30.947root 11241100x8000000000000000553414Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:30.947{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b5a73bb2768321a22021-12-21 11:38:30.947root 11241100x8000000000000000553415Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:30.947{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.97b8b9d3727b898d2021-12-21 11:38:30.947root 11241100x8000000000000000553416Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:30.947{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9e048b429eb76fd62021-12-21 11:38:30.947root 11241100x8000000000000000553417Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:30.947{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.cf8468770fa75c622021-12-21 11:38:30.947root 11241100x8000000000000000553418Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:30.947{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f9ec39924b9f9a0f2021-12-21 11:38:30.947root 11241100x8000000000000000553419Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:30.948{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ab1954ab735b72852021-12-21 11:38:30.948root 11241100x8000000000000000553420Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:30.948{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.740598bd6150a5272021-12-21 11:38:30.948root 11241100x8000000000000000553421Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:30.948{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e0d54e9e06fad9222021-12-21 11:38:30.948root 11241100x8000000000000000553422Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:30.948{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.077fcf7d3aab4fe62021-12-21 11:38:30.948root 11241100x8000000000000000553423Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:30.948{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d26b30e74fb90d8a2021-12-21 11:38:30.948root 11241100x8000000000000000553424Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:30.948{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.dd2bfb45c17bd87a2021-12-21 11:38:30.948root 11241100x8000000000000000553425Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:30.948{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.517bca14b823087d2021-12-21 11:38:30.948root 11241100x8000000000000000553426Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:30.948{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.70c8c80f16d08b6c2021-12-21 11:38:30.948root 11241100x8000000000000000553427Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:30.948{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8cedc821fad32c0f2021-12-21 11:38:30.948root 11241100x8000000000000000553428Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:30.948{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.980ab17e3736376c2021-12-21 11:38:30.948root 11241100x8000000000000000553429Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:30.948{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.fb15a4d25c9d53a42021-12-21 11:38:30.948root 11241100x8000000000000000553430Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:30.948{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f34e630fad8e9a822021-12-21 11:38:30.948root 11241100x8000000000000000553431Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:31.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2d03fdf27d1b25792021-12-21 11:38:31.443root 11241100x8000000000000000553432Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:31.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.802abc6050d9dd762021-12-21 11:38:31.443root 11241100x8000000000000000553433Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:31.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.649ab2be89835e302021-12-21 11:38:31.443root 11241100x8000000000000000553434Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:31.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.652bd9f35194e91f2021-12-21 11:38:31.443root 11241100x8000000000000000553435Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:31.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6e5a966c8c20b9102021-12-21 11:38:31.443root 11241100x8000000000000000553436Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:31.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2b761f3c05e15e022021-12-21 11:38:31.443root 11241100x8000000000000000553437Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:31.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.fc6d165c1eb332482021-12-21 11:38:31.444root 11241100x8000000000000000553438Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:31.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.976a86a483f2f0982021-12-21 11:38:31.444root 11241100x8000000000000000553439Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:31.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0e78084d8ce280542021-12-21 11:38:31.444root 11241100x8000000000000000553440Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:31.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.85b46d0e4aaf2a8d2021-12-21 11:38:31.444root 11241100x8000000000000000553441Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:31.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.31d6a795ea7dba972021-12-21 11:38:31.444root 11241100x8000000000000000553442Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:31.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.72c3292b1895118c2021-12-21 11:38:31.444root 11241100x8000000000000000553443Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:31.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.fc22fc7f4c94456f2021-12-21 11:38:31.444root 11241100x8000000000000000553444Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:31.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6d3f3eaa57b8a7792021-12-21 11:38:31.444root 11241100x8000000000000000553445Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:31.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d5c673ef550637de2021-12-21 11:38:31.444root 11241100x8000000000000000553446Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:31.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.136ff74352b24b212021-12-21 11:38:31.444root 11241100x8000000000000000553447Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:31.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.fe2e87d18b60911b2021-12-21 11:38:31.444root 11241100x8000000000000000553448Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:31.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e03da090955d62b62021-12-21 11:38:31.444root 11241100x8000000000000000553449Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:31.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.bb7fa3d1070f29bc2021-12-21 11:38:31.445root 11241100x8000000000000000553450Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:31.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.888dbe67cad029b82021-12-21 11:38:31.445root 11241100x8000000000000000553451Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:31.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b129345aee46a7a02021-12-21 11:38:31.445root 11241100x8000000000000000553452Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:31.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1ec73e3611bef9852021-12-21 11:38:31.445root 11241100x8000000000000000553453Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:31.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d42c56cd9a58629c2021-12-21 11:38:31.445root 11241100x8000000000000000553454Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:31.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d136c3ac4b0be9822021-12-21 11:38:31.445root 11241100x8000000000000000553455Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:31.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b6eceb955789857b2021-12-21 11:38:31.445root 11241100x8000000000000000553456Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:31.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e4a177c1752357862021-12-21 11:38:31.445root 11241100x8000000000000000553457Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:31.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.fd32beae1bc93ad62021-12-21 11:38:31.445root 11241100x8000000000000000553458Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:31.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.60a8aff263db30992021-12-21 11:38:31.445root 11241100x8000000000000000553459Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:31.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.527696199129dacf2021-12-21 11:38:31.445root 11241100x8000000000000000553460Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:31.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.23bbd11b15372bc92021-12-21 11:38:31.445root 11241100x8000000000000000553461Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:31.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.517c9fed8799f7f72021-12-21 11:38:31.445root 11241100x8000000000000000553462Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:31.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f47624203d5bac342021-12-21 11:38:31.445root 11241100x8000000000000000553463Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:31.942{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.32201004df5197ba2021-12-21 11:38:31.942root 11241100x8000000000000000553464Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:31.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.fb41f98a4ba3dd8e2021-12-21 11:38:31.943root 11241100x8000000000000000553465Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:31.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.78f5b7ab7b8256f62021-12-21 11:38:31.943root 11241100x8000000000000000553466Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:31.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.74dc6b1f975314622021-12-21 11:38:31.943root 11241100x8000000000000000553467Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:31.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.17d97496d829ed1f2021-12-21 11:38:31.943root 11241100x8000000000000000553468Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:31.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1a49b5f73163c46b2021-12-21 11:38:31.943root 11241100x8000000000000000553469Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:31.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.934b943e0c0fef0e2021-12-21 11:38:31.943root 11241100x8000000000000000553470Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:31.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2a580fe4f2c5e5e52021-12-21 11:38:31.943root 11241100x8000000000000000553471Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:31.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4c10023adebb54e52021-12-21 11:38:31.943root 11241100x8000000000000000553472Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:31.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.eb7a4f7e32cac0562021-12-21 11:38:31.943root 11241100x8000000000000000553473Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:31.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7cc22de3fc875bb92021-12-21 11:38:31.943root 11241100x8000000000000000553474Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:31.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ab784b30904408002021-12-21 11:38:31.943root 11241100x8000000000000000553475Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:31.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b651edbea1067ea32021-12-21 11:38:31.943root 11241100x8000000000000000553476Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:31.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.59968964b3cb9fba2021-12-21 11:38:31.943root 11241100x8000000000000000553477Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:31.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d9df5e95f07d32f52021-12-21 11:38:31.944root 11241100x8000000000000000553478Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:31.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0b71157e7445a6192021-12-21 11:38:31.944root 11241100x8000000000000000553479Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:31.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.587e9db72b8fddec2021-12-21 11:38:31.944root 11241100x8000000000000000553480Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:31.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.22c1d6e687a818fd2021-12-21 11:38:31.944root 11241100x8000000000000000553481Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:31.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f37a9a748dd444872021-12-21 11:38:31.944root 11241100x8000000000000000553482Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:31.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3ab707b30e35fb4f2021-12-21 11:38:31.944root 11241100x8000000000000000553483Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:31.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d508cd0c6bef76612021-12-21 11:38:31.944root 11241100x8000000000000000553484Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:31.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.72c34e460ed4fb652021-12-21 11:38:31.944root 11241100x8000000000000000553485Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:31.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.156c48413eddb00c2021-12-21 11:38:31.945root 11241100x8000000000000000553486Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:31.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ef110c03275835d92021-12-21 11:38:31.945root 11241100x8000000000000000553487Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:31.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8e5caaf93b883a872021-12-21 11:38:31.945root 11241100x8000000000000000553488Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:31.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7461f6242964c6202021-12-21 11:38:31.945root 11241100x8000000000000000553489Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:31.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.bb2984080ed7c5892021-12-21 11:38:31.945root 11241100x8000000000000000553490Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:31.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3e3894bb800ebafc2021-12-21 11:38:31.945root 11241100x8000000000000000553491Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:31.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.51faf9ddc509a6742021-12-21 11:38:31.945root 11241100x8000000000000000553492Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:31.946{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d03bfbf594d891642021-12-21 11:38:31.946root 11241100x8000000000000000553493Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:31.946{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d4d151dfed25da5c2021-12-21 11:38:31.946root 11241100x8000000000000000553494Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:31.946{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8dd1a7d80c678be72021-12-21 11:38:31.946root 11241100x8000000000000000553495Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:32.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a88048d1bb5957432021-12-21 11:38:32.443root 11241100x8000000000000000553496Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:32.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6b1602a1906df74a2021-12-21 11:38:32.443root 11241100x8000000000000000553497Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:32.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3bfe0f7c57d37b942021-12-21 11:38:32.443root 11241100x8000000000000000553498Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:32.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9f664107b6de51e82021-12-21 11:38:32.443root 11241100x8000000000000000553499Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:32.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.95f26bbf2c39c55c2021-12-21 11:38:32.444root 11241100x8000000000000000553500Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:32.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3d689a21e947198d2021-12-21 11:38:32.444root 11241100x8000000000000000553501Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:32.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b110af2eafeac4f82021-12-21 11:38:32.444root 11241100x8000000000000000553502Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:32.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5ec5c885e014ab412021-12-21 11:38:32.444root 11241100x8000000000000000553503Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:32.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.eff103400023a43a2021-12-21 11:38:32.444root 11241100x8000000000000000553504Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:32.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.afdbbb6a3b7bece42021-12-21 11:38:32.444root 11241100x8000000000000000553505Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:32.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.63239f831d2101b32021-12-21 11:38:32.444root 11241100x8000000000000000553506Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:32.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.371af7e3e88d5b792021-12-21 11:38:32.444root 11241100x8000000000000000553507Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:32.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.50f27d7a3c32ade42021-12-21 11:38:32.444root 11241100x8000000000000000553508Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:32.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.81b740954e81f7b22021-12-21 11:38:32.444root 11241100x8000000000000000553509Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:32.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.800172ce30e2b47e2021-12-21 11:38:32.445root 11241100x8000000000000000553510Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:32.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0a63a19916fd0dd62021-12-21 11:38:32.445root 11241100x8000000000000000553511Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:32.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7710469c0452c4412021-12-21 11:38:32.445root 11241100x8000000000000000553512Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:32.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.827fbf4de36f27ef2021-12-21 11:38:32.445root 11241100x8000000000000000553513Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:32.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7e42aa947cf39ad52021-12-21 11:38:32.445root 11241100x8000000000000000553514Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:32.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.61c4d8014ba33af62021-12-21 11:38:32.445root 11241100x8000000000000000553515Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:32.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d414783414478b512021-12-21 11:38:32.445root 11241100x8000000000000000553516Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:32.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.39a3e2859b0cee832021-12-21 11:38:32.445root 11241100x8000000000000000553517Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:32.446{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d67937f834ef0efc2021-12-21 11:38:32.446root 11241100x8000000000000000553518Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:32.446{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3727cb19da0573a32021-12-21 11:38:32.446root 11241100x8000000000000000553519Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:32.446{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.beaf596dc85b3d732021-12-21 11:38:32.446root 11241100x8000000000000000553520Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:32.446{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.68e1cf23c178cbc92021-12-21 11:38:32.446root 11241100x8000000000000000553521Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:32.446{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e03d56773eb97ee02021-12-21 11:38:32.446root 11241100x8000000000000000553522Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:32.446{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b96a6dfd980ae3632021-12-21 11:38:32.446root 11241100x8000000000000000553523Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:32.446{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e842c6476dc7d7d72021-12-21 11:38:32.446root 11241100x8000000000000000553524Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:32.446{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.feb06c850ba90c082021-12-21 11:38:32.446root 11241100x8000000000000000553525Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:32.447{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5d0a54791a3f08802021-12-21 11:38:32.447root 11241100x8000000000000000553526Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:32.448{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5185d955d0c8d42a2021-12-21 11:38:32.448root 11241100x8000000000000000553527Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:32.448{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f62567ec1d0ee8e02021-12-21 11:38:32.448root 11241100x8000000000000000553528Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:32.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.36a5cecb3ed251592021-12-21 11:38:32.943root 11241100x8000000000000000553529Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:32.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.208d8a5b7a8c260d2021-12-21 11:38:32.943root 11241100x8000000000000000553530Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:32.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.fbddca3d069e99b02021-12-21 11:38:32.943root 11241100x8000000000000000553531Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:32.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.208ec1fec28668652021-12-21 11:38:32.943root 11241100x8000000000000000553532Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:32.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b43401ee62f9beac2021-12-21 11:38:32.944root 11241100x8000000000000000553533Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:32.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.13d1df032975c9162021-12-21 11:38:32.944root 11241100x8000000000000000553534Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:32.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5eb02e76263d3a982021-12-21 11:38:32.944root 11241100x8000000000000000553535Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:32.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d3b42f95f3935a3e2021-12-21 11:38:32.944root 11241100x8000000000000000553536Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:32.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f05208c93b7d4ac72021-12-21 11:38:32.944root 11241100x8000000000000000553537Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:32.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2660a29c57c0227e2021-12-21 11:38:32.944root 11241100x8000000000000000553538Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:32.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d38e58f312a752d42021-12-21 11:38:32.944root 11241100x8000000000000000553539Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:32.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.dbbf7e36ff356be02021-12-21 11:38:32.944root 11241100x8000000000000000553540Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:32.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c1cb1b5da78b64e42021-12-21 11:38:32.944root 11241100x8000000000000000553541Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:32.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.702214ce6421bdad2021-12-21 11:38:32.944root 11241100x8000000000000000553542Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:32.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7df96e89722ab32c2021-12-21 11:38:32.944root 11241100x8000000000000000553543Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:32.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e29c9f3768f231662021-12-21 11:38:32.944root 11241100x8000000000000000553544Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:32.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.81f22575f9acebc62021-12-21 11:38:32.944root 11241100x8000000000000000553545Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:32.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.fdad312dac81e1cb2021-12-21 11:38:32.944root 11241100x8000000000000000553546Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:32.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4dae27a67ef045a22021-12-21 11:38:32.944root 11241100x8000000000000000553547Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:32.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e73ae176f09ac3852021-12-21 11:38:32.944root 11241100x8000000000000000553548Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:32.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.596f4131ab63ab252021-12-21 11:38:32.945root 11241100x8000000000000000553549Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:32.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.179dbe3059723c112021-12-21 11:38:32.945root 11241100x8000000000000000553550Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:32.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.973010f6f8145f102021-12-21 11:38:32.945root 11241100x8000000000000000553551Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:32.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.efbbc57ad58e42e42021-12-21 11:38:32.945root 11241100x8000000000000000553552Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:32.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6ad9dcef6e34a4802021-12-21 11:38:32.945root 11241100x8000000000000000553553Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:32.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9b835f4f4dbe16102021-12-21 11:38:32.945root 11241100x8000000000000000553554Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:32.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e446deaa20d183fa2021-12-21 11:38:32.945root 11241100x8000000000000000553555Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:32.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.eadb42c390976ade2021-12-21 11:38:32.945root 11241100x8000000000000000553556Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:32.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.120f27989fcfa7b62021-12-21 11:38:32.945root 11241100x8000000000000000553557Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:32.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.218fc5157fb978672021-12-21 11:38:32.945root 11241100x8000000000000000553558Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:32.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.82e4335d5d00147f2021-12-21 11:38:32.945root 11241100x8000000000000000553559Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:32.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.39d4d277bd3fb0932021-12-21 11:38:32.945root 11241100x8000000000000000553560Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:33.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.cba2478a20b87e6b2021-12-21 11:38:33.443root 11241100x8000000000000000553561Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:33.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b29a53be07bd15622021-12-21 11:38:33.444root 11241100x8000000000000000553562Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:33.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a747c1c0c7caefb42021-12-21 11:38:33.444root 11241100x8000000000000000553563Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:33.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f7e7a09eb0e628932021-12-21 11:38:33.445root 11241100x8000000000000000553564Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:33.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3ea9db07bf5802fd2021-12-21 11:38:33.445root 11241100x8000000000000000553565Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:33.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.182a9916df4758732021-12-21 11:38:33.445root 11241100x8000000000000000553566Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:33.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7774f36a1e0a25182021-12-21 11:38:33.445root 11241100x8000000000000000553567Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:33.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.628a7c83d16dfc3e2021-12-21 11:38:33.445root 11241100x8000000000000000553568Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:33.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6dd5edd3e8d77c902021-12-21 11:38:33.445root 11241100x8000000000000000553569Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:33.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.69956e33f0666c882021-12-21 11:38:33.445root 11241100x8000000000000000553570Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:33.446{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e1e77570fca8c0662021-12-21 11:38:33.446root 11241100x8000000000000000553571Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:33.446{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3b33e77b8d5e2d2c2021-12-21 11:38:33.446root 11241100x8000000000000000553572Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:33.446{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0881c0c339ff20982021-12-21 11:38:33.446root 11241100x8000000000000000553573Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:33.446{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.16aadead0a1292cd2021-12-21 11:38:33.446root 11241100x8000000000000000553574Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:33.446{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b951ad4927dacc2d2021-12-21 11:38:33.446root 11241100x8000000000000000553575Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:33.446{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.be1f5c741ef686b72021-12-21 11:38:33.446root 11241100x8000000000000000553576Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:33.446{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2372a83a01a99dd32021-12-21 11:38:33.446root 11241100x8000000000000000553577Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:33.446{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.77443c6f1554f6d92021-12-21 11:38:33.446root 11241100x8000000000000000553578Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:33.446{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d40707c68be7b0732021-12-21 11:38:33.446root 11241100x8000000000000000553579Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:33.447{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0d3c7cd7360053d62021-12-21 11:38:33.447root 11241100x8000000000000000553580Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:33.447{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5781558cd85778d92021-12-21 11:38:33.447root 11241100x8000000000000000553581Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:33.447{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.afd60f55cfa4624d2021-12-21 11:38:33.447root 11241100x8000000000000000553582Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:33.447{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.fd89afcdbece3b322021-12-21 11:38:33.447root 11241100x8000000000000000553583Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:33.447{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9739c6707ea9e10b2021-12-21 11:38:33.447root 11241100x8000000000000000553584Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:33.447{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.077afc5e9bf453d72021-12-21 11:38:33.447root 11241100x8000000000000000553585Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:33.447{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ed1783fc873873692021-12-21 11:38:33.447root 11241100x8000000000000000553586Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:33.448{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.218eca9a2c56d9092021-12-21 11:38:33.448root 11241100x8000000000000000553587Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:33.448{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6b4bf7676f8eae922021-12-21 11:38:33.448root 11241100x8000000000000000553588Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:33.448{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.dfd3c34df10d257a2021-12-21 11:38:33.448root 11241100x8000000000000000553589Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:33.448{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ad8be754ce70b7fc2021-12-21 11:38:33.448root 11241100x8000000000000000553590Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:33.448{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.eb2f2d85122e67982021-12-21 11:38:33.448root 11241100x8000000000000000553591Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:33.449{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.54d43c0733eaea252021-12-21 11:38:33.449root 11241100x8000000000000000553592Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:33.449{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2ba8b289702958212021-12-21 11:38:33.449root 11241100x8000000000000000553593Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:33.449{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.798d1ed031ef3d102021-12-21 11:38:33.449root 11241100x8000000000000000553594Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:33.449{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.15219a9db5c166e22021-12-21 11:38:33.449root 11241100x8000000000000000553595Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:33.449{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e20b71709376839e2021-12-21 11:38:33.449root 11241100x8000000000000000553596Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:33.449{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.13ef09adeb931b6d2021-12-21 11:38:33.449root 11241100x8000000000000000553597Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:33.449{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.684c064d14d458ba2021-12-21 11:38:33.449root 11241100x8000000000000000553598Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:33.449{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.463b396634b515df2021-12-21 11:38:33.449root 11241100x8000000000000000553599Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:33.449{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d78a7dd9a94021ee2021-12-21 11:38:33.449root 11241100x8000000000000000553600Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:33.449{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.27100ddf37df4b9d2021-12-21 11:38:33.449root 11241100x8000000000000000553601Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:33.449{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7803bb82a52c0c992021-12-21 11:38:33.449root 11241100x8000000000000000553602Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:33.450{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1be69cfb828c97382021-12-21 11:38:33.450root 11241100x8000000000000000553603Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:33.450{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ea2fec388f1005562021-12-21 11:38:33.450root 11241100x8000000000000000553604Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:33.450{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e5355d4da1bcfe662021-12-21 11:38:33.450root 11241100x8000000000000000553605Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:33.450{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7cffd17263dffffc2021-12-21 11:38:33.450root 11241100x8000000000000000553606Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:33.450{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c5dbaea6ef6dc49f2021-12-21 11:38:33.450root 11241100x8000000000000000553607Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:33.450{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0827f08ef1d3206f2021-12-21 11:38:33.450root 11241100x8000000000000000553608Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:33.450{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.34dd9e8ab7966b702021-12-21 11:38:33.450root 11241100x8000000000000000553609Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:33.450{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.245121340fd7df762021-12-21 11:38:33.450root 11241100x8000000000000000553610Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:33.450{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.82cfcb21ba6a6e262021-12-21 11:38:33.450root 11241100x8000000000000000553611Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:33.450{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.bc2c02479af4edb72021-12-21 11:38:33.450root 11241100x8000000000000000553612Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:33.450{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.105b009896723f402021-12-21 11:38:33.450root 11241100x8000000000000000553613Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:33.450{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.52f3c69dec7438d52021-12-21 11:38:33.450root 11241100x8000000000000000553614Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:33.450{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9db6d75b9aea98902021-12-21 11:38:33.450root 11241100x8000000000000000553615Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:33.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.42fd71180394d0f62021-12-21 11:38:33.943root 11241100x8000000000000000553616Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:33.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.268d90d54df2faff2021-12-21 11:38:33.943root 11241100x8000000000000000553617Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:33.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9c6998272eeaf69c2021-12-21 11:38:33.944root 11241100x8000000000000000553618Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:33.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.06eb6052b90230d82021-12-21 11:38:33.944root 11241100x8000000000000000553619Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:33.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d3cb63c919dabd7d2021-12-21 11:38:33.944root 11241100x8000000000000000553620Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:33.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6aa1132532af2e472021-12-21 11:38:33.944root 11241100x8000000000000000553621Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:33.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d0a2fa5445a2f2ae2021-12-21 11:38:33.944root 11241100x8000000000000000553622Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:33.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e3ce841627b076612021-12-21 11:38:33.944root 11241100x8000000000000000553623Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:33.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b83b6462bfb7f3ce2021-12-21 11:38:33.944root 11241100x8000000000000000553624Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:33.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c20cbf13146113b32021-12-21 11:38:33.944root 11241100x8000000000000000553625Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:33.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.44d53c96493f7c882021-12-21 11:38:33.944root 11241100x8000000000000000553626Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:33.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1587bb3d24a561142021-12-21 11:38:33.944root 11241100x8000000000000000553627Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:33.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.35e99594d7d168052021-12-21 11:38:33.945root 11241100x8000000000000000553628Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:33.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d86534ff1c7015212021-12-21 11:38:33.945root 11241100x8000000000000000553629Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:33.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5014cbd47b13e8602021-12-21 11:38:33.945root 11241100x8000000000000000553630Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:33.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d0adc51d07ed9c012021-12-21 11:38:33.945root 11241100x8000000000000000553631Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:33.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d14900913d5a9bc52021-12-21 11:38:33.945root 11241100x8000000000000000553632Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:33.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.26e0e6b3260068372021-12-21 11:38:33.945root 11241100x8000000000000000553633Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:33.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a7533830e6f9b1bf2021-12-21 11:38:33.945root 11241100x8000000000000000553634Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:33.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.04e292e61a08ef6a2021-12-21 11:38:33.945root 11241100x8000000000000000553635Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:33.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ebde45265fddac9e2021-12-21 11:38:33.945root 11241100x8000000000000000553636Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:33.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.22276b99595922612021-12-21 11:38:33.945root 11241100x8000000000000000553637Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:33.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f233cbec107459272021-12-21 11:38:33.945root 11241100x8000000000000000553638Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:33.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7fc4afa000b626e22021-12-21 11:38:33.945root 11241100x8000000000000000553639Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:33.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.63bef637d6a11aaf2021-12-21 11:38:33.945root 11241100x8000000000000000553640Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:33.946{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b9c5a58811836d802021-12-21 11:38:33.946root 11241100x8000000000000000553641Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:33.946{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.fbe4a3429de159602021-12-21 11:38:33.946root 11241100x8000000000000000553642Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:33.946{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.084662d2d93d6aca2021-12-21 11:38:33.946root 11241100x8000000000000000553643Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:33.946{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.aeee7022ba0cb6b92021-12-21 11:38:33.946root 11241100x8000000000000000553644Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:33.946{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0c741fcc78c2eb502021-12-21 11:38:33.946root 11241100x8000000000000000553645Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:33.946{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0c77b82cd64b03fb2021-12-21 11:38:33.946root 11241100x8000000000000000553646Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:33.946{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9b59215540952ce42021-12-21 11:38:33.946root 11241100x8000000000000000553647Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:33.946{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.314abacf5d3cfa1c2021-12-21 11:38:33.946root 11241100x8000000000000000553648Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:34.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c34561c42d873aca2021-12-21 11:38:34.444root 11241100x8000000000000000553649Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:34.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.71ef5b0170276e0d2021-12-21 11:38:34.444root 11241100x8000000000000000553650Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:34.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.16aa930e9283ab502021-12-21 11:38:34.444root 11241100x8000000000000000553651Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:34.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.18fdfe89feba09552021-12-21 11:38:34.444root 11241100x8000000000000000553652Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:34.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.156cf6c0d477777f2021-12-21 11:38:34.445root 11241100x8000000000000000553653Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:34.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6d47491d4fd8baac2021-12-21 11:38:34.445root 11241100x8000000000000000553654Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:34.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0b715b185a1630b62021-12-21 11:38:34.445root 11241100x8000000000000000553655Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:34.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.22094f551e6c4adc2021-12-21 11:38:34.445root 11241100x8000000000000000553656Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:34.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.10d469f7cacd4b2a2021-12-21 11:38:34.445root 11241100x8000000000000000553657Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:34.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.bec5f4ee485f01aa2021-12-21 11:38:34.445root 11241100x8000000000000000553658Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:34.446{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d475edfddf3aabb52021-12-21 11:38:34.446root 11241100x8000000000000000553659Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:34.446{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1ab4a3772cc54db32021-12-21 11:38:34.446root 11241100x8000000000000000553660Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:34.446{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9d03f5283158771f2021-12-21 11:38:34.446root 11241100x8000000000000000553661Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:34.446{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.97740cebd04e79e32021-12-21 11:38:34.446root 11241100x8000000000000000553662Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:34.446{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.22786dfed501b15d2021-12-21 11:38:34.446root 11241100x8000000000000000553663Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:34.446{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5d4f11bae28365462021-12-21 11:38:34.446root 11241100x8000000000000000553664Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:34.446{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0f6b8e0a6d39c1632021-12-21 11:38:34.446root 11241100x8000000000000000553665Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:34.446{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.06ddba34b8f29c1e2021-12-21 11:38:34.446root 11241100x8000000000000000553666Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:34.446{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4bcb5eb9b2fb74562021-12-21 11:38:34.446root 11241100x8000000000000000553667Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:34.447{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.bc17f370c8d9c2d22021-12-21 11:38:34.447root 11241100x8000000000000000553668Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:34.447{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a156a7f9902eef792021-12-21 11:38:34.447root 11241100x8000000000000000553669Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:34.447{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8404e56278ee88fa2021-12-21 11:38:34.447root 11241100x8000000000000000553670Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:34.447{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.505f3150b9493a8b2021-12-21 11:38:34.447root 11241100x8000000000000000553671Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:34.447{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e978e1a2d798028a2021-12-21 11:38:34.447root 11241100x8000000000000000553672Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:34.448{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.da93f6572a14181b2021-12-21 11:38:34.448root 11241100x8000000000000000553673Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:34.448{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3f4b34d670c273f42021-12-21 11:38:34.448root 11241100x8000000000000000553674Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:34.448{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7dce6c9cc87299362021-12-21 11:38:34.448root 11241100x8000000000000000553675Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:34.448{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.aea200ed5a1d6e3d2021-12-21 11:38:34.448root 11241100x8000000000000000553676Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:34.448{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4b6ab46ad91efe192021-12-21 11:38:34.448root 11241100x8000000000000000553677Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:34.448{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.fc1de0f7851e4a822021-12-21 11:38:34.448root 11241100x8000000000000000553678Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:34.448{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8f9ba7115d26752e2021-12-21 11:38:34.448root 11241100x8000000000000000553679Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:34.449{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.01f7d21a06dc0efc2021-12-21 11:38:34.449root 11241100x8000000000000000553680Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:34.449{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6c58f43c23d725292021-12-21 11:38:34.449root 11241100x8000000000000000553681Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:34.449{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.eb3e420bd89e64592021-12-21 11:38:34.449root 11241100x8000000000000000553682Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:34.449{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b36af03cb7f82b732021-12-21 11:38:34.449root 11241100x8000000000000000553683Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:34.449{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.676d553b94993a6f2021-12-21 11:38:34.449root 11241100x8000000000000000553684Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:34.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e390b7ebdac7e3902021-12-21 11:38:34.943root 11241100x8000000000000000553685Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:34.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d04be801dd1986c12021-12-21 11:38:34.943root 11241100x8000000000000000553686Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:34.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.65bb01dd3b5d8f312021-12-21 11:38:34.943root 11241100x8000000000000000553687Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:34.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3bf6e8389ed7501a2021-12-21 11:38:34.943root 11241100x8000000000000000553688Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:34.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a4dd1d22b99f7f5f2021-12-21 11:38:34.943root 11241100x8000000000000000553689Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:34.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1386162904d256872021-12-21 11:38:34.944root 11241100x8000000000000000553690Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:34.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1983c562ade27dc52021-12-21 11:38:34.944root 11241100x8000000000000000553691Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:34.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.96a68fc5cd4585bb2021-12-21 11:38:34.944root 11241100x8000000000000000553692Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:34.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.324323546ffdc6bc2021-12-21 11:38:34.944root 11241100x8000000000000000553693Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:34.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.39cc4956544b53c92021-12-21 11:38:34.945root 11241100x8000000000000000553694Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:34.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.44474fa9472bd5532021-12-21 11:38:34.945root 11241100x8000000000000000553695Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:34.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5a57e7e00d68a8ee2021-12-21 11:38:34.945root 11241100x8000000000000000553696Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:34.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a5ffe4af86f935b12021-12-21 11:38:34.945root 11241100x8000000000000000553697Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:34.946{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.bca294c16bcfe2162021-12-21 11:38:34.946root 11241100x8000000000000000553698Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:34.946{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7e9d0ca7c37741032021-12-21 11:38:34.946root 11241100x8000000000000000553699Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:34.946{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.10d8990ea5296a3b2021-12-21 11:38:34.946root 11241100x8000000000000000553700Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:34.946{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4b53e00665af21602021-12-21 11:38:34.946root 11241100x8000000000000000553701Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:34.947{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ad4a8e323bd574e92021-12-21 11:38:34.947root 11241100x8000000000000000553702Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:34.947{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.42da9581762c6b922021-12-21 11:38:34.947root 11241100x8000000000000000553703Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:34.947{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1c86ac09e4f3bd722021-12-21 11:38:34.947root 11241100x8000000000000000553704Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:34.947{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3c5ba4b9aa2144a02021-12-21 11:38:34.947root 11241100x8000000000000000553705Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:34.948{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e3bc3df194895ccf2021-12-21 11:38:34.948root 11241100x8000000000000000553706Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:34.948{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.531ca6b2245ee6a52021-12-21 11:38:34.948root 11241100x8000000000000000553707Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:34.948{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ee5fca113aed9ad72021-12-21 11:38:34.948root 11241100x8000000000000000553708Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:34.948{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.bc72afa0d26790c52021-12-21 11:38:34.948root 11241100x8000000000000000553709Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:34.948{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.57b60d69d42765782021-12-21 11:38:34.948root 11241100x8000000000000000553710Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:34.948{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4aa1c6a1bbec0fb92021-12-21 11:38:34.948root 11241100x8000000000000000553711Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:34.949{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0a03f5c2775721ef2021-12-21 11:38:34.949root 11241100x8000000000000000553712Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:34.949{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f2bd5105b29890512021-12-21 11:38:34.949root 11241100x8000000000000000553713Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:34.949{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.66b148e4af47d7662021-12-21 11:38:34.949root 11241100x8000000000000000553714Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:34.949{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ddab9ef7806e69552021-12-21 11:38:34.949root 11241100x8000000000000000553715Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:34.949{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d940383d3f5ecdf92021-12-21 11:38:34.949root 11241100x8000000000000000553716Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:34.949{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.728b950d46140e332021-12-21 11:38:34.949root 11241100x8000000000000000553717Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:34.950{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ddeb060f324129d92021-12-21 11:38:34.950root 11241100x8000000000000000553718Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:34.950{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2461d723e68dc0f22021-12-21 11:38:34.950root 11241100x8000000000000000553719Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:34.950{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1a18db95f79516dd2021-12-21 11:38:34.950root 11241100x8000000000000000553720Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:34.950{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.167a7f7924f6125f2021-12-21 11:38:34.950root 11241100x8000000000000000553721Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:34.950{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.07e31c89197a78432021-12-21 11:38:34.950root 11241100x8000000000000000553722Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:34.951{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3f770baa54e89c9c2021-12-21 11:38:34.951root 11241100x8000000000000000553723Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:34.951{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.731da7b86af142e02021-12-21 11:38:34.951root 11241100x8000000000000000553724Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:34.951{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8e3d12b4e8413cc42021-12-21 11:38:34.951root 11241100x8000000000000000553725Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:34.951{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.811eae6c8b5f266a2021-12-21 11:38:34.951root 11241100x8000000000000000553726Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:34.951{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.57e3dae56f7b65b62021-12-21 11:38:34.951root 11241100x8000000000000000553727Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:34.951{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b3ee4e91d6fd198a2021-12-21 11:38:34.951root 11241100x8000000000000000553728Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:34.952{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.815e63f8029b137d2021-12-21 11:38:34.952root 354300x8000000000000000553729Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:35.193{ec2b6afe-95d9-61c1-5175-3a0400000000}5346/opt/splunkforwarder/etc/apps/Splunk_TA_stream/linux_x86_64/bin/streamfwdroottcptruefalse10.0.1.25-48840-false10.0.1.12-8000- 11241100x8000000000000000553730Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:35.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3cf1b6a0dc8a1bca2021-12-21 11:38:35.193root 11241100x8000000000000000553731Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:35.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e48251793e9ad5572021-12-21 11:38:35.194root 11241100x8000000000000000553732Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:35.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7ecbdf5cd4752cc82021-12-21 11:38:35.194root 11241100x8000000000000000553733Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:35.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f516fb25c7321d532021-12-21 11:38:35.194root 11241100x8000000000000000553734Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:35.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3999df2418ac6b9e2021-12-21 11:38:35.194root 11241100x8000000000000000553735Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:35.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.025366adc3c71f282021-12-21 11:38:35.194root 11241100x8000000000000000553736Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:35.195{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.fe0ffe99a1f305562021-12-21 11:38:35.195root 11241100x8000000000000000553737Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:35.195{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0ea175376591cb912021-12-21 11:38:35.195root 11241100x8000000000000000553738Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:35.195{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.529bd139e5cbd22f2021-12-21 11:38:35.195root 11241100x8000000000000000553739Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:35.195{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d70048ba5ebbd63a2021-12-21 11:38:35.195root 11241100x8000000000000000553740Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:35.195{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1d06bda1ad72f96a2021-12-21 11:38:35.195root 11241100x8000000000000000553741Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:35.195{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e79046f7b57c0ae52021-12-21 11:38:35.195root 11241100x8000000000000000553742Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:35.196{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f916f4d5f42d83bd2021-12-21 11:38:35.196root 11241100x8000000000000000553743Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:35.196{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0a9ca58ff9ff4f542021-12-21 11:38:35.196root 11241100x8000000000000000553744Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:35.196{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5817ed4e69dbd51e2021-12-21 11:38:35.196root 11241100x8000000000000000553745Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:35.196{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1cba68c535482f262021-12-21 11:38:35.196root 11241100x8000000000000000553746Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:35.196{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.69e0b16406f568062021-12-21 11:38:35.196root 11241100x8000000000000000553747Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:35.196{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2c18e869794d025a2021-12-21 11:38:35.196root 11241100x8000000000000000553748Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:35.196{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5e600562956fcced2021-12-21 11:38:35.196root 11241100x8000000000000000553749Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:35.196{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.02b3d4ca122001402021-12-21 11:38:35.196root 11241100x8000000000000000553750Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:35.196{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f5a2356f054107a12021-12-21 11:38:35.196root 11241100x8000000000000000553751Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:35.196{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.edaaa5b16ebc87002021-12-21 11:38:35.196root 11241100x8000000000000000553752Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:35.197{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f26f9c96801de1d62021-12-21 11:38:35.197root 11241100x8000000000000000553753Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:35.197{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.aff81a775969c5552021-12-21 11:38:35.197root 11241100x8000000000000000553754Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:35.197{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0aaa7551aca9e4e82021-12-21 11:38:35.197root 11241100x8000000000000000553755Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:35.197{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.073cc5a5855231c62021-12-21 11:38:35.197root 11241100x8000000000000000553756Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:35.197{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1ee3af58629acc7c2021-12-21 11:38:35.197root 11241100x8000000000000000553757Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:35.197{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.bc440da889075efe2021-12-21 11:38:35.197root 11241100x8000000000000000553758Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:35.197{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.057789dbf0a610922021-12-21 11:38:35.197root 11241100x8000000000000000553759Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:35.197{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.adc277e19ccc33a02021-12-21 11:38:35.197root 11241100x8000000000000000553760Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:35.197{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.48c1d3d29eb0ce142021-12-21 11:38:35.197root 11241100x8000000000000000553761Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:35.197{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e4f7184eda1df5562021-12-21 11:38:35.197root 11241100x8000000000000000553762Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:35.198{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c42a872a028071632021-12-21 11:38:35.198root 11241100x8000000000000000553763Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:35.198{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8439d863e0b1b1c92021-12-21 11:38:35.198root 11241100x8000000000000000553764Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:35.198{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4d8820eeedfa2d512021-12-21 11:38:35.198root 11241100x8000000000000000553765Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:35.198{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.db9a4f4923bac69e2021-12-21 11:38:35.198root 11241100x8000000000000000553766Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:35.198{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.fb2e6dbc74a1cf432021-12-21 11:38:35.198root 11241100x8000000000000000553767Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:35.198{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2fed42ead46de3c32021-12-21 11:38:35.198root 11241100x8000000000000000553768Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:35.198{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.cb9e4ecf3ef446b42021-12-21 11:38:35.198root 11241100x8000000000000000553769Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:35.198{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f93c27159b6b5ecb2021-12-21 11:38:35.198root 11241100x8000000000000000553770Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:35.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c80b21decaaa74c92021-12-21 11:38:35.693root 11241100x8000000000000000553771Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:35.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.900e6081c6d936922021-12-21 11:38:35.693root 11241100x8000000000000000553772Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:35.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.05eb15175f7ac6ff2021-12-21 11:38:35.693root 11241100x8000000000000000553773Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:35.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1865a410ad1fdd7f2021-12-21 11:38:35.693root 11241100x8000000000000000553774Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:35.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3775b3e5ca03864d2021-12-21 11:38:35.694root 11241100x8000000000000000553775Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:35.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4e0486c195c9264a2021-12-21 11:38:35.694root 11241100x8000000000000000553776Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:35.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.86aa940ccf3f64762021-12-21 11:38:35.694root 11241100x8000000000000000553777Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:35.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d25dab23857bcbe62021-12-21 11:38:35.694root 11241100x8000000000000000553778Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:35.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.85dfe3286922740c2021-12-21 11:38:35.694root 11241100x8000000000000000553779Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:35.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8597ed0782f1e2822021-12-21 11:38:35.694root 11241100x8000000000000000553780Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:35.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.52af4cc726bdf50f2021-12-21 11:38:35.694root 11241100x8000000000000000553781Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:35.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6c9694627a876b532021-12-21 11:38:35.694root 11241100x8000000000000000553782Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:35.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.92ff1468a6855bbc2021-12-21 11:38:35.694root 11241100x8000000000000000553783Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:35.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ffe31ccd838c12b72021-12-21 11:38:35.694root 11241100x8000000000000000553784Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:35.695{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2d741f522cb681062021-12-21 11:38:35.695root 11241100x8000000000000000553785Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:35.695{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.06d0dfbfe492174f2021-12-21 11:38:35.695root 11241100x8000000000000000553786Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:35.695{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.10449e1111dbd4802021-12-21 11:38:35.695root 11241100x8000000000000000553787Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:35.695{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.02bac127fc4cf6522021-12-21 11:38:35.695root 11241100x8000000000000000553788Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:35.695{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2af2cd3ddce522e22021-12-21 11:38:35.695root 11241100x8000000000000000553789Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:35.696{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6518984eb94452852021-12-21 11:38:35.696root 11241100x8000000000000000553790Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:35.696{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ca74d6d6f93442422021-12-21 11:38:35.696root 11241100x8000000000000000553791Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:35.696{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.632239d13a2db50d2021-12-21 11:38:35.696root 11241100x8000000000000000553792Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:35.696{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.99bfa01c90ba39a62021-12-21 11:38:35.696root 11241100x8000000000000000553793Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:35.696{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.07cc47bcb52229782021-12-21 11:38:35.696root 11241100x8000000000000000553794Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:35.696{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d0f93a1b12a6dd942021-12-21 11:38:35.696root 11241100x8000000000000000553795Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:35.696{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.42d2cf153d95165d2021-12-21 11:38:35.696root 11241100x8000000000000000553796Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:35.696{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6e2adbf2e8e4b7da2021-12-21 11:38:35.696root 11241100x8000000000000000553797Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:35.696{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.05219694ef93fc322021-12-21 11:38:35.696root 11241100x8000000000000000553798Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:35.696{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.303a7215d41082072021-12-21 11:38:35.696root 11241100x8000000000000000553799Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:35.696{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.dbd18e897411deed2021-12-21 11:38:35.696root 11241100x8000000000000000553800Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:35.697{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3743b483ae2bea412021-12-21 11:38:35.697root 11241100x8000000000000000553801Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:35.697{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ec61524adb77441f2021-12-21 11:38:35.697root 11241100x8000000000000000553802Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:35.697{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.bed9bb8f458ad9062021-12-21 11:38:35.697root 11241100x8000000000000000553803Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:35.697{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e0e970b5d8d4fff12021-12-21 11:38:35.697root 11241100x8000000000000000553804Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:35.697{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.79bafcec19e348732021-12-21 11:38:35.697root 11241100x8000000000000000553805Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:35.697{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3bbcf2ab5ca16d812021-12-21 11:38:35.697root 11241100x8000000000000000553806Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:35.697{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b2df5a5d835b28942021-12-21 11:38:35.697root 11241100x8000000000000000553807Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:35.697{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ea72b0eea26377042021-12-21 11:38:35.697root 11241100x8000000000000000553808Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:36.192{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1f00aa8d2c97780b2021-12-21 11:38:36.192root 11241100x8000000000000000553809Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:36.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2b29136b6a74170a2021-12-21 11:38:36.193root 11241100x8000000000000000553810Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:36.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2e6e57da94191d0b2021-12-21 11:38:36.193root 11241100x8000000000000000553811Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:36.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.27c6db800e9e8c612021-12-21 11:38:36.193root 11241100x8000000000000000553812Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:36.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8a90685926a68a7a2021-12-21 11:38:36.193root 11241100x8000000000000000553813Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:36.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0410d33ef96c6a962021-12-21 11:38:36.193root 11241100x8000000000000000553814Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:36.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2e5e81cb9b448ccb2021-12-21 11:38:36.193root 11241100x8000000000000000553815Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:36.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0e15b1887a286c712021-12-21 11:38:36.193root 11241100x8000000000000000553816Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:36.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6bd61954fed470f42021-12-21 11:38:36.193root 11241100x8000000000000000553817Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:36.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3659916a6ddf12d72021-12-21 11:38:36.193root 11241100x8000000000000000553818Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:36.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c7e9a537588965872021-12-21 11:38:36.193root 11241100x8000000000000000553819Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:36.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9024bbeaf8c592672021-12-21 11:38:36.194root 11241100x8000000000000000553820Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:36.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b31279a69f6573682021-12-21 11:38:36.194root 11241100x8000000000000000553821Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:36.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2344f826d9414c2f2021-12-21 11:38:36.194root 11241100x8000000000000000553822Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:36.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8dd0dacbf901b0412021-12-21 11:38:36.194root 11241100x8000000000000000553823Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:36.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8dc0f85130ffe6c42021-12-21 11:38:36.194root 11241100x8000000000000000553824Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:36.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d8dac7eb802481f92021-12-21 11:38:36.194root 11241100x8000000000000000553825Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:36.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.378d168d330b30b52021-12-21 11:38:36.194root 11241100x8000000000000000553826Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:36.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.eef0dff6aeb8edda2021-12-21 11:38:36.194root 11241100x8000000000000000553827Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:36.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.983a0dd774b34cd82021-12-21 11:38:36.194root 11241100x8000000000000000553828Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:36.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.defb0852a3609de32021-12-21 11:38:36.194root 11241100x8000000000000000553829Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:36.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4462ab6e7f6394a32021-12-21 11:38:36.194root 11241100x8000000000000000553830Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:36.195{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.37a8cead5d0dbbbb2021-12-21 11:38:36.195root 11241100x8000000000000000553831Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:36.195{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e609edb53ab7b04f2021-12-21 11:38:36.195root 11241100x8000000000000000553832Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:36.195{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f567437a46f8fb5b2021-12-21 11:38:36.195root 11241100x8000000000000000553833Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:36.195{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9851aa49c35f73942021-12-21 11:38:36.195root 11241100x8000000000000000553834Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:36.195{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.92aa88a538dfe88b2021-12-21 11:38:36.195root 11241100x8000000000000000553835Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:36.195{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.cae82b7fead051a92021-12-21 11:38:36.195root 11241100x8000000000000000553836Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:36.195{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.66b7cc7fa657a2162021-12-21 11:38:36.195root 11241100x8000000000000000553837Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:36.195{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1b5db698f6c3c7c62021-12-21 11:38:36.195root 11241100x8000000000000000553838Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:36.196{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.afd9e5b2151210ca2021-12-21 11:38:36.196root 11241100x8000000000000000553839Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:36.196{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f5f55fedd5b591852021-12-21 11:38:36.196root 11241100x8000000000000000553840Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:36.196{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.bb1199ddadb919c22021-12-21 11:38:36.196root 11241100x8000000000000000553841Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:36.196{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.53daceb771e6167a2021-12-21 11:38:36.196root 11241100x8000000000000000553842Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:36.196{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2712ed67521447ba2021-12-21 11:38:36.196root 11241100x8000000000000000553843Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:36.196{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.259ddc82f60232fd2021-12-21 11:38:36.196root 11241100x8000000000000000553844Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:36.196{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.707490a40009aad02021-12-21 11:38:36.196root 11241100x8000000000000000553845Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:36.196{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.76b7d1a4b500b4e82021-12-21 11:38:36.196root 11241100x8000000000000000553846Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:36.196{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b97afe1367794f062021-12-21 11:38:36.196root 11241100x8000000000000000553847Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:36.196{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.44bd0f367813908b2021-12-21 11:38:36.196root 11241100x8000000000000000553848Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:36.196{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d5fbab40bebbcdb42021-12-21 11:38:36.196root 11241100x8000000000000000553849Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:36.197{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.299d7d7e4cab1a372021-12-21 11:38:36.197root 11241100x8000000000000000553850Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:36.197{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.db26d155baf100a82021-12-21 11:38:36.197root 11241100x8000000000000000553851Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:36.326{ec2b6afe-95d2-61c1-3038-b84203560000}5272/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/spool/splunk/tracker.log2021-12-21 11:38:36.326root 11241100x8000000000000000553852Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:36.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d4cd17ea134975862021-12-21 11:38:36.693root 11241100x8000000000000000553853Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:36.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f1e9387646212f2a2021-12-21 11:38:36.693root 11241100x8000000000000000553854Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:36.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b7f7afe2ce196caf2021-12-21 11:38:36.693root 11241100x8000000000000000553855Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:36.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.fb97b6772a7662ea2021-12-21 11:38:36.693root 11241100x8000000000000000553856Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:36.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a722512e538f2d6e2021-12-21 11:38:36.694root 11241100x8000000000000000553857Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:36.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.85f72bc2f194de8d2021-12-21 11:38:36.694root 11241100x8000000000000000553858Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:36.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e5dc845ac9a9bbe42021-12-21 11:38:36.694root 11241100x8000000000000000553859Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:36.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.14a5096ac823b2c92021-12-21 11:38:36.694root 11241100x8000000000000000553860Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:36.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9a11519aa16a026d2021-12-21 11:38:36.694root 11241100x8000000000000000553861Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:36.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6bca62815e870d9b2021-12-21 11:38:36.694root 11241100x8000000000000000553862Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:36.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ccf4e028503a0ac82021-12-21 11:38:36.694root 11241100x8000000000000000553863Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:36.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.39ad40e53c2775112021-12-21 11:38:36.694root 11241100x8000000000000000553864Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:36.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.597e542ff9aa888b2021-12-21 11:38:36.694root 11241100x8000000000000000553865Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:36.695{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f8692254af5388762021-12-21 11:38:36.695root 11241100x8000000000000000553866Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:36.695{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.55d457ce050d77532021-12-21 11:38:36.695root 11241100x8000000000000000553867Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:36.695{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.66b7d275fbb03e742021-12-21 11:38:36.695root 11241100x8000000000000000553868Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:36.695{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.14efc0672b3a40902021-12-21 11:38:36.695root 11241100x8000000000000000553869Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:36.695{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1f1bcaf93856f76e2021-12-21 11:38:36.695root 11241100x8000000000000000553870Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:36.695{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.42c0325c92c5fbb42021-12-21 11:38:36.695root 11241100x8000000000000000553871Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:36.695{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5e820814ceac088a2021-12-21 11:38:36.695root 11241100x8000000000000000553872Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:36.695{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d475f611572b40942021-12-21 11:38:36.695root 11241100x8000000000000000553873Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:36.696{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a29bb3c2d16761862021-12-21 11:38:36.696root 11241100x8000000000000000553874Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:36.696{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d3fd382a551ecfc72021-12-21 11:38:36.696root 11241100x8000000000000000553875Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:36.696{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6018cbd19d2f35a72021-12-21 11:38:36.696root 11241100x8000000000000000553876Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:36.696{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.dc2e0d5cb945b3462021-12-21 11:38:36.696root 11241100x8000000000000000553877Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:36.696{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.90b710a63ddc69df2021-12-21 11:38:36.696root 11241100x8000000000000000553878Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:36.697{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5161ca2fe2cccdff2021-12-21 11:38:36.697root 11241100x8000000000000000553879Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:36.697{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b5837c07172e95a32021-12-21 11:38:36.697root 11241100x8000000000000000553880Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:36.697{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.cc77749587710ca82021-12-21 11:38:36.697root 11241100x8000000000000000553881Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:36.697{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b5e2b6510ae42b992021-12-21 11:38:36.697root 11241100x8000000000000000553882Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:36.698{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6f066b1e56a5196a2021-12-21 11:38:36.698root 11241100x8000000000000000553883Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:36.698{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.dcf0c527ec8012ce2021-12-21 11:38:36.698root 11241100x8000000000000000553884Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:36.698{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4bb19c2122bda4782021-12-21 11:38:36.698root 11241100x8000000000000000553885Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:36.699{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5fc08d0bccc3e3402021-12-21 11:38:36.699root 11241100x8000000000000000553886Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:36.699{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.47e71477c1c433922021-12-21 11:38:36.699root 11241100x8000000000000000553887Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:36.699{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.40d3d95c7856a41b2021-12-21 11:38:36.699root 11241100x8000000000000000553888Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:37.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.fafe00aa3bcb48792021-12-21 11:38:37.193root 11241100x8000000000000000553889Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:37.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8c6aa1eca283486f2021-12-21 11:38:37.194root 11241100x8000000000000000553890Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:37.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5c424adbe5b8263f2021-12-21 11:38:37.194root 11241100x8000000000000000553891Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:37.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ebeb15c0588c078e2021-12-21 11:38:37.194root 11241100x8000000000000000553892Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:37.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8073109140e68a562021-12-21 11:38:37.194root 11241100x8000000000000000553893Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:37.195{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a2f856754f50f5d12021-12-21 11:38:37.195root 11241100x8000000000000000553894Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:37.195{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b5a229594616ee3b2021-12-21 11:38:37.195root 11241100x8000000000000000553895Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:37.195{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.10b119f762d427a12021-12-21 11:38:37.195root 11241100x8000000000000000553896Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:37.195{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.88ad3b9c69ac6eb72021-12-21 11:38:37.195root 11241100x8000000000000000553897Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:37.195{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c6543035b4e28d722021-12-21 11:38:37.195root 11241100x8000000000000000553898Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:37.195{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.db661f9b808c9d252021-12-21 11:38:37.195root 11241100x8000000000000000553899Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:37.195{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.71c80351c2ded7572021-12-21 11:38:37.195root 11241100x8000000000000000553900Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:37.195{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4842c81be5b1491c2021-12-21 11:38:37.195root 11241100x8000000000000000553901Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:37.196{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1581a38b5441d8c92021-12-21 11:38:37.196root 11241100x8000000000000000553902Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:37.196{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7c8b513a82a2646f2021-12-21 11:38:37.196root 11241100x8000000000000000553903Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:37.196{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a9c3a3ee61fdcdf92021-12-21 11:38:37.196root 11241100x8000000000000000553904Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:37.196{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5baaa7b0ef98adeb2021-12-21 11:38:37.196root 11241100x8000000000000000553905Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:37.196{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4d0a0fb5e1cbb0842021-12-21 11:38:37.196root 11241100x8000000000000000553906Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:37.196{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.fcae1d6824a196c42021-12-21 11:38:37.196root 11241100x8000000000000000553907Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:37.196{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.83a514dc178492f22021-12-21 11:38:37.196root 11241100x8000000000000000553908Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:37.196{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b52320c2edfcfc552021-12-21 11:38:37.196root 11241100x8000000000000000553909Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:37.196{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8764508e2571b7902021-12-21 11:38:37.196root 11241100x8000000000000000553910Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:37.196{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.18a94b06a0de947a2021-12-21 11:38:37.196root 11241100x8000000000000000553911Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:37.196{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1159b04c4b939c172021-12-21 11:38:37.196root 11241100x8000000000000000553912Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:37.197{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0380ec18f66254f12021-12-21 11:38:37.197root 11241100x8000000000000000553913Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:37.197{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c44aeac815629fa32021-12-21 11:38:37.197root 11241100x8000000000000000553914Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:37.197{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1591c593f70323e22021-12-21 11:38:37.197root 11241100x8000000000000000553915Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:37.197{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5aa92b807f8ccd512021-12-21 11:38:37.197root 11241100x8000000000000000553916Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:37.197{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6c986770cbde005d2021-12-21 11:38:37.197root 11241100x8000000000000000553917Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:37.197{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.78adeead6b5fb5162021-12-21 11:38:37.197root 11241100x8000000000000000553918Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:37.197{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1b6d10f98c3824a12021-12-21 11:38:37.197root 11241100x8000000000000000553919Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:37.197{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.02258b403bb45aa92021-12-21 11:38:37.197root 11241100x8000000000000000553920Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:37.198{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.fe8681d2dcfb85002021-12-21 11:38:37.198root 11241100x8000000000000000553921Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:37.198{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.122d588eed0f44742021-12-21 11:38:37.198root 11241100x8000000000000000553922Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:37.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6000d081d16f7ff42021-12-21 11:38:37.693root 11241100x8000000000000000553923Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:37.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.98e1bbf55b3686982021-12-21 11:38:37.693root 11241100x8000000000000000553924Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:37.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.66b9de6127b557ef2021-12-21 11:38:37.693root 11241100x8000000000000000553925Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:37.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b861ed58465ffc432021-12-21 11:38:37.693root 11241100x8000000000000000553926Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:37.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9908e6134e671a562021-12-21 11:38:37.693root 11241100x8000000000000000553927Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:37.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.eaebdfaa1eb4ede82021-12-21 11:38:37.693root 11241100x8000000000000000553928Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:37.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ac7b83b8171743222021-12-21 11:38:37.694root 11241100x8000000000000000553929Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:37.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e17529b63653211f2021-12-21 11:38:37.694root 11241100x8000000000000000553930Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:37.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5d1917d6e57fcc4b2021-12-21 11:38:37.694root 11241100x8000000000000000553931Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:37.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ea55555a2ea5155a2021-12-21 11:38:37.694root 11241100x8000000000000000553932Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:37.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.52ef1f5c80dceb8c2021-12-21 11:38:37.694root 11241100x8000000000000000553933Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:37.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2089622dc36188992021-12-21 11:38:37.694root 11241100x8000000000000000553934Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:37.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0dc466a64a3ce08f2021-12-21 11:38:37.694root 11241100x8000000000000000553935Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:37.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.283c313cfac40f362021-12-21 11:38:37.694root 11241100x8000000000000000553936Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:37.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1bbce1eb817f83c32021-12-21 11:38:37.694root 11241100x8000000000000000553937Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:37.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0970288ea9bc7cc02021-12-21 11:38:37.694root 11241100x8000000000000000553938Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:37.695{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e86fd86c150a03482021-12-21 11:38:37.695root 11241100x8000000000000000553939Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:37.695{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.74df7ce8d6250a862021-12-21 11:38:37.695root 11241100x8000000000000000553940Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:37.695{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ffdd3425086744e32021-12-21 11:38:37.695root 11241100x8000000000000000553941Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:37.695{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e22c1076371187d82021-12-21 11:38:37.695root 11241100x8000000000000000553942Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:37.695{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1ca049f4832284a62021-12-21 11:38:37.695root 11241100x8000000000000000553943Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:37.696{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6073d865faad4ba32021-12-21 11:38:37.696root 11241100x8000000000000000553944Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:37.696{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6fbab4a9effd67e42021-12-21 11:38:37.696root 11241100x8000000000000000553945Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:37.696{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.02d75130911fc6b22021-12-21 11:38:37.696root 11241100x8000000000000000553946Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:37.696{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1e5b3b672483a1562021-12-21 11:38:37.696root 11241100x8000000000000000553947Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:37.696{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.901f830c7ec4465e2021-12-21 11:38:37.696root 11241100x8000000000000000553948Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:37.696{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.25724ffe794084fc2021-12-21 11:38:37.696root 11241100x8000000000000000553949Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:37.696{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0e51e51b8c4979002021-12-21 11:38:37.696root 11241100x8000000000000000553950Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:37.696{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.551706114ed1f3eb2021-12-21 11:38:37.696root 11241100x8000000000000000553951Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:37.696{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.75e8fd39f48dfad92021-12-21 11:38:37.696root 11241100x8000000000000000553952Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:37.697{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5c0a5e6d42d63ce82021-12-21 11:38:37.697root 11241100x8000000000000000553953Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:37.697{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.83f9e9374d8108022021-12-21 11:38:37.697root 11241100x8000000000000000553954Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:37.697{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.87866d0a203649262021-12-21 11:38:37.697root 11241100x8000000000000000553955Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:37.697{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5d1afeb40fef44fc2021-12-21 11:38:37.697root 11241100x8000000000000000553956Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:38.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.85621595f5f8d7372021-12-21 11:38:38.193root 11241100x8000000000000000553957Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:38.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6e253a2a797695f02021-12-21 11:38:38.193root 11241100x8000000000000000553958Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:38.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.62a9062a3717c9322021-12-21 11:38:38.193root 11241100x8000000000000000553959Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:38.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3bee4bac3d8b2dba2021-12-21 11:38:38.194root 11241100x8000000000000000553960Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:38.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.bb36a6a1171445f52021-12-21 11:38:38.194root 11241100x8000000000000000553961Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:38.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.69283225febc1ea22021-12-21 11:38:38.194root 11241100x8000000000000000553962Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:38.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.97c601e0696629bc2021-12-21 11:38:38.194root 11241100x8000000000000000553963Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:38.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a37652a0ccf4c43b2021-12-21 11:38:38.194root 11241100x8000000000000000553964Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:38.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a6906506f347b4692021-12-21 11:38:38.194root 11241100x8000000000000000553965Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:38.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.aa0bb578724828832021-12-21 11:38:38.194root 11241100x8000000000000000553966Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:38.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8a5a268e0efb060d2021-12-21 11:38:38.194root 11241100x8000000000000000553967Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:38.195{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a740bae750037a732021-12-21 11:38:38.195root 11241100x8000000000000000553968Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:38.195{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2157b535551023162021-12-21 11:38:38.195root 11241100x8000000000000000553969Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:38.195{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9708362a534abcd02021-12-21 11:38:38.195root 11241100x8000000000000000553970Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:38.195{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a9905e76e732f8ae2021-12-21 11:38:38.195root 11241100x8000000000000000553971Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:38.195{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ecc1287abb4e1b872021-12-21 11:38:38.195root 11241100x8000000000000000553972Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:38.195{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0d46fb7ed067c6662021-12-21 11:38:38.195root 11241100x8000000000000000553973Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:38.195{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f9490b709f8a3d952021-12-21 11:38:38.195root 11241100x8000000000000000553974Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:38.195{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.dcfc0a9fe13c38562021-12-21 11:38:38.195root 11241100x8000000000000000553975Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:38.195{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ed04993c9ecc005f2021-12-21 11:38:38.195root 11241100x8000000000000000553976Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:38.195{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.40f3f372c6149f782021-12-21 11:38:38.195root 11241100x8000000000000000553977Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:38.195{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3cf01399b682a9312021-12-21 11:38:38.195root 11241100x8000000000000000553978Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:38.196{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.72b54e057730ca942021-12-21 11:38:38.196root 11241100x8000000000000000553979Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:38.196{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.fca3d719a4b5b03b2021-12-21 11:38:38.196root 11241100x8000000000000000553980Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:38.196{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d6f9e721b06434d12021-12-21 11:38:38.196root 11241100x8000000000000000553981Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:38.196{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b9f649e992fef3032021-12-21 11:38:38.196root 11241100x8000000000000000553982Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:38.196{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ae52718f317ca6922021-12-21 11:38:38.196root 11241100x8000000000000000553983Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:38.196{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e45dafe44b39e3b02021-12-21 11:38:38.196root 11241100x8000000000000000553984Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:38.196{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.84cf7cbbc208ac562021-12-21 11:38:38.196root 11241100x8000000000000000553985Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:38.196{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.fb0a49d2eda491ef2021-12-21 11:38:38.196root 11241100x8000000000000000553986Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:38.196{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.230d858d129824c32021-12-21 11:38:38.196root 11241100x8000000000000000553987Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:38.196{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.86edc23c4e49a2102021-12-21 11:38:38.196root 11241100x8000000000000000553988Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:38.196{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2ac9ebe2f00d8fbd2021-12-21 11:38:38.196root 11241100x8000000000000000553989Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:38.196{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6f899ae0026292472021-12-21 11:38:38.196root 11241100x8000000000000000553990Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:38.196{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5a4a564a049bba2f2021-12-21 11:38:38.196root 11241100x8000000000000000553991Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:38.196{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c3a8d2cc91cddbd02021-12-21 11:38:38.196root 11241100x8000000000000000553992Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:38.196{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0277da411106bdf32021-12-21 11:38:38.196root 11241100x8000000000000000553993Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:38.197{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f11a6ed90403d0b52021-12-21 11:38:38.197root 11241100x8000000000000000553994Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:38.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e4645d430cae85d52021-12-21 11:38:38.693root 11241100x8000000000000000553995Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:38.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3c047c74c99215d12021-12-21 11:38:38.693root 11241100x8000000000000000553996Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:38.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e720fab16c54c5da2021-12-21 11:38:38.693root 11241100x8000000000000000553997Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:38.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b1860688be67ff9e2021-12-21 11:38:38.693root 11241100x8000000000000000553998Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:38.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b8d506b55ee1c15b2021-12-21 11:38:38.693root 11241100x8000000000000000553999Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:38.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4efb1fb5500cea282021-12-21 11:38:38.694root 11241100x8000000000000000554000Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:38.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.494f5c85918493bf2021-12-21 11:38:38.694root 11241100x8000000000000000554001Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:38.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c7ad8e9ca2f690622021-12-21 11:38:38.694root 11241100x8000000000000000554002Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:38.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9d4f67d450b0777d2021-12-21 11:38:38.694root 11241100x8000000000000000554003Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:38.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.42e82c565a66c99c2021-12-21 11:38:38.694root 11241100x8000000000000000554004Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:38.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.30db25b02e86a0e92021-12-21 11:38:38.694root 11241100x8000000000000000554005Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:38.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.239bde0e08f133122021-12-21 11:38:38.694root 11241100x8000000000000000554006Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:38.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.96eeb77bcf2f562b2021-12-21 11:38:38.694root 11241100x8000000000000000554007Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:38.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ec84afd852e8b4122021-12-21 11:38:38.694root 11241100x8000000000000000554008Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:38.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4d156c61090b570e2021-12-21 11:38:38.694root 11241100x8000000000000000554009Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:38.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.45c98146984c157b2021-12-21 11:38:38.694root 11241100x8000000000000000554010Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:38.695{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.33d7ea025f09a7562021-12-21 11:38:38.695root 11241100x8000000000000000554011Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:38.695{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.184a98b9c915c6992021-12-21 11:38:38.695root 11241100x8000000000000000554012Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:38.695{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.73ec174bc627654d2021-12-21 11:38:38.695root 11241100x8000000000000000554013Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:38.695{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0a996c1c87b114732021-12-21 11:38:38.695root 11241100x8000000000000000554014Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:38.695{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4cf0e8bc543e873b2021-12-21 11:38:38.695root 11241100x8000000000000000554015Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:38.695{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2208c1fb309add8d2021-12-21 11:38:38.695root 11241100x8000000000000000554016Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:38.695{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ca7d016e261395292021-12-21 11:38:38.695root 11241100x8000000000000000554017Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:38.695{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d4675fe428f1062f2021-12-21 11:38:38.695root 11241100x8000000000000000554018Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:38.695{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4c2a16368fd5fcbb2021-12-21 11:38:38.695root 11241100x8000000000000000554019Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:38.696{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d3b53c923738cfe72021-12-21 11:38:38.696root 11241100x8000000000000000554020Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:38.696{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.10dd2e6d894948b52021-12-21 11:38:38.696root 11241100x8000000000000000554021Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:38.696{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6db5a3a1b25bed992021-12-21 11:38:38.696root 11241100x8000000000000000554022Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:38.696{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b1231b2d6ce7ceb82021-12-21 11:38:38.696root 11241100x8000000000000000554023Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:38.696{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.18a6daa69dab43c62021-12-21 11:38:38.696root 11241100x8000000000000000554024Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:38.696{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.59aa131eb7e327542021-12-21 11:38:38.696root 11241100x8000000000000000554025Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:38.696{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.fe42e852a98ac59c2021-12-21 11:38:38.696root 11241100x8000000000000000554026Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:38.696{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f949ee6ceeb9c41f2021-12-21 11:38:38.696root 11241100x8000000000000000554027Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:38.696{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.70e26bc2fa62d26e2021-12-21 11:38:38.696root 11241100x8000000000000000554028Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:38.696{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b19b3950db6cbff42021-12-21 11:38:38.696root 11241100x8000000000000000554029Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:38.696{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ca6d289d15c6f6e42021-12-21 11:38:38.696root 11241100x8000000000000000554030Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:38.697{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5c3843b346466d122021-12-21 11:38:38.697root 11241100x8000000000000000554031Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:39.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.98dfd5da3245339d2021-12-21 11:38:39.193root 11241100x8000000000000000554032Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:39.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.264da55187e53b112021-12-21 11:38:39.193root 11241100x8000000000000000554033Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:39.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3e5d972a4f994dba2021-12-21 11:38:39.194root 11241100x8000000000000000554034Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:39.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3df87fed2a87d9272021-12-21 11:38:39.194root 11241100x8000000000000000554035Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:39.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.13f4309ea3b553bf2021-12-21 11:38:39.194root 11241100x8000000000000000554036Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:39.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5d1bc59d1606f37d2021-12-21 11:38:39.194root 11241100x8000000000000000554037Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:39.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0b0cdb4a082e60142021-12-21 11:38:39.194root 11241100x8000000000000000554038Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:39.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.843c63855d6bdb7b2021-12-21 11:38:39.194root 11241100x8000000000000000554039Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:39.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3e8f1719470c6de12021-12-21 11:38:39.194root 11241100x8000000000000000554040Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:39.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c977844cb808e3f12021-12-21 11:38:39.194root 11241100x8000000000000000554041Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:39.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b398fcc2c6966fef2021-12-21 11:38:39.194root 11241100x8000000000000000554042Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:39.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.acf664c9eb39c35c2021-12-21 11:38:39.194root 11241100x8000000000000000554043Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:39.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.bcd266a66656e8092021-12-21 11:38:39.194root 11241100x8000000000000000554044Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:39.195{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3c2f54f997f4d58a2021-12-21 11:38:39.195root 11241100x8000000000000000554045Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:39.195{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c54578893b7a78f12021-12-21 11:38:39.195root 11241100x8000000000000000554046Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:39.195{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.377cbea73f9d29662021-12-21 11:38:39.195root 11241100x8000000000000000554047Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:39.195{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b034ede0aae28e902021-12-21 11:38:39.195root 11241100x8000000000000000554048Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:39.195{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d4b0dd1dcc3c4c142021-12-21 11:38:39.195root 11241100x8000000000000000554049Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:39.195{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.21e5b707e13230052021-12-21 11:38:39.195root 11241100x8000000000000000554050Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:39.195{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.14632b9b426e89ad2021-12-21 11:38:39.195root 11241100x8000000000000000554051Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:39.195{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.36207a7ee9e958f52021-12-21 11:38:39.195root 11241100x8000000000000000554052Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:39.195{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3d6225d23180ae6a2021-12-21 11:38:39.195root 11241100x8000000000000000554053Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:39.196{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4463473c5362c8a72021-12-21 11:38:39.196root 11241100x8000000000000000554054Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:39.196{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.29d2fc4dd0cd88562021-12-21 11:38:39.196root 11241100x8000000000000000554055Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:39.196{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c708f214b38f60002021-12-21 11:38:39.196root 11241100x8000000000000000554056Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:39.196{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5ba2f1dad44677902021-12-21 11:38:39.196root 11241100x8000000000000000554057Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:39.196{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.876d2787a612256c2021-12-21 11:38:39.196root 11241100x8000000000000000554058Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:39.196{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.15ae7831006cee992021-12-21 11:38:39.196root 11241100x8000000000000000554059Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:39.196{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.dc1069cad5cc6c802021-12-21 11:38:39.196root 11241100x8000000000000000554060Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:39.196{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.85551b3826267cf82021-12-21 11:38:39.196root 11241100x8000000000000000554061Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:39.197{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e5a65c47ea88c1ca2021-12-21 11:38:39.197root 11241100x8000000000000000554062Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:39.197{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ba6449717381760c2021-12-21 11:38:39.197root 11241100x8000000000000000554063Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:39.197{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.02ce8874ee3bc3272021-12-21 11:38:39.197root 11241100x8000000000000000554064Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:39.197{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.97f482666f7913082021-12-21 11:38:39.197root 11241100x8000000000000000554065Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:39.197{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.576145ce2fa5401a2021-12-21 11:38:39.197root 11241100x8000000000000000554066Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:39.197{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.96334aec74303d3e2021-12-21 11:38:39.197root 11241100x8000000000000000554067Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:39.197{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.dfe096ae5c220c992021-12-21 11:38:39.197root 11241100x8000000000000000554068Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:39.197{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9bb6126893e715142021-12-21 11:38:39.197root 11241100x8000000000000000554069Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:39.198{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.229773df5dc50d142021-12-21 11:38:39.198root 11241100x8000000000000000554070Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:39.198{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4f2f09121452e8982021-12-21 11:38:39.198root 11241100x8000000000000000554071Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:39.198{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.07d29311db2c7ac22021-12-21 11:38:39.198root 23542300x8000000000000000554072Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:39.327{ec2b6afe-95d2-61c1-3038-b84203560000}5272root/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/spool/splunk/tracker.log--- 11241100x8000000000000000554073Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:39.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.04fb726a6e3417a92021-12-21 11:38:39.693root 11241100x8000000000000000554074Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:39.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7ce05be95118b6902021-12-21 11:38:39.693root 11241100x8000000000000000554075Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:39.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2ce56cf813ea0acf2021-12-21 11:38:39.693root 11241100x8000000000000000554076Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:39.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.350a60227ca3db822021-12-21 11:38:39.693root 11241100x8000000000000000554077Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:39.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.bf5f70e751394f992021-12-21 11:38:39.693root 11241100x8000000000000000554078Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:39.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.28a992ddcaa6c9712021-12-21 11:38:39.693root 11241100x8000000000000000554079Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:39.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.86732db27ecf80c22021-12-21 11:38:39.693root 11241100x8000000000000000554080Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:39.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.da528bf42e390b032021-12-21 11:38:39.693root 11241100x8000000000000000554081Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:39.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f9601d4ccd8f8f5f2021-12-21 11:38:39.693root 11241100x8000000000000000554082Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:39.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9a0caa90fe7f6bc62021-12-21 11:38:39.694root 11241100x8000000000000000554083Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:39.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d52f7b381874d3e72021-12-21 11:38:39.694root 11241100x8000000000000000554084Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:39.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.380480f7f133f4702021-12-21 11:38:39.694root 11241100x8000000000000000554085Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:39.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.086345c30f654e3f2021-12-21 11:38:39.694root 11241100x8000000000000000554086Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:39.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.eebb26958af0883c2021-12-21 11:38:39.694root 11241100x8000000000000000554087Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:39.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c7e9bc74171690d72021-12-21 11:38:39.694root 11241100x8000000000000000554088Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:39.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.11556979a4a42c5f2021-12-21 11:38:39.694root 11241100x8000000000000000554089Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:39.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5c5f70b8f10db70a2021-12-21 11:38:39.694root 11241100x8000000000000000554090Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:39.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.20b7a9232cb222ee2021-12-21 11:38:39.694root 11241100x8000000000000000554091Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:39.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.625d888004e0aff22021-12-21 11:38:39.694root 11241100x8000000000000000554092Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:39.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6b1bcb6e047866182021-12-21 11:38:39.694root 11241100x8000000000000000554093Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:39.695{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c1b118ed46f48b542021-12-21 11:38:39.695root 11241100x8000000000000000554094Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:39.695{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.dbfd797e3a2b48232021-12-21 11:38:39.695root 11241100x8000000000000000554095Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:39.695{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2dac8ce6aaecd7c82021-12-21 11:38:39.695root 11241100x8000000000000000554096Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:39.695{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c16393744a754bc92021-12-21 11:38:39.695root 11241100x8000000000000000554097Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:39.695{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c4767489788585582021-12-21 11:38:39.695root 11241100x8000000000000000554098Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:39.695{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.fa6bff840e9f038d2021-12-21 11:38:39.695root 11241100x8000000000000000554099Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:39.695{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.972076e4453c95ab2021-12-21 11:38:39.695root 11241100x8000000000000000554100Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:39.695{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f513a3b946eeac232021-12-21 11:38:39.695root 11241100x8000000000000000554101Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:39.695{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.bdbc0438d322f38f2021-12-21 11:38:39.695root 11241100x8000000000000000554102Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:39.695{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a11ee4ac6cd558782021-12-21 11:38:39.695root 11241100x8000000000000000554103Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:39.696{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.36f88f8151a7e77c2021-12-21 11:38:39.696root 11241100x8000000000000000554104Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:39.696{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.223aa208c79d5a7a2021-12-21 11:38:39.696root 11241100x8000000000000000554105Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:39.696{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0db36bf2a7ddfb9c2021-12-21 11:38:39.696root 11241100x8000000000000000554106Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:39.696{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f45a9d2f0ec2a3ab2021-12-21 11:38:39.696root 11241100x8000000000000000554107Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:39.696{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.91c241c24179d66a2021-12-21 11:38:39.696root 11241100x8000000000000000554108Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:39.696{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9e76fe928fa539e52021-12-21 11:38:39.696root 11241100x8000000000000000554109Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:39.696{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9981db3592a4a4442021-12-21 11:38:39.696root 11241100x8000000000000000554110Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:39.696{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.53c57ea8c848d6332021-12-21 11:38:39.696root 11241100x8000000000000000554111Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:40.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.bd941b53908a9ae32021-12-21 11:38:40.193root 11241100x8000000000000000554112Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:40.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3c77ad4e4e9037642021-12-21 11:38:40.193root 11241100x8000000000000000554113Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:40.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.73495a07a199ce552021-12-21 11:38:40.193root 11241100x8000000000000000554114Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:40.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.375ea66ae083e47f2021-12-21 11:38:40.194root 11241100x8000000000000000554115Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:40.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1b88155de51740902021-12-21 11:38:40.194root 11241100x8000000000000000554116Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:40.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5cd747e5c3fa60152021-12-21 11:38:40.194root 11241100x8000000000000000554117Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:40.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.47e7feb4697833772021-12-21 11:38:40.194root 11241100x8000000000000000554118Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:40.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3766d5d3f9bb258a2021-12-21 11:38:40.194root 11241100x8000000000000000554119Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:40.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.cc93e67b65191d952021-12-21 11:38:40.194root 11241100x8000000000000000554120Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:40.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2dd384ee24baa0812021-12-21 11:38:40.194root 11241100x8000000000000000554121Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:40.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.fe5e0771195b3b942021-12-21 11:38:40.194root 11241100x8000000000000000554122Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:40.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6ad6ab675a62b5c52021-12-21 11:38:40.194root 11241100x8000000000000000554123Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:40.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.af4d93888b2e7c992021-12-21 11:38:40.194root 11241100x8000000000000000554124Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:40.195{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8480c2848d97aba22021-12-21 11:38:40.195root 11241100x8000000000000000554125Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:40.195{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c8714982da277ede2021-12-21 11:38:40.195root 11241100x8000000000000000554126Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:40.195{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.dc35f502e5a1cba32021-12-21 11:38:40.195root 11241100x8000000000000000554127Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:40.195{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.07d2acb7862caedd2021-12-21 11:38:40.195root 11241100x8000000000000000554128Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:40.195{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f9cedf565031dd2e2021-12-21 11:38:40.195root 11241100x8000000000000000554129Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:40.195{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2da9239c4f2e450d2021-12-21 11:38:40.195root 11241100x8000000000000000554130Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:40.195{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2811d94adf8449c02021-12-21 11:38:40.195root 11241100x8000000000000000554131Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:40.196{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0ace5c2a8a90811c2021-12-21 11:38:40.196root 11241100x8000000000000000554132Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:40.196{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7833e95e19cd72f52021-12-21 11:38:40.196root 11241100x8000000000000000554133Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:40.196{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.74a6de190647631d2021-12-21 11:38:40.196root 11241100x8000000000000000554134Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:40.196{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7dfe822e2af7b6422021-12-21 11:38:40.196root 11241100x8000000000000000554135Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:40.196{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e9d04bc2c06c98642021-12-21 11:38:40.196root 11241100x8000000000000000554136Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:40.196{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b7646cf8e0c6e26b2021-12-21 11:38:40.196root 11241100x8000000000000000554137Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:40.196{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ca8dd09319efc46c2021-12-21 11:38:40.196root 11241100x8000000000000000554138Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:40.196{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a15b779964981e1e2021-12-21 11:38:40.196root 11241100x8000000000000000554139Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:40.196{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e7df59fbe0d984b32021-12-21 11:38:40.196root 11241100x8000000000000000554140Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:40.196{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9bf9889abc4724b42021-12-21 11:38:40.196root 11241100x8000000000000000554141Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:40.196{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6b3e60ec55b9349a2021-12-21 11:38:40.196root 11241100x8000000000000000554142Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:40.197{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e6c1f2dbeb2551d62021-12-21 11:38:40.197root 11241100x8000000000000000554143Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:40.197{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9c22bacb163b68402021-12-21 11:38:40.197root 11241100x8000000000000000554144Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:40.197{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.847bbdc045a34b1e2021-12-21 11:38:40.197root 11241100x8000000000000000554145Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:40.197{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.19cc177baea2fc442021-12-21 11:38:40.197root 11241100x8000000000000000554146Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:40.197{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e2552478cfa462692021-12-21 11:38:40.197root 11241100x8000000000000000554147Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:40.692{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6359de46a2f361f72021-12-21 11:38:40.692root 11241100x8000000000000000554148Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:40.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9e56bb1fe08719c72021-12-21 11:38:40.693root 11241100x8000000000000000554149Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:40.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c19e8d64de04f1dd2021-12-21 11:38:40.693root 11241100x8000000000000000554150Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:40.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.92e1178efeee03612021-12-21 11:38:40.693root 11241100x8000000000000000554151Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:40.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8e9ceedb8e65376b2021-12-21 11:38:40.693root 11241100x8000000000000000554152Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:40.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c00ba48841a700fb2021-12-21 11:38:40.693root 11241100x8000000000000000554153Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:40.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a9dc99634168fe8b2021-12-21 11:38:40.693root 11241100x8000000000000000554154Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:40.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f2cdf01a278651dc2021-12-21 11:38:40.693root 11241100x8000000000000000554155Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:40.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8aee8ad17b3d7bae2021-12-21 11:38:40.693root 11241100x8000000000000000554156Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:40.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0c00d7e73225640b2021-12-21 11:38:40.694root 11241100x8000000000000000554157Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:40.695{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d06a17393f006efa2021-12-21 11:38:40.695root 11241100x8000000000000000554158Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:40.695{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9e43882aae6dd9032021-12-21 11:38:40.695root 11241100x8000000000000000554159Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:40.695{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2fc4d80b973a06212021-12-21 11:38:40.695root 11241100x8000000000000000554160Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:40.695{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.aedff930cb58d4db2021-12-21 11:38:40.695root 11241100x8000000000000000554161Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:40.695{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3c5026bca0b337af2021-12-21 11:38:40.695root 11241100x8000000000000000554162Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:40.695{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.71cdb468246cfa542021-12-21 11:38:40.695root 11241100x8000000000000000554163Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:40.695{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ae9973911a5ec62a2021-12-21 11:38:40.695root 11241100x8000000000000000554164Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:40.695{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1ccab90458ecccdc2021-12-21 11:38:40.695root 11241100x8000000000000000554165Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:40.695{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.fc383795706bdddc2021-12-21 11:38:40.695root 11241100x8000000000000000554166Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:40.696{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.bbb0c3ab233d3c712021-12-21 11:38:40.696root 11241100x8000000000000000554167Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:40.696{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a982aa2d2a62202d2021-12-21 11:38:40.696root 11241100x8000000000000000554168Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:40.696{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d146e0f90eb1a3352021-12-21 11:38:40.696root 11241100x8000000000000000554169Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:40.696{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e0dff34da19b1e142021-12-21 11:38:40.696root 11241100x8000000000000000554170Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:40.696{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4c2aee0d0522b4e92021-12-21 11:38:40.696root 11241100x8000000000000000554171Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:40.696{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.543f37a86a0692952021-12-21 11:38:40.696root 11241100x8000000000000000554172Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:40.696{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9f770a49924a47f42021-12-21 11:38:40.696root 11241100x8000000000000000554173Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:40.696{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5b8beb53e8f1f1562021-12-21 11:38:40.696root 11241100x8000000000000000554174Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:40.696{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7377ac670f5ef72b2021-12-21 11:38:40.696root 11241100x8000000000000000554175Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:40.697{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e872c9193ac84af22021-12-21 11:38:40.697root 11241100x8000000000000000554176Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:40.697{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c1e6cbddc8a2b68d2021-12-21 11:38:40.697root 11241100x8000000000000000554177Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:40.697{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f6e9d256fad129712021-12-21 11:38:40.697root 11241100x8000000000000000554178Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:40.698{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.34d5fb3fd2393c222021-12-21 11:38:40.698root 11241100x8000000000000000554179Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:40.698{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f0ec5b31de10eb772021-12-21 11:38:40.698root 11241100x8000000000000000554180Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:40.698{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.719fb28ab6a6d3ec2021-12-21 11:38:40.698root 11241100x8000000000000000554181Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:40.698{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e23f249e4a009e272021-12-21 11:38:40.698root 11241100x8000000000000000554182Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:40.698{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.47b4f18bbfa815302021-12-21 11:38:40.698root 11241100x8000000000000000554183Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:40.698{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e6c8b65c591420c62021-12-21 11:38:40.698root 11241100x8000000000000000554184Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:40.698{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5665d2e5a0a05d872021-12-21 11:38:40.698root 11241100x8000000000000000554185Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:40.698{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9e5a308466d96fe02021-12-21 11:38:40.698root 11241100x8000000000000000554186Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:40.698{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.eb478bc2cf4effca2021-12-21 11:38:40.698root 11241100x8000000000000000554187Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:40.698{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.82917ac9ad0d93022021-12-21 11:38:40.698root 11241100x8000000000000000554188Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:40.699{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ff1cc10ed7e0d4542021-12-21 11:38:40.699root 354300x8000000000000000554189Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:41.071{ec2b6afe-95d9-61c1-5175-3a0400000000}5346/opt/splunkforwarder/etc/apps/Splunk_TA_stream/linux_x86_64/bin/streamfwdroottcptruefalse10.0.1.25-48842-false10.0.1.12-8000- 11241100x8000000000000000554190Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:41.072{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.801df03ed08cb23e2021-12-21 11:38:41.072root 11241100x8000000000000000554191Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:41.072{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c97fde9fdb92aed62021-12-21 11:38:41.072root 11241100x8000000000000000554192Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:41.072{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.96543d1c64d56e682021-12-21 11:38:41.072root 11241100x8000000000000000554193Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:41.072{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f180a064d7dc98582021-12-21 11:38:41.072root 11241100x8000000000000000554194Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:41.073{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3dc12595d11b035b2021-12-21 11:38:41.073root 11241100x8000000000000000554195Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:41.073{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9b42e685a856057e2021-12-21 11:38:41.073root 11241100x8000000000000000554196Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:41.073{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b21b5c696881977c2021-12-21 11:38:41.073root 11241100x8000000000000000554197Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:41.073{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.bdc3a7fb477a86862021-12-21 11:38:41.073root 11241100x8000000000000000554198Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:41.073{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.04682710699ebddc2021-12-21 11:38:41.073root 11241100x8000000000000000554199Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:41.073{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b3da9492ba5b2b8d2021-12-21 11:38:41.073root 11241100x8000000000000000554200Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:41.073{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ca121a53fcc475be2021-12-21 11:38:41.073root 11241100x8000000000000000554201Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:41.073{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5a0774e0b1856f3c2021-12-21 11:38:41.073root 11241100x8000000000000000554202Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:41.073{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4abe12c880ba73612021-12-21 11:38:41.073root 11241100x8000000000000000554203Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:41.073{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.679ae7934105c5e02021-12-21 11:38:41.073root 11241100x8000000000000000554204Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:41.074{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.12b251f7320d862a2021-12-21 11:38:41.074root 11241100x8000000000000000554205Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:41.074{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5e5444fd26dfbc052021-12-21 11:38:41.074root 11241100x8000000000000000554206Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:41.074{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.08119a9eee87abf92021-12-21 11:38:41.074root 11241100x8000000000000000554207Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:41.074{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d0d1769d827df4202021-12-21 11:38:41.074root 11241100x8000000000000000554208Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:41.074{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.36e36ed07aa66d552021-12-21 11:38:41.074root 11241100x8000000000000000554209Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:41.074{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ef002097c54153502021-12-21 11:38:41.074root 11241100x8000000000000000554210Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:41.074{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.42c6409d2708dc8a2021-12-21 11:38:41.074root 11241100x8000000000000000554211Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:41.074{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.442dd6c76610e3272021-12-21 11:38:41.074root 11241100x8000000000000000554212Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:41.074{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.235c62c89616ca882021-12-21 11:38:41.074root 11241100x8000000000000000554213Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:41.075{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8d0b8c34a38abc212021-12-21 11:38:41.075root 11241100x8000000000000000554214Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:41.075{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f2768f414594f3f02021-12-21 11:38:41.075root 11241100x8000000000000000554215Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:41.075{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e89b2310e28f4c832021-12-21 11:38:41.075root 11241100x8000000000000000554216Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:41.075{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.bf3de732150884362021-12-21 11:38:41.075root 11241100x8000000000000000554217Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:41.075{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e1ebca627ab18c1f2021-12-21 11:38:41.075root 11241100x8000000000000000554218Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:41.075{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c049a501919958f42021-12-21 11:38:41.075root 11241100x8000000000000000554219Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:41.075{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.118988cf2004aff82021-12-21 11:38:41.075root 11241100x8000000000000000554220Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:41.075{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.87f1fae58e24cc392021-12-21 11:38:41.075root 11241100x8000000000000000554221Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:41.075{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.276bf49d530a54d92021-12-21 11:38:41.075root 11241100x8000000000000000554222Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:41.075{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.68a1f4a7ce7a049f2021-12-21 11:38:41.075root 11241100x8000000000000000554223Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:41.076{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c11fbbee78f80a4b2021-12-21 11:38:41.076root 11241100x8000000000000000554224Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:41.076{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.18de84c49c21cea42021-12-21 11:38:41.076root 11241100x8000000000000000554225Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:41.076{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e8743466b7d6fcc32021-12-21 11:38:41.076root 11241100x8000000000000000554226Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:41.076{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6a76b76b364f04882021-12-21 11:38:41.076root 11241100x8000000000000000554227Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:41.076{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.de66f6af8ada67332021-12-21 11:38:41.076root 11241100x8000000000000000554228Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:41.076{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.34dc264f4c58d81e2021-12-21 11:38:41.076root 11241100x8000000000000000554229Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:41.076{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e850c5b5ee8b31202021-12-21 11:38:41.076root 11241100x8000000000000000554230Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:41.076{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.53114232729265322021-12-21 11:38:41.076root 11241100x8000000000000000554231Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:41.076{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c5ddfc98e0e5da6f2021-12-21 11:38:41.076root 11241100x8000000000000000554232Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:41.076{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1b4c328ec8d323bd2021-12-21 11:38:41.076root 11241100x8000000000000000554233Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:41.077{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.cc8047982c84b8b72021-12-21 11:38:41.077root 11241100x8000000000000000554234Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:41.077{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.00c4958b96ee04a52021-12-21 11:38:41.077root 11241100x8000000000000000554235Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:41.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2b24b6d83a245cc62021-12-21 11:38:41.443root 11241100x8000000000000000554236Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:41.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b26a20545da5f7642021-12-21 11:38:41.443root 11241100x8000000000000000554237Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:41.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.eab7f199b38597012021-12-21 11:38:41.443root 11241100x8000000000000000554238Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:41.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.92d25a4ba5ca18632021-12-21 11:38:41.443root 11241100x8000000000000000554239Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:41.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4bc79547aaa726e22021-12-21 11:38:41.443root 11241100x8000000000000000554240Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:41.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.03af1b15c5c82f182021-12-21 11:38:41.443root 11241100x8000000000000000554241Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:41.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.477baef5c53c77c42021-12-21 11:38:41.443root 11241100x8000000000000000554242Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:41.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f103c65461d023802021-12-21 11:38:41.443root 11241100x8000000000000000554243Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:41.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0dd0f9e9283520f62021-12-21 11:38:41.443root 11241100x8000000000000000554244Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:41.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.fbc5d47a2b2484632021-12-21 11:38:41.443root 11241100x8000000000000000554245Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:41.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.39a3580764c8d2132021-12-21 11:38:41.443root 11241100x8000000000000000554246Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:41.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.69174683a6b4abcd2021-12-21 11:38:41.444root 11241100x8000000000000000554247Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:41.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c2e53e1b13e9cd492021-12-21 11:38:41.444root 11241100x8000000000000000554248Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:41.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4da698d0e1effedd2021-12-21 11:38:41.444root 11241100x8000000000000000554249Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:41.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.61948f5c0aef8b452021-12-21 11:38:41.444root 11241100x8000000000000000554250Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:41.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.80c55448bb95d7a22021-12-21 11:38:41.444root 11241100x8000000000000000554251Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:41.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.dad964ff7abd4be72021-12-21 11:38:41.444root 11241100x8000000000000000554252Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:41.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.fbc7fa1d5613cc032021-12-21 11:38:41.444root 11241100x8000000000000000554253Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:41.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.65e6037be1a39bf82021-12-21 11:38:41.444root 11241100x8000000000000000554254Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:41.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e360235d338ae13e2021-12-21 11:38:41.444root 11241100x8000000000000000554255Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:41.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e10a86d45c99d7592021-12-21 11:38:41.444root 11241100x8000000000000000554256Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:41.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b31040d953274d412021-12-21 11:38:41.445root 11241100x8000000000000000554257Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:41.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2f89d850d8c1f9092021-12-21 11:38:41.445root 11241100x8000000000000000554258Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:41.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.94e8038260553cbb2021-12-21 11:38:41.445root 11241100x8000000000000000554259Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:41.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8e66697bf613d4cd2021-12-21 11:38:41.445root 11241100x8000000000000000554260Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:41.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0ad96447928cf8652021-12-21 11:38:41.445root 11241100x8000000000000000554261Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:41.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.805ed6c54a8945b72021-12-21 11:38:41.445root 11241100x8000000000000000554262Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:41.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.465784220ba1d7cc2021-12-21 11:38:41.445root 11241100x8000000000000000554263Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:41.446{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.cf2fdb447431cd232021-12-21 11:38:41.446root 11241100x8000000000000000554264Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:41.446{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.195aa12e7a8a97dd2021-12-21 11:38:41.446root 11241100x8000000000000000554265Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:41.446{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e37cf748b1e05a552021-12-21 11:38:41.446root 11241100x8000000000000000554266Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:41.446{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b30c1e71f4c072972021-12-21 11:38:41.446root 11241100x8000000000000000554267Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:41.446{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.92fefd7232d8e2b12021-12-21 11:38:41.446root 11241100x8000000000000000554268Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:41.446{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.39baef17e6ff56202021-12-21 11:38:41.446root 11241100x8000000000000000554269Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:41.447{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.83aca6e448f6a1032021-12-21 11:38:41.447root 11241100x8000000000000000554270Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:41.447{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.43f22a92f9eac57a2021-12-21 11:38:41.447root 11241100x8000000000000000554271Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:41.447{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.bba4031a3c2918322021-12-21 11:38:41.447root 11241100x8000000000000000554272Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:41.447{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7f70d89738f9f9922021-12-21 11:38:41.447root 11241100x8000000000000000554273Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:41.448{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.67a44724544cd8132021-12-21 11:38:41.448root 11241100x8000000000000000554274Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:41.448{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e4bfa2fb5e4bc5f32021-12-21 11:38:41.448root 11241100x8000000000000000554275Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:41.448{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2581f8f9a08d09a62021-12-21 11:38:41.448root 11241100x8000000000000000554276Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:41.448{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9e3876b8cbf9a25d2021-12-21 11:38:41.448root 11241100x8000000000000000554277Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:41.449{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f5cc40c62e0c1a162021-12-21 11:38:41.449root 11241100x8000000000000000554278Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:41.449{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f25eaac8daceb1782021-12-21 11:38:41.449root 11241100x8000000000000000554279Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:41.449{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e5e38d095e1f02e22021-12-21 11:38:41.449root 11241100x8000000000000000554280Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:41.449{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7602cd143f85eec02021-12-21 11:38:41.449root 11241100x8000000000000000554281Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:41.450{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.469e9f392637dfb32021-12-21 11:38:41.450root 11241100x8000000000000000554282Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:41.450{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e4924cdc82761c1f2021-12-21 11:38:41.450root 11241100x8000000000000000554283Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:41.450{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.17c00bfa119d013a2021-12-21 11:38:41.450root 11241100x8000000000000000554284Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:41.450{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d13fa8f8cdf4ccb52021-12-21 11:38:41.450root 11241100x8000000000000000554285Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:41.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.979f56bb886f5d052021-12-21 11:38:41.944root 11241100x8000000000000000554286Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:41.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4712f113ffdd431b2021-12-21 11:38:41.944root 11241100x8000000000000000554287Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:41.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.fc8d12830f361c982021-12-21 11:38:41.944root 11241100x8000000000000000554288Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:41.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.205e62495deaeca92021-12-21 11:38:41.944root 11241100x8000000000000000554289Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:41.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.19f38db8fb825fbb2021-12-21 11:38:41.944root 11241100x8000000000000000554290Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:41.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e5522935710ebe102021-12-21 11:38:41.944root 11241100x8000000000000000554291Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:41.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.86e10d60c6d76fc62021-12-21 11:38:41.944root 11241100x8000000000000000554292Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:41.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5769b78aaec994aa2021-12-21 11:38:41.944root 11241100x8000000000000000554293Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:41.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e9ac9ac3bfb6fa5f2021-12-21 11:38:41.944root 11241100x8000000000000000554294Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:41.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3522938a9e20ddd22021-12-21 11:38:41.944root 11241100x8000000000000000554295Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:41.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.575d313aa74d4c7e2021-12-21 11:38:41.945root 11241100x8000000000000000554296Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:41.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8902571ce14628012021-12-21 11:38:41.945root 11241100x8000000000000000554297Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:41.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b12e96fd77ffc7002021-12-21 11:38:41.945root 11241100x8000000000000000554298Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:41.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.081774ef928309ba2021-12-21 11:38:41.945root 11241100x8000000000000000554299Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:41.946{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.05f3dc91e297c8492021-12-21 11:38:41.946root 11241100x8000000000000000554300Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:41.946{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.665812d5c70113d52021-12-21 11:38:41.946root 11241100x8000000000000000554301Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:41.946{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3179ab43f88e7e222021-12-21 11:38:41.946root 11241100x8000000000000000554302Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:41.946{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a2ce0b07124821fe2021-12-21 11:38:41.946root 11241100x8000000000000000554303Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:41.946{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b63c4337f64a290d2021-12-21 11:38:41.946root 11241100x8000000000000000554304Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:41.947{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7dbef970e9aaee012021-12-21 11:38:41.947root 11241100x8000000000000000554305Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:41.947{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ddd73c1050cb4add2021-12-21 11:38:41.947root 11241100x8000000000000000554306Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:41.947{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.738e5f3e0c05fa182021-12-21 11:38:41.947root 11241100x8000000000000000554307Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:41.948{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b8d68b1144faa06f2021-12-21 11:38:41.948root 11241100x8000000000000000554308Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:41.949{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9591a2082293656a2021-12-21 11:38:41.949root 11241100x8000000000000000554309Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:41.949{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.571b53b4ba2412a52021-12-21 11:38:41.949root 11241100x8000000000000000554310Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:41.949{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f136d6f0a09f2d052021-12-21 11:38:41.949root 11241100x8000000000000000554311Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:41.949{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.eb313cf2574c504f2021-12-21 11:38:41.949root 11241100x8000000000000000554312Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:41.949{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.fd0ca15ca922ac902021-12-21 11:38:41.949root 11241100x8000000000000000554313Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:41.949{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.22bc27e5df57bc4e2021-12-21 11:38:41.949root 11241100x8000000000000000554314Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:41.949{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.96f62eb41c797c0f2021-12-21 11:38:41.949root 11241100x8000000000000000554315Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:41.950{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6a89910df35cbc412021-12-21 11:38:41.950root 11241100x8000000000000000554316Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:41.950{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.afb30b2b7f2824252021-12-21 11:38:41.950root 11241100x8000000000000000554317Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:41.950{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d6ef2d796735346b2021-12-21 11:38:41.950root 11241100x8000000000000000554318Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:41.950{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3029fdbf7c6d2e4a2021-12-21 11:38:41.950root 11241100x8000000000000000554319Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:41.950{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5dbe1ef3f6a6922d2021-12-21 11:38:41.950root 11241100x8000000000000000554320Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:41.950{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f7bd876eeda7b82a2021-12-21 11:38:41.950root 11241100x8000000000000000554321Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:42.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.72723e249a341efa2021-12-21 11:38:42.443root 11241100x8000000000000000554322Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:42.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0b4ed5ef476812492021-12-21 11:38:42.443root 11241100x8000000000000000554323Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:42.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.bf788dcf5f9c78d42021-12-21 11:38:42.443root 11241100x8000000000000000554324Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:42.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.10b0ccee4c38414d2021-12-21 11:38:42.443root 11241100x8000000000000000554325Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:42.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.bb705928fcc735d22021-12-21 11:38:42.444root 11241100x8000000000000000554326Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:42.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.97adcb3cf8a6b7172021-12-21 11:38:42.444root 11241100x8000000000000000554327Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:42.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.066b8cb139e0e23a2021-12-21 11:38:42.444root 11241100x8000000000000000554328Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:42.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.19585ce5a0d196f52021-12-21 11:38:42.444root 11241100x8000000000000000554329Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:42.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b0f9e65d6670beb62021-12-21 11:38:42.444root 11241100x8000000000000000554330Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:42.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a83d8ae31f6af8b92021-12-21 11:38:42.444root 11241100x8000000000000000554331Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:42.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1ae18b3aeca9eaac2021-12-21 11:38:42.444root 11241100x8000000000000000554332Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:42.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3a45e883935506412021-12-21 11:38:42.444root 11241100x8000000000000000554333Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:42.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d8c4b68b75dad9412021-12-21 11:38:42.444root 11241100x8000000000000000554334Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:42.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6fdb73ba6c7628052021-12-21 11:38:42.444root 11241100x8000000000000000554335Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:42.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d39ee9a736462e732021-12-21 11:38:42.444root 11241100x8000000000000000554336Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:42.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7c581920e425bdc32021-12-21 11:38:42.444root 11241100x8000000000000000554337Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:42.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.80d52324ea5043942021-12-21 11:38:42.444root 11241100x8000000000000000554338Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:42.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7e39aca5d5a8dd132021-12-21 11:38:42.444root 11241100x8000000000000000554339Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:42.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c8ea5eb3b85ed37f2021-12-21 11:38:42.444root 11241100x8000000000000000554340Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:42.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.046dd15c3861b7c72021-12-21 11:38:42.445root 11241100x8000000000000000554341Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:42.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.38322b653163a8f02021-12-21 11:38:42.445root 11241100x8000000000000000554342Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:42.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e12e6b03250b023f2021-12-21 11:38:42.445root 11241100x8000000000000000554343Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:42.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c9b2318612d9e30e2021-12-21 11:38:42.445root 11241100x8000000000000000554344Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:42.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.64caffc65398c29e2021-12-21 11:38:42.445root 11241100x8000000000000000554345Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:42.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5f0e9bb1239c05a12021-12-21 11:38:42.445root 11241100x8000000000000000554346Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:42.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6d2cdbacccd3c6222021-12-21 11:38:42.445root 11241100x8000000000000000554347Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:42.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.19833a23fb36efe52021-12-21 11:38:42.445root 11241100x8000000000000000554348Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:42.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.53c8a1d9d8de51a42021-12-21 11:38:42.445root 11241100x8000000000000000554349Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:42.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.82a8a51c895f20322021-12-21 11:38:42.445root 11241100x8000000000000000554350Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:42.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.43b694268529a5bb2021-12-21 11:38:42.445root 11241100x8000000000000000554351Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:42.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.06d99bef88f314182021-12-21 11:38:42.445root 11241100x8000000000000000554352Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:42.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4968f75864b5e9682021-12-21 11:38:42.445root 11241100x8000000000000000554353Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:42.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.baa626d5590d408e2021-12-21 11:38:42.445root 11241100x8000000000000000554354Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:42.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d936b4fd0cb3f7492021-12-21 11:38:42.445root 11241100x8000000000000000554355Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:42.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.67282b28989122fc2021-12-21 11:38:42.445root 11241100x8000000000000000554356Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:42.446{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d12a66800fc27d152021-12-21 11:38:42.446root 11241100x8000000000000000554357Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:42.446{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1deab65367ee742b2021-12-21 11:38:42.446root 11241100x8000000000000000554358Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:42.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.056cf2e83ed0c8a22021-12-21 11:38:42.943root 11241100x8000000000000000554359Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:42.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ba5251b946fa561c2021-12-21 11:38:42.943root 11241100x8000000000000000554360Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:42.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.05aea8933d6c151b2021-12-21 11:38:42.943root 11241100x8000000000000000554361Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:42.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6ff1e49f511ff13e2021-12-21 11:38:42.943root 11241100x8000000000000000554362Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:42.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b3b5cbba96524b5a2021-12-21 11:38:42.943root 11241100x8000000000000000554363Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:42.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.911a07506cead3662021-12-21 11:38:42.944root 11241100x8000000000000000554364Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:42.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0eca9414ce9131842021-12-21 11:38:42.944root 11241100x8000000000000000554365Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:42.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.186a983d0c5a01f32021-12-21 11:38:42.944root 11241100x8000000000000000554366Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:42.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f94dcc6257d2ef702021-12-21 11:38:42.944root 11241100x8000000000000000554367Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:42.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5ed511eddee4aa4a2021-12-21 11:38:42.944root 11241100x8000000000000000554368Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:42.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c9abc3d13bfae4e52021-12-21 11:38:42.944root 11241100x8000000000000000554369Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:42.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.60c526c665f6f1402021-12-21 11:38:42.945root 11241100x8000000000000000554370Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:42.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a82dff88d56ea4492021-12-21 11:38:42.945root 11241100x8000000000000000554371Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:42.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8e5b7d9bd31676662021-12-21 11:38:42.945root 11241100x8000000000000000554372Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:42.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1cf5c402764dce082021-12-21 11:38:42.945root 11241100x8000000000000000554373Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:42.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1250533570cdb3532021-12-21 11:38:42.945root 11241100x8000000000000000554374Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:42.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ae3b3f2840356d7d2021-12-21 11:38:42.945root 11241100x8000000000000000554375Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:42.946{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.229510e46d32992e2021-12-21 11:38:42.946root 11241100x8000000000000000554376Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:42.946{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.cc4bfcf7c8c649e12021-12-21 11:38:42.946root 11241100x8000000000000000554377Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:42.946{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.05c8436195e433a82021-12-21 11:38:42.946root 11241100x8000000000000000554378Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:42.946{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3e3831551ce0cb3e2021-12-21 11:38:42.946root 11241100x8000000000000000554379Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:42.946{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.887fa4cc2bc4cb5e2021-12-21 11:38:42.946root 11241100x8000000000000000554380Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:42.946{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.fc27d77613d99af92021-12-21 11:38:42.946root 11241100x8000000000000000554381Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:42.947{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.fd08e5eb0c96103c2021-12-21 11:38:42.947root 11241100x8000000000000000554382Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:42.947{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7c28b61dc228d4cf2021-12-21 11:38:42.947root 11241100x8000000000000000554383Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:42.947{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.97f285adffdc2c3a2021-12-21 11:38:42.947root 11241100x8000000000000000554384Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:42.947{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.592a2c0caade49c12021-12-21 11:38:42.947root 11241100x8000000000000000554385Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:42.947{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.354f365349f2cc992021-12-21 11:38:42.947root 11241100x8000000000000000554386Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:42.947{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.45c8d67effe511272021-12-21 11:38:42.947root 11241100x8000000000000000554387Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:42.948{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.df05c9968596fbcb2021-12-21 11:38:42.948root 11241100x8000000000000000554388Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:42.948{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.37fd6fc2cb8724792021-12-21 11:38:42.948root 11241100x8000000000000000554389Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:42.948{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.bdf2d5fe80e8a38f2021-12-21 11:38:42.948root 11241100x8000000000000000554390Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:42.948{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4453a8e5d0d69c7e2021-12-21 11:38:42.948root 11241100x8000000000000000554391Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:42.948{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.aa3d349f9dae79fa2021-12-21 11:38:42.948root 11241100x8000000000000000554392Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:42.948{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3091eb69f432f67e2021-12-21 11:38:42.948root 11241100x8000000000000000554393Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:42.948{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.70a3c84db7ee021c2021-12-21 11:38:42.948root 11241100x8000000000000000554394Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:42.950{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ecbcbe5df10ee5112021-12-21 11:38:42.950root 11241100x8000000000000000554395Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:42.950{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.32cca186ef03b8b22021-12-21 11:38:42.950root 11241100x8000000000000000554396Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:42.951{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.56f15f1204e09a0f2021-12-21 11:38:42.951root 11241100x8000000000000000554397Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:43.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.de1d9f51203d0cca2021-12-21 11:38:43.443root 11241100x8000000000000000554398Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:43.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.937dd875d0e921db2021-12-21 11:38:43.443root 11241100x8000000000000000554399Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:43.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4ee2262ef18b27342021-12-21 11:38:43.443root 11241100x8000000000000000554400Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:43.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2d475a176900fa3d2021-12-21 11:38:43.443root 11241100x8000000000000000554401Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:43.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2e93f4a860c239732021-12-21 11:38:43.444root 11241100x8000000000000000554402Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:43.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b3dcc98cb86dedaf2021-12-21 11:38:43.444root 11241100x8000000000000000554403Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:43.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c5d02f8abace1f4c2021-12-21 11:38:43.444root 11241100x8000000000000000554404Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:43.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6f24276f07c816e82021-12-21 11:38:43.444root 11241100x8000000000000000554405Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:43.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.07343c562d7e28512021-12-21 11:38:43.444root 11241100x8000000000000000554406Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:43.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8511474d9ff0d4b72021-12-21 11:38:43.444root 11241100x8000000000000000554407Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:43.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6cee74c705b3fcd32021-12-21 11:38:43.444root 11241100x8000000000000000554408Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:43.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a12d3659b32d51622021-12-21 11:38:43.444root 11241100x8000000000000000554409Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:43.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f558e73f98b166e72021-12-21 11:38:43.444root 11241100x8000000000000000554410Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:43.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a29f834462af59ae2021-12-21 11:38:43.444root 11241100x8000000000000000554411Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:43.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2f8f485adf357bf42021-12-21 11:38:43.444root 11241100x8000000000000000554412Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:43.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1ee5cf74dad2f09a2021-12-21 11:38:43.444root 11241100x8000000000000000554413Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:43.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ed55c4087ebea6742021-12-21 11:38:43.444root 11241100x8000000000000000554414Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:43.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3c1ec9b40ff74da82021-12-21 11:38:43.444root 11241100x8000000000000000554415Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:43.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.74712073e5568c392021-12-21 11:38:43.444root 11241100x8000000000000000554416Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:43.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.01d7d707af1ff4742021-12-21 11:38:43.444root 11241100x8000000000000000554417Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:43.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.baaea2c70e2d31122021-12-21 11:38:43.445root 11241100x8000000000000000554418Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:43.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.34daa8ca1779393b2021-12-21 11:38:43.445root 11241100x8000000000000000554419Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:43.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e10c5ef9895cd70b2021-12-21 11:38:43.445root 11241100x8000000000000000554420Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:43.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.971750fe9f2869852021-12-21 11:38:43.445root 11241100x8000000000000000554421Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:43.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3ad383497b2a67392021-12-21 11:38:43.445root 11241100x8000000000000000554422Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:43.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.438ab29de9ca563d2021-12-21 11:38:43.445root 11241100x8000000000000000554423Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:43.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c924f74f491121c12021-12-21 11:38:43.445root 11241100x8000000000000000554424Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:43.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.169931a5157e37482021-12-21 11:38:43.445root 11241100x8000000000000000554425Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:43.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6690da59c2b1e47b2021-12-21 11:38:43.445root 11241100x8000000000000000554426Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:43.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.cfa839a4691bcbfb2021-12-21 11:38:43.445root 11241100x8000000000000000554427Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:43.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9bae8755c21c67402021-12-21 11:38:43.445root 11241100x8000000000000000554428Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:43.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8f5ecf8e33a2329b2021-12-21 11:38:43.445root 11241100x8000000000000000554429Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:43.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a15a82b0f005bed52021-12-21 11:38:43.445root 11241100x8000000000000000554430Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:43.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2634926bb2e3df262021-12-21 11:38:43.445root 11241100x8000000000000000554431Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:43.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.81fa1af2b367b9752021-12-21 11:38:43.445root 11241100x8000000000000000554432Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:43.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5f57c5cb420124432021-12-21 11:38:43.445root 11241100x8000000000000000554433Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:43.446{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.bed7953edbb0e4472021-12-21 11:38:43.446root 11241100x8000000000000000554434Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:43.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ba91175d9284324d2021-12-21 11:38:43.943root 11241100x8000000000000000554435Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:43.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.eefbb0ea7920134e2021-12-21 11:38:43.943root 11241100x8000000000000000554436Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:43.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d63085b1c8e74cfb2021-12-21 11:38:43.943root 11241100x8000000000000000554437Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:43.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.90c33bc4478607662021-12-21 11:38:43.944root 11241100x8000000000000000554438Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:43.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d084e5dc2d3025ba2021-12-21 11:38:43.944root 11241100x8000000000000000554439Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:43.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.39c5a3760a5133ab2021-12-21 11:38:43.944root 11241100x8000000000000000554440Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:43.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.82c3447b3ed9b1db2021-12-21 11:38:43.944root 11241100x8000000000000000554441Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:43.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.eb4a246d18608e0a2021-12-21 11:38:43.944root 11241100x8000000000000000554442Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:43.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.cd64b0cf14aebdb12021-12-21 11:38:43.944root 11241100x8000000000000000554443Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:43.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6658a7770e2f19d22021-12-21 11:38:43.944root 11241100x8000000000000000554444Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:43.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1f71f5ccb8eef79a2021-12-21 11:38:43.944root 11241100x8000000000000000554445Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:43.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b2c73c94c2ae60772021-12-21 11:38:43.944root 11241100x8000000000000000554446Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:43.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.598c0df596f714ad2021-12-21 11:38:43.944root 11241100x8000000000000000554447Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:43.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e025a13d601704792021-12-21 11:38:43.945root 11241100x8000000000000000554448Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:43.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.72f26af24bce2b072021-12-21 11:38:43.945root 11241100x8000000000000000554449Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:43.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1185cf8fbd42b75a2021-12-21 11:38:43.945root 11241100x8000000000000000554450Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:43.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0081b6cd5e78a5de2021-12-21 11:38:43.945root 11241100x8000000000000000554451Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:43.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7c6ed84eef4750b22021-12-21 11:38:43.945root 11241100x8000000000000000554452Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:43.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0e3b52d62cf6166a2021-12-21 11:38:43.945root 11241100x8000000000000000554453Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:43.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.71c5bb36686a70872021-12-21 11:38:43.945root 11241100x8000000000000000554454Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:43.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a4046967d9feb0942021-12-21 11:38:43.945root 11241100x8000000000000000554455Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:43.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0cb8310f30bf4afe2021-12-21 11:38:43.945root 11241100x8000000000000000554456Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:43.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1b9591fbb1986e482021-12-21 11:38:43.945root 11241100x8000000000000000554457Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:43.946{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.de509482ef75f17e2021-12-21 11:38:43.946root 11241100x8000000000000000554458Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:43.946{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.33eba3b64d75bb042021-12-21 11:38:43.946root 11241100x8000000000000000554459Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:43.946{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d29bc00f0c78c10b2021-12-21 11:38:43.946root 11241100x8000000000000000554460Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:43.946{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b2e02706cfc775ff2021-12-21 11:38:43.946root 11241100x8000000000000000554461Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:43.946{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9d7ac52d1f3d9c802021-12-21 11:38:43.946root 11241100x8000000000000000554462Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:43.946{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a6a176dec72731572021-12-21 11:38:43.946root 11241100x8000000000000000554463Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:43.946{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5b30c6b32920e9092021-12-21 11:38:43.946root 11241100x8000000000000000554464Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:43.946{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b838c74c43a10d922021-12-21 11:38:43.946root 11241100x8000000000000000554465Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:43.946{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a35e9e87dfad6e3a2021-12-21 11:38:43.946root 11241100x8000000000000000554466Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:43.947{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2e36b86fa7a4f0a32021-12-21 11:38:43.947root 11241100x8000000000000000554467Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:43.947{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.743fedec1b36855e2021-12-21 11:38:43.947root 11241100x8000000000000000554468Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:43.947{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.37427e4d30f82f062021-12-21 11:38:43.947root 11241100x8000000000000000554469Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:43.948{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.31ec2c8d68af8cae2021-12-21 11:38:43.948root 11241100x8000000000000000554470Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:44.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.de382ec747022dcb2021-12-21 11:38:44.443root 11241100x8000000000000000554471Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:44.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f6beb0af3d6817e72021-12-21 11:38:44.443root 11241100x8000000000000000554472Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:44.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.128db7c6fb3690112021-12-21 11:38:44.443root 11241100x8000000000000000554473Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:44.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1da5c998d2fee3e52021-12-21 11:38:44.443root 11241100x8000000000000000554474Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:44.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d7c800dd910fc43b2021-12-21 11:38:44.443root 11241100x8000000000000000554475Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:44.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.61059b9cb01b6b9b2021-12-21 11:38:44.443root 11241100x8000000000000000554476Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:44.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f2679dba1d9d1ca32021-12-21 11:38:44.443root 11241100x8000000000000000554477Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:44.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.cd74e2d5fdf99de82021-12-21 11:38:44.443root 11241100x8000000000000000554478Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:44.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f47a53bc94d009f22021-12-21 11:38:44.443root 11241100x8000000000000000554479Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:44.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.dd242268a42624d12021-12-21 11:38:44.443root 11241100x8000000000000000554480Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:44.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3b8e91ba964a4b6c2021-12-21 11:38:44.444root 11241100x8000000000000000554481Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:44.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.479672203cf9d2862021-12-21 11:38:44.444root 11241100x8000000000000000554482Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:44.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c47f9f7dd535aeee2021-12-21 11:38:44.444root 11241100x8000000000000000554483Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:44.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.99ba92cca687f9422021-12-21 11:38:44.444root 11241100x8000000000000000554484Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:44.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.dc551af0fd4d41302021-12-21 11:38:44.444root 11241100x8000000000000000554485Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:44.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b034ae43c291ed3a2021-12-21 11:38:44.444root 11241100x8000000000000000554486Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:44.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9f5de2b3fb2ac78b2021-12-21 11:38:44.444root 11241100x8000000000000000554487Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:44.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3bcc1b903ac405d22021-12-21 11:38:44.444root 11241100x8000000000000000554488Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:44.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.312cf06f3c3e14722021-12-21 11:38:44.444root 11241100x8000000000000000554489Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:44.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ee89bef720b820e32021-12-21 11:38:44.444root 11241100x8000000000000000554490Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:44.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a4ab118be63416d82021-12-21 11:38:44.445root 11241100x8000000000000000554491Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:44.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5aa29208066d1ebc2021-12-21 11:38:44.445root 11241100x8000000000000000554492Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:44.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e17ec9b98fab4f202021-12-21 11:38:44.445root 11241100x8000000000000000554493Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:44.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e4eb41d9178de6862021-12-21 11:38:44.445root 11241100x8000000000000000554494Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:44.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.368dbd1f62c1a7fe2021-12-21 11:38:44.445root 11241100x8000000000000000554495Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:44.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.bc138c1a4f971bdf2021-12-21 11:38:44.445root 11241100x8000000000000000554496Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:44.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c25d8515731ccf562021-12-21 11:38:44.445root 11241100x8000000000000000554497Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:44.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b464c8c3b89e51d22021-12-21 11:38:44.445root 11241100x8000000000000000554498Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:44.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f66a6e371d22c1e82021-12-21 11:38:44.445root 11241100x8000000000000000554499Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:44.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6c56e6c0603e29742021-12-21 11:38:44.445root 11241100x8000000000000000554500Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:44.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.194c8f1e8183724a2021-12-21 11:38:44.445root 11241100x8000000000000000554501Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:44.446{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1de6f2c4f04344ea2021-12-21 11:38:44.446root 11241100x8000000000000000554502Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:44.446{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8df48b5da9cbdfbf2021-12-21 11:38:44.446root 11241100x8000000000000000554503Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:44.446{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5a1cae33c297e7b42021-12-21 11:38:44.446root 11241100x8000000000000000554504Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:44.446{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ad138643112e22af2021-12-21 11:38:44.446root 11241100x8000000000000000554505Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:44.446{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.46186c253995a7d62021-12-21 11:38:44.446root 11241100x8000000000000000554506Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:44.446{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c9957bcd54eaa0c02021-12-21 11:38:44.446root 11241100x8000000000000000554507Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:44.446{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4344ef1146853ff02021-12-21 11:38:44.446root 11241100x8000000000000000554508Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:44.446{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e4cf5f156ad048a42021-12-21 11:38:44.446root 11241100x8000000000000000554509Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:44.446{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9c47351c9dc5507f2021-12-21 11:38:44.446root 11241100x8000000000000000554510Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:44.446{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.bb1ec06c220a4ea32021-12-21 11:38:44.446root 11241100x8000000000000000554511Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:44.446{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.276f64114dedeee52021-12-21 11:38:44.446root 11241100x8000000000000000554512Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:44.447{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.baa981962a915ebc2021-12-21 11:38:44.447root 11241100x8000000000000000554513Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:44.447{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.91b7324a3e4b09522021-12-21 11:38:44.447root 11241100x8000000000000000554514Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:44.447{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.feb1b66dd649639d2021-12-21 11:38:44.447root 11241100x8000000000000000554515Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:44.447{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.742ed492904578312021-12-21 11:38:44.447root 11241100x8000000000000000554516Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:44.447{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f989b978726b44002021-12-21 11:38:44.447root 11241100x8000000000000000554517Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:44.447{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.19ee99d3a76685882021-12-21 11:38:44.447root 11241100x8000000000000000554518Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:44.447{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.999ec841524616ab2021-12-21 11:38:44.447root 11241100x8000000000000000554519Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:44.447{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6a3e9593eef614602021-12-21 11:38:44.447root 11241100x8000000000000000554520Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:44.447{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9fab0862fc604e462021-12-21 11:38:44.447root 11241100x8000000000000000554521Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:44.448{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c914327bec4ae3832021-12-21 11:38:44.448root 11241100x8000000000000000554522Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:44.448{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d25d8a0c65d4dc812021-12-21 11:38:44.448root 11241100x8000000000000000554523Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:44.448{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0ae25817eb3e04f32021-12-21 11:38:44.448root 11241100x8000000000000000554524Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:44.448{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ef23f7cc5d801c232021-12-21 11:38:44.448root 11241100x8000000000000000554525Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:44.448{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.bb1d5f18c98ed9922021-12-21 11:38:44.448root 11241100x8000000000000000554526Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:44.448{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.88efd38cc6e9a27e2021-12-21 11:38:44.448root 11241100x8000000000000000554527Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:44.448{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d451bfc8391fd0232021-12-21 11:38:44.448root 11241100x8000000000000000554528Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:44.448{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.fbceaf358367db8c2021-12-21 11:38:44.448root 11241100x8000000000000000554529Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:44.448{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.39c425f54119fcdc2021-12-21 11:38:44.448root 11241100x8000000000000000554530Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:44.448{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ce70f6430f4a0d1d2021-12-21 11:38:44.448root 11241100x8000000000000000554531Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:44.448{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9c0424f1f93875ee2021-12-21 11:38:44.448root 11241100x8000000000000000554532Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:44.449{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2d2769d9c7758ca82021-12-21 11:38:44.449root 11241100x8000000000000000554533Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:44.449{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3563dd08f69cff502021-12-21 11:38:44.449root 11241100x8000000000000000554534Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:44.449{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8ba4e15e0d8b4d9a2021-12-21 11:38:44.449root 11241100x8000000000000000554535Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:44.449{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.94e107d49dff3cfe2021-12-21 11:38:44.449root 11241100x8000000000000000554536Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:44.449{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f8c928e8713641be2021-12-21 11:38:44.449root 11241100x8000000000000000554537Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:44.449{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ff73e3330957fd352021-12-21 11:38:44.449root 11241100x8000000000000000554538Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:44.449{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3a1f0ffcdb0df7652021-12-21 11:38:44.449root 11241100x8000000000000000554539Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:44.449{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.09fa002c8353873d2021-12-21 11:38:44.449root 11241100x8000000000000000554540Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:44.450{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.925646bf35dea80c2021-12-21 11:38:44.450root 11241100x8000000000000000554541Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:44.450{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9924824a542acfe52021-12-21 11:38:44.450root 11241100x8000000000000000554542Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:44.450{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.877f6b9de523b3602021-12-21 11:38:44.450root 11241100x8000000000000000554543Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:44.450{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d8393b9cb4e20b5f2021-12-21 11:38:44.450root 11241100x8000000000000000554544Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:44.450{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.bfc38aca897abbd82021-12-21 11:38:44.450root 11241100x8000000000000000554545Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:44.450{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.86f248320029bbc12021-12-21 11:38:44.450root 11241100x8000000000000000554546Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:44.450{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3325a7084374d4122021-12-21 11:38:44.450root 11241100x8000000000000000554547Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:44.450{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.817171127991f3882021-12-21 11:38:44.450root 11241100x8000000000000000554548Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:44.451{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.55fbfa706a63ddc22021-12-21 11:38:44.451root 11241100x8000000000000000554549Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:44.451{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.297b3603633c54072021-12-21 11:38:44.451root 11241100x8000000000000000554550Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:44.451{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d89eea230fab59a42021-12-21 11:38:44.451root 11241100x8000000000000000554551Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:44.451{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3e4288f11d020d0a2021-12-21 11:38:44.451root 11241100x8000000000000000554552Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:44.451{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ae2b4f35e85e4d972021-12-21 11:38:44.451root 11241100x8000000000000000554553Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:44.451{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.63da797499cb33092021-12-21 11:38:44.451root 11241100x8000000000000000554554Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:44.451{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8a15df5e5243ccfe2021-12-21 11:38:44.451root 11241100x8000000000000000554555Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:44.451{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3ebbede4051c3f492021-12-21 11:38:44.451root 11241100x8000000000000000554556Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:44.451{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c543e2f8ab5bf07c2021-12-21 11:38:44.451root 11241100x8000000000000000554557Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:44.451{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b888ebd9e9dea3dc2021-12-21 11:38:44.451root 11241100x8000000000000000554558Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:44.452{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.eaa8a0ed99b132982021-12-21 11:38:44.452root 11241100x8000000000000000554559Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:44.452{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.bcb56b8ddd24d2072021-12-21 11:38:44.452root 11241100x8000000000000000554560Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:44.452{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d9cbf200c6e286942021-12-21 11:38:44.452root 11241100x8000000000000000554561Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:44.452{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.fbfcce1b6226b8872021-12-21 11:38:44.452root 11241100x8000000000000000554562Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:44.452{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ee738bde63f32c892021-12-21 11:38:44.452root 11241100x8000000000000000554563Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:44.452{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.fffb6bb0bcb707e52021-12-21 11:38:44.452root 11241100x8000000000000000554564Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:44.452{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.205b71120a040a512021-12-21 11:38:44.452root 11241100x8000000000000000554565Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:44.452{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a643d2012bfea7552021-12-21 11:38:44.452root 11241100x8000000000000000554566Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:44.452{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c59636885fb8ae422021-12-21 11:38:44.452root 11241100x8000000000000000554567Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:44.452{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1edb65e4ee9652622021-12-21 11:38:44.452root 11241100x8000000000000000554568Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:44.452{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.824b6bab5d760c502021-12-21 11:38:44.452root 11241100x8000000000000000554569Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:44.453{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d3b80f274799d0992021-12-21 11:38:44.453root 11241100x8000000000000000554570Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:44.453{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3ec32ab14c4b253c2021-12-21 11:38:44.453root 11241100x8000000000000000554571Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:44.453{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7cf02a60eb7e58c42021-12-21 11:38:44.453root 11241100x8000000000000000554572Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:44.453{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0197eb87ac8a38252021-12-21 11:38:44.453root 11241100x8000000000000000554573Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:44.453{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f287bfca972d1cfc2021-12-21 11:38:44.453root 11241100x8000000000000000554574Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:44.453{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c3ae6a192987efd02021-12-21 11:38:44.453root 11241100x8000000000000000554575Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:44.453{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1386fcab17a466f32021-12-21 11:38:44.453root 11241100x8000000000000000554576Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:44.453{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c82aba32862a245a2021-12-21 11:38:44.453root 11241100x8000000000000000554577Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:44.453{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.77921e7022fc38442021-12-21 11:38:44.453root 11241100x8000000000000000554578Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:44.453{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.518057abccd4fb082021-12-21 11:38:44.453root 11241100x8000000000000000554579Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:44.453{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7679161546a376b12021-12-21 11:38:44.453root 11241100x8000000000000000554580Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:44.454{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e746fd722b9f81842021-12-21 11:38:44.454root 11241100x8000000000000000554581Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:44.454{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7882d85f81de656c2021-12-21 11:38:44.454root 11241100x8000000000000000554582Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:44.454{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.01be6166d1ebc5db2021-12-21 11:38:44.454root 11241100x8000000000000000554583Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:44.454{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d82d1addc6c4d83c2021-12-21 11:38:44.454root 11241100x8000000000000000554584Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:44.454{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c8e1049e8f7ee4622021-12-21 11:38:44.454root 11241100x8000000000000000554585Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:44.454{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a7846fe9d2cbc1c92021-12-21 11:38:44.454root 11241100x8000000000000000554586Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:44.454{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b77de690245a22192021-12-21 11:38:44.454root 11241100x8000000000000000554587Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:44.454{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.50ebfbea17d54e5a2021-12-21 11:38:44.454root 11241100x8000000000000000554588Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:44.454{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7c6904d5b408c5972021-12-21 11:38:44.454root 11241100x8000000000000000554589Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:44.454{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7f4c3d20436c6a552021-12-21 11:38:44.454root 11241100x8000000000000000554590Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:44.454{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.21c2abb84384e0182021-12-21 11:38:44.454root 11241100x8000000000000000554591Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:44.455{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.96a84185a3feac892021-12-21 11:38:44.455root 11241100x8000000000000000554592Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:44.455{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4ff127dab911937f2021-12-21 11:38:44.455root 11241100x8000000000000000554593Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:44.455{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b0d8f8f146b97fd32021-12-21 11:38:44.455root 11241100x8000000000000000554594Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:44.455{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.67895b230754fb122021-12-21 11:38:44.455root 11241100x8000000000000000554595Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:44.455{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f8866893331f57242021-12-21 11:38:44.455root 11241100x8000000000000000554596Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:44.455{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b8afed77003b6c172021-12-21 11:38:44.455root 11241100x8000000000000000554597Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:44.455{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f8e0f6dfa15148502021-12-21 11:38:44.455root 11241100x8000000000000000554598Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:44.455{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4463186719c017fd2021-12-21 11:38:44.455root 11241100x8000000000000000554599Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:44.455{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c3898abd44bc18f42021-12-21 11:38:44.455root 11241100x8000000000000000554600Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:44.455{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9e9c4582e1309c2a2021-12-21 11:38:44.455root 11241100x8000000000000000554601Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:44.455{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a2202180da6d951c2021-12-21 11:38:44.455root 11241100x8000000000000000554602Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:44.456{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2fae78868c3bffb92021-12-21 11:38:44.456root 11241100x8000000000000000554603Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:44.456{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.343af8f1ccaa7fe42021-12-21 11:38:44.456root 11241100x8000000000000000554604Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:44.456{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e40cdf90e9fc25a72021-12-21 11:38:44.456root 11241100x8000000000000000554605Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:44.456{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.32a87aa74af6164f2021-12-21 11:38:44.456root 11241100x8000000000000000554606Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:44.456{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7e59217ebfe74c622021-12-21 11:38:44.456root 11241100x8000000000000000554607Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:44.456{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.690d21b1ad53e4392021-12-21 11:38:44.456root 11241100x8000000000000000554608Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:44.456{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.10d0eda9d4d763602021-12-21 11:38:44.456root 11241100x8000000000000000554609Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:44.456{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.89d6fafb411da86a2021-12-21 11:38:44.456root 11241100x8000000000000000554610Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:44.456{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d9f886f2eb9a0c3c2021-12-21 11:38:44.456root 11241100x8000000000000000554611Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:44.456{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3061a6f696b350422021-12-21 11:38:44.456root 11241100x8000000000000000554612Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:44.456{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5c7202669457cfc12021-12-21 11:38:44.456root 11241100x8000000000000000554613Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:44.457{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b35ca627c0ef77652021-12-21 11:38:44.457root 11241100x8000000000000000554614Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:44.457{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c208f0629092bf042021-12-21 11:38:44.457root 11241100x8000000000000000554615Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:44.457{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1e61a85d1c7b36ca2021-12-21 11:38:44.457root 11241100x8000000000000000554616Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:44.457{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.acc6ee2418ce5a282021-12-21 11:38:44.457root 11241100x8000000000000000554617Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:44.457{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.603f237840e781542021-12-21 11:38:44.457root 11241100x8000000000000000554618Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:44.457{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f0da6747b9148ce62021-12-21 11:38:44.457root 11241100x8000000000000000554619Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:44.457{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e31050976ac51f382021-12-21 11:38:44.457root 11241100x8000000000000000554620Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:44.457{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.bc992a6dd2841fda2021-12-21 11:38:44.457root 11241100x8000000000000000554621Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:44.457{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d8e2c242d794a84b2021-12-21 11:38:44.457root 11241100x8000000000000000554622Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:44.458{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7574d2cb284bdc562021-12-21 11:38:44.458root 11241100x8000000000000000554623Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:44.458{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.828e14272f7c15912021-12-21 11:38:44.458root 11241100x8000000000000000554624Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:44.458{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9fd6ea59547880412021-12-21 11:38:44.458root 11241100x8000000000000000554625Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:44.458{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e8b9b887566ea3ff2021-12-21 11:38:44.458root 11241100x8000000000000000554626Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:44.458{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6850d36b6e59bee12021-12-21 11:38:44.458root 11241100x8000000000000000554627Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:44.458{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8f53e645567aeb3a2021-12-21 11:38:44.458root 11241100x8000000000000000554628Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:44.458{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f7836860056970782021-12-21 11:38:44.458root 11241100x8000000000000000554629Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:44.458{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d0813e2f3b4a20b62021-12-21 11:38:44.458root 11241100x8000000000000000554630Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:44.458{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.97b2c1122078a3de2021-12-21 11:38:44.458root 11241100x8000000000000000554631Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:44.458{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.56351014830e044a2021-12-21 11:38:44.458root 11241100x8000000000000000554632Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:44.458{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.78e5ffa8ad028a732021-12-21 11:38:44.458root 11241100x8000000000000000554633Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:44.459{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6647a1cdf03295262021-12-21 11:38:44.459root 11241100x8000000000000000554634Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:44.459{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f33b9d73ef7499d22021-12-21 11:38:44.459root 11241100x8000000000000000554635Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:44.459{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.99a89d3173b12de02021-12-21 11:38:44.459root 11241100x8000000000000000554636Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:44.459{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.28cbbc5724b9c6122021-12-21 11:38:44.459root 11241100x8000000000000000554637Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:44.459{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9c620df69dc6035e2021-12-21 11:38:44.459root 11241100x8000000000000000554638Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:44.459{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.047d3c38a0e485f92021-12-21 11:38:44.459root 11241100x8000000000000000554639Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:44.459{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c6032a26c13975c82021-12-21 11:38:44.459root 11241100x8000000000000000554640Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:44.459{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8ea424b28cc63eba2021-12-21 11:38:44.459root 11241100x8000000000000000554641Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:44.459{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e3dabdecbd4352e32021-12-21 11:38:44.459root 11241100x8000000000000000554642Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:44.459{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2666b64f3d7c98fd2021-12-21 11:38:44.459root 11241100x8000000000000000554643Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:44.459{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b4f23d38297797642021-12-21 11:38:44.459root 11241100x8000000000000000554644Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:44.459{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ca68a4b28bd12c5a2021-12-21 11:38:44.459root 11241100x8000000000000000554645Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:44.460{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.999d9c04777e83e42021-12-21 11:38:44.460root 11241100x8000000000000000554646Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:44.460{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.292ebcec1274795a2021-12-21 11:38:44.460root 11241100x8000000000000000554647Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:44.460{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6deea08d43282ca72021-12-21 11:38:44.460root 11241100x8000000000000000554648Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:44.460{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.21acde9509da974c2021-12-21 11:38:44.460root 11241100x8000000000000000554649Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:44.460{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.38ac5dbe9a915a482021-12-21 11:38:44.460root 11241100x8000000000000000554650Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:44.460{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a12301802952bede2021-12-21 11:38:44.460root 11241100x8000000000000000554651Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:44.460{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c3f1a1e736b07db12021-12-21 11:38:44.460root 11241100x8000000000000000554652Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:44.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4c2b83d2fdb3cc662021-12-21 11:38:44.943root 11241100x8000000000000000554653Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:44.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9091a2adf47e2bf32021-12-21 11:38:44.943root 11241100x8000000000000000554654Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:44.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f0e7e367dfdcdbf02021-12-21 11:38:44.943root 11241100x8000000000000000554655Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:44.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9589cc6fb8db56002021-12-21 11:38:44.943root 11241100x8000000000000000554656Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:44.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a780882484b7c5ed2021-12-21 11:38:44.944root 11241100x8000000000000000554657Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:44.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6715d1bcaf149d4d2021-12-21 11:38:44.944root 11241100x8000000000000000554658Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:44.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a3545ca18fa938d22021-12-21 11:38:44.944root 11241100x8000000000000000554659Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:44.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.fa6b4fb6689dbacc2021-12-21 11:38:44.944root 11241100x8000000000000000554660Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:44.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.cb6c7b45928c81862021-12-21 11:38:44.944root 11241100x8000000000000000554661Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:44.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.603969225947b7a02021-12-21 11:38:44.944root 11241100x8000000000000000554662Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:44.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.dbb87b82fa6ef0062021-12-21 11:38:44.944root 11241100x8000000000000000554663Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:44.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4b303ccc4dc7d6ec2021-12-21 11:38:44.944root 11241100x8000000000000000554664Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:44.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.883abf84d2653d322021-12-21 11:38:44.944root 11241100x8000000000000000554665Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:44.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2bed5c2efe6833bd2021-12-21 11:38:44.944root 11241100x8000000000000000554666Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:44.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.deba2f84bf59ec6f2021-12-21 11:38:44.944root 11241100x8000000000000000554667Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:44.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.fb271d34e2b016412021-12-21 11:38:44.944root 11241100x8000000000000000554668Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:44.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a8ea96d58517a5372021-12-21 11:38:44.944root 11241100x8000000000000000554669Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:44.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.95bce41a774144c52021-12-21 11:38:44.944root 11241100x8000000000000000554670Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:44.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.40c291d0621bb5652021-12-21 11:38:44.944root 11241100x8000000000000000554671Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:44.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.64752c29b4cdfc652021-12-21 11:38:44.945root 11241100x8000000000000000554672Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:44.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.570a0f5bf31fc35d2021-12-21 11:38:44.945root 11241100x8000000000000000554673Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:44.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3955ce61b8c694ba2021-12-21 11:38:44.945root 11241100x8000000000000000554674Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:44.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d2a239a43286cc062021-12-21 11:38:44.945root 11241100x8000000000000000554675Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:44.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.58ea20f17a2280b42021-12-21 11:38:44.945root 11241100x8000000000000000554676Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:44.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1f3a07dba7cdb45d2021-12-21 11:38:44.945root 11241100x8000000000000000554677Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:44.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4c37fa3db2cb7fc12021-12-21 11:38:44.945root 11241100x8000000000000000554678Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:44.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.409db98ae1f2b8502021-12-21 11:38:44.945root 11241100x8000000000000000554679Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:44.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.df7591c9290404582021-12-21 11:38:44.945root 11241100x8000000000000000554680Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:44.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.98402cf97c025dff2021-12-21 11:38:44.945root 11241100x8000000000000000554681Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:44.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e45c72489ac9a2f92021-12-21 11:38:44.945root 11241100x8000000000000000554682Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:44.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.efa859ad530cbf612021-12-21 11:38:44.945root 11241100x8000000000000000554683Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:44.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6fe6a0a46a0f43942021-12-21 11:38:44.945root 11241100x8000000000000000554684Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:44.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6d5c464678fbb9462021-12-21 11:38:44.945root 11241100x8000000000000000554685Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:44.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6b0cfb6288d01f312021-12-21 11:38:44.945root 11241100x8000000000000000554686Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:44.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9c5cbf2b0db4f1b52021-12-21 11:38:44.945root 11241100x8000000000000000554687Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:44.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7620add1e21d013e2021-12-21 11:38:44.945root 11241100x8000000000000000554688Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:44.946{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.fb1e1365a1acf40b2021-12-21 11:38:44.946root 11241100x8000000000000000554689Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:44.946{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d21aaf4ff45e18e02021-12-21 11:38:44.946root 11241100x8000000000000000554690Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:44.946{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.895b291a2e5a481d2021-12-21 11:38:44.946root 11241100x8000000000000000554691Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:44.946{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f2d9e87ff35689972021-12-21 11:38:44.946root 11241100x8000000000000000554692Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:44.946{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4122becefbd0d23a2021-12-21 11:38:44.946root 11241100x8000000000000000554693Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:44.946{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c5160f21e333bc032021-12-21 11:38:44.946root 11241100x8000000000000000554694Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:44.946{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9927332b9fa54a242021-12-21 11:38:44.946root 11241100x8000000000000000554695Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:44.946{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.819f7d199251e9c42021-12-21 11:38:44.946root 11241100x8000000000000000554696Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:44.946{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.188e8451d81724572021-12-21 11:38:44.946root 11241100x8000000000000000554697Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:44.946{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ce80a209c6723b132021-12-21 11:38:44.946root 11241100x8000000000000000554698Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:44.946{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.33419ea8b5ab5f342021-12-21 11:38:44.946root 11241100x8000000000000000554699Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:44.946{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.12014dbd0fa1c6712021-12-21 11:38:44.946root 11241100x8000000000000000554700Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:45.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.800bb3036b63135d2021-12-21 11:38:45.443root 11241100x8000000000000000554701Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:45.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c7a0b329990deadc2021-12-21 11:38:45.443root 11241100x8000000000000000554702Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:45.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e628ed830cfc12e52021-12-21 11:38:45.443root 11241100x8000000000000000554703Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:45.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8fd8af10eb0c6b462021-12-21 11:38:45.443root 11241100x8000000000000000554704Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:45.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.fb491fe0000ff3502021-12-21 11:38:45.443root 11241100x8000000000000000554705Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:45.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.412dcd5f447c2fbc2021-12-21 11:38:45.443root 11241100x8000000000000000554706Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:45.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9bfc5fda6960d5832021-12-21 11:38:45.443root 11241100x8000000000000000554707Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:45.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.09534df62ecbaca42021-12-21 11:38:45.443root 11241100x8000000000000000554708Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:45.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0ad565cf144ddc692021-12-21 11:38:45.444root 11241100x8000000000000000554709Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:45.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d3be48ca19a3807c2021-12-21 11:38:45.444root 11241100x8000000000000000554710Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:45.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f61a85ea107664792021-12-21 11:38:45.444root 11241100x8000000000000000554711Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:45.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8bee702a346c04862021-12-21 11:38:45.444root 11241100x8000000000000000554712Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:45.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.21f7ae2667e621142021-12-21 11:38:45.444root 11241100x8000000000000000554713Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:45.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.12ee8844febeb8682021-12-21 11:38:45.444root 11241100x8000000000000000554714Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:45.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c6dd858abd6ba90d2021-12-21 11:38:45.444root 11241100x8000000000000000554715Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:45.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.510182c4c61f64382021-12-21 11:38:45.444root 11241100x8000000000000000554716Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:45.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.dc5cb49233cfd0c32021-12-21 11:38:45.444root 11241100x8000000000000000554717Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:45.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a2f6f773ecdc2ce52021-12-21 11:38:45.444root 11241100x8000000000000000554718Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:45.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ec3f5e1e8b67d7da2021-12-21 11:38:45.445root 11241100x8000000000000000554719Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:45.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6adfb8be372b60f02021-12-21 11:38:45.445root 11241100x8000000000000000554720Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:45.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2059b5293555f4ad2021-12-21 11:38:45.445root 11241100x8000000000000000554721Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:45.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e3510d8a53a831f52021-12-21 11:38:45.445root 11241100x8000000000000000554722Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:45.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7ee1951ddc160e312021-12-21 11:38:45.445root 11241100x8000000000000000554723Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:45.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a1d188745191d4252021-12-21 11:38:45.445root 11241100x8000000000000000554724Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:45.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b78db5f0fa0951992021-12-21 11:38:45.445root 11241100x8000000000000000554725Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:45.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.197e617b5efbd17e2021-12-21 11:38:45.445root 11241100x8000000000000000554726Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:45.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9148df7e68f730952021-12-21 11:38:45.445root 11241100x8000000000000000554727Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:45.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1268660a7741c6222021-12-21 11:38:45.445root 11241100x8000000000000000554728Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:45.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7a893a7b90ad17682021-12-21 11:38:45.445root 11241100x8000000000000000554729Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:45.446{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.976f860f118d4fb82021-12-21 11:38:45.446root 11241100x8000000000000000554730Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:45.446{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1d59c01d08e582932021-12-21 11:38:45.446root 11241100x8000000000000000554731Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:45.446{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a3c7f6702ee0f79e2021-12-21 11:38:45.446root 11241100x8000000000000000554732Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:45.446{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.660b2a10e8662f032021-12-21 11:38:45.446root 11241100x8000000000000000554733Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:45.446{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.cad002bd07b97ea12021-12-21 11:38:45.446root 11241100x8000000000000000554734Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:45.446{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7ae7fcc26b0ab6c42021-12-21 11:38:45.446root 11241100x8000000000000000554735Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:45.446{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.fa2f7f454e83b2932021-12-21 11:38:45.446root 11241100x8000000000000000554736Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:45.446{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2873cdf6848d49092021-12-21 11:38:45.446root 11241100x8000000000000000554737Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:45.446{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1d6044d8281ca2442021-12-21 11:38:45.446root 11241100x8000000000000000554738Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:45.446{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e52747e6e22fba472021-12-21 11:38:45.446root 11241100x8000000000000000554739Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:45.448{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.29f6513516ed6cdd2021-12-21 11:38:45.448root 11241100x8000000000000000554740Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:45.448{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f40837cc38a2a4012021-12-21 11:38:45.448root 11241100x8000000000000000554741Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:45.448{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8d5e825fb24862322021-12-21 11:38:45.448root 11241100x8000000000000000554742Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:45.448{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5fce67ba455f93b32021-12-21 11:38:45.448root 11241100x8000000000000000554743Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:45.448{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2fe091c25a86d2d22021-12-21 11:38:45.448root 11241100x8000000000000000554744Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:45.448{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.13f16d5d1b6a42cc2021-12-21 11:38:45.448root 11241100x8000000000000000554745Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:45.448{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.af99576d6b340dd02021-12-21 11:38:45.448root 11241100x8000000000000000554746Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:45.448{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3547eabaaf04c59f2021-12-21 11:38:45.448root 11241100x8000000000000000554747Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:45.449{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5d6d15a1d5d98e892021-12-21 11:38:45.449root 11241100x8000000000000000554748Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:45.449{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b4070525fade74232021-12-21 11:38:45.449root 11241100x8000000000000000554749Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:45.449{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.47acad2e1a2a851d2021-12-21 11:38:45.449root 11241100x8000000000000000554750Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:45.449{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.98b2faefce982caf2021-12-21 11:38:45.449root 11241100x8000000000000000554751Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:45.449{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5e8a6d4466021fc52021-12-21 11:38:45.449root 11241100x8000000000000000554752Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:45.449{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.236803b167e3eda12021-12-21 11:38:45.449root 11241100x8000000000000000554753Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:45.449{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.db8841b5408570792021-12-21 11:38:45.449root 11241100x8000000000000000554754Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:45.449{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.084bc039abab72f92021-12-21 11:38:45.449root 11241100x8000000000000000554755Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:45.449{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8bfc6e95a765b4962021-12-21 11:38:45.449root 11241100x8000000000000000554756Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:45.449{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9d84ef7fc72ce9972021-12-21 11:38:45.449root 11241100x8000000000000000554757Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:45.449{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4b9ecafe6bac95bb2021-12-21 11:38:45.449root 11241100x8000000000000000554758Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:45.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.eb8bedccd392c63f2021-12-21 11:38:45.943root 11241100x8000000000000000554759Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:45.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.873571f782b80c2b2021-12-21 11:38:45.943root 11241100x8000000000000000554760Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:45.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c4ff96e71bdcebc02021-12-21 11:38:45.943root 11241100x8000000000000000554761Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:45.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2547def557f9c5682021-12-21 11:38:45.943root 11241100x8000000000000000554762Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:45.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c1dc0bae54d4e3eb2021-12-21 11:38:45.944root 11241100x8000000000000000554763Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:45.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d58fbf6f82d93e7f2021-12-21 11:38:45.944root 11241100x8000000000000000554764Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:45.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.dbb5bddaa414ff502021-12-21 11:38:45.944root 11241100x8000000000000000554765Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:45.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f9bd5e10ab2ff2f42021-12-21 11:38:45.944root 11241100x8000000000000000554766Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:45.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.29937af378cc9dc02021-12-21 11:38:45.944root 11241100x8000000000000000554767Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:45.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.be829021759055212021-12-21 11:38:45.944root 11241100x8000000000000000554768Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:45.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.86d7862b2a83431a2021-12-21 11:38:45.944root 11241100x8000000000000000554769Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:45.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6855d731fbc9ea2e2021-12-21 11:38:45.944root 11241100x8000000000000000554770Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:45.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7e215890d48b44672021-12-21 11:38:45.945root 11241100x8000000000000000554771Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:45.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2058ac0d3dcf99bd2021-12-21 11:38:45.945root 11241100x8000000000000000554772Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:45.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7817564c44056fa72021-12-21 11:38:45.945root 11241100x8000000000000000554773Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:45.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.14be306428618be32021-12-21 11:38:45.945root 11241100x8000000000000000554774Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:45.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.bc46cb624170243c2021-12-21 11:38:45.945root 11241100x8000000000000000554775Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:45.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1213cd9246b80df62021-12-21 11:38:45.945root 11241100x8000000000000000554776Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:45.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.dd303dd22452a1382021-12-21 11:38:45.945root 11241100x8000000000000000554777Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:45.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5c62a0da7e956f482021-12-21 11:38:45.945root 11241100x8000000000000000554778Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:45.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ffc5402262d104c82021-12-21 11:38:45.945root 11241100x8000000000000000554779Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:45.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5613f27075761f982021-12-21 11:38:45.945root 11241100x8000000000000000554780Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:45.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2f2f39189ad670872021-12-21 11:38:45.945root 11241100x8000000000000000554781Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:45.946{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1229cb02348a0f5a2021-12-21 11:38:45.946root 11241100x8000000000000000554782Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:45.946{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d8c70fe7cf7f7dbd2021-12-21 11:38:45.946root 11241100x8000000000000000554783Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:45.946{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4c72ca39aa8eb6972021-12-21 11:38:45.946root 11241100x8000000000000000554784Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:45.946{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.134b09a976ea24002021-12-21 11:38:45.946root 11241100x8000000000000000554785Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:45.946{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.128f99e5050a3f3b2021-12-21 11:38:45.946root 11241100x8000000000000000554786Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:45.946{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b7223e50f0446b7d2021-12-21 11:38:45.946root 11241100x8000000000000000554787Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:45.946{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c0692628f33d9acd2021-12-21 11:38:45.946root 11241100x8000000000000000554788Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:45.946{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8a8880020628f7152021-12-21 11:38:45.946root 11241100x8000000000000000554789Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:45.946{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.58609f66395ed4532021-12-21 11:38:45.946root 11241100x8000000000000000554790Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:45.946{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a0328b1f7c34d5a12021-12-21 11:38:45.946root 11241100x8000000000000000554791Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:45.946{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.84ad1084762060402021-12-21 11:38:45.946root 11241100x8000000000000000554792Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:45.947{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5b974d262318cc172021-12-21 11:38:45.947root 11241100x8000000000000000554793Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:45.947{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.86229f990be615712021-12-21 11:38:45.947root 11241100x8000000000000000554794Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:45.947{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.dc0f33fad5c0c7ee2021-12-21 11:38:45.947root 11241100x8000000000000000554795Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:45.947{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.56aeded676d988242021-12-21 11:38:45.947root 11241100x8000000000000000554796Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:45.947{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.550892c86e6776a42021-12-21 11:38:45.947root 11241100x8000000000000000554797Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:45.947{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.709c7334f003ba652021-12-21 11:38:45.947root 11241100x8000000000000000554798Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:45.947{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.09daab34dca6ecb62021-12-21 11:38:45.947root 11241100x8000000000000000554799Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:45.947{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2fa438630db3ee9a2021-12-21 11:38:45.947root 11241100x8000000000000000554800Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:45.948{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ffa44b0f74cbf2402021-12-21 11:38:45.948root 11241100x8000000000000000554801Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:45.948{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d1769b2a6055b0c02021-12-21 11:38:45.948root 11241100x8000000000000000554802Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:45.948{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a24053767bc3bb6f2021-12-21 11:38:45.948root 11241100x8000000000000000554803Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:45.948{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f683723bfd915bfe2021-12-21 11:38:45.948root 354300x8000000000000000554804Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:46.088{ec2b6afe-95d9-61c1-5175-3a0400000000}5346/opt/splunkforwarder/etc/apps/Splunk_TA_stream/linux_x86_64/bin/streamfwdroottcptruefalse10.0.1.25-48844-false10.0.1.12-8000- 11241100x8000000000000000554805Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:46.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.cea061af8247aeee2021-12-21 11:38:46.443root 11241100x8000000000000000554806Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:46.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6d0af6913848bb8a2021-12-21 11:38:46.443root 11241100x8000000000000000554807Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:46.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0d126868659bc7b32021-12-21 11:38:46.443root 11241100x8000000000000000554808Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:46.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.10a6e5cdceccb6a02021-12-21 11:38:46.443root 11241100x8000000000000000554809Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:46.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b873c37a4410c7a72021-12-21 11:38:46.444root 11241100x8000000000000000554810Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:46.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.68727df46a15ac752021-12-21 11:38:46.444root 11241100x8000000000000000554811Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:46.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4aedb166943999772021-12-21 11:38:46.444root 11241100x8000000000000000554812Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:46.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a14ab91e81c150b32021-12-21 11:38:46.444root 11241100x8000000000000000554813Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:46.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.10f5bafac8d096bf2021-12-21 11:38:46.444root 11241100x8000000000000000554814Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:46.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.823b0d6a6d6b73232021-12-21 11:38:46.444root 11241100x8000000000000000554815Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:46.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9e2b71b3fba455fb2021-12-21 11:38:46.444root 11241100x8000000000000000554816Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:46.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0bf9814712e0cdb22021-12-21 11:38:46.444root 11241100x8000000000000000554817Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:46.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b9982cf801d0c29d2021-12-21 11:38:46.445root 11241100x8000000000000000554818Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:46.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3ffa8e46bca8f05f2021-12-21 11:38:46.445root 11241100x8000000000000000554819Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:46.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.128f6491a2981b202021-12-21 11:38:46.445root 11241100x8000000000000000554820Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:46.446{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ccc40d09efe05f5f2021-12-21 11:38:46.446root 11241100x8000000000000000554821Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:46.446{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.84e7c2a63f1797002021-12-21 11:38:46.446root 11241100x8000000000000000554822Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:46.446{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.08848abee85a4ef52021-12-21 11:38:46.446root 11241100x8000000000000000554823Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:46.446{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8a3523d3498590802021-12-21 11:38:46.446root 11241100x8000000000000000554824Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:46.447{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e9d3c3a5774b6e272021-12-21 11:38:46.447root 11241100x8000000000000000554825Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:46.447{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.22166735f469ab0b2021-12-21 11:38:46.447root 11241100x8000000000000000554826Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:46.447{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1c8bd33b9b801b1a2021-12-21 11:38:46.447root 11241100x8000000000000000554827Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:46.447{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4fda7c694d8c8c972021-12-21 11:38:46.447root 11241100x8000000000000000554828Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:46.448{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4598c2edd2a701822021-12-21 11:38:46.448root 11241100x8000000000000000554829Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:46.448{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2c528f908b6f36b22021-12-21 11:38:46.448root 11241100x8000000000000000554830Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:46.448{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.100f49e665c11de22021-12-21 11:38:46.448root 11241100x8000000000000000554831Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:46.448{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.059b213c607f143d2021-12-21 11:38:46.448root 11241100x8000000000000000554832Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:46.448{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c7bdb9ae7eb9a0572021-12-21 11:38:46.448root 11241100x8000000000000000554833Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:46.449{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.97cb91e1d7c1b3972021-12-21 11:38:46.449root 11241100x8000000000000000554834Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:46.449{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7f6674783b7b85242021-12-21 11:38:46.449root 11241100x8000000000000000554835Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:46.449{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f692e13b052273242021-12-21 11:38:46.449root 11241100x8000000000000000554836Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:46.449{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.858a1c96d3daa3242021-12-21 11:38:46.449root 11241100x8000000000000000554837Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:46.450{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.dfedff5613ed4a822021-12-21 11:38:46.450root 11241100x8000000000000000554838Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:46.450{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7bcfb76cd1fc745c2021-12-21 11:38:46.450root 11241100x8000000000000000554839Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:46.450{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.15fadb81f02830c02021-12-21 11:38:46.450root 11241100x8000000000000000554840Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:46.450{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.04d22d214c131a5e2021-12-21 11:38:46.450root 11241100x8000000000000000554841Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:46.450{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.05906b5de5a0b9be2021-12-21 11:38:46.450root 11241100x8000000000000000554842Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:46.450{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6153296c95e61b042021-12-21 11:38:46.450root 11241100x8000000000000000554843Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:46.451{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.cc9e5e65e62d79622021-12-21 11:38:46.451root 11241100x8000000000000000554844Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:46.451{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3454474542949b332021-12-21 11:38:46.451root 11241100x8000000000000000554845Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:46.451{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a3b47b174884006d2021-12-21 11:38:46.451root 11241100x8000000000000000554846Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:46.451{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6350af72a5e11a0b2021-12-21 11:38:46.451root 11241100x8000000000000000554847Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:46.452{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8e61efb1c64f6ce62021-12-21 11:38:46.452root 11241100x8000000000000000554848Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:46.452{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0331f491fb09cd7d2021-12-21 11:38:46.452root 11241100x8000000000000000554849Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:46.452{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4b866f74c82fe89f2021-12-21 11:38:46.452root 11241100x8000000000000000554850Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:46.452{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.bc41998d0a7a58752021-12-21 11:38:46.452root 11241100x8000000000000000554851Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:46.452{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b92f4923aaf65ca92021-12-21 11:38:46.452root 11241100x8000000000000000554852Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:46.455{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7be8330a8e21bb772021-12-21 11:38:46.455root 11241100x8000000000000000554853Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:46.455{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d95f894fa2c0172e2021-12-21 11:38:46.455root 11241100x8000000000000000554854Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:46.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.171f1b077bce48372021-12-21 11:38:46.943root 11241100x8000000000000000554855Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:46.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b7253c831e3ec89c2021-12-21 11:38:46.943root 11241100x8000000000000000554856Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:46.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.87c85d26fbc40bc52021-12-21 11:38:46.943root 11241100x8000000000000000554857Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:46.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1575c89a652b59852021-12-21 11:38:46.943root 11241100x8000000000000000554858Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:46.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.64e631cdc92ee1ce2021-12-21 11:38:46.943root 11241100x8000000000000000554859Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:46.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b7dcde7ed8f93c3e2021-12-21 11:38:46.943root 11241100x8000000000000000554860Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:46.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.951ed3b6ff8e18982021-12-21 11:38:46.943root 11241100x8000000000000000554861Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:46.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b4fcf523f11316162021-12-21 11:38:46.943root 11241100x8000000000000000554862Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:46.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9eda528c0331e6b22021-12-21 11:38:46.944root 11241100x8000000000000000554863Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:46.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e121a7fdc00dd1482021-12-21 11:38:46.944root 11241100x8000000000000000554864Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:46.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c3333916f7002fcc2021-12-21 11:38:46.944root 11241100x8000000000000000554865Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:46.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.db2c303681add6db2021-12-21 11:38:46.944root 11241100x8000000000000000554866Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:46.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9cffe6d4569f27f02021-12-21 11:38:46.944root 11241100x8000000000000000554867Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:46.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.81a2ab54f2689ba52021-12-21 11:38:46.944root 11241100x8000000000000000554868Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:46.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4a7a3fbf996ce2e72021-12-21 11:38:46.944root 11241100x8000000000000000554869Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:46.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.65a4c2863e3690ce2021-12-21 11:38:46.944root 11241100x8000000000000000554870Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:46.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7f0a40612dedc96e2021-12-21 11:38:46.944root 11241100x8000000000000000554871Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:46.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8767530665451c092021-12-21 11:38:46.944root 11241100x8000000000000000554872Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:46.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d625debff896f31b2021-12-21 11:38:46.944root 11241100x8000000000000000554873Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:46.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1dde0afcd36191f12021-12-21 11:38:46.945root 11241100x8000000000000000554874Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:46.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2abf3ed12fe241a22021-12-21 11:38:46.945root 11241100x8000000000000000554875Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:46.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.602647cac858806c2021-12-21 11:38:46.945root 11241100x8000000000000000554876Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:46.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4e1dfbb389be86292021-12-21 11:38:46.945root 11241100x8000000000000000554877Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:46.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.aadb64566c01f8dc2021-12-21 11:38:46.945root 11241100x8000000000000000554878Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:46.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.67c87bda931c449f2021-12-21 11:38:46.945root 11241100x8000000000000000554879Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:46.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.daccbcf48e1059012021-12-21 11:38:46.945root 11241100x8000000000000000554880Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:46.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.01e82976c6e6a7292021-12-21 11:38:46.945root 11241100x8000000000000000554881Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:46.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2ccf6d23a52943062021-12-21 11:38:46.945root 11241100x8000000000000000554882Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:46.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b519669ba22b1cc42021-12-21 11:38:46.945root 11241100x8000000000000000554883Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:46.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.def56027d47cdaa62021-12-21 11:38:46.945root 11241100x8000000000000000554884Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:46.946{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c63e48a0ac4aea6b2021-12-21 11:38:46.946root 11241100x8000000000000000554885Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:46.946{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c254132718b3f61b2021-12-21 11:38:46.946root 11241100x8000000000000000554886Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:46.946{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2d72cbfa2a789f762021-12-21 11:38:46.946root 11241100x8000000000000000554887Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:46.946{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d715eb279e72c7782021-12-21 11:38:46.946root 11241100x8000000000000000554888Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:46.946{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.043338073f8f53962021-12-21 11:38:46.946root 11241100x8000000000000000554889Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:46.946{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ba93825db5937af12021-12-21 11:38:46.946root 11241100x8000000000000000554890Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:46.946{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ea561e29b87c1bf02021-12-21 11:38:46.946root 11241100x8000000000000000554891Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:46.946{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7dbc68d97c0432662021-12-21 11:38:46.946root 11241100x8000000000000000554892Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:46.946{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9747af8424ee6cca2021-12-21 11:38:46.946root 11241100x8000000000000000554893Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:46.947{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1abac6498faf80132021-12-21 11:38:46.947root 11241100x8000000000000000554894Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:46.947{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3791e8ad95d2dc862021-12-21 11:38:46.947root 11241100x8000000000000000554895Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:47.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a93e36b6355c081b2021-12-21 11:38:47.443root 11241100x8000000000000000554896Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:47.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1179c50042a3472f2021-12-21 11:38:47.443root 11241100x8000000000000000554897Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:47.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.10befd2fa5edd59b2021-12-21 11:38:47.443root 11241100x8000000000000000554898Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:47.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.adf12e15e5180b882021-12-21 11:38:47.443root 11241100x8000000000000000554899Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:47.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d1d3295e78205c0c2021-12-21 11:38:47.444root 11241100x8000000000000000554900Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:47.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.77fb18143ae999ce2021-12-21 11:38:47.444root 11241100x8000000000000000554901Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:47.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2e14c4c81dffc2682021-12-21 11:38:47.444root 11241100x8000000000000000554902Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:47.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4327f6240ad5aff02021-12-21 11:38:47.444root 11241100x8000000000000000554903Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:47.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7e5cc79453044bcf2021-12-21 11:38:47.444root 11241100x8000000000000000554904Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:47.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5fbe2f56bea179ba2021-12-21 11:38:47.444root 11241100x8000000000000000554905Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:47.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c0ad5bf8f6d155092021-12-21 11:38:47.444root 11241100x8000000000000000554906Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:47.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9b0eb8f5cfd276ba2021-12-21 11:38:47.444root 11241100x8000000000000000554907Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:47.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c47e614b8331b75a2021-12-21 11:38:47.444root 11241100x8000000000000000554908Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:47.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.81ba2dfadfd05ba42021-12-21 11:38:47.444root 11241100x8000000000000000554909Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:47.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.38ab9ba0772d40a02021-12-21 11:38:47.444root 11241100x8000000000000000554910Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:47.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2de649fafc1783412021-12-21 11:38:47.444root 11241100x8000000000000000554911Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:47.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7f422dbdcb4eb4b32021-12-21 11:38:47.444root 11241100x8000000000000000554912Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:47.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1d0db255073032092021-12-21 11:38:47.444root 11241100x8000000000000000554913Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:47.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5128aa2e523131052021-12-21 11:38:47.444root 11241100x8000000000000000554914Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:47.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ac2f391d421699962021-12-21 11:38:47.444root 11241100x8000000000000000554915Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:47.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8ce313037a86ca132021-12-21 11:38:47.445root 11241100x8000000000000000554916Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:47.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d98886772f50a96b2021-12-21 11:38:47.445root 11241100x8000000000000000554917Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:47.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ad0a82d88edf3bb12021-12-21 11:38:47.445root 11241100x8000000000000000554918Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:47.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a27647a4db0824212021-12-21 11:38:47.445root 11241100x8000000000000000554919Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:47.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d3e165465bc3c1442021-12-21 11:38:47.445root 11241100x8000000000000000554920Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:47.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c885e3da81f4a4d62021-12-21 11:38:47.445root 11241100x8000000000000000554921Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:47.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b7ee12a84b21d6ac2021-12-21 11:38:47.445root 11241100x8000000000000000554922Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:47.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.46ab0e827e5772152021-12-21 11:38:47.445root 11241100x8000000000000000554923Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:47.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4d293ab1eddee4cd2021-12-21 11:38:47.445root 11241100x8000000000000000554924Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:47.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.14a5179a97a01e7b2021-12-21 11:38:47.445root 11241100x8000000000000000554925Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:47.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.41366db623f2f5a62021-12-21 11:38:47.445root 11241100x8000000000000000554926Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:47.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0c81a00c735966b82021-12-21 11:38:47.445root 11241100x8000000000000000554927Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:47.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.338ad8b593c1323d2021-12-21 11:38:47.445root 11241100x8000000000000000554928Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:47.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d48804ac177126272021-12-21 11:38:47.445root 11241100x8000000000000000554929Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:47.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.95cc851d227c53312021-12-21 11:38:47.445root 11241100x8000000000000000554930Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:47.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.619467419ab465bc2021-12-21 11:38:47.445root 11241100x8000000000000000554931Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:47.446{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c6339dbeef5b97cf2021-12-21 11:38:47.446root 11241100x8000000000000000554932Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:47.446{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d33572e441597f332021-12-21 11:38:47.446root 11241100x8000000000000000554933Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:47.446{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5c55b0a3ef903ede2021-12-21 11:38:47.446root 11241100x8000000000000000554934Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:47.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.470a4cd24ef19caf2021-12-21 11:38:47.943root 11241100x8000000000000000554935Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:47.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3a75073f764a62512021-12-21 11:38:47.943root 11241100x8000000000000000554936Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:47.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d89e1be4f719f7282021-12-21 11:38:47.943root 11241100x8000000000000000554937Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:47.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.fdf5c823dd1f89eb2021-12-21 11:38:47.943root 11241100x8000000000000000554938Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:47.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e4096f7c616493ca2021-12-21 11:38:47.944root 11241100x8000000000000000554939Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:47.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.47e64c79160f601e2021-12-21 11:38:47.944root 11241100x8000000000000000554940Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:47.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c478932a117bf2d22021-12-21 11:38:47.944root 11241100x8000000000000000554941Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:47.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1615f24c25d9caa82021-12-21 11:38:47.944root 11241100x8000000000000000554942Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:47.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.bb3e0f2d3dc5e6b52021-12-21 11:38:47.944root 11241100x8000000000000000554943Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:47.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1c433472e1f08b322021-12-21 11:38:47.944root 11241100x8000000000000000554944Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:47.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7d7be83917a0d42c2021-12-21 11:38:47.944root 11241100x8000000000000000554945Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:47.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9665e6f9e76c2a472021-12-21 11:38:47.944root 11241100x8000000000000000554946Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:47.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.40ee0d64e9a876452021-12-21 11:38:47.944root 11241100x8000000000000000554947Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:47.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f10e984516db99142021-12-21 11:38:47.944root 11241100x8000000000000000554948Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:47.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d195239d18cd1f102021-12-21 11:38:47.944root 11241100x8000000000000000554949Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:47.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.106e4b715f30bddf2021-12-21 11:38:47.944root 11241100x8000000000000000554950Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:47.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ec0f3ab8468a446b2021-12-21 11:38:47.944root 11241100x8000000000000000554951Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:47.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.037c849fe8e2b9b72021-12-21 11:38:47.944root 11241100x8000000000000000554952Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:47.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a73206b0fb7a07232021-12-21 11:38:47.944root 11241100x8000000000000000554953Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:47.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9c96bedf42e761aa2021-12-21 11:38:47.944root 11241100x8000000000000000554954Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:47.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.73dab8cc4c957f0b2021-12-21 11:38:47.945root 11241100x8000000000000000554955Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:47.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5330fdca75afac842021-12-21 11:38:47.945root 11241100x8000000000000000554956Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:47.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.315ba1aff264dc192021-12-21 11:38:47.945root 11241100x8000000000000000554957Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:47.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6c2ead1636e313392021-12-21 11:38:47.945root 11241100x8000000000000000554958Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:47.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f1cb5255d97e74f02021-12-21 11:38:47.945root 11241100x8000000000000000554959Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:47.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6aa279f2ae1aa83f2021-12-21 11:38:47.945root 11241100x8000000000000000554960Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:47.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.bfbaa0e0e01cd1f62021-12-21 11:38:47.945root 11241100x8000000000000000554961Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:47.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.073f6efa4d75ddee2021-12-21 11:38:47.945root 11241100x8000000000000000554962Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:47.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0b5469783507ecf12021-12-21 11:38:47.945root 11241100x8000000000000000554963Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:47.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.39ad3fd14a91f2422021-12-21 11:38:47.945root 11241100x8000000000000000554964Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:47.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6138dff8b1f67e402021-12-21 11:38:47.945root 11241100x8000000000000000554965Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:47.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6517ecdcd92369332021-12-21 11:38:47.945root 11241100x8000000000000000554966Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:47.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.16a3448a3df128342021-12-21 11:38:47.945root 11241100x8000000000000000554967Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:47.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f0bec1e4b338cc6c2021-12-21 11:38:47.945root 11241100x8000000000000000554968Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:47.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f3c880ab069caa0c2021-12-21 11:38:47.945root 11241100x8000000000000000554969Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:47.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f6aede80550db90a2021-12-21 11:38:47.945root 11241100x8000000000000000554970Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:47.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4ac3c3fa8db9235e2021-12-21 11:38:47.945root 11241100x8000000000000000554971Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:48.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.277e9a052fb935fb2021-12-21 11:38:48.443root 11241100x8000000000000000554972Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:48.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.bd1271122403e1c72021-12-21 11:38:48.443root 11241100x8000000000000000554973Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:48.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.208e14c3f7480b962021-12-21 11:38:48.443root 11241100x8000000000000000554974Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:48.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9e581e6ce9af1da32021-12-21 11:38:48.443root 11241100x8000000000000000554975Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:48.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c60441384af852b42021-12-21 11:38:48.443root 11241100x8000000000000000554976Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:48.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.503fda8dda0956642021-12-21 11:38:48.444root 11241100x8000000000000000554977Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:48.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f6f552ca523e19df2021-12-21 11:38:48.444root 11241100x8000000000000000554978Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:48.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4f8c2cb109559a6d2021-12-21 11:38:48.444root 11241100x8000000000000000554979Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:48.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.65ef3f2a551faca02021-12-21 11:38:48.444root 11241100x8000000000000000554980Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:48.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.cff51260308bc1bc2021-12-21 11:38:48.444root 11241100x8000000000000000554981Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:48.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8a5519fb116f75502021-12-21 11:38:48.444root 11241100x8000000000000000554982Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:48.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c4b0da35e70350722021-12-21 11:38:48.444root 11241100x8000000000000000554983Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:48.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ee1e96393f75ed632021-12-21 11:38:48.444root 11241100x8000000000000000554984Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:48.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.aab4f828b588478e2021-12-21 11:38:48.444root 11241100x8000000000000000554985Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:48.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1d0292dd1afbd9732021-12-21 11:38:48.444root 11241100x8000000000000000554986Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:48.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2edc5f56c590a9642021-12-21 11:38:48.445root 11241100x8000000000000000554987Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:48.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c3f3543537b349f52021-12-21 11:38:48.445root 11241100x8000000000000000554988Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:48.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d2c62c59899e59972021-12-21 11:38:48.445root 11241100x8000000000000000554989Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:48.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ae13f99939f3a9ee2021-12-21 11:38:48.445root 11241100x8000000000000000554990Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:48.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7f406d7c0f2337cd2021-12-21 11:38:48.445root 11241100x8000000000000000554991Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:48.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e8701fd42b75be5d2021-12-21 11:38:48.445root 11241100x8000000000000000554992Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:48.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8d6939a6fe4912742021-12-21 11:38:48.445root 11241100x8000000000000000554993Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:48.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.70980f3d072b16a92021-12-21 11:38:48.445root 11241100x8000000000000000554994Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:48.446{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4533c7f82090170a2021-12-21 11:38:48.446root 11241100x8000000000000000554995Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:48.446{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e6057e12c6f3aaa82021-12-21 11:38:48.446root 11241100x8000000000000000554996Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:48.446{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5a7bd077be7666712021-12-21 11:38:48.446root 11241100x8000000000000000554997Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:48.446{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c0edcc2232a34a122021-12-21 11:38:48.446root 11241100x8000000000000000554998Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:48.446{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.976f0839401b53412021-12-21 11:38:48.446root 11241100x8000000000000000554999Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:48.446{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7b194f38d2645bb62021-12-21 11:38:48.446root 11241100x8000000000000000555000Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:48.446{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.434f03a0385687a22021-12-21 11:38:48.446root 11241100x8000000000000000555001Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:48.446{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.12e05f47066afb402021-12-21 11:38:48.446root 11241100x8000000000000000555002Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:48.446{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5f356f4301ad702f2021-12-21 11:38:48.446root 11241100x8000000000000000555003Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:48.446{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.88fd135b858ee1f52021-12-21 11:38:48.446root 11241100x8000000000000000555004Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:48.447{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4169f333f9fe7b3a2021-12-21 11:38:48.447root 11241100x8000000000000000555005Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:48.447{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.271b6e7c4db259792021-12-21 11:38:48.447root 11241100x8000000000000000555006Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:48.447{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f6091fafc71f68182021-12-21 11:38:48.447root 11241100x8000000000000000555007Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:48.447{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1c6881577e75e70e2021-12-21 11:38:48.447root 11241100x8000000000000000555008Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:48.447{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.bd6961037454cca42021-12-21 11:38:48.447root 11241100x8000000000000000555009Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:48.447{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.af51ac3456470b1a2021-12-21 11:38:48.447root 11241100x8000000000000000555010Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:48.447{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5084c0550b6827be2021-12-21 11:38:48.447root 11241100x8000000000000000555011Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:48.447{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9bfee9b61beb041d2021-12-21 11:38:48.447root 11241100x8000000000000000555012Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:48.447{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c77acb26fd7b8adb2021-12-21 11:38:48.447root 11241100x8000000000000000555013Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:48.448{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5c5c83d670b050bf2021-12-21 11:38:48.448root 11241100x8000000000000000555014Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:48.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0a9ac3539056155f2021-12-21 11:38:48.943root 11241100x8000000000000000555015Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:48.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.21d3fb7c5bfe88152021-12-21 11:38:48.943root 11241100x8000000000000000555016Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:48.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0dd60460d1d7b9792021-12-21 11:38:48.943root 11241100x8000000000000000555017Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:48.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.76b9f1d533b9bd102021-12-21 11:38:48.943root 11241100x8000000000000000555018Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:48.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.15e3cb74db2484552021-12-21 11:38:48.944root 11241100x8000000000000000555019Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:48.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2800776dc94814532021-12-21 11:38:48.944root 11241100x8000000000000000555020Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:48.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.91125e514ae329502021-12-21 11:38:48.944root 11241100x8000000000000000555021Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:48.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7de172f5fc11ec282021-12-21 11:38:48.944root 11241100x8000000000000000555022Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:48.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3b6e1053a07513d62021-12-21 11:38:48.944root 11241100x8000000000000000555023Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:48.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7892aac1d262a95e2021-12-21 11:38:48.944root 11241100x8000000000000000555024Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:48.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3d639c0a8aa6a90c2021-12-21 11:38:48.944root 11241100x8000000000000000555025Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:48.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a325b7d63cdc96c82021-12-21 11:38:48.944root 11241100x8000000000000000555026Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:48.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.43f21bc030f1a26c2021-12-21 11:38:48.944root 11241100x8000000000000000555027Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:48.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8708e8d014ab8e952021-12-21 11:38:48.944root 11241100x8000000000000000555028Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:48.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d4cca887937e38ac2021-12-21 11:38:48.944root 11241100x8000000000000000555029Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:48.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.28056e77f0b48d8b2021-12-21 11:38:48.944root 11241100x8000000000000000555030Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:48.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7ae0f50f5e042f412021-12-21 11:38:48.944root 11241100x8000000000000000555031Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:48.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.19127da6c7a95ee62021-12-21 11:38:48.944root 11241100x8000000000000000555032Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:48.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.44a09ad60682188d2021-12-21 11:38:48.944root 11241100x8000000000000000555033Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:48.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0c8a5451cc9572bf2021-12-21 11:38:48.944root 11241100x8000000000000000555034Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:48.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5cc7e91decf9bc942021-12-21 11:38:48.945root 11241100x8000000000000000555035Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:48.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3fa924121511d9382021-12-21 11:38:48.945root 11241100x8000000000000000555036Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:48.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3b4c2ef45559c7ef2021-12-21 11:38:48.945root 11241100x8000000000000000555037Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:48.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.cbafb542069138c82021-12-21 11:38:48.945root 11241100x8000000000000000555038Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:48.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ebe7926049295f952021-12-21 11:38:48.945root 11241100x8000000000000000555039Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:48.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c58b5cc5211b46292021-12-21 11:38:48.945root 11241100x8000000000000000555040Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:48.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9b894154a9087f742021-12-21 11:38:48.945root 11241100x8000000000000000555041Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:48.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.84697e223d6a4d4b2021-12-21 11:38:48.945root 11241100x8000000000000000555042Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:48.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7d36c3b3a38559012021-12-21 11:38:48.945root 11241100x8000000000000000555043Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:48.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b03bfb21115d743b2021-12-21 11:38:48.945root 11241100x8000000000000000555044Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:48.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.381b235c9336a6d32021-12-21 11:38:48.945root 11241100x8000000000000000555045Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:48.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.92d75b52602bf6ae2021-12-21 11:38:48.945root 11241100x8000000000000000555046Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:48.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.142319f23a06f44d2021-12-21 11:38:48.945root 11241100x8000000000000000555047Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:48.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a56e92e813742d712021-12-21 11:38:48.945root 11241100x8000000000000000555048Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:48.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ede9d3aa6ebcfe592021-12-21 11:38:48.945root 11241100x8000000000000000555049Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:48.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8e1179d38fe262722021-12-21 11:38:48.945root 11241100x8000000000000000555050Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:48.946{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5661957ad0e139332021-12-21 11:38:48.946root 11241100x8000000000000000555051Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:49.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.642171cf755cdcec2021-12-21 11:38:49.443root 11241100x8000000000000000555052Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:49.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6797ede39f43f3ba2021-12-21 11:38:49.443root 11241100x8000000000000000555053Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:49.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ad6c8130d0e4a1952021-12-21 11:38:49.443root 11241100x8000000000000000555054Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:49.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0b0d9788ef83bf932021-12-21 11:38:49.443root 11241100x8000000000000000555055Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:49.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c736a84eb413a6e82021-12-21 11:38:49.443root 11241100x8000000000000000555056Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:49.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.80178f9d646003c22021-12-21 11:38:49.443root 11241100x8000000000000000555057Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:49.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2d82e86cad5fb0ec2021-12-21 11:38:49.444root 11241100x8000000000000000555058Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:49.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.df3dc82e3385a0542021-12-21 11:38:49.444root 11241100x8000000000000000555059Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:49.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6f3d8404ee2b7c4f2021-12-21 11:38:49.444root 11241100x8000000000000000555060Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:49.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.bdf1bfb7690eeb152021-12-21 11:38:49.444root 11241100x8000000000000000555061Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:49.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d9ee5fc7967b65672021-12-21 11:38:49.444root 11241100x8000000000000000555062Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:49.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d2a848c94258505f2021-12-21 11:38:49.444root 11241100x8000000000000000555063Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:49.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.efd9ce794cd793c92021-12-21 11:38:49.444root 11241100x8000000000000000555064Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:49.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7e9fb6ef595413dd2021-12-21 11:38:49.444root 11241100x8000000000000000555065Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:49.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4d675e57bfa6bdc92021-12-21 11:38:49.444root 11241100x8000000000000000555066Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:49.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ba94f613056e54cc2021-12-21 11:38:49.445root 11241100x8000000000000000555067Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:49.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a3224c00cb180fcd2021-12-21 11:38:49.445root 11241100x8000000000000000555068Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:49.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.65f15603fc664b4b2021-12-21 11:38:49.445root 11241100x8000000000000000555069Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:49.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f3a76458e39c152a2021-12-21 11:38:49.445root 11241100x8000000000000000555070Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:49.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.31fc999e0e19a58f2021-12-21 11:38:49.445root 11241100x8000000000000000555071Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:49.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.edd65b4cf89a9e192021-12-21 11:38:49.445root 11241100x8000000000000000555072Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:49.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.be0c5479b3a082702021-12-21 11:38:49.445root 11241100x8000000000000000555073Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:49.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6a4e286b815f9e4f2021-12-21 11:38:49.445root 11241100x8000000000000000555074Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:49.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.95d3202af940c4252021-12-21 11:38:49.445root 11241100x8000000000000000555075Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:49.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9baf42d646c302712021-12-21 11:38:49.445root 11241100x8000000000000000555076Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:49.446{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.485fc7ee21dcd3582021-12-21 11:38:49.446root 11241100x8000000000000000555077Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:49.446{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5364d3de9894a3852021-12-21 11:38:49.446root 11241100x8000000000000000555078Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:49.446{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4847bb4369f3d2b02021-12-21 11:38:49.446root 11241100x8000000000000000555079Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:49.446{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7f7d8a34d11716422021-12-21 11:38:49.446root 11241100x8000000000000000555080Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:49.446{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e6cfc541582ab0ad2021-12-21 11:38:49.446root 11241100x8000000000000000555081Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:49.446{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b95d444e38752f1b2021-12-21 11:38:49.446root 11241100x8000000000000000555082Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:49.446{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.341da6e93b54ac0b2021-12-21 11:38:49.446root 11241100x8000000000000000555083Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:49.446{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c3c719847920da712021-12-21 11:38:49.446root 11241100x8000000000000000555084Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:49.446{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b981b7e0940a18a02021-12-21 11:38:49.446root 11241100x8000000000000000555085Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:49.446{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.26a00cbe5e05e8462021-12-21 11:38:49.446root 11241100x8000000000000000555086Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:49.447{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c2508ab98954bb5c2021-12-21 11:38:49.447root 11241100x8000000000000000555087Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:49.447{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3e1e1c9c1444bafb2021-12-21 11:38:49.447root 11241100x8000000000000000555088Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:49.447{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.cf7d0f7e15ba17d62021-12-21 11:38:49.447root 11241100x8000000000000000555089Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:49.447{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7a87fb75911745f82021-12-21 11:38:49.447root 11241100x8000000000000000555090Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:49.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.231bf2694dfeb95f2021-12-21 11:38:49.943root 11241100x8000000000000000555091Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:49.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d78b401203675a4f2021-12-21 11:38:49.943root 11241100x8000000000000000555092Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:49.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4a82fd9708abeda32021-12-21 11:38:49.943root 11241100x8000000000000000555093Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:49.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7608ed5063b7e8512021-12-21 11:38:49.943root 11241100x8000000000000000555094Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:49.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d431827e91d60edc2021-12-21 11:38:49.944root 11241100x8000000000000000555095Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:49.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4dc5d18f888451db2021-12-21 11:38:49.944root 11241100x8000000000000000555096Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:49.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8ee2eab00214071a2021-12-21 11:38:49.944root 11241100x8000000000000000555097Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:49.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9c37da7804c8c6d12021-12-21 11:38:49.944root 11241100x8000000000000000555098Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:49.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.609259099a421c2b2021-12-21 11:38:49.944root 11241100x8000000000000000555099Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:49.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.90cf3beafbfda7362021-12-21 11:38:49.944root 11241100x8000000000000000555100Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:49.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6f8efd5a98d0c5c72021-12-21 11:38:49.944root 11241100x8000000000000000555101Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:49.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b9e6e2e8d4a0bb762021-12-21 11:38:49.944root 11241100x8000000000000000555102Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:49.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1417f05e0302a4bb2021-12-21 11:38:49.944root 11241100x8000000000000000555103Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:49.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c8a3a3789c422a5b2021-12-21 11:38:49.944root 11241100x8000000000000000555104Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:49.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c7e6df457e45c3472021-12-21 11:38:49.944root 11241100x8000000000000000555105Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:49.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2db7dec142fedc0a2021-12-21 11:38:49.944root 11241100x8000000000000000555106Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:49.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.00b0476fb5d8e16f2021-12-21 11:38:49.944root 11241100x8000000000000000555107Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:49.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a18000ba8269e4a92021-12-21 11:38:49.944root 11241100x8000000000000000555108Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:49.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ce00387b463014f22021-12-21 11:38:49.944root 11241100x8000000000000000555109Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:49.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.66236170fbcff6b52021-12-21 11:38:49.944root 11241100x8000000000000000555110Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:49.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2dc5987c665018cb2021-12-21 11:38:49.945root 11241100x8000000000000000555111Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:49.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.dd1143d7b008dcdb2021-12-21 11:38:49.945root 11241100x8000000000000000555112Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:49.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.68298efe898944fa2021-12-21 11:38:49.945root 11241100x8000000000000000555113Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:49.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ff9ca1d7f3d703a12021-12-21 11:38:49.945root 11241100x8000000000000000555114Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:49.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.55443d5c3eda993c2021-12-21 11:38:49.945root 11241100x8000000000000000555115Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:49.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7e8399403d8a1e2f2021-12-21 11:38:49.945root 11241100x8000000000000000555116Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:49.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d834a8e91c8096032021-12-21 11:38:49.945root 11241100x8000000000000000555117Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:49.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.55a22f11483317b22021-12-21 11:38:49.945root 11241100x8000000000000000555118Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:49.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0e17e504d5debff02021-12-21 11:38:49.945root 11241100x8000000000000000555119Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:49.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6b3c1edc09d9f4ab2021-12-21 11:38:49.945root 11241100x8000000000000000555120Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:49.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b9e183fed25e904f2021-12-21 11:38:49.945root 11241100x8000000000000000555121Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:49.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3caf0881de771d072021-12-21 11:38:49.945root 11241100x8000000000000000555122Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:49.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d743f9445ba8d0682021-12-21 11:38:49.945root 11241100x8000000000000000555123Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:49.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f8cfe7c5a9541f742021-12-21 11:38:49.945root 11241100x8000000000000000555124Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:49.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.772eb9dabcd33fb12021-12-21 11:38:49.945root 11241100x8000000000000000555125Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:49.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.486bb29304a673f72021-12-21 11:38:49.945root 11241100x8000000000000000555126Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:49.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d29fc40cf94094592021-12-21 11:38:49.945root 11241100x8000000000000000555127Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:49.946{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5438607b656660d92021-12-21 11:38:49.946root 11241100x8000000000000000555128Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:50.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0c79417433000f522021-12-21 11:38:50.443root 11241100x8000000000000000555129Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:50.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8d1c096c6185406b2021-12-21 11:38:50.443root 11241100x8000000000000000555130Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:50.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6b40bb56d5a5669a2021-12-21 11:38:50.443root 11241100x8000000000000000555131Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:50.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.422ac11077c46e8e2021-12-21 11:38:50.443root 11241100x8000000000000000555132Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:50.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4972016ef7519d742021-12-21 11:38:50.444root 11241100x8000000000000000555133Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:50.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7e8f12c02889abe82021-12-21 11:38:50.444root 11241100x8000000000000000555134Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:50.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.700354e13fe2aed32021-12-21 11:38:50.444root 11241100x8000000000000000555135Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:50.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8643155cfb200bb82021-12-21 11:38:50.444root 11241100x8000000000000000555136Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:50.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9abf1ccc2a8f41ea2021-12-21 11:38:50.444root 11241100x8000000000000000555137Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:50.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2b21a39f996247f12021-12-21 11:38:50.444root 11241100x8000000000000000555138Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:50.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.913abb4ee4ebda9a2021-12-21 11:38:50.444root 11241100x8000000000000000555139Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:50.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.cafb9fbafd3e04b52021-12-21 11:38:50.444root 11241100x8000000000000000555140Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:50.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.38de47dc9d86dba12021-12-21 11:38:50.444root 11241100x8000000000000000555141Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:50.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b4a86760d6c45ee12021-12-21 11:38:50.444root 11241100x8000000000000000555142Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:50.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e4ef417d4da16a5f2021-12-21 11:38:50.444root 11241100x8000000000000000555143Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:50.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b14137f2694ebfc42021-12-21 11:38:50.444root 11241100x8000000000000000555144Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:50.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1162599a2f8addd32021-12-21 11:38:50.444root 11241100x8000000000000000555145Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:50.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d6cb43ac310512832021-12-21 11:38:50.444root 11241100x8000000000000000555146Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:50.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.dacd1e0928c4043f2021-12-21 11:38:50.444root 11241100x8000000000000000555147Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:50.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a0ecfa6c9744215f2021-12-21 11:38:50.445root 11241100x8000000000000000555148Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:50.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.220b86c08e355cc72021-12-21 11:38:50.445root 11241100x8000000000000000555149Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:50.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1bd49a577c7c77ba2021-12-21 11:38:50.445root 11241100x8000000000000000555150Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:50.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.beafeacda861e3712021-12-21 11:38:50.445root 11241100x8000000000000000555151Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:50.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1e6bbb0c307c9a172021-12-21 11:38:50.445root 11241100x8000000000000000555152Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:50.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c7eb90c7cacac9642021-12-21 11:38:50.445root 11241100x8000000000000000555153Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:50.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5d484d88d89452a02021-12-21 11:38:50.445root 11241100x8000000000000000555154Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:50.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c9c329dd7740cf852021-12-21 11:38:50.445root 11241100x8000000000000000555155Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:50.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3db881830f7726b42021-12-21 11:38:50.445root 11241100x8000000000000000555156Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:50.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.13abb685df9824532021-12-21 11:38:50.445root 11241100x8000000000000000555157Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:50.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a30b885fac15958c2021-12-21 11:38:50.445root 11241100x8000000000000000555158Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:50.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.603db6c5e45847072021-12-21 11:38:50.445root 11241100x8000000000000000555159Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:50.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0ae47d1d365f9f382021-12-21 11:38:50.445root 11241100x8000000000000000555160Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:50.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ece0cb7da07da23a2021-12-21 11:38:50.445root 11241100x8000000000000000555161Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:50.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2374ce558d2541db2021-12-21 11:38:50.445root 11241100x8000000000000000555162Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:50.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.784e5b15cabd4ad52021-12-21 11:38:50.445root 11241100x8000000000000000555163Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:50.446{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.86483d96b7f3c1982021-12-21 11:38:50.446root 11241100x8000000000000000555164Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:50.446{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8e619e50e0eb49f72021-12-21 11:38:50.446root 11241100x8000000000000000555165Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:50.446{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.090e6de56564520e2021-12-21 11:38:50.446root 11241100x8000000000000000555166Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:50.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.820b14bd7e0b073f2021-12-21 11:38:50.943root 11241100x8000000000000000555167Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:50.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.82bf4a0d0dd15ba82021-12-21 11:38:50.943root 11241100x8000000000000000555168Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:50.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.bf7ae9cf539a4bca2021-12-21 11:38:50.943root 11241100x8000000000000000555169Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:50.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f3520829c717cfcc2021-12-21 11:38:50.943root 11241100x8000000000000000555170Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:50.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f5c4f019149516572021-12-21 11:38:50.943root 11241100x8000000000000000555171Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:50.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1e6f657517b4034f2021-12-21 11:38:50.943root 11241100x8000000000000000555172Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:50.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.40b0b162359d33452021-12-21 11:38:50.943root 11241100x8000000000000000555173Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:50.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.498001a63a5f585f2021-12-21 11:38:50.944root 11241100x8000000000000000555174Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:50.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ade4e764aecc38ee2021-12-21 11:38:50.944root 11241100x8000000000000000555175Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:50.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.db4972d59284bff92021-12-21 11:38:50.944root 11241100x8000000000000000555176Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:50.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0260ad61d9ed3fec2021-12-21 11:38:50.944root 11241100x8000000000000000555177Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:50.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2c93607b6a78170f2021-12-21 11:38:50.944root 11241100x8000000000000000555178Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:50.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3900f7ee7d1e23002021-12-21 11:38:50.944root 11241100x8000000000000000555179Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:50.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f233fda92e34ded42021-12-21 11:38:50.944root 11241100x8000000000000000555180Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:50.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2ad6d8f6528cd8b72021-12-21 11:38:50.944root 11241100x8000000000000000555181Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:50.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.51bc3c769cde85ef2021-12-21 11:38:50.944root 11241100x8000000000000000555182Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:50.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.93ed8fca81366ba82021-12-21 11:38:50.945root 11241100x8000000000000000555183Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:50.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d0fafb4307addecd2021-12-21 11:38:50.945root 11241100x8000000000000000555184Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:50.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.67557a8c3a96839a2021-12-21 11:38:50.945root 11241100x8000000000000000555185Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:50.947{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.de1cf178ef5386cc2021-12-21 11:38:50.947root 11241100x8000000000000000555186Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:50.947{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ad2b24e1fc6bbc812021-12-21 11:38:50.947root 11241100x8000000000000000555187Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:50.947{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.578cc3a1c8ad52142021-12-21 11:38:50.947root 11241100x8000000000000000555188Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:50.947{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.277a22b8e83fb23e2021-12-21 11:38:50.947root 11241100x8000000000000000555189Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:50.947{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0c0a2d3664858ca02021-12-21 11:38:50.947root 11241100x8000000000000000555190Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:50.947{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.492b1f0415febb1d2021-12-21 11:38:50.947root 11241100x8000000000000000555191Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:50.947{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3df568a509c42aaf2021-12-21 11:38:50.947root 11241100x8000000000000000555192Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:50.948{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.69752c06c2a6f13c2021-12-21 11:38:50.948root 11241100x8000000000000000555193Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:50.948{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9cf1a9b73efe83b02021-12-21 11:38:50.948root 11241100x8000000000000000555194Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:50.948{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.762e22bcdb17eae12021-12-21 11:38:50.948root 11241100x8000000000000000555195Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:50.948{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c6cfe35aa44120fd2021-12-21 11:38:50.948root 11241100x8000000000000000555196Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:50.948{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.45f815b010ebe7e42021-12-21 11:38:50.948root 11241100x8000000000000000555197Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:50.948{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.76849e1bdb0ede9f2021-12-21 11:38:50.948root 11241100x8000000000000000555198Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:50.948{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9ccb9e7ba4b176e02021-12-21 11:38:50.948root 11241100x8000000000000000555199Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:50.948{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.cf6f585564dda4cc2021-12-21 11:38:50.948root 11241100x8000000000000000555200Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:50.948{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c7f928bf071d0d512021-12-21 11:38:50.948root 11241100x8000000000000000555201Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:50.948{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4263cc6c26c1b5fa2021-12-21 11:38:50.948root 11241100x8000000000000000555202Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:50.948{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5b7c06e50101cf5c2021-12-21 11:38:50.948root 11241100x8000000000000000555203Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:50.949{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b72ffe537feac5332021-12-21 11:38:50.949root 11241100x8000000000000000555204Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:50.949{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f2f8af12cc191fe12021-12-21 11:38:50.949root 11241100x8000000000000000555205Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:50.949{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e4b01d54b9e10d432021-12-21 11:38:50.949root 11241100x8000000000000000555206Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:50.949{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2cbfbb113983f6ab2021-12-21 11:38:50.949root 11241100x8000000000000000555207Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:50.949{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a2abd1cb369d3f502021-12-21 11:38:50.949root 11241100x8000000000000000555208Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:50.949{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8b0ac08af4265a502021-12-21 11:38:50.949root 11241100x8000000000000000555209Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:50.949{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.fdb22199ae89a6642021-12-21 11:38:50.949root 11241100x8000000000000000555210Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:50.949{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.aac1ad82e93931422021-12-21 11:38:50.949root 11241100x8000000000000000555211Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:50.950{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7873a5e695bb4f022021-12-21 11:38:50.950root 354300x8000000000000000555212Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:51.214{ec2b6afe-95d9-61c1-5175-3a0400000000}5346/opt/splunkforwarder/etc/apps/Splunk_TA_stream/linux_x86_64/bin/streamfwdroottcptruefalse10.0.1.25-48846-false10.0.1.12-8000- 11241100x8000000000000000555213Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:51.215{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.91e0e5a690b1e9d42021-12-21 11:38:51.215root 11241100x8000000000000000555214Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:51.215{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1b6b7b47abc718ef2021-12-21 11:38:51.215root 11241100x8000000000000000555215Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:51.215{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.dcf96bf11365fe4a2021-12-21 11:38:51.215root 11241100x8000000000000000555216Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:51.216{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ec8db617e2569cfd2021-12-21 11:38:51.216root 11241100x8000000000000000555217Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:51.216{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a724a1a998d6b23e2021-12-21 11:38:51.216root 11241100x8000000000000000555218Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:51.216{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7ec9db14f77330502021-12-21 11:38:51.216root 11241100x8000000000000000555219Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:51.216{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.62c71c56c79749442021-12-21 11:38:51.216root 11241100x8000000000000000555220Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:51.216{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8df82e9a760125022021-12-21 11:38:51.216root 11241100x8000000000000000555221Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:51.216{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a9c48675a48a58412021-12-21 11:38:51.216root 11241100x8000000000000000555222Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:51.216{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1885c37fbb02cbf92021-12-21 11:38:51.216root 11241100x8000000000000000555223Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:51.216{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.39b39d7270b815142021-12-21 11:38:51.216root 11241100x8000000000000000555224Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:51.216{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.66696c078458a0b52021-12-21 11:38:51.216root 11241100x8000000000000000555225Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:51.216{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.58bf05058f063dfb2021-12-21 11:38:51.216root 11241100x8000000000000000555226Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:51.216{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c19806696331f1ee2021-12-21 11:38:51.216root 11241100x8000000000000000555227Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:51.216{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.96011930fc63d3052021-12-21 11:38:51.216root 11241100x8000000000000000555228Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:51.216{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.789f881388ae6d762021-12-21 11:38:51.216root 11241100x8000000000000000555229Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:51.216{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.414aeb93b12ed41c2021-12-21 11:38:51.216root 11241100x8000000000000000555230Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:51.216{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3e7efcf12882f1372021-12-21 11:38:51.216root 11241100x8000000000000000555231Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:51.217{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.729dc5c459869a582021-12-21 11:38:51.217root 11241100x8000000000000000555232Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:51.217{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.faaa382ea966fc5c2021-12-21 11:38:51.217root 11241100x8000000000000000555233Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:51.217{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e303e07ca0e3e6802021-12-21 11:38:51.217root 11241100x8000000000000000555234Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:51.217{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.24a11a41e19fe9f92021-12-21 11:38:51.217root 11241100x8000000000000000555235Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:51.217{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.cca54cb0b600ae022021-12-21 11:38:51.217root 11241100x8000000000000000555236Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:51.217{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.16313ec9109eaafe2021-12-21 11:38:51.217root 11241100x8000000000000000555237Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:51.217{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.69d2bfccd753c07f2021-12-21 11:38:51.217root 11241100x8000000000000000555238Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:51.218{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b755b9b8a3bcb2952021-12-21 11:38:51.218root 11241100x8000000000000000555239Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:51.218{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.62be67c0429717f32021-12-21 11:38:51.218root 11241100x8000000000000000555240Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:51.218{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.be106b356ac92c932021-12-21 11:38:51.218root 11241100x8000000000000000555241Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:51.218{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c133e52b369092392021-12-21 11:38:51.218root 11241100x8000000000000000555242Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:51.218{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9db99b57d2ab29ca2021-12-21 11:38:51.218root 11241100x8000000000000000555243Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:51.218{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8ad885f2cfb0dee52021-12-21 11:38:51.218root 11241100x8000000000000000555244Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:51.218{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e873d79133c1f57d2021-12-21 11:38:51.218root 11241100x8000000000000000555245Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:51.218{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.81548ddf505818262021-12-21 11:38:51.218root 11241100x8000000000000000555246Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:51.218{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f8bc8d803d2586aa2021-12-21 11:38:51.218root 11241100x8000000000000000555247Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:51.218{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.efb51e44899900912021-12-21 11:38:51.218root 11241100x8000000000000000555248Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:51.218{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.44005eb5ba62f6822021-12-21 11:38:51.218root 11241100x8000000000000000555249Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:51.218{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.54db2b238466c4172021-12-21 11:38:51.218root 11241100x8000000000000000555250Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:51.218{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e1e872aa5aa3213d2021-12-21 11:38:51.218root 11241100x8000000000000000555251Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:51.218{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7feca8b933f17efc2021-12-21 11:38:51.218root 11241100x8000000000000000555252Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:51.219{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.aa0ef8bdfe9d30e12021-12-21 11:38:51.219root 11241100x8000000000000000555253Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:51.219{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f5326a9c2f58986f2021-12-21 11:38:51.219root 11241100x8000000000000000555254Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:51.219{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.073e125d7a1844f62021-12-21 11:38:51.219root 11241100x8000000000000000555255Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:51.219{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1596e3110d5dc1f12021-12-21 11:38:51.219root 11241100x8000000000000000555256Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:51.219{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.51c76bf47b6aff502021-12-21 11:38:51.219root 11241100x8000000000000000555257Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:51.219{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1cff09b4fdd93e032021-12-21 11:38:51.219root 11241100x8000000000000000555258Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:51.219{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7cc4a86b430efffb2021-12-21 11:38:51.219root 11241100x8000000000000000555259Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:51.219{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e261b04e49748d6b2021-12-21 11:38:51.219root 11241100x8000000000000000555260Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:51.219{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0871d6ee5fae51e72021-12-21 11:38:51.219root 11241100x8000000000000000555261Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:51.219{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5268321b91ffdc062021-12-21 11:38:51.219root 11241100x8000000000000000555262Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:51.219{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3b629abbca8a5d4b2021-12-21 11:38:51.219root 11241100x8000000000000000555263Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:51.219{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9c283dc402946ca42021-12-21 11:38:51.219root 11241100x8000000000000000555264Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:51.219{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.31a9e09056c5f7682021-12-21 11:38:51.219root 11241100x8000000000000000555265Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:51.220{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5c5470f9a47756672021-12-21 11:38:51.220root 11241100x8000000000000000555266Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:51.220{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5b6e9006e5ee04c52021-12-21 11:38:51.220root 11241100x8000000000000000555267Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:51.220{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d417c8a127be0faa2021-12-21 11:38:51.220root 11241100x8000000000000000555268Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:51.220{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ed33fb70d32484f32021-12-21 11:38:51.220root 11241100x8000000000000000555269Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:51.220{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.69f83d3f5ba071df2021-12-21 11:38:51.220root 11241100x8000000000000000555270Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:51.220{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.67c207039d1b99f52021-12-21 11:38:51.220root 11241100x8000000000000000555271Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:51.220{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ad3502335f43078e2021-12-21 11:38:51.220root 11241100x8000000000000000555272Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:51.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.76e98f52e44d3d032021-12-21 11:38:51.693root 11241100x8000000000000000555273Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:51.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a02750927edeed352021-12-21 11:38:51.693root 11241100x8000000000000000555274Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:51.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d9b9c983d13f99e22021-12-21 11:38:51.693root 11241100x8000000000000000555275Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:51.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f5355fc6d61724852021-12-21 11:38:51.693root 11241100x8000000000000000555276Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:51.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.723c90e00cd7c5be2021-12-21 11:38:51.694root 11241100x8000000000000000555277Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:51.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.35e0d54bd67a74d42021-12-21 11:38:51.694root 11241100x8000000000000000555278Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:51.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.034ae3ce3351f9442021-12-21 11:38:51.694root 11241100x8000000000000000555279Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:51.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.81190ed547bc54232021-12-21 11:38:51.694root 11241100x8000000000000000555280Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:51.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.db80324e098d663b2021-12-21 11:38:51.694root 11241100x8000000000000000555281Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:51.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.cbebec23da176cb42021-12-21 11:38:51.694root 11241100x8000000000000000555282Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:51.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.cd78992eb94a5af62021-12-21 11:38:51.694root 11241100x8000000000000000555283Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:51.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8a61cfd06c76a7dc2021-12-21 11:38:51.694root 11241100x8000000000000000555284Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:51.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.92a0fa7931bf62af2021-12-21 11:38:51.694root 11241100x8000000000000000555285Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:51.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.cc71e213134ee4a42021-12-21 11:38:51.694root 11241100x8000000000000000555286Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:51.695{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.50626af880188eb32021-12-21 11:38:51.695root 11241100x8000000000000000555287Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:51.695{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1c1194966047523b2021-12-21 11:38:51.695root 11241100x8000000000000000555288Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:51.695{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3bac69a2e95b5a442021-12-21 11:38:51.695root 11241100x8000000000000000555289Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:51.695{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5a16f52de42db7b32021-12-21 11:38:51.695root 11241100x8000000000000000555290Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:51.695{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c20d09168eacf3da2021-12-21 11:38:51.695root 11241100x8000000000000000555291Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:51.695{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4264e67be42395b62021-12-21 11:38:51.695root 11241100x8000000000000000555292Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:51.695{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.11c3b07d91d2bd8d2021-12-21 11:38:51.695root 11241100x8000000000000000555293Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:51.695{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.765dd3d86f431c562021-12-21 11:38:51.695root 11241100x8000000000000000555294Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:51.695{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.210c343d2ed429e32021-12-21 11:38:51.695root 11241100x8000000000000000555295Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:51.695{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8fde7920b260df242021-12-21 11:38:51.695root 11241100x8000000000000000555296Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:51.695{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.cd5511e7070134202021-12-21 11:38:51.695root 11241100x8000000000000000555297Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:51.696{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7b6d0da25ed433c82021-12-21 11:38:51.696root 11241100x8000000000000000555298Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:51.696{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1a7f6cd04fc2ed592021-12-21 11:38:51.696root 11241100x8000000000000000555299Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:51.696{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.37ff8296aa56eedd2021-12-21 11:38:51.696root 11241100x8000000000000000555300Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:51.696{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.719d197ad0722daa2021-12-21 11:38:51.696root 11241100x8000000000000000555301Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:51.696{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.35244da824f6b8d12021-12-21 11:38:51.696root 11241100x8000000000000000555302Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:51.696{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.221779bb409fd3682021-12-21 11:38:51.696root 11241100x8000000000000000555303Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:51.696{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.71891f251972049b2021-12-21 11:38:51.696root 11241100x8000000000000000555304Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:51.696{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8ad9d847a370137b2021-12-21 11:38:51.696root 11241100x8000000000000000555305Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:51.696{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.40e3d739926b281f2021-12-21 11:38:51.696root 11241100x8000000000000000555306Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:51.696{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.987a54717882e4aa2021-12-21 11:38:51.696root 11241100x8000000000000000555307Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:51.697{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.248ac8b59d9d56992021-12-21 11:38:51.697root 11241100x8000000000000000555308Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:51.697{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9e1e7350ba36ef792021-12-21 11:38:51.697root 11241100x8000000000000000555309Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:51.697{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.25947fe5ccc9544c2021-12-21 11:38:51.697root 11241100x8000000000000000555310Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:51.697{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e88a9dad0111d2f92021-12-21 11:38:51.697root 11241100x8000000000000000555311Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:51.697{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ccaa6c34392ea6502021-12-21 11:38:51.697root 11241100x8000000000000000555312Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:51.697{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e9042c4cb61fd9372021-12-21 11:38:51.697root 11241100x8000000000000000555313Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:52.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1dce2cfe127bf9002021-12-21 11:38:52.193root 11241100x8000000000000000555314Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:52.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.68379422c41214f32021-12-21 11:38:52.193root 11241100x8000000000000000555315Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:52.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.681ad6c320dad7122021-12-21 11:38:52.193root 11241100x8000000000000000555316Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:52.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a14072c015f4cd4c2021-12-21 11:38:52.193root 11241100x8000000000000000555317Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:52.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ee761707f35c11af2021-12-21 11:38:52.193root 11241100x8000000000000000555318Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:52.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.916d1897c76968e32021-12-21 11:38:52.194root 11241100x8000000000000000555319Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:52.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.82d22f4435c9afb92021-12-21 11:38:52.194root 11241100x8000000000000000555320Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:52.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a5f32c47997067ca2021-12-21 11:38:52.194root 11241100x8000000000000000555321Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:52.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b18213d89dfe71262021-12-21 11:38:52.194root 11241100x8000000000000000555322Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:52.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.34c9c5a0ff59c2442021-12-21 11:38:52.194root 11241100x8000000000000000555323Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:52.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.39f67905bd9d36332021-12-21 11:38:52.194root 11241100x8000000000000000555324Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:52.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9bb3cd573c1656052021-12-21 11:38:52.194root 11241100x8000000000000000555325Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:52.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8498eecd726d34722021-12-21 11:38:52.194root 11241100x8000000000000000555326Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:52.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.22674dd1eae563522021-12-21 11:38:52.194root 11241100x8000000000000000555327Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:52.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.82ec20ab68e0e7332021-12-21 11:38:52.194root 11241100x8000000000000000555328Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:52.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.eec6ae81688a5ba42021-12-21 11:38:52.194root 11241100x8000000000000000555329Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:52.195{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.72e19b362bebe34b2021-12-21 11:38:52.195root 11241100x8000000000000000555330Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:52.195{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1933f2da391a19892021-12-21 11:38:52.195root 11241100x8000000000000000555331Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:52.195{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.42de3d99446c655e2021-12-21 11:38:52.195root 11241100x8000000000000000555332Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:52.195{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.57fef51ef4b9a0bd2021-12-21 11:38:52.195root 11241100x8000000000000000555333Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:52.195{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.976ffb33480521b62021-12-21 11:38:52.195root 11241100x8000000000000000555334Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:52.195{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.eebc1ac1c2c3c5852021-12-21 11:38:52.195root 11241100x8000000000000000555335Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:52.195{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.223c40c33aa266472021-12-21 11:38:52.195root 11241100x8000000000000000555336Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:52.195{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ec268be33361e22f2021-12-21 11:38:52.195root 11241100x8000000000000000555337Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:52.195{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8e4d5e1567115fb12021-12-21 11:38:52.195root 11241100x8000000000000000555338Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:52.195{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c3c696de811b4feb2021-12-21 11:38:52.195root 11241100x8000000000000000555339Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:52.196{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.66432f9318c05f332021-12-21 11:38:52.196root 11241100x8000000000000000555340Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:52.196{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.87f896b2cfaff83a2021-12-21 11:38:52.196root 11241100x8000000000000000555341Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:52.196{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7580a16e4594f89a2021-12-21 11:38:52.196root 11241100x8000000000000000555342Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:52.196{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.48146d396546c2f82021-12-21 11:38:52.196root 11241100x8000000000000000555343Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:52.196{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3962f7656f605e072021-12-21 11:38:52.196root 11241100x8000000000000000555344Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:52.197{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ea75cf39c742b3a22021-12-21 11:38:52.197root 11241100x8000000000000000555345Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:52.197{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9af3f9ed6772ae822021-12-21 11:38:52.197root 11241100x8000000000000000555346Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:52.197{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9ac460bc198e9f982021-12-21 11:38:52.197root 11241100x8000000000000000555347Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:52.197{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.73f0f5d3913e92672021-12-21 11:38:52.197root 11241100x8000000000000000555348Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:52.197{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5fef6e007fe935e72021-12-21 11:38:52.197root 11241100x8000000000000000555349Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:52.197{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ce6f9621727b32ba2021-12-21 11:38:52.197root 11241100x8000000000000000555350Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:52.197{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.93907848977eaa0e2021-12-21 11:38:52.197root 11241100x8000000000000000555351Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:52.197{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ec0de88626654a7b2021-12-21 11:38:52.197root 11241100x8000000000000000555352Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:52.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4d356791ca66d16b2021-12-21 11:38:52.693root 11241100x8000000000000000555353Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:52.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.188e0d1f81225c622021-12-21 11:38:52.693root 11241100x8000000000000000555354Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:52.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.424e1d0a72bfc4ef2021-12-21 11:38:52.693root 11241100x8000000000000000555355Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:52.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a2aaa50f5e0616142021-12-21 11:38:52.693root 11241100x8000000000000000555356Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:52.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.08c96d2ffb3e39dd2021-12-21 11:38:52.694root 11241100x8000000000000000555357Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:52.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.954208f59e8481212021-12-21 11:38:52.694root 11241100x8000000000000000555358Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:52.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5e062fb435d481bc2021-12-21 11:38:52.694root 11241100x8000000000000000555359Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:52.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ba685fa803c8fd802021-12-21 11:38:52.694root 11241100x8000000000000000555360Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:52.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.dc2956410a22827a2021-12-21 11:38:52.694root 11241100x8000000000000000555361Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:52.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8c56caf7e39bb5902021-12-21 11:38:52.694root 11241100x8000000000000000555362Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:52.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b1b7b0682909e2522021-12-21 11:38:52.694root 11241100x8000000000000000555363Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:52.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.cd12695335b45e5a2021-12-21 11:38:52.694root 11241100x8000000000000000555364Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:52.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d79bddd2f63322b22021-12-21 11:38:52.694root 11241100x8000000000000000555365Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:52.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2da78a93410c21572021-12-21 11:38:52.694root 11241100x8000000000000000555366Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:52.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3be032cba53345ed2021-12-21 11:38:52.694root 11241100x8000000000000000555367Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:52.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7a24533a7abc084b2021-12-21 11:38:52.694root 11241100x8000000000000000555368Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:52.695{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5521beaa981b99bc2021-12-21 11:38:52.695root 11241100x8000000000000000555369Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:52.695{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6f5ff84c7e9ad1aa2021-12-21 11:38:52.695root 11241100x8000000000000000555370Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:52.695{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6930e2560225bbbf2021-12-21 11:38:52.695root 11241100x8000000000000000555371Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:52.695{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.bdca10fa98f90ed82021-12-21 11:38:52.695root 11241100x8000000000000000555372Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:52.695{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8d7499484ffe940f2021-12-21 11:38:52.695root 11241100x8000000000000000555373Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:52.695{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0cfb75b57f08ac0e2021-12-21 11:38:52.695root 11241100x8000000000000000555374Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:52.695{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.65ae13cd566321d82021-12-21 11:38:52.695root 11241100x8000000000000000555375Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:52.695{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7327fb770976171e2021-12-21 11:38:52.695root 11241100x8000000000000000555376Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:52.695{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5c67cfb6e40932262021-12-21 11:38:52.695root 11241100x8000000000000000555377Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:52.696{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9e1883b8ea3886f22021-12-21 11:38:52.696root 11241100x8000000000000000555378Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:52.696{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0010528cc3cdc61c2021-12-21 11:38:52.696root 11241100x8000000000000000555379Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:52.696{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.357aae3ed5f27ca52021-12-21 11:38:52.696root 11241100x8000000000000000555380Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:52.696{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.90ca269efe5c917b2021-12-21 11:38:52.696root 11241100x8000000000000000555381Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:52.696{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f38f4cf4d3138ee72021-12-21 11:38:52.696root 11241100x8000000000000000555382Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:52.696{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.80306afbe51e3fa62021-12-21 11:38:52.696root 11241100x8000000000000000555383Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:52.696{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7e67cb625e1a39a22021-12-21 11:38:52.696root 11241100x8000000000000000555384Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:52.696{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.cc3fb7817720ea7b2021-12-21 11:38:52.696root 11241100x8000000000000000555385Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:52.696{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0a70baede38d122c2021-12-21 11:38:52.696root 11241100x8000000000000000555386Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:52.696{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.44c2d789754823aa2021-12-21 11:38:52.696root 11241100x8000000000000000555387Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:52.696{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7f4ea328bb366f9f2021-12-21 11:38:52.696root 11241100x8000000000000000555388Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:52.696{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1dcce5b56d043fd32021-12-21 11:38:52.696root 11241100x8000000000000000555389Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:52.697{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6064bf24c946c2dd2021-12-21 11:38:52.697root 11241100x8000000000000000555390Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:52.697{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c56bc2a00a6b1f722021-12-21 11:38:52.697root 11241100x8000000000000000555391Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:52.697{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ab5e912e3c6880642021-12-21 11:38:52.697root 11241100x8000000000000000555392Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:52.697{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.18b06fd09be05f9f2021-12-21 11:38:52.697root 11241100x8000000000000000555393Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:52.697{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0be81fc0e4e638be2021-12-21 11:38:52.697root 11241100x8000000000000000555394Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:52.697{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9a59f3f17daa102d2021-12-21 11:38:52.697root 11241100x8000000000000000555395Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:52.697{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f6220de955d119cb2021-12-21 11:38:52.697root 11241100x8000000000000000555396Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:52.697{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.dcc2570f7bfd6f4f2021-12-21 11:38:52.697root 11241100x8000000000000000555397Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:52.697{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.92f2ee3c9c06940c2021-12-21 11:38:52.697root 11241100x8000000000000000555398Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:52.697{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ae82965154678e0c2021-12-21 11:38:52.697root 11241100x8000000000000000555399Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:52.698{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.56d90ade2c2680c52021-12-21 11:38:52.698root 11241100x8000000000000000555400Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:52.698{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5f075de8443c06022021-12-21 11:38:52.698root 11241100x8000000000000000555401Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:52.698{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5dbd28c7669a34982021-12-21 11:38:52.698root 11241100x8000000000000000555402Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:52.698{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b7f10ba1394096fd2021-12-21 11:38:52.698root 11241100x8000000000000000555403Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:52.698{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.12a6b3b526d5bfce2021-12-21 11:38:52.698root 11241100x8000000000000000555404Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:52.698{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.975944c0e49f509b2021-12-21 11:38:52.698root 11241100x8000000000000000555405Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:53.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ce3a99909659236f2021-12-21 11:38:53.193root 11241100x8000000000000000555406Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:53.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.61aaa28f79d972352021-12-21 11:38:53.193root 11241100x8000000000000000555407Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:53.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.47b730e8451125742021-12-21 11:38:53.193root 11241100x8000000000000000555408Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:53.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.441fba7df5dbb5e22021-12-21 11:38:53.194root 11241100x8000000000000000555409Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:53.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9f619fceb959f76d2021-12-21 11:38:53.194root 11241100x8000000000000000555410Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:53.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a05523d3be2e33d72021-12-21 11:38:53.194root 11241100x8000000000000000555411Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:53.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2ae376c7b469ed0a2021-12-21 11:38:53.194root 11241100x8000000000000000555412Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:53.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2f737d7cc904f5192021-12-21 11:38:53.194root 11241100x8000000000000000555413Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:53.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.bb17be6db3a9de6c2021-12-21 11:38:53.194root 11241100x8000000000000000555414Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:53.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b566ed2999c2eebc2021-12-21 11:38:53.194root 11241100x8000000000000000555415Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:53.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a6f8c1dde0a44b992021-12-21 11:38:53.194root 11241100x8000000000000000555416Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:53.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.905b833ae619a7552021-12-21 11:38:53.194root 11241100x8000000000000000555417Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:53.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9a9330be4493e4292021-12-21 11:38:53.194root 11241100x8000000000000000555418Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:53.195{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.80839b99c4401e3a2021-12-21 11:38:53.195root 11241100x8000000000000000555419Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:53.195{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b4c0fe35d658db602021-12-21 11:38:53.195root 11241100x8000000000000000555420Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:53.195{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.001b00791d11e37a2021-12-21 11:38:53.195root 11241100x8000000000000000555421Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:53.195{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e7ba728f5b6aa0492021-12-21 11:38:53.195root 11241100x8000000000000000555422Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:53.195{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c4057d351cb80f552021-12-21 11:38:53.195root 11241100x8000000000000000555423Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:53.196{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.553c893e251951152021-12-21 11:38:53.196root 11241100x8000000000000000555424Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:53.196{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.fec7c956edd437702021-12-21 11:38:53.196root 11241100x8000000000000000555425Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:53.196{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2c006ec4d41634a72021-12-21 11:38:53.196root 11241100x8000000000000000555426Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:53.196{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.40592a2d4b147bc02021-12-21 11:38:53.196root 11241100x8000000000000000555427Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:53.196{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.561b06ea87c996fa2021-12-21 11:38:53.196root 11241100x8000000000000000555428Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:53.196{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.20aa344c193b5fdc2021-12-21 11:38:53.196root 11241100x8000000000000000555429Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:53.196{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.45308db6a579387e2021-12-21 11:38:53.196root 11241100x8000000000000000555430Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:53.196{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6fa54513e28b289f2021-12-21 11:38:53.196root 11241100x8000000000000000555431Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:53.197{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c1aaa1d6043fdc1c2021-12-21 11:38:53.197root 11241100x8000000000000000555432Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:53.197{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0ea618f4adeb5eec2021-12-21 11:38:53.197root 11241100x8000000000000000555433Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:53.197{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8d20ff5f6fb9d4332021-12-21 11:38:53.197root 11241100x8000000000000000555434Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:53.197{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.15a4c9542588cf2c2021-12-21 11:38:53.197root 11241100x8000000000000000555435Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:53.198{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1878475eb592b41c2021-12-21 11:38:53.198root 11241100x8000000000000000555436Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:53.198{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.57928b5f8f8e25e22021-12-21 11:38:53.198root 11241100x8000000000000000555437Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:53.198{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.88ee236fc09a4c0a2021-12-21 11:38:53.198root 11241100x8000000000000000555438Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:53.198{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.991db6e165ffb14d2021-12-21 11:38:53.198root 11241100x8000000000000000555439Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:53.198{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3918281b68cc21842021-12-21 11:38:53.198root 11241100x8000000000000000555440Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:53.198{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.33270000a73bd7d72021-12-21 11:38:53.198root 11241100x8000000000000000555441Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:53.198{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1f7c1626127fc18b2021-12-21 11:38:53.198root 11241100x8000000000000000555442Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:53.198{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.87e7f0b8c115c5752021-12-21 11:38:53.198root 11241100x8000000000000000555443Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:53.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.054dcc35fd08d6e62021-12-21 11:38:53.693root 11241100x8000000000000000555444Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:53.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f18f161b90e7c5d82021-12-21 11:38:53.693root 11241100x8000000000000000555445Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:53.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d4e1696c3baef4d12021-12-21 11:38:53.693root 11241100x8000000000000000555446Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:53.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.28ef9516b7b17cfc2021-12-21 11:38:53.693root 11241100x8000000000000000555447Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:53.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4fda786cc48d94e02021-12-21 11:38:53.693root 11241100x8000000000000000555448Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:53.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.77a057ef7fa488832021-12-21 11:38:53.694root 11241100x8000000000000000555449Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:53.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f9c0fd0dc4615e642021-12-21 11:38:53.694root 11241100x8000000000000000555450Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:53.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ff24243468b647692021-12-21 11:38:53.694root 11241100x8000000000000000555451Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:53.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f1f2071d0096fd1f2021-12-21 11:38:53.694root 11241100x8000000000000000555452Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:53.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5e15617a6b601b892021-12-21 11:38:53.694root 11241100x8000000000000000555453Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:53.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4746afc9a865ac2e2021-12-21 11:38:53.694root 11241100x8000000000000000555454Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:53.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ed743a2e447a3a332021-12-21 11:38:53.694root 11241100x8000000000000000555455Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:53.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d87bdbeef60fcf9a2021-12-21 11:38:53.694root 11241100x8000000000000000555456Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:53.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d1f2b34245e30ee12021-12-21 11:38:53.694root 11241100x8000000000000000555457Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:53.695{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7d9c6936823426622021-12-21 11:38:53.695root 11241100x8000000000000000555458Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:53.695{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0e3783df43a42d7b2021-12-21 11:38:53.695root 11241100x8000000000000000555459Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:53.695{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.490c14ff88eaac7d2021-12-21 11:38:53.695root 11241100x8000000000000000555460Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:53.695{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a3438a1e4efc07e72021-12-21 11:38:53.695root 11241100x8000000000000000555461Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:53.695{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2f5f2e293f6baa5d2021-12-21 11:38:53.695root 11241100x8000000000000000555462Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:53.695{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.18df36b3e236e4552021-12-21 11:38:53.695root 11241100x8000000000000000555463Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:53.695{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7f1b05f7382b98fd2021-12-21 11:38:53.695root 11241100x8000000000000000555464Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:53.695{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.cde170cfd2d0eb8c2021-12-21 11:38:53.695root 11241100x8000000000000000555465Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:53.695{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.84cce74e6c4f9b2c2021-12-21 11:38:53.695root 11241100x8000000000000000555466Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:53.695{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3422b83cce4601cf2021-12-21 11:38:53.695root 11241100x8000000000000000555467Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:53.696{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2aaff069e18e5c0b2021-12-21 11:38:53.696root 11241100x8000000000000000555468Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:53.696{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e7248e966aecf0412021-12-21 11:38:53.696root 11241100x8000000000000000555469Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:53.696{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e945e66823bed2eb2021-12-21 11:38:53.696root 11241100x8000000000000000555470Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:53.696{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.266feff93594e6102021-12-21 11:38:53.696root 11241100x8000000000000000555471Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:53.696{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.15bf148398ca683f2021-12-21 11:38:53.696root 11241100x8000000000000000555472Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:53.696{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4d7bc0e98c2519612021-12-21 11:38:53.696root 11241100x8000000000000000555473Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:53.697{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.721158887e27bcb42021-12-21 11:38:53.697root 11241100x8000000000000000555474Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:53.697{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f6058fd5b5240dc82021-12-21 11:38:53.697root 11241100x8000000000000000555475Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:53.697{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e87c0f94f115072a2021-12-21 11:38:53.697root 11241100x8000000000000000555476Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:53.697{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4e36e62745fb927c2021-12-21 11:38:53.697root 11241100x8000000000000000555477Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:53.697{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.833c298b1fcde6e82021-12-21 11:38:53.697root 11241100x8000000000000000555478Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:53.697{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d6bac5945241e0632021-12-21 11:38:53.697root 11241100x8000000000000000555479Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:53.697{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f59c050f322dc1522021-12-21 11:38:53.697root 11241100x8000000000000000555480Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:53.697{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.eb1876b4aaacd6112021-12-21 11:38:53.697root 11241100x8000000000000000555481Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:53.698{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f9c6c95d9482fecf2021-12-21 11:38:53.698root 11241100x8000000000000000555482Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:53.698{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.366f6efeaf508c9a2021-12-21 11:38:53.698root 11241100x8000000000000000555483Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:54.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.29f6954cac7eb1822021-12-21 11:38:54.193root 11241100x8000000000000000555484Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:54.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5938f89c5ca7474a2021-12-21 11:38:54.194root 11241100x8000000000000000555485Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:54.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.cffcad8b84ca2a882021-12-21 11:38:54.194root 11241100x8000000000000000555486Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:54.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8a47da8a0331f68d2021-12-21 11:38:54.194root 11241100x8000000000000000555487Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:54.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b998279c2f8a97442021-12-21 11:38:54.194root 11241100x8000000000000000555488Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:54.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b7c62abc07d14c442021-12-21 11:38:54.194root 11241100x8000000000000000555489Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:54.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8854ec2febdd5c372021-12-21 11:38:54.194root 11241100x8000000000000000555490Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:54.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.60cb3b2ba004839b2021-12-21 11:38:54.194root 11241100x8000000000000000555491Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:54.195{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4036dd9f01f6d8152021-12-21 11:38:54.195root 11241100x8000000000000000555492Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:54.195{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c49c01371945cec62021-12-21 11:38:54.195root 11241100x8000000000000000555493Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:54.195{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3d66d54c6ded8cd32021-12-21 11:38:54.195root 11241100x8000000000000000555494Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:54.195{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.51876af5995fb1dc2021-12-21 11:38:54.195root 11241100x8000000000000000555495Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:54.195{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6d5f9872fe54fc3b2021-12-21 11:38:54.195root 11241100x8000000000000000555496Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:54.195{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4a011ce6d759590e2021-12-21 11:38:54.195root 11241100x8000000000000000555497Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:54.195{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8f2c1359b1535e692021-12-21 11:38:54.195root 11241100x8000000000000000555498Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:54.195{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f0368eff9a0a72ef2021-12-21 11:38:54.195root 11241100x8000000000000000555499Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:54.196{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ac3c52289d5e91ba2021-12-21 11:38:54.196root 11241100x8000000000000000555500Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:54.197{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6b16b3abb7d2f9ae2021-12-21 11:38:54.197root 11241100x8000000000000000555501Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:54.197{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c1047d62ea9086b22021-12-21 11:38:54.197root 11241100x8000000000000000555502Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:54.198{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.24fc73963bb7581d2021-12-21 11:38:54.198root 11241100x8000000000000000555503Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:54.198{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f9b4391d71bda96a2021-12-21 11:38:54.198root 11241100x8000000000000000555504Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:54.200{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9600bb7854759ba52021-12-21 11:38:54.200root 11241100x8000000000000000555505Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:54.200{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.95056c595a0c249f2021-12-21 11:38:54.200root 11241100x8000000000000000555506Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:54.200{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7c2d086ecffec0202021-12-21 11:38:54.200root 11241100x8000000000000000555507Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:54.200{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e3d4333d63a587752021-12-21 11:38:54.200root 11241100x8000000000000000555508Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:54.200{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.295a1be9ec25770a2021-12-21 11:38:54.200root 11241100x8000000000000000555509Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:54.200{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.836ede110d306d8f2021-12-21 11:38:54.200root 11241100x8000000000000000555510Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:54.200{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5b19a163bc63d6022021-12-21 11:38:54.200root 11241100x8000000000000000555511Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:54.200{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9de4c2c59cf856e02021-12-21 11:38:54.200root 11241100x8000000000000000555512Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:54.200{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e1b8ec2bc2a5559c2021-12-21 11:38:54.200root 11241100x8000000000000000555513Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:54.200{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.adb3a2b13475ac372021-12-21 11:38:54.200root 11241100x8000000000000000555514Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:54.200{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.282e815131cb33592021-12-21 11:38:54.200root 11241100x8000000000000000555515Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:54.200{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ccabc6e18d62b5c82021-12-21 11:38:54.200root 11241100x8000000000000000555516Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:54.200{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2cb9d00e2783b9382021-12-21 11:38:54.200root 11241100x8000000000000000555517Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:54.201{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d0799af95db4b7e12021-12-21 11:38:54.201root 11241100x8000000000000000555518Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:54.201{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0c1e00fb60365cb32021-12-21 11:38:54.201root 11241100x8000000000000000555519Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:54.201{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.446d4b3023e875242021-12-21 11:38:54.201root 11241100x8000000000000000555520Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:54.202{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2d9302a51a633b992021-12-21 11:38:54.202root 11241100x8000000000000000555521Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:54.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c62718a3cc75198b2021-12-21 11:38:54.693root 11241100x8000000000000000555522Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:54.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.94253eb761cacfdf2021-12-21 11:38:54.693root 11241100x8000000000000000555523Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:54.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f8fa2e9b43e8fd152021-12-21 11:38:54.693root 11241100x8000000000000000555524Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:54.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.779780f9fb93a5132021-12-21 11:38:54.693root 11241100x8000000000000000555525Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:54.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.06f481b5f82cd44c2021-12-21 11:38:54.693root 11241100x8000000000000000555526Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:54.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.cb36b9dc71a68e0b2021-12-21 11:38:54.693root 11241100x8000000000000000555527Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:54.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.44fe4b56e5ee3c2d2021-12-21 11:38:54.694root 11241100x8000000000000000555528Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:54.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.bca630126ce922812021-12-21 11:38:54.694root 11241100x8000000000000000555529Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:54.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f64c9f1eb9fa48312021-12-21 11:38:54.694root 11241100x8000000000000000555530Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:54.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ec1da4631933319c2021-12-21 11:38:54.694root 11241100x8000000000000000555531Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:54.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.bef146a4638a34332021-12-21 11:38:54.694root 11241100x8000000000000000555532Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:54.695{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d36bf60a47a8cfac2021-12-21 11:38:54.695root 11241100x8000000000000000555533Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:54.695{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2df8e20e2a2191452021-12-21 11:38:54.695root 11241100x8000000000000000555534Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:54.695{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ef8336626e88522d2021-12-21 11:38:54.695root 11241100x8000000000000000555535Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:54.695{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e9e8583ec5ad27cf2021-12-21 11:38:54.695root 11241100x8000000000000000555536Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:54.695{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ac379467e2e948362021-12-21 11:38:54.695root 11241100x8000000000000000555537Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:54.695{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c144eb774bdf0c162021-12-21 11:38:54.695root 11241100x8000000000000000555538Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:54.696{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ef00333694dde7bd2021-12-21 11:38:54.696root 11241100x8000000000000000555539Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:54.696{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c8f89344800711972021-12-21 11:38:54.696root 11241100x8000000000000000555540Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:54.696{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d85def5131c27b312021-12-21 11:38:54.696root 11241100x8000000000000000555541Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:54.696{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d1540253b0516e972021-12-21 11:38:54.696root 11241100x8000000000000000555542Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:54.696{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8ddc947b0b7b43f62021-12-21 11:38:54.696root 11241100x8000000000000000555543Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:54.696{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ede454629cb69d7e2021-12-21 11:38:54.696root 11241100x8000000000000000555544Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:54.696{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f4363af568c7c46a2021-12-21 11:38:54.696root 11241100x8000000000000000555545Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:54.696{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.42392808dc1388a12021-12-21 11:38:54.696root 11241100x8000000000000000555546Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:54.696{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f1d3dd1954565dac2021-12-21 11:38:54.696root 11241100x8000000000000000555547Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:54.697{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.86d280578bca73b82021-12-21 11:38:54.697root 11241100x8000000000000000555548Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:54.697{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5abfffb774e2852d2021-12-21 11:38:54.697root 11241100x8000000000000000555549Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:54.697{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a90ada3f688d39ff2021-12-21 11:38:54.697root 11241100x8000000000000000555550Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:54.697{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9aaf36ccf0b43b9b2021-12-21 11:38:54.697root 11241100x8000000000000000555551Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:54.697{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.588a3e0beb00f9b62021-12-21 11:38:54.697root 11241100x8000000000000000555552Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:54.697{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8c60e04aacb933f32021-12-21 11:38:54.697root 11241100x8000000000000000555553Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:54.698{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.62022f6a255f0f6a2021-12-21 11:38:54.698root 11241100x8000000000000000555554Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:54.698{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a095dde4322e7cec2021-12-21 11:38:54.698root 11241100x8000000000000000555555Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:54.698{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.bdef09d7c9dab0b42021-12-21 11:38:54.698root 11241100x8000000000000000555556Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:54.698{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6b57c11ce1b423f42021-12-21 11:38:54.698root 11241100x8000000000000000555557Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:54.698{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e7b582d2444efe132021-12-21 11:38:54.698root 11241100x8000000000000000555558Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:54.698{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b255469ae2564db62021-12-21 11:38:54.698root 11241100x8000000000000000555559Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:54.698{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.dd02088d561686a42021-12-21 11:38:54.698root 11241100x8000000000000000555560Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:54.699{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.12dc097bbf717c752021-12-21 11:38:54.699root 11241100x8000000000000000555561Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:54.699{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.947a30f8376823ef2021-12-21 11:38:54.699root 11241100x8000000000000000555562Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:55.192{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f9535547a5a2a9e12021-12-21 11:38:55.192root 11241100x8000000000000000555563Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:55.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0c7cd2b3a916b1292021-12-21 11:38:55.193root 11241100x8000000000000000555564Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:55.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1c4e6082b8bca7d72021-12-21 11:38:55.193root 11241100x8000000000000000555565Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:55.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.324a8d670823228c2021-12-21 11:38:55.193root 11241100x8000000000000000555566Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:55.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.79d128bf74e41d0f2021-12-21 11:38:55.193root 11241100x8000000000000000555567Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:55.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7ee3d5d3fb2ba6e62021-12-21 11:38:55.193root 11241100x8000000000000000555568Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:55.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.60d41530e41f82ff2021-12-21 11:38:55.193root 11241100x8000000000000000555569Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:55.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.26501c5d311b4fc32021-12-21 11:38:55.193root 11241100x8000000000000000555570Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:55.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3a979e63a6b471822021-12-21 11:38:55.193root 11241100x8000000000000000555571Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:55.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e9a1fb7366bc66b12021-12-21 11:38:55.193root 11241100x8000000000000000555572Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:55.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ab144e29c2235d002021-12-21 11:38:55.193root 11241100x8000000000000000555573Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:55.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2a5e7a78bd049d382021-12-21 11:38:55.193root 11241100x8000000000000000555574Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:55.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.94bd116f7f0cc6b52021-12-21 11:38:55.193root 11241100x8000000000000000555575Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:55.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6a16a4af48c2d5e02021-12-21 11:38:55.193root 11241100x8000000000000000555576Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:55.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.002efb805df099a52021-12-21 11:38:55.193root 11241100x8000000000000000555577Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:55.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.53d2742dbcdb51602021-12-21 11:38:55.194root 11241100x8000000000000000555578Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:55.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5793ae1990a78bd82021-12-21 11:38:55.194root 11241100x8000000000000000555579Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:55.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d083b343b5c581782021-12-21 11:38:55.194root 11241100x8000000000000000555580Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:55.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9b1076aacb2e7d4a2021-12-21 11:38:55.194root 11241100x8000000000000000555581Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:55.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e5c7c08e46bb97e42021-12-21 11:38:55.194root 11241100x8000000000000000555582Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:55.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.56e94a88c6e63aff2021-12-21 11:38:55.194root 11241100x8000000000000000555583Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:55.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b74c1a702d853b7e2021-12-21 11:38:55.194root 11241100x8000000000000000555584Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:55.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a31ff80f6201aa482021-12-21 11:38:55.194root 11241100x8000000000000000555585Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:55.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3476fb944e463d4b2021-12-21 11:38:55.194root 11241100x8000000000000000555586Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:55.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.fbc65253efc9f9ee2021-12-21 11:38:55.194root 11241100x8000000000000000555587Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:55.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.236050681796a9862021-12-21 11:38:55.194root 11241100x8000000000000000555588Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:55.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5f95dcc6f5c1a34d2021-12-21 11:38:55.194root 11241100x8000000000000000555589Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:55.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d909cbd34b81184f2021-12-21 11:38:55.194root 11241100x8000000000000000555590Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:55.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9e26e0dd016e38612021-12-21 11:38:55.194root 11241100x8000000000000000555591Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:55.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.005520e6a261f6cf2021-12-21 11:38:55.194root 11241100x8000000000000000555592Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:55.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.77f956368af9b84a2021-12-21 11:38:55.194root 11241100x8000000000000000555593Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:55.195{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f7d0de964a8fe08d2021-12-21 11:38:55.195root 11241100x8000000000000000555594Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:55.195{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b33ee525b6d8875e2021-12-21 11:38:55.195root 11241100x8000000000000000555595Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:55.195{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.dfffbe94f5c1c3632021-12-21 11:38:55.195root 11241100x8000000000000000555596Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:55.195{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ea2305bad89d57cf2021-12-21 11:38:55.195root 11241100x8000000000000000555597Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:55.195{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3aed36b14b59433b2021-12-21 11:38:55.195root 11241100x8000000000000000555598Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:55.195{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.afdba05faf98900c2021-12-21 11:38:55.195root 11241100x8000000000000000555599Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:55.195{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.05785a846bb7d6952021-12-21 11:38:55.195root 11241100x8000000000000000555600Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:55.195{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b5d58e939768ad7c2021-12-21 11:38:55.195root 11241100x8000000000000000555601Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:55.195{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d17a42821fe4f1aa2021-12-21 11:38:55.195root 11241100x8000000000000000555602Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:55.195{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b8725025ea459e842021-12-21 11:38:55.195root 11241100x8000000000000000555603Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:55.195{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4da0010fa339518e2021-12-21 11:38:55.195root 11241100x8000000000000000555604Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:55.195{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.81e4f7726ced9d882021-12-21 11:38:55.195root 11241100x8000000000000000555605Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:55.195{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f28dd2feb4fe03312021-12-21 11:38:55.195root 11241100x8000000000000000555606Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:55.196{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.cc63ddff53d430c62021-12-21 11:38:55.196root 11241100x8000000000000000555607Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:55.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0785ab82ab82f4272021-12-21 11:38:55.693root 11241100x8000000000000000555608Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:55.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0dc45774c49ddff12021-12-21 11:38:55.693root 11241100x8000000000000000555609Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:55.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1961585f1e73928e2021-12-21 11:38:55.693root 11241100x8000000000000000555610Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:55.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ff904f21aec2dc202021-12-21 11:38:55.693root 11241100x8000000000000000555611Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:55.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.12f0a8db0fdc454a2021-12-21 11:38:55.693root 11241100x8000000000000000555612Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:55.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2a6545d942c458b12021-12-21 11:38:55.693root 11241100x8000000000000000555613Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:55.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d5fa4bd88ac0784e2021-12-21 11:38:55.693root 11241100x8000000000000000555614Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:55.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4b3a58fe48d8fa472021-12-21 11:38:55.693root 11241100x8000000000000000555615Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:55.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b2d0d3278e4fcea22021-12-21 11:38:55.694root 11241100x8000000000000000555616Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:55.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0bcd5666a817fcd12021-12-21 11:38:55.694root 11241100x8000000000000000555617Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:55.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9aba363941cb76e32021-12-21 11:38:55.694root 11241100x8000000000000000555618Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:55.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e4bb64c55d2a34ca2021-12-21 11:38:55.694root 11241100x8000000000000000555619Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:55.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.69df3d0557416f602021-12-21 11:38:55.694root 11241100x8000000000000000555620Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:55.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.13f8d740ad3d4c6d2021-12-21 11:38:55.694root 11241100x8000000000000000555621Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:55.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4cada1c4d2fe66a32021-12-21 11:38:55.694root 11241100x8000000000000000555622Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:55.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.25ee7cb4013dc3482021-12-21 11:38:55.694root 11241100x8000000000000000555623Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:55.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.412d871136a34d482021-12-21 11:38:55.694root 11241100x8000000000000000555624Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:55.695{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.cb835e061097b25d2021-12-21 11:38:55.695root 11241100x8000000000000000555625Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:55.695{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f8db0d4dbbfa574e2021-12-21 11:38:55.695root 11241100x8000000000000000555626Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:55.695{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9d6dc5323eb0a8022021-12-21 11:38:55.695root 11241100x8000000000000000555627Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:55.695{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5633d806d18950002021-12-21 11:38:55.695root 11241100x8000000000000000555628Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:55.695{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2bdd4fc20b0a65972021-12-21 11:38:55.695root 11241100x8000000000000000555629Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:55.695{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.60119e87d7bab9992021-12-21 11:38:55.695root 11241100x8000000000000000555630Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:55.695{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2d8a676bc388be3a2021-12-21 11:38:55.695root 11241100x8000000000000000555631Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:55.695{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1bb9a2997607d93f2021-12-21 11:38:55.695root 11241100x8000000000000000555632Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:55.695{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.550c7a933ab1170f2021-12-21 11:38:55.695root 11241100x8000000000000000555633Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:55.695{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a66730747bd6552e2021-12-21 11:38:55.695root 11241100x8000000000000000555634Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:55.695{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b21d8fd6e4a6bdc12021-12-21 11:38:55.695root 11241100x8000000000000000555635Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:55.696{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.213e83b482ac285e2021-12-21 11:38:55.696root 11241100x8000000000000000555636Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:55.696{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.834e617256d534342021-12-21 11:38:55.696root 11241100x8000000000000000555637Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:55.696{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.998d70148ff37a172021-12-21 11:38:55.696root 11241100x8000000000000000555638Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:55.696{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0f0969a1571329392021-12-21 11:38:55.696root 11241100x8000000000000000555639Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:55.696{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2916d59d47d506fa2021-12-21 11:38:55.696root 11241100x8000000000000000555640Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:55.696{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.754da08e9b199f9b2021-12-21 11:38:55.696root 11241100x8000000000000000555641Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:55.696{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0d33967872fcb82b2021-12-21 11:38:55.696root 11241100x8000000000000000555642Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:55.696{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5020fcbf7e6b8c9f2021-12-21 11:38:55.696root 11241100x8000000000000000555643Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:55.696{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d3de4ce7aea94bb32021-12-21 11:38:55.696root 11241100x8000000000000000555644Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:55.696{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d926a9a6c7fbbb192021-12-21 11:38:55.696root 11241100x8000000000000000555645Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:55.696{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.64707d9341b484772021-12-21 11:38:55.696root 11241100x8000000000000000555646Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:55.696{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ec220bf754f8339c2021-12-21 11:38:55.696root 11241100x8000000000000000555647Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:55.697{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3215b7829ce112ec2021-12-21 11:38:55.697root 11241100x8000000000000000555648Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:55.697{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.30b74a53d1e90c9e2021-12-21 11:38:55.697root 11241100x8000000000000000555649Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:55.697{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7007abee5a8e12e92021-12-21 11:38:55.697root 11241100x8000000000000000555650Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:55.697{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b29112142b8de82e2021-12-21 11:38:55.697root 11241100x8000000000000000555651Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:55.697{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.fc2ef585d1e337462021-12-21 11:38:55.697root 11241100x8000000000000000555652Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:55.697{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.774c7f3aadac6eaa2021-12-21 11:38:55.697root 11241100x8000000000000000555653Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:56.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4a00dc0fdb3949a42021-12-21 11:38:56.193root 11241100x8000000000000000555654Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:56.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f10d3748811afabc2021-12-21 11:38:56.193root 11241100x8000000000000000555655Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:56.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.41e66c20463c04192021-12-21 11:38:56.193root 11241100x8000000000000000555656Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:56.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.cc08edc8a49043c42021-12-21 11:38:56.193root 11241100x8000000000000000555657Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:56.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.406e53e7ee3ca90c2021-12-21 11:38:56.193root 11241100x8000000000000000555658Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:56.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2bc6228df030a21e2021-12-21 11:38:56.193root 11241100x8000000000000000555659Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:56.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.53df9851e7a0d4212021-12-21 11:38:56.193root 11241100x8000000000000000555660Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:56.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.78aab05c80c2723d2021-12-21 11:38:56.194root 11241100x8000000000000000555661Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:56.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b5a45b0c78370dad2021-12-21 11:38:56.194root 11241100x8000000000000000555662Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:56.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e08f9bcafdcbd9082021-12-21 11:38:56.194root 11241100x8000000000000000555663Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:56.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d7ad0510673597412021-12-21 11:38:56.194root 11241100x8000000000000000555664Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:56.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1fac968bc66238262021-12-21 11:38:56.194root 11241100x8000000000000000555665Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:56.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c8c63b9eaa1f335f2021-12-21 11:38:56.194root 11241100x8000000000000000555666Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:56.195{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2c3afc2b76d7852a2021-12-21 11:38:56.195root 11241100x8000000000000000555667Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:56.195{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.326319b606e970b02021-12-21 11:38:56.195root 11241100x8000000000000000555668Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:56.195{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.688fdbe17d6a00192021-12-21 11:38:56.195root 11241100x8000000000000000555669Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:56.195{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4299de4bbf2e6ffb2021-12-21 11:38:56.195root 11241100x8000000000000000555670Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:56.196{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.502c4c8396be70e92021-12-21 11:38:56.196root 11241100x8000000000000000555671Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:56.196{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7f8be7bb11d7ce762021-12-21 11:38:56.196root 11241100x8000000000000000555672Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:56.196{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d6be7240a7bf34172021-12-21 11:38:56.196root 11241100x8000000000000000555673Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:56.196{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2dba5ab140df80e42021-12-21 11:38:56.196root 11241100x8000000000000000555674Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:56.196{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.880bedae444b99b82021-12-21 11:38:56.196root 11241100x8000000000000000555675Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:56.196{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.43c7ef60f9cd69a72021-12-21 11:38:56.196root 11241100x8000000000000000555676Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:56.196{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.77497aa0e9ffaa122021-12-21 11:38:56.196root 11241100x8000000000000000555677Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:56.196{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.cfa39890692608b12021-12-21 11:38:56.196root 11241100x8000000000000000555678Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:56.196{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.05654007f33d3d312021-12-21 11:38:56.196root 11241100x8000000000000000555679Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:56.196{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.dd0ea45c0ba177b62021-12-21 11:38:56.196root 11241100x8000000000000000555680Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:56.196{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.828ec4a7976a12f52021-12-21 11:38:56.196root 11241100x8000000000000000555681Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:56.196{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.fee79761d75c25b52021-12-21 11:38:56.196root 11241100x8000000000000000555682Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:56.197{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1fc8020d97533b5e2021-12-21 11:38:56.197root 11241100x8000000000000000555683Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:56.197{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e18957f718f2557b2021-12-21 11:38:56.197root 11241100x8000000000000000555684Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:56.197{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a403457c7da7ca862021-12-21 11:38:56.197root 11241100x8000000000000000555685Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:56.197{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.bdd9d0b3b25864692021-12-21 11:38:56.197root 11241100x8000000000000000555686Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:56.197{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a21203557ce824192021-12-21 11:38:56.197root 11241100x8000000000000000555687Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:56.197{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ec9249b513fbf8b02021-12-21 11:38:56.197root 11241100x8000000000000000555688Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:56.197{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5a19b3d729afba6b2021-12-21 11:38:56.197root 11241100x8000000000000000555689Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:56.197{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3b4018c77b1891122021-12-21 11:38:56.197root 11241100x8000000000000000555690Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:56.197{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7f6d22f5da291b422021-12-21 11:38:56.197root 11241100x8000000000000000555691Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:56.197{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.fb142780b24735d82021-12-21 11:38:56.197root 11241100x8000000000000000555692Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:56.197{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.70ac2445d29a9b712021-12-21 11:38:56.197root 11241100x8000000000000000555693Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:56.197{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.84b5ae8a8c1c9b682021-12-21 11:38:56.197root 11241100x8000000000000000555694Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:56.197{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0676a3c63d65b2692021-12-21 11:38:56.197root 11241100x8000000000000000555695Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:56.197{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1bd8c64f96c2e8252021-12-21 11:38:56.197root 11241100x8000000000000000555696Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:56.197{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1ae8cc90b394e31d2021-12-21 11:38:56.197root 11241100x8000000000000000555697Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:56.197{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.64f19303585fe76f2021-12-21 11:38:56.197root 11241100x8000000000000000555698Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:56.198{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ffc02f361d7682012021-12-21 11:38:56.198root 11241100x8000000000000000555699Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:56.198{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f8571686ce7028262021-12-21 11:38:56.198root 11241100x8000000000000000555700Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:56.198{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d8929960b1305aa52021-12-21 11:38:56.198root 11241100x8000000000000000555701Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:56.198{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6383c0d7d63e5f5c2021-12-21 11:38:56.198root 11241100x8000000000000000555702Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:56.198{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e58c0ce14e8a916f2021-12-21 11:38:56.198root 11241100x8000000000000000555703Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:56.198{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ba087ec844f87c852021-12-21 11:38:56.198root 11241100x8000000000000000555704Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:56.198{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.017e711f13d9e7732021-12-21 11:38:56.198root 11241100x8000000000000000555705Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:56.198{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7df4a6e5dbca073f2021-12-21 11:38:56.198root 11241100x8000000000000000555706Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:56.198{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f508730ec0e022f12021-12-21 11:38:56.198root 11241100x8000000000000000555707Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:56.198{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7542aa27472fd9fd2021-12-21 11:38:56.198root 11241100x8000000000000000555708Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:56.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8125e55f38cf7ce72021-12-21 11:38:56.693root 11241100x8000000000000000555709Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:56.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.82e8004ea1f3adb72021-12-21 11:38:56.693root 11241100x8000000000000000555710Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:56.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5b901b613fdc1c0d2021-12-21 11:38:56.693root 11241100x8000000000000000555711Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:56.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ef5581abf366fe4f2021-12-21 11:38:56.694root 11241100x8000000000000000555712Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:56.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.122b01f781222a8a2021-12-21 11:38:56.694root 11241100x8000000000000000555713Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:56.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.457c6831af1fd93a2021-12-21 11:38:56.694root 11241100x8000000000000000555714Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:56.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.73e5e427977bdf9b2021-12-21 11:38:56.694root 11241100x8000000000000000555715Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:56.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.48efb7e4ddbebfcb2021-12-21 11:38:56.694root 11241100x8000000000000000555716Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:56.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0aa612dd63abb51a2021-12-21 11:38:56.694root 11241100x8000000000000000555717Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:56.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9025136f852efb672021-12-21 11:38:56.694root 11241100x8000000000000000555718Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:56.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f572c4cca622b90c2021-12-21 11:38:56.694root 11241100x8000000000000000555719Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:56.695{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.33ffab75a7ae4b022021-12-21 11:38:56.695root 11241100x8000000000000000555720Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:56.695{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.939e9f59b430370a2021-12-21 11:38:56.695root 11241100x8000000000000000555721Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:56.695{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5cdcf1964c417b9f2021-12-21 11:38:56.695root 11241100x8000000000000000555722Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:56.695{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.526860bb10c2e0422021-12-21 11:38:56.695root 11241100x8000000000000000555723Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:56.695{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.74f9e59dc5dd46452021-12-21 11:38:56.695root 11241100x8000000000000000555724Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:56.695{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9c875282d505a6c02021-12-21 11:38:56.695root 11241100x8000000000000000555725Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:56.695{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5268af6a443d1cd62021-12-21 11:38:56.695root 11241100x8000000000000000555726Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:56.695{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3cbb6323a3d5153f2021-12-21 11:38:56.695root 11241100x8000000000000000555727Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:56.695{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8027779e2703674c2021-12-21 11:38:56.695root 11241100x8000000000000000555728Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:56.696{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.85349e99d1f367592021-12-21 11:38:56.696root 11241100x8000000000000000555729Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:56.696{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.386f79f30b1992682021-12-21 11:38:56.696root 11241100x8000000000000000555730Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:56.696{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c0df942edf03bcbc2021-12-21 11:38:56.696root 11241100x8000000000000000555731Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:56.696{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2e6607a0520a0fef2021-12-21 11:38:56.696root 11241100x8000000000000000555732Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:56.696{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2d3f43a591ffb4c32021-12-21 11:38:56.696root 11241100x8000000000000000555733Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:56.696{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.41d0039a7d12d1752021-12-21 11:38:56.696root 11241100x8000000000000000555734Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:56.696{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.921197f82782c90c2021-12-21 11:38:56.696root 11241100x8000000000000000555735Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:56.697{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5258a7d48fdb762c2021-12-21 11:38:56.697root 11241100x8000000000000000555736Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:56.697{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e314d1a80652bad02021-12-21 11:38:56.697root 11241100x8000000000000000555737Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:56.697{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d85350e3fc45775b2021-12-21 11:38:56.697root 11241100x8000000000000000555738Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:56.697{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.cf5cf1925a8f51f22021-12-21 11:38:56.697root 11241100x8000000000000000555739Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:56.697{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.22984fa643c43bf62021-12-21 11:38:56.697root 11241100x8000000000000000555740Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:56.697{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6ffda1ee5dcb81752021-12-21 11:38:56.697root 11241100x8000000000000000555741Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:56.697{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a49734a4fa6383fa2021-12-21 11:38:56.697root 11241100x8000000000000000555742Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:56.697{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.bdb91adbaa3b14a62021-12-21 11:38:56.697root 11241100x8000000000000000555743Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:56.698{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.60d8ed3c007e13692021-12-21 11:38:56.698root 11241100x8000000000000000555744Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:56.698{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.21a7c688867915a62021-12-21 11:38:56.698root 11241100x8000000000000000555745Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:56.698{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b8160b040f8f895f2021-12-21 11:38:56.698root 354300x8000000000000000555746Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:57.172{ec2b6afe-95d9-61c1-5175-3a0400000000}5346/opt/splunkforwarder/etc/apps/Splunk_TA_stream/linux_x86_64/bin/streamfwdroottcptruefalse10.0.1.25-48848-false10.0.1.12-8000- 11241100x8000000000000000555747Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:57.173{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.16d0b99941822d282021-12-21 11:38:57.173root 11241100x8000000000000000555748Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:57.173{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b9943f890faab47a2021-12-21 11:38:57.173root 11241100x8000000000000000555749Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:57.173{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.eaadcab8f9128e312021-12-21 11:38:57.173root 11241100x8000000000000000555750Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:57.173{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7a4bd96ae381f1892021-12-21 11:38:57.173root 11241100x8000000000000000555751Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:57.173{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ea9c258fcaa668ae2021-12-21 11:38:57.173root 11241100x8000000000000000555752Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:57.173{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.44af442c84f271242021-12-21 11:38:57.173root 11241100x8000000000000000555753Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:57.174{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d1b6e94e8718cc2d2021-12-21 11:38:57.174root 11241100x8000000000000000555754Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:57.174{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.89f1d9ef996f674b2021-12-21 11:38:57.174root 11241100x8000000000000000555755Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:57.174{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9872dd8ce9e554412021-12-21 11:38:57.174root 11241100x8000000000000000555756Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:57.174{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.56240f838bf44bd42021-12-21 11:38:57.174root 11241100x8000000000000000555757Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:57.174{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e5c5854401873b0f2021-12-21 11:38:57.174root 11241100x8000000000000000555758Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:57.174{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.be5938850541aa842021-12-21 11:38:57.174root 11241100x8000000000000000555759Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:57.175{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2df061161270701d2021-12-21 11:38:57.175root 11241100x8000000000000000555760Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:57.175{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.039e3958bbdb7e492021-12-21 11:38:57.175root 11241100x8000000000000000555761Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:57.175{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.74be5254a76c96602021-12-21 11:38:57.175root 11241100x8000000000000000555762Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:57.175{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3a75a78b18803f132021-12-21 11:38:57.175root 11241100x8000000000000000555763Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:57.175{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7166d50aba88d86d2021-12-21 11:38:57.175root 11241100x8000000000000000555764Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:57.175{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e5beb28113480f222021-12-21 11:38:57.175root 11241100x8000000000000000555765Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:57.175{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a1670253dc2163512021-12-21 11:38:57.175root 11241100x8000000000000000555766Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:57.175{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b09757635a418f172021-12-21 11:38:57.175root 11241100x8000000000000000555767Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:57.176{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.17ae6269bf0bf73b2021-12-21 11:38:57.176root 11241100x8000000000000000555768Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:57.176{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4c71cbaaa5ad067a2021-12-21 11:38:57.176root 11241100x8000000000000000555769Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:57.176{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.57d0ede5130ee2722021-12-21 11:38:57.176root 11241100x8000000000000000555770Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:57.176{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.12e4bccbefd2a6f22021-12-21 11:38:57.176root 11241100x8000000000000000555771Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:57.176{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.889733c12cfd11b22021-12-21 11:38:57.176root 11241100x8000000000000000555772Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:57.176{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5e6ba60223a88fcc2021-12-21 11:38:57.176root 11241100x8000000000000000555773Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:57.176{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d0714d90bdd4b7c12021-12-21 11:38:57.176root 11241100x8000000000000000555774Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:57.176{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.971524bb94d1f51f2021-12-21 11:38:57.176root 11241100x8000000000000000555775Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:57.176{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7f2c62b2e22ae9652021-12-21 11:38:57.176root 11241100x8000000000000000555776Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:57.177{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e1000bfaec6c36ea2021-12-21 11:38:57.177root 11241100x8000000000000000555777Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:57.177{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0700a6e51c98123d2021-12-21 11:38:57.177root 11241100x8000000000000000555778Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:57.177{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1a6ec00123f26d752021-12-21 11:38:57.177root 11241100x8000000000000000555779Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:57.178{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.993138d4dc3948ef2021-12-21 11:38:57.178root 11241100x8000000000000000555780Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:57.178{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.94c1d6ad37661e392021-12-21 11:38:57.178root 11241100x8000000000000000555781Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:57.178{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a714ef95e1453bf22021-12-21 11:38:57.178root 11241100x8000000000000000555782Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:57.178{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.872fd018b49471582021-12-21 11:38:57.178root 11241100x8000000000000000555783Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:57.178{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.815174ea91b1a95b2021-12-21 11:38:57.178root 11241100x8000000000000000555784Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:57.179{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c2c7388d18975aea2021-12-21 11:38:57.179root 11241100x8000000000000000555785Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:57.179{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d9892ba0970bb0ca2021-12-21 11:38:57.179root 11241100x8000000000000000555786Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:57.179{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d1920cb91ff79c182021-12-21 11:38:57.179root 11241100x8000000000000000555787Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:57.179{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c7be4eebbe0e6a152021-12-21 11:38:57.179root 11241100x8000000000000000555788Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:57.179{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.81461526219c65002021-12-21 11:38:57.179root 11241100x8000000000000000555789Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:57.179{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1cd62541e932d37b2021-12-21 11:38:57.179root 11241100x8000000000000000555790Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:57.180{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1677664fcf42a2302021-12-21 11:38:57.180root 11241100x8000000000000000555791Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:57.180{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.80757d4438b0b87c2021-12-21 11:38:57.180root 11241100x8000000000000000555792Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:57.180{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e00cc1990f33fcf02021-12-21 11:38:57.180root 11241100x8000000000000000555793Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:57.180{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8508fd0f3b7c845a2021-12-21 11:38:57.180root 11241100x8000000000000000555794Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:57.180{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f27a76416da8ffe92021-12-21 11:38:57.180root 11241100x8000000000000000555795Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:57.180{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.56ba13564e7f40002021-12-21 11:38:57.180root 11241100x8000000000000000555796Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:57.180{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1dd4df5d2c33f1842021-12-21 11:38:57.180root 11241100x8000000000000000555797Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:57.180{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5614a59efe5fa2f82021-12-21 11:38:57.180root 11241100x8000000000000000555798Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:57.180{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3d0182c2b4da5ac72021-12-21 11:38:57.180root 11241100x8000000000000000555799Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:57.181{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c39bce690a24d1f42021-12-21 11:38:57.181root 11241100x8000000000000000555800Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:57.181{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.342056b2261fefc82021-12-21 11:38:57.181root 11241100x8000000000000000555801Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:57.181{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.410767b6831fa3d72021-12-21 11:38:57.181root 11241100x8000000000000000555802Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:57.181{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.40b89b0653a28a182021-12-21 11:38:57.181root 11241100x8000000000000000555803Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:57.181{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d7fec1c836aaf0452021-12-21 11:38:57.181root 11241100x8000000000000000555804Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:57.181{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.797f247df984e3992021-12-21 11:38:57.181root 11241100x8000000000000000555805Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:57.181{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5c3b54bf16dcad492021-12-21 11:38:57.181root 11241100x8000000000000000555806Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:57.181{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1b7bf13de51688ee2021-12-21 11:38:57.181root 11241100x8000000000000000555807Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:57.181{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b96c22128eeb30db2021-12-21 11:38:57.181root 11241100x8000000000000000555808Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:57.181{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2bf7e27c66c600fe2021-12-21 11:38:57.181root 11241100x8000000000000000555809Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:57.181{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f9ee215bfbe80ab02021-12-21 11:38:57.181root 11241100x8000000000000000555810Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:57.182{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6df5e8d9daabdb242021-12-21 11:38:57.182root 11241100x8000000000000000555811Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:57.182{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a2752f1826bdaf662021-12-21 11:38:57.182root 11241100x8000000000000000555812Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:57.182{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c90c377393f724c82021-12-21 11:38:57.182root 11241100x8000000000000000555813Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:57.182{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.97cd4585d1fb31af2021-12-21 11:38:57.182root 11241100x8000000000000000555814Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:57.182{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.08973051dd594e692021-12-21 11:38:57.182root 11241100x8000000000000000555815Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:57.182{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c10c7a83160b4d2d2021-12-21 11:38:57.182root 11241100x8000000000000000555816Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:57.182{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7b808626d74f159d2021-12-21 11:38:57.182root 11241100x8000000000000000555817Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:57.182{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5d9bf85726c38bad2021-12-21 11:38:57.182root 11241100x8000000000000000555818Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:57.182{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.63748b3bbb0212ab2021-12-21 11:38:57.182root 11241100x8000000000000000555819Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:57.182{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4d6a1605280ba68f2021-12-21 11:38:57.182root 11241100x8000000000000000555820Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:57.182{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.26d347693ec6bf712021-12-21 11:38:57.182root 11241100x8000000000000000555821Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:57.182{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.93b1663a0aee5d282021-12-21 11:38:57.182root 11241100x8000000000000000555822Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:57.183{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.17ba8497038ce89a2021-12-21 11:38:57.183root 11241100x8000000000000000555823Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:57.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.75bbf8334b3598c72021-12-21 11:38:57.443root 11241100x8000000000000000555824Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:57.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e320b6d02f1f01ba2021-12-21 11:38:57.443root 11241100x8000000000000000555825Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:57.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.459a1615c43d5d8f2021-12-21 11:38:57.443root 11241100x8000000000000000555826Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:57.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.47f96fb2dd9291c02021-12-21 11:38:57.443root 11241100x8000000000000000555827Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:57.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a96c45d87b6677822021-12-21 11:38:57.443root 11241100x8000000000000000555828Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:57.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c96e75e6a3a9d40b2021-12-21 11:38:57.443root 11241100x8000000000000000555829Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:57.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5cd6945cc368f5032021-12-21 11:38:57.444root 11241100x8000000000000000555830Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:57.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ca217f9c42a1a7b92021-12-21 11:38:57.444root 11241100x8000000000000000555831Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:57.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9614b61357e8d6f02021-12-21 11:38:57.444root 11241100x8000000000000000555832Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:57.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5c22e5bba7a9a6382021-12-21 11:38:57.444root 11241100x8000000000000000555833Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:57.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7a185c4e594aefb22021-12-21 11:38:57.444root 11241100x8000000000000000555834Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:57.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.21a77cd4b4c5620e2021-12-21 11:38:57.444root 11241100x8000000000000000555835Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:57.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.054ebe6e9acc181d2021-12-21 11:38:57.444root 11241100x8000000000000000555836Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:57.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.12f135b2eff0f8542021-12-21 11:38:57.444root 11241100x8000000000000000555837Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:57.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9479574551f71f002021-12-21 11:38:57.444root 11241100x8000000000000000555838Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:57.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d0fde8f0963e87eb2021-12-21 11:38:57.444root 11241100x8000000000000000555839Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:57.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ea4485fbdee147132021-12-21 11:38:57.444root 11241100x8000000000000000555840Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:57.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a04653770d58260f2021-12-21 11:38:57.444root 11241100x8000000000000000555841Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:57.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.70741e8a964a56522021-12-21 11:38:57.444root 11241100x8000000000000000555842Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:57.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.17e2621e9f40a1152021-12-21 11:38:57.444root 11241100x8000000000000000555843Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:57.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8c9ab4716986b6582021-12-21 11:38:57.445root 11241100x8000000000000000555844Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:57.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5b00a6a4db38d8382021-12-21 11:38:57.445root 11241100x8000000000000000555845Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:57.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.adbba12bd3a74de92021-12-21 11:38:57.445root 11241100x8000000000000000555846Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:57.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d2c421a49c560cb02021-12-21 11:38:57.445root 11241100x8000000000000000555847Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:57.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.75ad0a5002da17042021-12-21 11:38:57.445root 11241100x8000000000000000555848Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:57.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.df37b326973033e02021-12-21 11:38:57.445root 11241100x8000000000000000555849Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:57.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f0ea343ea82950ff2021-12-21 11:38:57.445root 11241100x8000000000000000555850Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:57.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e2b24e7685d140232021-12-21 11:38:57.445root 11241100x8000000000000000555851Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:57.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7e821c537a6ee7602021-12-21 11:38:57.445root 11241100x8000000000000000555852Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:57.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c6cdd3fb09838a422021-12-21 11:38:57.445root 11241100x8000000000000000555853Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:57.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f1266ace09b3d4e82021-12-21 11:38:57.445root 11241100x8000000000000000555854Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:57.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.512b54d7779cbc112021-12-21 11:38:57.445root 11241100x8000000000000000555855Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:57.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e790470abed7c5d62021-12-21 11:38:57.445root 11241100x8000000000000000555856Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:57.446{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.46347a17d881ce122021-12-21 11:38:57.446root 11241100x8000000000000000555857Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:57.446{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.78ba09f8e149dfc12021-12-21 11:38:57.446root 11241100x8000000000000000555858Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:57.446{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.90fb2b35457113ec2021-12-21 11:38:57.446root 11241100x8000000000000000555859Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:57.446{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.facc421aeeed05f52021-12-21 11:38:57.446root 11241100x8000000000000000555860Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:57.446{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.35603f47b218abc42021-12-21 11:38:57.446root 11241100x8000000000000000555861Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:57.446{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.359c53ba253f53062021-12-21 11:38:57.446root 11241100x8000000000000000555862Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:57.446{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4599e1c59ab94a5a2021-12-21 11:38:57.446root 11241100x8000000000000000555863Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:57.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9337d0fa7b1937b52021-12-21 11:38:57.943root 11241100x8000000000000000555864Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:57.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0ff7b0ad476ffc9c2021-12-21 11:38:57.943root 11241100x8000000000000000555865Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:57.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0338eefeb1d462952021-12-21 11:38:57.943root 11241100x8000000000000000555866Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:57.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.090f672ddea079892021-12-21 11:38:57.943root 11241100x8000000000000000555867Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:57.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1e31f59bdeaf58bf2021-12-21 11:38:57.943root 11241100x8000000000000000555868Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:57.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b239e983a28a6f632021-12-21 11:38:57.943root 11241100x8000000000000000555869Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:57.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e3f0ca4853a0e2572021-12-21 11:38:57.943root 11241100x8000000000000000555870Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:57.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.12a7205d4f8a3a442021-12-21 11:38:57.944root 11241100x8000000000000000555871Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:57.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.07ff68f5bb07780d2021-12-21 11:38:57.944root 11241100x8000000000000000555872Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:57.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5e27b4eca0d93bc12021-12-21 11:38:57.944root 11241100x8000000000000000555873Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:57.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7c651f387eb887702021-12-21 11:38:57.944root 11241100x8000000000000000555874Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:57.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8bc02c2b6a6b6e572021-12-21 11:38:57.944root 11241100x8000000000000000555875Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:57.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3d21bb2650bfe12c2021-12-21 11:38:57.945root 11241100x8000000000000000555876Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:57.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4cb0fd494b86e7172021-12-21 11:38:57.945root 11241100x8000000000000000555877Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:57.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.09cdeca2f1250b3a2021-12-21 11:38:57.945root 11241100x8000000000000000555878Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:57.946{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4177d728552802332021-12-21 11:38:57.946root 11241100x8000000000000000555879Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:57.946{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.05ae4d9fe8e0f5422021-12-21 11:38:57.946root 11241100x8000000000000000555880Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:57.946{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.aa20bf99f10af9ac2021-12-21 11:38:57.946root 11241100x8000000000000000555881Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:57.947{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3907e08e4464f1842021-12-21 11:38:57.947root 11241100x8000000000000000555882Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:57.947{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e7b30a9749d5921b2021-12-21 11:38:57.947root 11241100x8000000000000000555883Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:57.947{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6b5d5e8adbec87e52021-12-21 11:38:57.947root 11241100x8000000000000000555884Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:57.947{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b2374b0677ef95082021-12-21 11:38:57.947root 11241100x8000000000000000555885Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:57.948{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b7b8d0b7a3221cf62021-12-21 11:38:57.948root 11241100x8000000000000000555886Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:57.948{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.90286ab3317c64db2021-12-21 11:38:57.948root 11241100x8000000000000000555887Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:57.948{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c7402abb0b6c0aee2021-12-21 11:38:57.948root 11241100x8000000000000000555888Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:57.949{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f5d575f54e74f49e2021-12-21 11:38:57.949root 11241100x8000000000000000555889Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:57.949{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ae6b4f682dae69482021-12-21 11:38:57.949root 11241100x8000000000000000555890Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:57.949{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c32625ba0ef8b79e2021-12-21 11:38:57.949root 11241100x8000000000000000555891Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:57.950{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3c5ff4b0c286550d2021-12-21 11:38:57.950root 11241100x8000000000000000555892Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:57.950{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9b3478ab57a52b6f2021-12-21 11:38:57.950root 11241100x8000000000000000555893Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:57.950{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.fab06e7efa0f53462021-12-21 11:38:57.950root 11241100x8000000000000000555894Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:57.950{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8d3a0e49455a2fb32021-12-21 11:38:57.950root 11241100x8000000000000000555895Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:57.950{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a26796d380e3aec32021-12-21 11:38:57.950root 11241100x8000000000000000555896Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:57.950{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f43f8b14df2a19572021-12-21 11:38:57.950root 11241100x8000000000000000555897Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:57.950{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0a92ac3807fcb9212021-12-21 11:38:57.950root 11241100x8000000000000000555898Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:57.951{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3d4c48cefd9c51082021-12-21 11:38:57.951root 11241100x8000000000000000555899Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:57.951{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7ce27c65b6d94f5f2021-12-21 11:38:57.951root 11241100x8000000000000000555900Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:57.953{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.cd44ac793b7320172021-12-21 11:38:57.953root 11241100x8000000000000000555901Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:57.953{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0857a951f60466122021-12-21 11:38:57.953root 11241100x8000000000000000555902Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:57.953{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.516617d2dd3cc8c92021-12-21 11:38:57.953root 11241100x8000000000000000555903Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:57.953{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.642d0ac594c3c5b92021-12-21 11:38:57.953root 11241100x8000000000000000555904Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:57.953{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5eab834c268c04ad2021-12-21 11:38:57.953root 11241100x8000000000000000555905Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:57.954{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a85e2ff5c4d360a02021-12-21 11:38:57.954root 11241100x8000000000000000555906Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:57.954{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.353545f2b1b838dc2021-12-21 11:38:57.954root 11241100x8000000000000000555907Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:57.954{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.63fb2dceb736eaf92021-12-21 11:38:57.954root 11241100x8000000000000000555908Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:57.954{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6a13764785ae27142021-12-21 11:38:57.954root 11241100x8000000000000000555909Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:57.955{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7d01fedcdb4ed7492021-12-21 11:38:57.955root 11241100x8000000000000000555910Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:57.956{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5e5f8857cee13daa2021-12-21 11:38:57.956root 11241100x8000000000000000555911Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:58.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2f5702b7c9cc06222021-12-21 11:38:58.443root 11241100x8000000000000000555912Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:58.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5a031a3a3cd83a612021-12-21 11:38:58.443root 11241100x8000000000000000555913Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:58.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c668974f0015c04f2021-12-21 11:38:58.443root 11241100x8000000000000000555914Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:58.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.43122967276262db2021-12-21 11:38:58.443root 11241100x8000000000000000555915Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:58.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a5602f1cef56967b2021-12-21 11:38:58.444root 11241100x8000000000000000555916Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:58.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7d795b9fa8162b212021-12-21 11:38:58.444root 11241100x8000000000000000555917Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:58.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3a91cea9dac4ad732021-12-21 11:38:58.444root 11241100x8000000000000000555918Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:58.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b3b9dc5f52aaa61d2021-12-21 11:38:58.444root 11241100x8000000000000000555919Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:58.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5659bec0992b8f5e2021-12-21 11:38:58.444root 11241100x8000000000000000555920Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:58.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.577b4aaa4a86130b2021-12-21 11:38:58.444root 11241100x8000000000000000555921Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:58.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0c4df39dce98a9d02021-12-21 11:38:58.444root 11241100x8000000000000000555922Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:58.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8259d44dd260e86c2021-12-21 11:38:58.444root 11241100x8000000000000000555923Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:58.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a4fb6edc806bdd202021-12-21 11:38:58.444root 11241100x8000000000000000555924Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:58.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1bc766ff22de9b882021-12-21 11:38:58.444root 11241100x8000000000000000555925Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:58.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.40e682baa412fd922021-12-21 11:38:58.444root 11241100x8000000000000000555926Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:58.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.75f04e20ba246d9c2021-12-21 11:38:58.445root 11241100x8000000000000000555927Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:58.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.bbf30319d8d8da882021-12-21 11:38:58.445root 11241100x8000000000000000555928Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:58.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e2ad04d572769e9f2021-12-21 11:38:58.445root 11241100x8000000000000000555929Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:58.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.955af9e927d40d6b2021-12-21 11:38:58.445root 11241100x8000000000000000555930Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:58.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.88e8e1959d7c24fb2021-12-21 11:38:58.445root 11241100x8000000000000000555931Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:58.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d4ccc676ceb123b32021-12-21 11:38:58.445root 11241100x8000000000000000555932Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:58.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d9e0a10c3c3b4bdc2021-12-21 11:38:58.445root 11241100x8000000000000000555933Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:58.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.abe5b36599a33b1a2021-12-21 11:38:58.445root 11241100x8000000000000000555934Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:58.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ad4e90f448926eeb2021-12-21 11:38:58.445root 11241100x8000000000000000555935Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:58.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.85cad33565bad5192021-12-21 11:38:58.445root 11241100x8000000000000000555936Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:58.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.dca21b0735a8275c2021-12-21 11:38:58.445root 11241100x8000000000000000555937Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:58.446{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.aa8f82077bb7acf02021-12-21 11:38:58.446root 11241100x8000000000000000555938Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:58.446{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.76e3f815c435e5bd2021-12-21 11:38:58.446root 11241100x8000000000000000555939Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:58.446{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4ced8f01f869a1512021-12-21 11:38:58.446root 11241100x8000000000000000555940Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:58.446{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.81a6d81c71150ea82021-12-21 11:38:58.446root 11241100x8000000000000000555941Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:58.446{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a4c785978eafc0022021-12-21 11:38:58.446root 11241100x8000000000000000555942Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:58.446{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.246856144d6a5dac2021-12-21 11:38:58.446root 11241100x8000000000000000555943Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:58.446{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3dc812307f4426022021-12-21 11:38:58.446root 11241100x8000000000000000555944Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:58.446{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5893622c4022e5e92021-12-21 11:38:58.446root 11241100x8000000000000000555945Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:58.446{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c62faac3189f68832021-12-21 11:38:58.446root 11241100x8000000000000000555946Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:58.446{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6bcef08acea8683b2021-12-21 11:38:58.446root 11241100x8000000000000000555947Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:58.446{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.aa7b8b86588684f92021-12-21 11:38:58.446root 11241100x8000000000000000555948Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:58.447{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1ed5fdb713250a8f2021-12-21 11:38:58.447root 11241100x8000000000000000555949Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:58.447{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ff26fbd4ee1d865c2021-12-21 11:38:58.447root 11241100x8000000000000000555950Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:58.447{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3515ca065a372e172021-12-21 11:38:58.447root 11241100x8000000000000000555951Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:58.447{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8e192ddcf69750c72021-12-21 11:38:58.447root 11241100x8000000000000000555952Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:58.447{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7d4961c0b3b03e522021-12-21 11:38:58.447root 11241100x8000000000000000555953Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:58.447{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.33c99d5519ac431f2021-12-21 11:38:58.447root 11241100x8000000000000000555954Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:58.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.64797165e313592d2021-12-21 11:38:58.943root 11241100x8000000000000000555955Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:58.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b4436fc3ea521d812021-12-21 11:38:58.943root 11241100x8000000000000000555956Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:58.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1e34a4300c769cce2021-12-21 11:38:58.943root 11241100x8000000000000000555957Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:58.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9c1fc9b357f0b4992021-12-21 11:38:58.943root 11241100x8000000000000000555958Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:58.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.92642f4a7f52c65d2021-12-21 11:38:58.943root 11241100x8000000000000000555959Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:58.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3a85d75e28221d882021-12-21 11:38:58.944root 11241100x8000000000000000555960Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:58.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ef40c76d2ef2289c2021-12-21 11:38:58.944root 11241100x8000000000000000555961Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:58.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8e0d65329d39e3a72021-12-21 11:38:58.944root 11241100x8000000000000000555962Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:58.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ac3a118fa6906a982021-12-21 11:38:58.944root 11241100x8000000000000000555963Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:58.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7ab6712112e7a0972021-12-21 11:38:58.944root 11241100x8000000000000000555964Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:58.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f8a6ad3575141a062021-12-21 11:38:58.944root 11241100x8000000000000000555965Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:58.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5c1b1233be24498a2021-12-21 11:38:58.944root 11241100x8000000000000000555966Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:58.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1036d3c3d6cefec82021-12-21 11:38:58.944root 11241100x8000000000000000555967Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:58.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f67534066efce8402021-12-21 11:38:58.944root 11241100x8000000000000000555968Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:58.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9d6f04c2857a4a2d2021-12-21 11:38:58.944root 11241100x8000000000000000555969Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:58.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5b3c51543f562af22021-12-21 11:38:58.945root 11241100x8000000000000000555970Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:58.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.aa61d055d299b4702021-12-21 11:38:58.945root 11241100x8000000000000000555971Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:58.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.32736e8f8c4996372021-12-21 11:38:58.945root 11241100x8000000000000000555972Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:58.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c198ef041549b2912021-12-21 11:38:58.945root 11241100x8000000000000000555973Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:58.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.aaae2ce6445434892021-12-21 11:38:58.945root 11241100x8000000000000000555974Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:58.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1d8ceab4809421b02021-12-21 11:38:58.945root 11241100x8000000000000000555975Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:58.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e97c6191926c98d62021-12-21 11:38:58.945root 11241100x8000000000000000555976Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:58.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3a0dad432f76587d2021-12-21 11:38:58.945root 11241100x8000000000000000555977Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:58.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.23e30ff1b3e9a42c2021-12-21 11:38:58.945root 11241100x8000000000000000555978Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:58.946{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9e76ac01980f54362021-12-21 11:38:58.946root 11241100x8000000000000000555979Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:58.946{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a50c2e84005f63ce2021-12-21 11:38:58.946root 11241100x8000000000000000555980Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:58.946{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d1c37dae4af834de2021-12-21 11:38:58.946root 11241100x8000000000000000555981Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:58.946{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.31d6758d266c2d602021-12-21 11:38:58.946root 11241100x8000000000000000555982Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:58.946{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.73dc6102c03193542021-12-21 11:38:58.946root 11241100x8000000000000000555983Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:58.946{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.de5e9376f41f7a1c2021-12-21 11:38:58.946root 11241100x8000000000000000555984Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:58.947{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.30200e5b84a222a52021-12-21 11:38:58.947root 11241100x8000000000000000555985Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:58.947{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e9802625dff4a68d2021-12-21 11:38:58.947root 11241100x8000000000000000555986Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:58.947{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.57c0059acf1341272021-12-21 11:38:58.947root 11241100x8000000000000000555987Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:58.947{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b5069a87c023e10c2021-12-21 11:38:58.947root 11241100x8000000000000000555988Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:58.947{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4d01984e54712e412021-12-21 11:38:58.947root 11241100x8000000000000000555989Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:58.947{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2a2a8f168a1798952021-12-21 11:38:58.947root 11241100x8000000000000000555990Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:58.947{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4cb8219750263cf12021-12-21 11:38:58.947root 11241100x8000000000000000555991Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:58.948{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3446e9015f5b9a822021-12-21 11:38:58.948root 11241100x8000000000000000555992Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:58.948{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.83efa63a871efbbc2021-12-21 11:38:58.948root 11241100x8000000000000000555993Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:58.948{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.74ccfd7893c75d4f2021-12-21 11:38:58.948root 11241100x8000000000000000555994Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:58.948{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9abff63d911023332021-12-21 11:38:58.948root 11241100x8000000000000000555995Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:58.948{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b600dd1f451dda2d2021-12-21 11:38:58.948root 11241100x8000000000000000555996Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:58.948{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.64b3f9c1562fbed22021-12-21 11:38:58.948root 11241100x8000000000000000555997Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:58.948{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a6a6f8309f87fff32021-12-21 11:38:58.948root 11241100x8000000000000000555998Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:58.949{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.aa689b946a63c9ac2021-12-21 11:38:58.949root 11241100x8000000000000000555999Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:58.949{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.eee94221e749c4d22021-12-21 11:38:58.949root 11241100x8000000000000000556000Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:58.949{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3743c875d17e4ec42021-12-21 11:38:58.949root 11241100x8000000000000000556001Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:58.949{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e360b3f8d6f4835d2021-12-21 11:38:58.949root 11241100x8000000000000000556002Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:58.949{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.72c648a64c14f4802021-12-21 11:38:58.949root 11241100x8000000000000000556003Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:58.949{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e2e478bb069020502021-12-21 11:38:58.949root 11241100x8000000000000000556004Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:58.949{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.013ffaa46e65ba142021-12-21 11:38:58.949root 11241100x8000000000000000556005Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:58.950{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4e0ed63907aeb1d52021-12-21 11:38:58.950root 11241100x8000000000000000556006Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:58.950{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e245cd4cf66442d42021-12-21 11:38:58.950root 11241100x8000000000000000556007Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:59.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d064cd6fa982539a2021-12-21 11:38:59.443root 11241100x8000000000000000556008Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:59.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.57db860d8997aa162021-12-21 11:38:59.443root 11241100x8000000000000000556009Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:59.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1a036e6469ac25a72021-12-21 11:38:59.443root 11241100x8000000000000000556010Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:59.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4ac7abf3b6639f3b2021-12-21 11:38:59.443root 11241100x8000000000000000556011Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:59.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.12a7a91f878949c32021-12-21 11:38:59.443root 11241100x8000000000000000556012Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:59.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.683e258aa68286202021-12-21 11:38:59.443root 11241100x8000000000000000556013Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:59.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.eee05b24d9f7c9712021-12-21 11:38:59.444root 11241100x8000000000000000556014Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:59.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.60b8d6ad9b75c25a2021-12-21 11:38:59.444root 11241100x8000000000000000556015Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:59.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6464b6c208d368bb2021-12-21 11:38:59.444root 11241100x8000000000000000556016Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:59.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a37cfa4ba2cd11572021-12-21 11:38:59.444root 11241100x8000000000000000556017Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:59.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.637a21f51a8fe1e22021-12-21 11:38:59.445root 11241100x8000000000000000556018Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:59.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0a2ccfafff7b3d302021-12-21 11:38:59.445root 11241100x8000000000000000556019Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:59.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3ac07b079e1324222021-12-21 11:38:59.445root 11241100x8000000000000000556020Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:59.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c23f486bfadc36fd2021-12-21 11:38:59.445root 11241100x8000000000000000556021Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:59.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.04b0218b32e6c27d2021-12-21 11:38:59.445root 11241100x8000000000000000556022Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:59.446{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.481b55c253571d242021-12-21 11:38:59.446root 11241100x8000000000000000556023Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:59.446{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f28f05b7b390ed602021-12-21 11:38:59.446root 11241100x8000000000000000556024Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:59.446{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.38932029d588533d2021-12-21 11:38:59.446root 11241100x8000000000000000556025Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:59.446{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.60aa46e0374842412021-12-21 11:38:59.446root 11241100x8000000000000000556026Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:59.446{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f2ed24f6694cae9f2021-12-21 11:38:59.446root 11241100x8000000000000000556027Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:59.446{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.37400a67602cd4742021-12-21 11:38:59.446root 11241100x8000000000000000556028Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:59.446{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a409aaaccbd33c4c2021-12-21 11:38:59.446root 11241100x8000000000000000556029Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:59.446{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.28dbdbd54bc80cee2021-12-21 11:38:59.446root 11241100x8000000000000000556030Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:59.446{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c0cb53acceccc8612021-12-21 11:38:59.446root 11241100x8000000000000000556031Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:59.446{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.42adeb253ac477c22021-12-21 11:38:59.446root 11241100x8000000000000000556032Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:59.447{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c0c897084f5f39e12021-12-21 11:38:59.447root 11241100x8000000000000000556033Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:59.447{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e921b534d3e563572021-12-21 11:38:59.447root 11241100x8000000000000000556034Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:59.447{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0d5d3ce22b094c132021-12-21 11:38:59.447root 11241100x8000000000000000556035Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:59.447{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6f20e62a553cd6c42021-12-21 11:38:59.447root 11241100x8000000000000000556036Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:59.447{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.062c92b8165260d52021-12-21 11:38:59.447root 11241100x8000000000000000556037Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:59.447{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.bec9de4b1ea43a202021-12-21 11:38:59.447root 11241100x8000000000000000556038Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:59.447{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9c54a5936dd422582021-12-21 11:38:59.447root 11241100x8000000000000000556039Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:59.447{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d56357233ea562fa2021-12-21 11:38:59.447root 11241100x8000000000000000556040Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:59.447{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1b419646dd25c7e72021-12-21 11:38:59.447root 11241100x8000000000000000556041Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:59.447{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a28f304ec3031d812021-12-21 11:38:59.447root 11241100x8000000000000000556042Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:59.448{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5073aeb6df12917b2021-12-21 11:38:59.448root 11241100x8000000000000000556043Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:59.448{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.970a1e34b45465ca2021-12-21 11:38:59.448root 11241100x8000000000000000556044Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:59.448{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5148edc590c24cf72021-12-21 11:38:59.448root 11241100x8000000000000000556045Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:59.448{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.84105c603c4ef1302021-12-21 11:38:59.448root 11241100x8000000000000000556046Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:59.448{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.94ee9551465c30572021-12-21 11:38:59.448root 11241100x8000000000000000556047Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:59.448{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.fd9bf2eac30a4b0b2021-12-21 11:38:59.448root 11241100x8000000000000000556048Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:59.448{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.cfaca4dfa67f19472021-12-21 11:38:59.448root 11241100x8000000000000000556049Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:59.449{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e796c75d83d385ba2021-12-21 11:38:59.449root 11241100x8000000000000000556050Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:59.449{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4896fd273ca66fc12021-12-21 11:38:59.449root 11241100x8000000000000000556051Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:59.449{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e13bd9587ed32b0a2021-12-21 11:38:59.449root 11241100x8000000000000000556052Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:59.449{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.54896027a8e2c9ec2021-12-21 11:38:59.449root 11241100x8000000000000000556053Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:59.449{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c4ff92bc80f42cc32021-12-21 11:38:59.449root 11241100x8000000000000000556054Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:59.449{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.fbfaff7fa12e72492021-12-21 11:38:59.449root 11241100x8000000000000000556055Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:59.449{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5750743278b8a3b22021-12-21 11:38:59.449root 11241100x8000000000000000556056Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:59.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.91729ed673c0cc7e2021-12-21 11:38:59.943root 11241100x8000000000000000556057Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:59.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.63e6022a34c8504b2021-12-21 11:38:59.943root 11241100x8000000000000000556058Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:59.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f2a7b4b68f1284c62021-12-21 11:38:59.943root 11241100x8000000000000000556059Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:59.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.bc1ef8ab9cb34e502021-12-21 11:38:59.943root 11241100x8000000000000000556060Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:59.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.aa61855132f817d42021-12-21 11:38:59.943root 11241100x8000000000000000556061Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:59.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ea6cd3907df8ba7a2021-12-21 11:38:59.943root 11241100x8000000000000000556062Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:59.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.17f12f005b817ab02021-12-21 11:38:59.943root 11241100x8000000000000000556063Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:59.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6504030a96c88d702021-12-21 11:38:59.944root 11241100x8000000000000000556064Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:59.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8f23761916a3d72a2021-12-21 11:38:59.944root 11241100x8000000000000000556065Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:59.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.81b6173f2eb107042021-12-21 11:38:59.944root 11241100x8000000000000000556066Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:59.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d78e6ad996e384f32021-12-21 11:38:59.944root 11241100x8000000000000000556067Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:59.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.17f3f1459bde7dab2021-12-21 11:38:59.944root 11241100x8000000000000000556068Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:59.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2785cb129d5ee8562021-12-21 11:38:59.944root 11241100x8000000000000000556069Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:59.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f5327ab88c4dcca82021-12-21 11:38:59.944root 11241100x8000000000000000556070Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:59.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c701e4b2d938f9852021-12-21 11:38:59.944root 11241100x8000000000000000556071Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:59.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.14a3cb938f46041d2021-12-21 11:38:59.945root 11241100x8000000000000000556072Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:59.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.89ba04b9429ca1c42021-12-21 11:38:59.945root 11241100x8000000000000000556073Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:59.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.309c393dc31a7f242021-12-21 11:38:59.945root 11241100x8000000000000000556074Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:59.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.84e44615f1656df12021-12-21 11:38:59.945root 11241100x8000000000000000556075Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:59.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.234101ad11fe884c2021-12-21 11:38:59.945root 11241100x8000000000000000556076Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:59.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.02ae5e7889f00b7e2021-12-21 11:38:59.945root 11241100x8000000000000000556077Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:59.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b79ffcc9e671ab752021-12-21 11:38:59.945root 11241100x8000000000000000556078Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:59.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a6d50c3c051edd842021-12-21 11:38:59.945root 11241100x8000000000000000556079Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:59.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1ea6e711011145ca2021-12-21 11:38:59.945root 11241100x8000000000000000556080Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:59.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.fd2cc4bcd577cce62021-12-21 11:38:59.945root 11241100x8000000000000000556081Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:59.946{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d2bb1e42c394cfd82021-12-21 11:38:59.946root 11241100x8000000000000000556082Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:59.946{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.40cfd0e82a299b9a2021-12-21 11:38:59.946root 11241100x8000000000000000556083Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:59.946{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.872f69e57e4304ad2021-12-21 11:38:59.946root 11241100x8000000000000000556084Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:59.946{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e7bdf8e2d395cadb2021-12-21 11:38:59.946root 11241100x8000000000000000556085Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:59.946{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.bf3fc828ac9767022021-12-21 11:38:59.946root 11241100x8000000000000000556086Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:59.946{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1b419ae1a095cbad2021-12-21 11:38:59.946root 11241100x8000000000000000556087Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:59.946{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8f518bc9fa31fd072021-12-21 11:38:59.946root 11241100x8000000000000000556088Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:59.947{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.caac321828b900ca2021-12-21 11:38:59.947root 11241100x8000000000000000556089Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:59.947{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b578606a12eeee522021-12-21 11:38:59.947root 11241100x8000000000000000556090Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:59.947{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.921e2a5d5af09b632021-12-21 11:38:59.947root 11241100x8000000000000000556091Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:59.947{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f0825fcb51faecf12021-12-21 11:38:59.947root 11241100x8000000000000000556092Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:59.947{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9b8f11de60804e602021-12-21 11:38:59.947root 11241100x8000000000000000556093Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:59.947{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d1729cde5e39980a2021-12-21 11:38:59.947root 11241100x8000000000000000556094Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:59.948{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c5ffb648fa7d45752021-12-21 11:38:59.948root 11241100x8000000000000000556095Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:59.948{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.285b96a3d1c698632021-12-21 11:38:59.948root 11241100x8000000000000000556096Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:59.948{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.09c1fc19a5c7186f2021-12-21 11:38:59.948root 11241100x8000000000000000556097Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:59.948{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3ca0c658d9c7228f2021-12-21 11:38:59.948root 11241100x8000000000000000556098Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:59.948{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3b5927fae75713e62021-12-21 11:38:59.948root 11241100x8000000000000000556099Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:59.948{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c423b06b0e0f0edd2021-12-21 11:38:59.948root 11241100x8000000000000000556100Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:59.948{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c5164a6329c8745a2021-12-21 11:38:59.948root 11241100x8000000000000000556101Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:59.949{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.83167475fbda8c2a2021-12-21 11:38:59.949root 11241100x8000000000000000556102Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:59.949{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.caf5003ea88da9202021-12-21 11:38:59.949root 11241100x8000000000000000556103Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:59.949{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.21d37c6cbcb656042021-12-21 11:38:59.949root 11241100x8000000000000000556104Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:59.949{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ecdb71741215554c2021-12-21 11:38:59.949root 11241100x8000000000000000556105Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:59.949{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.cc0bd918eca96d432021-12-21 11:38:59.949root 11241100x8000000000000000556106Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:59.949{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.fe387a9f51cf3c312021-12-21 11:38:59.949root 11241100x8000000000000000556107Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:38:59.950{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.00a6601e8baf4d892021-12-21 11:38:59.950root 11241100x8000000000000000556108Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:00.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3a03bcf00bd599d72021-12-21 11:39:00.443root 11241100x8000000000000000556109Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:00.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.44f6f9ab38d9b89c2021-12-21 11:39:00.443root 11241100x8000000000000000556110Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:00.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7f7d7b7c448b397b2021-12-21 11:39:00.443root 11241100x8000000000000000556111Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:00.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.acf9539083aa014d2021-12-21 11:39:00.444root 11241100x8000000000000000556112Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:00.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b32db07c2f4eca902021-12-21 11:39:00.444root 11241100x8000000000000000556113Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:00.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4f6d082f1ada7ff12021-12-21 11:39:00.444root 11241100x8000000000000000556114Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:00.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2ff85345c0aa008d2021-12-21 11:39:00.444root 11241100x8000000000000000556115Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:00.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.12ae4eddd7e6e0302021-12-21 11:39:00.444root 11241100x8000000000000000556116Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:00.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b20099096ec8dbf52021-12-21 11:39:00.444root 11241100x8000000000000000556117Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:00.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3fe43cabb3247e122021-12-21 11:39:00.444root 11241100x8000000000000000556118Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:00.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4326b8e19c83a6362021-12-21 11:39:00.444root 11241100x8000000000000000556119Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:00.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8f60134e55787d2b2021-12-21 11:39:00.444root 11241100x8000000000000000556120Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:00.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ecb6d940730c8f392021-12-21 11:39:00.444root 11241100x8000000000000000556121Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:00.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0049d6a30da993822021-12-21 11:39:00.444root 11241100x8000000000000000556122Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:00.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.96e5ece6a52ed9802021-12-21 11:39:00.445root 11241100x8000000000000000556123Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:00.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f6f69c03ee5f08e82021-12-21 11:39:00.445root 11241100x8000000000000000556124Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:00.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f284d84ab29b9b122021-12-21 11:39:00.445root 11241100x8000000000000000556125Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:00.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c20ae2b9df0a83472021-12-21 11:39:00.445root 11241100x8000000000000000556126Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:00.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a98a3658a704b5512021-12-21 11:39:00.445root 11241100x8000000000000000556127Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:00.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d7c7f08c5e583f312021-12-21 11:39:00.445root 11241100x8000000000000000556128Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:00.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8c7744bd9f88c0b22021-12-21 11:39:00.445root 11241100x8000000000000000556129Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:00.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.83df81a1d135a0012021-12-21 11:39:00.445root 11241100x8000000000000000556130Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:00.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.028d99d84e2ac5db2021-12-21 11:39:00.445root 11241100x8000000000000000556131Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:00.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.763870d8f05711152021-12-21 11:39:00.445root 11241100x8000000000000000556132Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:00.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.90a8625b33abfe2e2021-12-21 11:39:00.445root 11241100x8000000000000000556133Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:00.446{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c1fd06e883e529a72021-12-21 11:39:00.446root 11241100x8000000000000000556134Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:00.446{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.67d91546b7b4762c2021-12-21 11:39:00.446root 11241100x8000000000000000556135Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:00.446{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.24faa95ebcd399902021-12-21 11:39:00.446root 11241100x8000000000000000556136Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:00.446{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c94383cbc38509fa2021-12-21 11:39:00.446root 11241100x8000000000000000556137Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:00.446{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e9629343ba5cfb5a2021-12-21 11:39:00.446root 11241100x8000000000000000556138Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:00.446{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8bf4f29a5b06c9ed2021-12-21 11:39:00.446root 11241100x8000000000000000556139Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:00.446{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.09ddd01d681405632021-12-21 11:39:00.446root 11241100x8000000000000000556140Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:00.446{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.51dde1f8ccb07da02021-12-21 11:39:00.446root 11241100x8000000000000000556141Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:00.446{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.375ec92ae9e761392021-12-21 11:39:00.446root 11241100x8000000000000000556142Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:00.446{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.083a30e6ba0ef9552021-12-21 11:39:00.446root 11241100x8000000000000000556143Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:00.446{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.dbb6207b54198d072021-12-21 11:39:00.446root 11241100x8000000000000000556144Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:00.446{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ce55d7c7597052d72021-12-21 11:39:00.446root 11241100x8000000000000000556145Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:00.446{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9456da5f4da8e9a72021-12-21 11:39:00.446root 11241100x8000000000000000556146Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:00.447{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f854c231277e26902021-12-21 11:39:00.447root 11241100x8000000000000000556147Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:00.447{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7066b8d926a6984f2021-12-21 11:39:00.447root 11241100x8000000000000000556148Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:00.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2eb52a9991228b962021-12-21 11:39:00.943root 11241100x8000000000000000556149Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:00.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.bf7799fc4bf14ebd2021-12-21 11:39:00.943root 11241100x8000000000000000556150Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:00.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4c77d277d16836ac2021-12-21 11:39:00.943root 11241100x8000000000000000556151Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:00.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c3420c42dda7328c2021-12-21 11:39:00.943root 11241100x8000000000000000556152Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:00.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.fe30c9876445829d2021-12-21 11:39:00.943root 11241100x8000000000000000556153Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:00.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a186baefab29bfde2021-12-21 11:39:00.943root 11241100x8000000000000000556154Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:00.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c6c131ddf4a1f8a62021-12-21 11:39:00.943root 11241100x8000000000000000556155Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:00.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.580d4c0bbdb3abc62021-12-21 11:39:00.944root 11241100x8000000000000000556156Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:00.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b8c88cbb1b6f50252021-12-21 11:39:00.944root 11241100x8000000000000000556157Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:00.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8724f51171b24b8f2021-12-21 11:39:00.944root 11241100x8000000000000000556158Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:00.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0ec0c5a287380c292021-12-21 11:39:00.944root 11241100x8000000000000000556159Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:00.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d57d33e06c958ea92021-12-21 11:39:00.944root 11241100x8000000000000000556160Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:00.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7ebb93945d31195f2021-12-21 11:39:00.944root 11241100x8000000000000000556161Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:00.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.02d660df41177f792021-12-21 11:39:00.944root 11241100x8000000000000000556162Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:00.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2a7a2744a45c4f0b2021-12-21 11:39:00.944root 11241100x8000000000000000556163Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:00.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0a0ca73f2b7886292021-12-21 11:39:00.945root 11241100x8000000000000000556164Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:00.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6ec664c1e9e1c9662021-12-21 11:39:00.945root 11241100x8000000000000000556165Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:00.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0b69b32273d25ac52021-12-21 11:39:00.945root 11241100x8000000000000000556166Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:00.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a75e1e83fdbc10a62021-12-21 11:39:00.945root 11241100x8000000000000000556167Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:00.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9a92a9fbbe8562622021-12-21 11:39:00.945root 11241100x8000000000000000556168Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:00.946{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e5dc5d49aabd60972021-12-21 11:39:00.946root 11241100x8000000000000000556169Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:00.946{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4c9b85d1c79429122021-12-21 11:39:00.946root 11241100x8000000000000000556170Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:00.946{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.cb778b1bf605ef792021-12-21 11:39:00.946root 11241100x8000000000000000556171Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:00.946{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.46895d91958c96b62021-12-21 11:39:00.946root 11241100x8000000000000000556172Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:00.946{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.676117add5e185312021-12-21 11:39:00.946root 11241100x8000000000000000556173Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:00.947{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.894e0873a1c99ba62021-12-21 11:39:00.947root 11241100x8000000000000000556174Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:00.947{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e783f22fe33fb1142021-12-21 11:39:00.947root 11241100x8000000000000000556175Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:00.947{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9842ed97b4b5cdf02021-12-21 11:39:00.947root 11241100x8000000000000000556176Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:00.947{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.641e62259da86ebb2021-12-21 11:39:00.947root 11241100x8000000000000000556177Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:00.947{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d23e4ed7b0343a2e2021-12-21 11:39:00.947root 11241100x8000000000000000556178Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:00.947{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.70e99805bc4903882021-12-21 11:39:00.947root 11241100x8000000000000000556179Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:00.947{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8e21a32f8eb238972021-12-21 11:39:00.947root 11241100x8000000000000000556180Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:00.947{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7ee11b251ec2ba692021-12-21 11:39:00.947root 11241100x8000000000000000556181Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:00.947{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4ed2d3dae2afef092021-12-21 11:39:00.947root 11241100x8000000000000000556182Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:00.947{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ca552100bb54eb992021-12-21 11:39:00.947root 11241100x8000000000000000556183Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:00.948{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.11bbee2e63d415742021-12-21 11:39:00.948root 11241100x8000000000000000556184Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:00.948{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0ad78cbb287067612021-12-21 11:39:00.948root 11241100x8000000000000000556185Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:00.948{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.78de134cd3f988bb2021-12-21 11:39:00.948root 11241100x8000000000000000556186Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:00.948{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3af1f05e267718f02021-12-21 11:39:00.948root 11241100x8000000000000000556187Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:00.948{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6ffe7bf59369167f2021-12-21 11:39:00.948root 11241100x8000000000000000556188Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:00.948{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3abf45762d454b0a2021-12-21 11:39:00.948root 11241100x8000000000000000556189Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:00.948{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1aca2c3ffaaa88802021-12-21 11:39:00.948root 11241100x8000000000000000556190Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:00.949{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a49b12636c600df32021-12-21 11:39:00.949root 11241100x8000000000000000556191Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:00.949{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d6ab8c42c74d4c5b2021-12-21 11:39:00.949root 11241100x8000000000000000556192Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:00.949{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.eb9e687dff788a6f2021-12-21 11:39:00.949root 11241100x8000000000000000556193Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:00.949{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.479447c0f82a42912021-12-21 11:39:00.949root 11241100x8000000000000000556194Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:00.949{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.704e1990776f30482021-12-21 11:39:00.949root 11241100x8000000000000000556195Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:00.949{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.52b962c4ddaa21822021-12-21 11:39:00.949root 11241100x8000000000000000556196Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:00.949{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7889f7116403f26f2021-12-21 11:39:00.949root 11241100x8000000000000000556197Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:00.949{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d6d632b969162fc82021-12-21 11:39:00.949root 11241100x8000000000000000556198Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:00.950{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.fdc947a41633ab7b2021-12-21 11:39:00.950root 11241100x8000000000000000556199Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:00.950{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.986499e1f6f15a872021-12-21 11:39:00.950root 11241100x8000000000000000556200Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:00.950{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e5b20fd1d83449e62021-12-21 11:39:00.950root 11241100x8000000000000000556201Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:00.950{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c159f38a9a656a842021-12-21 11:39:00.950root 11241100x8000000000000000556202Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:00.950{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.55edd35af0a0e5772021-12-21 11:39:00.950root 11241100x8000000000000000556203Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:00.950{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0b06209a8ada8bf22021-12-21 11:39:00.950root 11241100x8000000000000000556204Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:00.950{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.df001411c764a3882021-12-21 11:39:00.950root 11241100x8000000000000000556205Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:00.950{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8532ad3ba8d6c1bf2021-12-21 11:39:00.950root 11241100x8000000000000000556206Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:00.951{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.460e8139caa4931f2021-12-21 11:39:00.951root 11241100x8000000000000000556207Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:00.951{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5b4a6c55d5ee09062021-12-21 11:39:00.951root 11241100x8000000000000000556208Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:00.951{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a310f294ca9d57972021-12-21 11:39:00.951root 11241100x8000000000000000556209Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:01.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.524da9e2aff0d26d2021-12-21 11:39:01.443root 11241100x8000000000000000556210Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:01.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f995637970fd94c02021-12-21 11:39:01.443root 11241100x8000000000000000556211Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:01.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7d389205bc77d0262021-12-21 11:39:01.443root 11241100x8000000000000000556212Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:01.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.82d6008e60f8bb1b2021-12-21 11:39:01.443root 11241100x8000000000000000556213Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:01.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.cff56e70f3bb494b2021-12-21 11:39:01.443root 11241100x8000000000000000556214Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:01.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f2065a123aad724e2021-12-21 11:39:01.443root 11241100x8000000000000000556215Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:01.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.64d2be4c1f28a2d12021-12-21 11:39:01.444root 11241100x8000000000000000556216Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:01.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8eab9cb62ab076892021-12-21 11:39:01.444root 11241100x8000000000000000556217Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:01.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7d3380d6d2ceb1c72021-12-21 11:39:01.444root 11241100x8000000000000000556218Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:01.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d56ce4c3201ef41b2021-12-21 11:39:01.444root 11241100x8000000000000000556219Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:01.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d93b3bfe865b1da72021-12-21 11:39:01.444root 11241100x8000000000000000556220Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:01.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.125b4ebd5a0777892021-12-21 11:39:01.444root 11241100x8000000000000000556221Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:01.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.fd6b95664439d3542021-12-21 11:39:01.444root 11241100x8000000000000000556222Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:01.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3431326251ddc2902021-12-21 11:39:01.444root 11241100x8000000000000000556223Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:01.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7722e94eab83df382021-12-21 11:39:01.444root 11241100x8000000000000000556224Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:01.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.adbf5495e7e199642021-12-21 11:39:01.444root 11241100x8000000000000000556225Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:01.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.cdea8e8cf01e59422021-12-21 11:39:01.445root 11241100x8000000000000000556226Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:01.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ed8c2dec90a12e4f2021-12-21 11:39:01.445root 11241100x8000000000000000556227Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:01.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d9c8467c0953865e2021-12-21 11:39:01.445root 11241100x8000000000000000556228Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:01.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d2f563343488533f2021-12-21 11:39:01.445root 11241100x8000000000000000556229Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:01.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ec9db8e6e401af452021-12-21 11:39:01.445root 11241100x8000000000000000556230Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:01.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0f6f4739308e53322021-12-21 11:39:01.445root 11241100x8000000000000000556231Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:01.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4086f5e38aa197782021-12-21 11:39:01.445root 11241100x8000000000000000556232Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:01.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.076f3743200aa3e22021-12-21 11:39:01.445root 11241100x8000000000000000556233Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:01.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.bddceebc76f8bcba2021-12-21 11:39:01.445root 11241100x8000000000000000556234Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:01.446{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2efd4ce7dbe01e3c2021-12-21 11:39:01.446root 11241100x8000000000000000556235Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:01.446{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7e4001ed7eeafff52021-12-21 11:39:01.446root 11241100x8000000000000000556236Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:01.446{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0268e3daa7e8710e2021-12-21 11:39:01.446root 11241100x8000000000000000556237Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:01.446{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2285f16eb8971a5f2021-12-21 11:39:01.446root 11241100x8000000000000000556238Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:01.447{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ba08ca0a840cd6972021-12-21 11:39:01.447root 11241100x8000000000000000556239Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:01.447{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1cd356fc2f79aabb2021-12-21 11:39:01.447root 11241100x8000000000000000556240Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:01.448{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.12936842a54813a92021-12-21 11:39:01.448root 11241100x8000000000000000556241Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:01.448{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e9a8d7e8be4e5aa92021-12-21 11:39:01.448root 11241100x8000000000000000556242Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:01.448{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9aa6c06c9f0f10762021-12-21 11:39:01.448root 11241100x8000000000000000556243Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:01.448{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5363a402353e96602021-12-21 11:39:01.448root 11241100x8000000000000000556244Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:01.448{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f252c744636f14672021-12-21 11:39:01.448root 11241100x8000000000000000556245Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:01.448{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4d020b838103ad4e2021-12-21 11:39:01.448root 11241100x8000000000000000556246Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:01.448{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b82d907eb771bc112021-12-21 11:39:01.448root 11241100x8000000000000000556247Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:01.448{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1844f8aae29c6d142021-12-21 11:39:01.448root 11241100x8000000000000000556248Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:01.449{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ee6c3e08f0f76ab52021-12-21 11:39:01.449root 11241100x8000000000000000556249Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:01.449{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.04c29131d3e7d1da2021-12-21 11:39:01.449root 11241100x8000000000000000556250Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:01.449{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.58f3fa1624be9b602021-12-21 11:39:01.449root 11241100x8000000000000000556251Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:01.449{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a2e882f6212618b52021-12-21 11:39:01.449root 11241100x8000000000000000556252Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:01.449{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.604da5fd410990082021-12-21 11:39:01.449root 11241100x8000000000000000556253Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:01.449{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.192da6f3dac912422021-12-21 11:39:01.449root 11241100x8000000000000000556254Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:01.449{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3ae6832cbbf556312021-12-21 11:39:01.449root 11241100x8000000000000000556255Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:01.449{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.29ac68fdaf79608c2021-12-21 11:39:01.449root 11241100x8000000000000000556256Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:01.449{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7da942b20fe9b4932021-12-21 11:39:01.449root 11241100x8000000000000000556257Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:01.450{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8c15887e0e1f70042021-12-21 11:39:01.450root 11241100x8000000000000000556258Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:01.450{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.35a7e51f47c264162021-12-21 11:39:01.450root 11241100x8000000000000000556259Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:01.450{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4c672aa8ca96896b2021-12-21 11:39:01.450root 11241100x8000000000000000556260Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:01.450{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.026c3cf491ed0f232021-12-21 11:39:01.450root 11241100x8000000000000000556261Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:01.450{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f6e3c1016b6c85152021-12-21 11:39:01.450root 11241100x8000000000000000556262Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:01.450{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0ae33355d1b7fbce2021-12-21 11:39:01.450root 11241100x8000000000000000556263Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:01.450{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.39918ddefc499c4e2021-12-21 11:39:01.450root 11241100x8000000000000000556264Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:01.451{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.84f4ed5e06f4907c2021-12-21 11:39:01.451root 11241100x8000000000000000556265Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:01.451{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.fea7282122aa38b32021-12-21 11:39:01.451root 11241100x8000000000000000556266Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:01.451{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f2789f88802213262021-12-21 11:39:01.451root 11241100x8000000000000000556267Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:01.451{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b5f5a245851a27822021-12-21 11:39:01.451root 11241100x8000000000000000556268Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:01.451{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.02661c27d071d95f2021-12-21 11:39:01.451root 11241100x8000000000000000556269Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:01.451{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a1c3fd8d4b7b653a2021-12-21 11:39:01.451root 11241100x8000000000000000556270Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:01.451{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9f074cb7bbe3160a2021-12-21 11:39:01.451root 11241100x8000000000000000556271Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:01.451{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d69c0521e4a1372b2021-12-21 11:39:01.451root 11241100x8000000000000000556272Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:01.451{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9d962d70c83a24c42021-12-21 11:39:01.451root 11241100x8000000000000000556273Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:01.451{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a8f6ea08f14d58d72021-12-21 11:39:01.451root 11241100x8000000000000000556274Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:01.452{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.96aa77b322e293d82021-12-21 11:39:01.452root 11241100x8000000000000000556275Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:01.452{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1d15fd1e1e15f5ff2021-12-21 11:39:01.452root 11241100x8000000000000000556276Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:01.452{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.641f1caba40d09bf2021-12-21 11:39:01.452root 11241100x8000000000000000556277Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:01.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.63644a52b35ebfa42021-12-21 11:39:01.943root 11241100x8000000000000000556278Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:01.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2b49ea97a717eebc2021-12-21 11:39:01.943root 11241100x8000000000000000556279Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:01.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d4822aa3f400db742021-12-21 11:39:01.943root 11241100x8000000000000000556280Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:01.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1c9d00528d1126e82021-12-21 11:39:01.943root 11241100x8000000000000000556281Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:01.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.330aa6a915b68e092021-12-21 11:39:01.944root 11241100x8000000000000000556282Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:01.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.880fab953d88fc842021-12-21 11:39:01.944root 11241100x8000000000000000556283Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:01.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1484960d769f1ff72021-12-21 11:39:01.944root 11241100x8000000000000000556284Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:01.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1b09ab89177297652021-12-21 11:39:01.944root 11241100x8000000000000000556285Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:01.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.49dc77e8b469adf62021-12-21 11:39:01.944root 11241100x8000000000000000556286Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:01.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7bf1e51d1fb6c5b72021-12-21 11:39:01.944root 11241100x8000000000000000556287Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:01.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.279bc9b3edb8dc392021-12-21 11:39:01.944root 11241100x8000000000000000556288Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:01.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f9903177ddd55e9b2021-12-21 11:39:01.944root 11241100x8000000000000000556289Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:01.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5a170fc6a45be6812021-12-21 11:39:01.944root 11241100x8000000000000000556290Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:01.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d178fbfb43f1863d2021-12-21 11:39:01.944root 11241100x8000000000000000556291Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:01.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.63c2b7e6db62c30a2021-12-21 11:39:01.944root 11241100x8000000000000000556292Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:01.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.92d929b99c7e77d32021-12-21 11:39:01.945root 11241100x8000000000000000556293Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:01.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8737fd1e44f33d462021-12-21 11:39:01.945root 11241100x8000000000000000556294Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:01.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4c9fa31854c203112021-12-21 11:39:01.945root 11241100x8000000000000000556295Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:01.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a9bdb7072f1139d02021-12-21 11:39:01.945root 11241100x8000000000000000556296Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:01.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5ad5b0695c85138b2021-12-21 11:39:01.945root 11241100x8000000000000000556297Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:01.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.af427bc0ba88a7642021-12-21 11:39:01.945root 11241100x8000000000000000556298Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:01.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5b9eea70039a4c012021-12-21 11:39:01.945root 11241100x8000000000000000556299Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:01.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.208f7fa7dbffccdc2021-12-21 11:39:01.945root 11241100x8000000000000000556300Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:01.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.cdfda722d26cd6d42021-12-21 11:39:01.945root 11241100x8000000000000000556301Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:01.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e76d1f4d5ffcfcac2021-12-21 11:39:01.945root 11241100x8000000000000000556302Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:01.946{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f8bbc27ef8797f302021-12-21 11:39:01.946root 11241100x8000000000000000556303Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:01.946{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9c6e58160c69d5242021-12-21 11:39:01.946root 11241100x8000000000000000556304Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:01.946{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.52b90805e58c02842021-12-21 11:39:01.946root 11241100x8000000000000000556305Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:01.946{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c85eb9ccb81163be2021-12-21 11:39:01.946root 11241100x8000000000000000556306Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:01.946{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.70e2b7c5ff5f217e2021-12-21 11:39:01.946root 11241100x8000000000000000556307Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:01.946{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e4b177d7a7ec467b2021-12-21 11:39:01.946root 11241100x8000000000000000556308Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:01.946{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.609c2ef34f501b162021-12-21 11:39:01.946root 11241100x8000000000000000556309Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:01.946{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.086b93fc59a312142021-12-21 11:39:01.946root 11241100x8000000000000000556310Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:01.946{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b28d73f62dfbd9872021-12-21 11:39:01.946root 11241100x8000000000000000556311Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:01.946{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.87fa953760715cab2021-12-21 11:39:01.946root 11241100x8000000000000000556312Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:01.948{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ded568ec7a0eddd22021-12-21 11:39:01.948root 11241100x8000000000000000556313Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:01.948{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b380671d4768bc882021-12-21 11:39:01.948root 11241100x8000000000000000556314Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:01.948{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.fb69f7a65aaa739e2021-12-21 11:39:01.948root 11241100x8000000000000000556315Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:01.948{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c2b0876c8f12dea82021-12-21 11:39:01.948root 11241100x8000000000000000556316Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:01.949{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.63528f5684e839062021-12-21 11:39:01.949root 11241100x8000000000000000556317Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:01.949{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c2739b0b5f85c8402021-12-21 11:39:01.949root 11241100x8000000000000000556318Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:01.949{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9f54eabd9e977f7a2021-12-21 11:39:01.949root 11241100x8000000000000000556319Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:01.949{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.769a7ead10d225922021-12-21 11:39:01.949root 11241100x8000000000000000556320Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:01.949{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d9858af49e15174e2021-12-21 11:39:01.949root 11241100x8000000000000000556321Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:01.949{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.91138beb82295da42021-12-21 11:39:01.949root 11241100x8000000000000000556322Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:01.949{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e2ed4f108691739c2021-12-21 11:39:01.949root 11241100x8000000000000000556323Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:01.949{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.56499e8bf1985af82021-12-21 11:39:01.949root 11241100x8000000000000000556324Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:01.949{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3604b947aabe5fc92021-12-21 11:39:01.949root 11241100x8000000000000000556325Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:01.949{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.009cd073e7f5235a2021-12-21 11:39:01.949root 11241100x8000000000000000556326Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:01.949{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2d0554790a1986112021-12-21 11:39:01.949root 11241100x8000000000000000556327Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:01.950{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.56ae425d5e96bc4f2021-12-21 11:39:01.950root 354300x8000000000000000556328Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:02.241{ec2b6afe-95d9-61c1-5175-3a0400000000}5346/opt/splunkforwarder/etc/apps/Splunk_TA_stream/linux_x86_64/bin/streamfwdroottcptruefalse10.0.1.25-48850-false10.0.1.12-8000- 11241100x8000000000000000556329Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:02.242{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b681f1fa4de939d02021-12-21 11:39:02.242root 11241100x8000000000000000556330Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:02.242{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.20fa8766475f77c62021-12-21 11:39:02.242root 11241100x8000000000000000556331Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:02.242{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.34605f462e1ea1ea2021-12-21 11:39:02.242root 11241100x8000000000000000556332Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:02.242{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8c7a33bb06b547182021-12-21 11:39:02.242root 11241100x8000000000000000556333Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:02.242{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0f52a8aff95d7ba42021-12-21 11:39:02.242root 11241100x8000000000000000556334Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:02.242{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1221a3a6f4a1b6e72021-12-21 11:39:02.242root 11241100x8000000000000000556335Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:02.243{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.85422c715f1cd53a2021-12-21 11:39:02.243root 11241100x8000000000000000556336Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:02.243{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.179d20c35e56823b2021-12-21 11:39:02.243root 11241100x8000000000000000556337Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:02.243{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b9d405bd4955c5672021-12-21 11:39:02.243root 11241100x8000000000000000556338Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:02.243{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f69b046166a0e1e52021-12-21 11:39:02.243root 11241100x8000000000000000556339Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:02.243{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.629a69b66c79c1ca2021-12-21 11:39:02.243root 11241100x8000000000000000556340Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:02.243{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.fb26c7ce6fb1912e2021-12-21 11:39:02.243root 11241100x8000000000000000556341Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:02.244{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5c78c3c1d169a65f2021-12-21 11:39:02.244root 11241100x8000000000000000556342Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:02.244{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.15ae668292e774322021-12-21 11:39:02.244root 11241100x8000000000000000556343Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:02.244{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.29c09d61c688b47e2021-12-21 11:39:02.244root 11241100x8000000000000000556344Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:02.244{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0e8fa00f0a7d5f5a2021-12-21 11:39:02.244root 11241100x8000000000000000556345Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:02.244{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0a3a856f5ebe3eda2021-12-21 11:39:02.244root 11241100x8000000000000000556346Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:02.244{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.24dceeb496ee1c0c2021-12-21 11:39:02.244root 11241100x8000000000000000556347Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:02.245{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.71f4c836816fe5df2021-12-21 11:39:02.245root 11241100x8000000000000000556348Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:02.245{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.cd536b95635f02132021-12-21 11:39:02.245root 11241100x8000000000000000556349Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:02.245{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3faa7aeff7feea0d2021-12-21 11:39:02.245root 11241100x8000000000000000556350Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:02.245{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c55908afa5aebc0f2021-12-21 11:39:02.245root 11241100x8000000000000000556351Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:02.245{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7deb87844831f13d2021-12-21 11:39:02.245root 11241100x8000000000000000556352Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:02.245{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.37c0d0d01f52e1d22021-12-21 11:39:02.245root 11241100x8000000000000000556353Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:02.246{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3061b8f986b4df012021-12-21 11:39:02.246root 11241100x8000000000000000556354Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:02.246{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.30d7e82550f462dc2021-12-21 11:39:02.246root 11241100x8000000000000000556355Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:02.246{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.21bd9e1e1f284ba32021-12-21 11:39:02.246root 11241100x8000000000000000556356Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:02.246{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.258f9fcdd4dd21442021-12-21 11:39:02.246root 11241100x8000000000000000556357Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:02.246{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8b1c954f89c0574c2021-12-21 11:39:02.246root 11241100x8000000000000000556358Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:02.246{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.545f32adef7b232f2021-12-21 11:39:02.246root 11241100x8000000000000000556359Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:02.247{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4290fe13bad5550a2021-12-21 11:39:02.247root 11241100x8000000000000000556360Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:02.247{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d6f5f4490f3543d42021-12-21 11:39:02.247root 11241100x8000000000000000556361Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:02.247{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4e208cba400d8c992021-12-21 11:39:02.247root 11241100x8000000000000000556362Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:02.247{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0a7bad81441ca5d22021-12-21 11:39:02.247root 11241100x8000000000000000556363Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:02.247{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5d52f46b526ec6502021-12-21 11:39:02.247root 11241100x8000000000000000556364Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:02.249{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.dbcc44f5c09f3a962021-12-21 11:39:02.249root 11241100x8000000000000000556365Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:02.249{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7369bada49b703192021-12-21 11:39:02.249root 11241100x8000000000000000556366Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:02.249{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d4fa0a1ba6ad93542021-12-21 11:39:02.249root 11241100x8000000000000000556367Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:02.249{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5a3bfbc39f62b9832021-12-21 11:39:02.249root 11241100x8000000000000000556368Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:02.249{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d9ca371471316fa82021-12-21 11:39:02.249root 11241100x8000000000000000556369Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:02.249{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5f7faa132d4e28b52021-12-21 11:39:02.249root 11241100x8000000000000000556370Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:02.249{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d185179c9d3f6d4d2021-12-21 11:39:02.249root 11241100x8000000000000000556371Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:02.250{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c4a642c75a9efbdb2021-12-21 11:39:02.250root 11241100x8000000000000000556372Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:02.250{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d1c2ae474fde47e12021-12-21 11:39:02.250root 11241100x8000000000000000556373Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:02.250{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.72cef661d6d944a72021-12-21 11:39:02.250root 11241100x8000000000000000556374Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:02.250{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3090b9252c048ddb2021-12-21 11:39:02.250root 11241100x8000000000000000556375Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:02.250{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.42e1212a8264e8092021-12-21 11:39:02.250root 11241100x8000000000000000556376Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:02.251{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7007fc5661f4e29b2021-12-21 11:39:02.251root 11241100x8000000000000000556377Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:02.251{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ba01d485aee3d1fc2021-12-21 11:39:02.251root 11241100x8000000000000000556378Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:02.251{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a6fcafddc50a7f772021-12-21 11:39:02.251root 11241100x8000000000000000556379Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:02.251{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d263690f0ef143e42021-12-21 11:39:02.251root 11241100x8000000000000000556380Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:02.251{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a12f600129cfdeb62021-12-21 11:39:02.251root 11241100x8000000000000000556381Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:02.251{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c4dc86436d2608fc2021-12-21 11:39:02.251root 11241100x8000000000000000556382Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:02.251{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.01832a85efbf7e2b2021-12-21 11:39:02.251root 11241100x8000000000000000556383Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:02.252{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d8101a2091356b5a2021-12-21 11:39:02.252root 11241100x8000000000000000556384Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:02.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.888159bccaac69692021-12-21 11:39:02.693root 11241100x8000000000000000556385Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:02.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.82edd048f974725d2021-12-21 11:39:02.693root 11241100x8000000000000000556386Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:02.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.821d3b1ce9fe63b32021-12-21 11:39:02.694root 11241100x8000000000000000556387Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:02.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4b44c96ccd7772042021-12-21 11:39:02.694root 11241100x8000000000000000556388Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:02.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0407e00c84a06e322021-12-21 11:39:02.694root 11241100x8000000000000000556389Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:02.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0824a6a722c99fdc2021-12-21 11:39:02.694root 11241100x8000000000000000556390Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:02.695{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b80aa8deb3ec6e9e2021-12-21 11:39:02.695root 11241100x8000000000000000556391Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:02.695{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.66619f893be85b4c2021-12-21 11:39:02.695root 11241100x8000000000000000556392Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:02.695{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.bf785bc2c512bc312021-12-21 11:39:02.695root 11241100x8000000000000000556393Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:02.695{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.af9f1b157767cdbe2021-12-21 11:39:02.695root 11241100x8000000000000000556394Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:02.695{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5fe7301b6cafc2392021-12-21 11:39:02.695root 11241100x8000000000000000556395Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:02.695{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.cfac7bd7487e6a0d2021-12-21 11:39:02.695root 11241100x8000000000000000556396Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:02.695{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ac1343364f8d4e162021-12-21 11:39:02.695root 11241100x8000000000000000556397Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:02.695{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5bd997b8d18b94ee2021-12-21 11:39:02.695root 11241100x8000000000000000556398Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:02.695{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f24adf917db6d5252021-12-21 11:39:02.695root 11241100x8000000000000000556399Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:02.695{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.991108352d3a00972021-12-21 11:39:02.695root 11241100x8000000000000000556400Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:02.695{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b589fe75564cee912021-12-21 11:39:02.695root 11241100x8000000000000000556401Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:02.696{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2055b799a499f7292021-12-21 11:39:02.696root 11241100x8000000000000000556402Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:02.696{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.696c65fd2b8037d32021-12-21 11:39:02.696root 11241100x8000000000000000556403Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:02.696{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.04ee36277d1bf4952021-12-21 11:39:02.696root 11241100x8000000000000000556404Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:02.696{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.00b9b022f99a11eb2021-12-21 11:39:02.696root 11241100x8000000000000000556405Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:02.696{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e2016c668e1035c52021-12-21 11:39:02.696root 11241100x8000000000000000556406Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:02.696{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.74da570a21d0ee3e2021-12-21 11:39:02.696root 11241100x8000000000000000556407Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:02.696{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.688438ab241c49352021-12-21 11:39:02.696root 11241100x8000000000000000556408Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:02.696{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.bcce2eef9d0bdf092021-12-21 11:39:02.696root 11241100x8000000000000000556409Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:02.696{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a4f7ee6ea3e3c1be2021-12-21 11:39:02.696root 11241100x8000000000000000556410Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:02.696{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d6afa3c8bb1f28c42021-12-21 11:39:02.696root 11241100x8000000000000000556411Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:02.697{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7af7897d3605bce82021-12-21 11:39:02.697root 11241100x8000000000000000556412Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:02.697{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4e58cfe71b413d542021-12-21 11:39:02.697root 11241100x8000000000000000556413Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:02.697{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b0b2da9793ebe4922021-12-21 11:39:02.697root 11241100x8000000000000000556414Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:02.697{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c9cb7be59c7cc0a62021-12-21 11:39:02.697root 11241100x8000000000000000556415Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:02.698{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.346030f5269d9a4e2021-12-21 11:39:02.698root 11241100x8000000000000000556416Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:02.698{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.cbfaf1f221c7a5662021-12-21 11:39:02.698root 11241100x8000000000000000556417Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:02.698{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f8c7ee3d2a3530a62021-12-21 11:39:02.698root 11241100x8000000000000000556418Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:02.698{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.951073b36d947c9d2021-12-21 11:39:02.698root 11241100x8000000000000000556419Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:02.699{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5f43b6ed298d7c0f2021-12-21 11:39:02.699root 11241100x8000000000000000556420Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:02.699{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2be2dbb11ab31b5d2021-12-21 11:39:02.699root 11241100x8000000000000000556421Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:02.699{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e79ce6d754343b3c2021-12-21 11:39:02.699root 11241100x8000000000000000556422Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:02.699{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.20afb37b2d88cd072021-12-21 11:39:02.699root 11241100x8000000000000000556423Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:02.699{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.513e6b4a874f1c4b2021-12-21 11:39:02.699root 11241100x8000000000000000556424Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:02.699{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.35c03103e9d5fe662021-12-21 11:39:02.699root 11241100x8000000000000000556425Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:02.699{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d8c010322a827cc32021-12-21 11:39:02.699root 11241100x8000000000000000556426Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:02.699{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6456be4a1c2017182021-12-21 11:39:02.699root 11241100x8000000000000000556427Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:03.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c25035227be01b782021-12-21 11:39:03.193root 11241100x8000000000000000556428Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:03.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ef24986c840120d62021-12-21 11:39:03.193root 11241100x8000000000000000556429Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:03.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3de93988349aa7342021-12-21 11:39:03.193root 11241100x8000000000000000556430Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:03.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7adcc35be6c6272b2021-12-21 11:39:03.193root 11241100x8000000000000000556431Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:03.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.91ef303c5245d07a2021-12-21 11:39:03.193root 11241100x8000000000000000556432Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:03.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.bafd1c95413239072021-12-21 11:39:03.193root 11241100x8000000000000000556433Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:03.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.50a92434e196b63c2021-12-21 11:39:03.193root 11241100x8000000000000000556434Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:03.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.877857d38f7537a02021-12-21 11:39:03.193root 11241100x8000000000000000556435Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:03.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.50e9075165cc3c5c2021-12-21 11:39:03.194root 11241100x8000000000000000556436Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:03.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9a68f7074d44a7dd2021-12-21 11:39:03.194root 11241100x8000000000000000556437Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:03.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.358c86f0089a35b82021-12-21 11:39:03.194root 11241100x8000000000000000556438Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:03.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0ee36e684d8db9c62021-12-21 11:39:03.194root 11241100x8000000000000000556439Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:03.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b2990a5bc761bc652021-12-21 11:39:03.194root 11241100x8000000000000000556440Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:03.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8aaea0ebd444a2182021-12-21 11:39:03.194root 11241100x8000000000000000556441Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:03.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b55779e65f3d76ec2021-12-21 11:39:03.194root 11241100x8000000000000000556442Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:03.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.95baf4f7e13b9b7b2021-12-21 11:39:03.194root 11241100x8000000000000000556443Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:03.198{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.df3a577437b17d042021-12-21 11:39:03.198root 11241100x8000000000000000556444Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:03.198{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.61659380a340952b2021-12-21 11:39:03.198root 11241100x8000000000000000556445Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:03.198{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.175b5469c20542b62021-12-21 11:39:03.198root 11241100x8000000000000000556446Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:03.198{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.93205742bd8afac42021-12-21 11:39:03.198root 11241100x8000000000000000556447Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:03.198{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4f1528e01bea8d752021-12-21 11:39:03.198root 11241100x8000000000000000556448Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:03.198{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1d197a3630ff646d2021-12-21 11:39:03.198root 11241100x8000000000000000556449Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:03.198{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6a3d280c912df5e62021-12-21 11:39:03.198root 11241100x8000000000000000556450Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:03.198{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.58f3317e3b89faa82021-12-21 11:39:03.198root 11241100x8000000000000000556451Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:03.198{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0e725deb7fbd91902021-12-21 11:39:03.198root 11241100x8000000000000000556452Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:03.198{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.aa120e71732f91872021-12-21 11:39:03.198root 11241100x8000000000000000556453Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:03.198{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.bcf0c16443c044532021-12-21 11:39:03.198root 11241100x8000000000000000556454Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:03.198{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b7a25c433fcdbc212021-12-21 11:39:03.198root 11241100x8000000000000000556455Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:03.199{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.04509607128b40bf2021-12-21 11:39:03.199root 11241100x8000000000000000556456Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:03.199{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.21669a4d020ad4ee2021-12-21 11:39:03.199root 11241100x8000000000000000556457Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:03.199{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.518bf00393ff38f32021-12-21 11:39:03.199root 11241100x8000000000000000556458Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:03.199{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.22289fdac289880e2021-12-21 11:39:03.199root 11241100x8000000000000000556459Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:03.199{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.32132f1429e185ab2021-12-21 11:39:03.199root 11241100x8000000000000000556460Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:03.199{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.60b7d9441533287b2021-12-21 11:39:03.199root 11241100x8000000000000000556461Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:03.199{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.bc6266dbff28cf892021-12-21 11:39:03.199root 11241100x8000000000000000556462Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:03.200{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.370ad3a4d7f9026a2021-12-21 11:39:03.200root 11241100x8000000000000000556463Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:03.200{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a4d0f50b984de3272021-12-21 11:39:03.200root 11241100x8000000000000000556464Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:03.200{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.20264d3c811dac872021-12-21 11:39:03.200root 11241100x8000000000000000556465Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:03.200{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.99e8510b35bca8dc2021-12-21 11:39:03.200root 11241100x8000000000000000556466Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:03.201{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f7b5667c0164576b2021-12-21 11:39:03.201root 11241100x8000000000000000556467Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:03.201{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.29d26fcd077e63792021-12-21 11:39:03.201root 11241100x8000000000000000556468Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:03.201{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d9c9299b7ce802be2021-12-21 11:39:03.201root 11241100x8000000000000000556469Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:03.201{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5951fefd84ebe0722021-12-21 11:39:03.201root 11241100x8000000000000000556470Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:03.202{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.de67d9781a2a93902021-12-21 11:39:03.202root 11241100x8000000000000000556471Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:03.202{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.88f0c86e91f14fee2021-12-21 11:39:03.202root 11241100x8000000000000000556472Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:03.202{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5bddf0499a90dfc82021-12-21 11:39:03.202root 11241100x8000000000000000556473Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:03.202{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6b8ee9110c8a8c812021-12-21 11:39:03.202root 11241100x8000000000000000556474Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:03.202{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.28522d816c937eb12021-12-21 11:39:03.202root 11241100x8000000000000000556475Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:03.203{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5a2645b2b4e3f3dd2021-12-21 11:39:03.203root 11241100x8000000000000000556476Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:03.203{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2e93e1ad906f4ae22021-12-21 11:39:03.203root 11241100x8000000000000000556477Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:03.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f791c4f56740c6e72021-12-21 11:39:03.693root 11241100x8000000000000000556478Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:03.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.dcd57bf5cee898f82021-12-21 11:39:03.693root 11241100x8000000000000000556479Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:03.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d75b38ff82cf3cb52021-12-21 11:39:03.694root 11241100x8000000000000000556480Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:03.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5bc440a284d678792021-12-21 11:39:03.694root 11241100x8000000000000000556481Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:03.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4ea85997148251362021-12-21 11:39:03.694root 11241100x8000000000000000556482Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:03.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.bbc83e76c780e14f2021-12-21 11:39:03.694root 11241100x8000000000000000556483Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:03.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e9ebd00bd66cfc0f2021-12-21 11:39:03.694root 11241100x8000000000000000556484Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:03.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.06ce43bb226f28e72021-12-21 11:39:03.694root 11241100x8000000000000000556485Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:03.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.38f168572e6cc4592021-12-21 11:39:03.694root 11241100x8000000000000000556486Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:03.695{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a3b6d816bc4ba6b32021-12-21 11:39:03.695root 11241100x8000000000000000556487Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:03.695{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.63d2ff3b61f71a342021-12-21 11:39:03.695root 11241100x8000000000000000556488Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:03.695{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4b9a09eccf8c16c62021-12-21 11:39:03.695root 11241100x8000000000000000556489Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:03.695{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f80742206da5315a2021-12-21 11:39:03.695root 11241100x8000000000000000556490Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:03.695{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ef11d66e1b665e2f2021-12-21 11:39:03.695root 11241100x8000000000000000556491Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:03.695{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2e5292aa4ab1e3d22021-12-21 11:39:03.695root 11241100x8000000000000000556492Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:03.695{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ff7ed9f17f38bb582021-12-21 11:39:03.695root 11241100x8000000000000000556493Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:03.695{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6e7a0bd6f006f2b52021-12-21 11:39:03.695root 11241100x8000000000000000556494Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:03.695{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.61e958de098d13cd2021-12-21 11:39:03.695root 11241100x8000000000000000556495Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:03.696{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.93f8f43876ec5b2c2021-12-21 11:39:03.696root 11241100x8000000000000000556496Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:03.696{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.562e72e16c69c6402021-12-21 11:39:03.696root 11241100x8000000000000000556497Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:03.696{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b1758d78a8bfefa32021-12-21 11:39:03.696root 11241100x8000000000000000556498Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:03.696{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.566d22f14d6a7f892021-12-21 11:39:03.696root 11241100x8000000000000000556499Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:03.696{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.fa89577abcf5ecda2021-12-21 11:39:03.696root 11241100x8000000000000000556500Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:03.696{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0cf1bf4a307eaf702021-12-21 11:39:03.696root 11241100x8000000000000000556501Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:03.696{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f6a3bc1003d1b1222021-12-21 11:39:03.696root 11241100x8000000000000000556502Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:03.696{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3fad17ca9a4e25b32021-12-21 11:39:03.696root 11241100x8000000000000000556503Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:03.696{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.632043e78b0d28772021-12-21 11:39:03.696root 11241100x8000000000000000556504Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:03.697{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.11bcb07f9019eafe2021-12-21 11:39:03.697root 11241100x8000000000000000556505Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:03.697{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.922aa93c165585332021-12-21 11:39:03.697root 11241100x8000000000000000556506Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:03.697{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3a5b592040e0d1bb2021-12-21 11:39:03.697root 11241100x8000000000000000556507Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:03.697{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c3d2045a12ad80632021-12-21 11:39:03.697root 11241100x8000000000000000556508Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:03.697{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a171e910425e71bc2021-12-21 11:39:03.697root 11241100x8000000000000000556509Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:03.697{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.cea6ad363dcac2c62021-12-21 11:39:03.697root 11241100x8000000000000000556510Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:03.698{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9db84f0b91ce40362021-12-21 11:39:03.698root 11241100x8000000000000000556511Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:03.698{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0322f30cee3e6eb52021-12-21 11:39:03.698root 11241100x8000000000000000556512Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:03.698{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e12daf6526bd889e2021-12-21 11:39:03.698root 11241100x8000000000000000556513Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:03.698{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2f1211e9746f64782021-12-21 11:39:03.698root 11241100x8000000000000000556514Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:03.698{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ee3b9708030e89b52021-12-21 11:39:03.698root 11241100x8000000000000000556515Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:03.698{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9eb4ef2584dd7b4c2021-12-21 11:39:03.698root 11241100x8000000000000000556516Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:03.698{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0c336113ab7caa6e2021-12-21 11:39:03.698root 11241100x8000000000000000556517Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:03.699{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6c49ae22b28890d52021-12-21 11:39:03.699root 11241100x8000000000000000556518Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:04.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c88bcc5b9c1085b92021-12-21 11:39:04.193root 11241100x8000000000000000556519Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:04.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a8224e97bd328b872021-12-21 11:39:04.193root 11241100x8000000000000000556520Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:04.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.74ac6d5c03d729ad2021-12-21 11:39:04.193root 11241100x8000000000000000556521Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:04.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d5e4d6af6f017e662021-12-21 11:39:04.193root 11241100x8000000000000000556522Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:04.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a09ec5a4c5e484872021-12-21 11:39:04.193root 11241100x8000000000000000556523Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:04.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.54b3c073462e92242021-12-21 11:39:04.193root 11241100x8000000000000000556524Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:04.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2209f0232c5e49e22021-12-21 11:39:04.193root 11241100x8000000000000000556525Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:04.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.13eba9adc3973c722021-12-21 11:39:04.193root 11241100x8000000000000000556526Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:04.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.062d7fa940c87d132021-12-21 11:39:04.194root 11241100x8000000000000000556527Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:04.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c9d07b9b7b2f7de62021-12-21 11:39:04.194root 11241100x8000000000000000556528Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:04.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a10296938dfb7a292021-12-21 11:39:04.194root 11241100x8000000000000000556529Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:04.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d04ead8ebe0ab2bd2021-12-21 11:39:04.194root 11241100x8000000000000000556530Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:04.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.99d067effb8573342021-12-21 11:39:04.194root 11241100x8000000000000000556531Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:04.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.af1ef7872ab31f482021-12-21 11:39:04.194root 11241100x8000000000000000556532Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:04.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c50bbb76c9faf2f02021-12-21 11:39:04.194root 11241100x8000000000000000556533Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:04.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7515d6571a17ba322021-12-21 11:39:04.194root 11241100x8000000000000000556534Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:04.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3dfad26c2fcc8cc12021-12-21 11:39:04.194root 11241100x8000000000000000556535Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:04.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b32ccc1170ee9e8f2021-12-21 11:39:04.194root 11241100x8000000000000000556536Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:04.195{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.85e0f0150caf05842021-12-21 11:39:04.195root 11241100x8000000000000000556537Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:04.195{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.105b06cf7ce8faa02021-12-21 11:39:04.195root 11241100x8000000000000000556538Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:04.195{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.047f691b53edf9f02021-12-21 11:39:04.195root 11241100x8000000000000000556539Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:04.195{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.aa08dae174979e922021-12-21 11:39:04.195root 11241100x8000000000000000556540Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:04.195{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.fd8b63e00734563e2021-12-21 11:39:04.195root 11241100x8000000000000000556541Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:04.195{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.34ab7ea749ba909f2021-12-21 11:39:04.195root 11241100x8000000000000000556542Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:04.195{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.abbe29a801705b192021-12-21 11:39:04.195root 11241100x8000000000000000556543Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:04.195{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8e734dd2b4e72d6a2021-12-21 11:39:04.195root 11241100x8000000000000000556544Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:04.195{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.123ed3719f77caa42021-12-21 11:39:04.195root 11241100x8000000000000000556545Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:04.196{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e747601ce5b47e702021-12-21 11:39:04.196root 11241100x8000000000000000556546Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:04.196{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.bf1320a2230847d82021-12-21 11:39:04.196root 11241100x8000000000000000556547Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:04.196{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b9c9e66ece2458b52021-12-21 11:39:04.196root 11241100x8000000000000000556548Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:04.196{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3d6714a792ff87d12021-12-21 11:39:04.196root 11241100x8000000000000000556549Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:04.196{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.52fd0984b6af9bc52021-12-21 11:39:04.196root 11241100x8000000000000000556550Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:04.196{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.61744feafec530232021-12-21 11:39:04.196root 11241100x8000000000000000556551Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:04.196{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8f0ccee6175039692021-12-21 11:39:04.196root 11241100x8000000000000000556552Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:04.196{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e6cd1c4e97ce07362021-12-21 11:39:04.196root 11241100x8000000000000000556553Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:04.196{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4d763dfcb8116c582021-12-21 11:39:04.196root 11241100x8000000000000000556554Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:04.196{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5f09ef687dcdbd322021-12-21 11:39:04.196root 11241100x8000000000000000556555Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:04.196{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.28620bd715ea9ea92021-12-21 11:39:04.196root 11241100x8000000000000000556556Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:04.197{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4bfe7531d16f73f62021-12-21 11:39:04.197root 11241100x8000000000000000556557Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:04.197{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e0cb4e69dc8c65182021-12-21 11:39:04.197root 11241100x8000000000000000556558Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:04.197{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d96f4eba1058623d2021-12-21 11:39:04.197root 11241100x8000000000000000556559Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:04.197{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4760a9c2275f73752021-12-21 11:39:04.197root 11241100x8000000000000000556560Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:04.197{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.43213462e16bd50f2021-12-21 11:39:04.197root 11241100x8000000000000000556561Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:04.197{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.24d526c2d7cd561b2021-12-21 11:39:04.197root 11241100x8000000000000000556562Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:04.197{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7b20fa3f0892f8a32021-12-21 11:39:04.197root 11241100x8000000000000000556563Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:04.197{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.fc5e01de9d9e77a92021-12-21 11:39:04.197root 11241100x8000000000000000556564Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:04.197{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.63d7f375aa7074242021-12-21 11:39:04.197root 11241100x8000000000000000556565Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:04.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.83ec9b36dd1be81a2021-12-21 11:39:04.693root 11241100x8000000000000000556566Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:04.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.506408095354c0732021-12-21 11:39:04.694root 11241100x8000000000000000556567Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:04.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7caf481973eea3a62021-12-21 11:39:04.694root 11241100x8000000000000000556568Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:04.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b94305a9a67cb66a2021-12-21 11:39:04.694root 11241100x8000000000000000556569Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:04.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ad0c075f4612c4d32021-12-21 11:39:04.694root 11241100x8000000000000000556570Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:04.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4cc9be5d6dc214092021-12-21 11:39:04.694root 11241100x8000000000000000556571Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:04.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.bb9a48cc11a497492021-12-21 11:39:04.694root 11241100x8000000000000000556572Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:04.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d63c4a7f67436f9d2021-12-21 11:39:04.694root 11241100x8000000000000000556573Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:04.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.cdea912d9de4ac402021-12-21 11:39:04.694root 11241100x8000000000000000556574Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:04.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ebc898ad049100ec2021-12-21 11:39:04.694root 11241100x8000000000000000556575Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:04.695{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8ca848bc6afc0db42021-12-21 11:39:04.695root 11241100x8000000000000000556576Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:04.695{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1d4f6b67db46ce512021-12-21 11:39:04.695root 11241100x8000000000000000556577Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:04.695{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.595538bfa0cae4a22021-12-21 11:39:04.695root 11241100x8000000000000000556578Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:04.695{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d3b110c958a463c62021-12-21 11:39:04.695root 11241100x8000000000000000556579Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:04.695{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.399dd02f26b716fa2021-12-21 11:39:04.695root 11241100x8000000000000000556580Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:04.695{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e419295861af43ec2021-12-21 11:39:04.695root 11241100x8000000000000000556581Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:04.695{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f4b6bbd67991a7b32021-12-21 11:39:04.695root 11241100x8000000000000000556582Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:04.695{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.78f299fbecfcea922021-12-21 11:39:04.695root 11241100x8000000000000000556583Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:04.695{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7a8a0088d958df5d2021-12-21 11:39:04.695root 11241100x8000000000000000556584Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:04.695{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1020bf58970cbce42021-12-21 11:39:04.695root 11241100x8000000000000000556585Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:04.696{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.05e0dcdbb9d2733d2021-12-21 11:39:04.696root 11241100x8000000000000000556586Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:04.696{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d40a360da4f856cc2021-12-21 11:39:04.696root 11241100x8000000000000000556587Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:04.696{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3cd35c1b10f41a562021-12-21 11:39:04.696root 11241100x8000000000000000556588Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:04.696{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0c32282f8fbde2bd2021-12-21 11:39:04.696root 11241100x8000000000000000556589Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:04.696{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.79884b159280db522021-12-21 11:39:04.696root 11241100x8000000000000000556590Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:04.696{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4350c7b3cbe7332b2021-12-21 11:39:04.696root 11241100x8000000000000000556591Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:04.696{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c39c859f3bc32e1b2021-12-21 11:39:04.696root 11241100x8000000000000000556592Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:04.696{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ff02e94c5dfa47ee2021-12-21 11:39:04.696root 11241100x8000000000000000556593Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:04.697{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a074aaaa16b1ee442021-12-21 11:39:04.697root 11241100x8000000000000000556594Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:04.697{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1f38bac566556f182021-12-21 11:39:04.697root 11241100x8000000000000000556595Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:04.697{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9833ceb9a6aab20a2021-12-21 11:39:04.697root 11241100x8000000000000000556596Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:04.697{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4bf72b83a53bf2d72021-12-21 11:39:04.697root 11241100x8000000000000000556597Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:04.697{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4b8df8ceb0d22fe92021-12-21 11:39:04.697root 11241100x8000000000000000556598Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:04.698{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d9a179101d0633512021-12-21 11:39:04.698root 11241100x8000000000000000556599Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:04.698{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5bca2682ee8700822021-12-21 11:39:04.698root 11241100x8000000000000000556600Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:04.699{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.679e5bb664d374e12021-12-21 11:39:04.699root 11241100x8000000000000000556601Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:04.699{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d431bfd6131fece12021-12-21 11:39:04.699root 11241100x8000000000000000556602Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:04.699{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.049f45972073be372021-12-21 11:39:04.699root 11241100x8000000000000000556603Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:04.699{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b48ee9653aa6cff92021-12-21 11:39:04.699root 11241100x8000000000000000556604Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:04.699{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.062767570cdaea472021-12-21 11:39:04.699root 11241100x8000000000000000556605Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:05.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4efad9f22c09f4012021-12-21 11:39:05.193root 11241100x8000000000000000556606Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:05.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b5c9bd226098ce402021-12-21 11:39:05.193root 11241100x8000000000000000556607Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:05.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3588b7ec9545945d2021-12-21 11:39:05.194root 11241100x8000000000000000556608Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:05.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.110e1e1d0f7ca4492021-12-21 11:39:05.194root 11241100x8000000000000000556609Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:05.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7325caf12a47c8d32021-12-21 11:39:05.194root 11241100x8000000000000000556610Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:05.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e520a11e646f65212021-12-21 11:39:05.194root 11241100x8000000000000000556611Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:05.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d6f619a1a9b961ae2021-12-21 11:39:05.194root 11241100x8000000000000000556612Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:05.195{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.bd192c408fa082392021-12-21 11:39:05.195root 11241100x8000000000000000556613Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:05.195{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6d4f467f0a54eb502021-12-21 11:39:05.195root 11241100x8000000000000000556614Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:05.195{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.020bef1ef4a553582021-12-21 11:39:05.195root 11241100x8000000000000000556615Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:05.195{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.aa445f1f156c30192021-12-21 11:39:05.195root 11241100x8000000000000000556616Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:05.195{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b3470d01d122285e2021-12-21 11:39:05.195root 11241100x8000000000000000556617Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:05.195{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.53e9694358d1a6972021-12-21 11:39:05.195root 11241100x8000000000000000556618Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:05.195{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b4adfe075d9772af2021-12-21 11:39:05.195root 11241100x8000000000000000556619Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:05.195{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2bfb305c8489d7d92021-12-21 11:39:05.195root 11241100x8000000000000000556620Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:05.195{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4be5cb31e761ca7a2021-12-21 11:39:05.195root 11241100x8000000000000000556621Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:05.195{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6e315e34096289b32021-12-21 11:39:05.195root 11241100x8000000000000000556622Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:05.195{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e3f1eb1ab1b9c8ce2021-12-21 11:39:05.195root 11241100x8000000000000000556623Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:05.195{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.86d18d3946ce628f2021-12-21 11:39:05.195root 11241100x8000000000000000556624Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:05.196{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.bd82493e7e07e98c2021-12-21 11:39:05.196root 11241100x8000000000000000556625Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:05.196{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1374ac8805ad71bb2021-12-21 11:39:05.196root 11241100x8000000000000000556626Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:05.196{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c35bb699e97e70aa2021-12-21 11:39:05.196root 11241100x8000000000000000556627Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:05.196{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1c835f25da2349c02021-12-21 11:39:05.196root 11241100x8000000000000000556628Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:05.196{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.65d5e8393eaa35d82021-12-21 11:39:05.196root 11241100x8000000000000000556629Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:05.196{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.80aaf4c30ad56eb82021-12-21 11:39:05.196root 11241100x8000000000000000556630Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:05.196{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6a586cb2160f15aa2021-12-21 11:39:05.196root 11241100x8000000000000000556631Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:05.196{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ef45c301458660602021-12-21 11:39:05.196root 11241100x8000000000000000556632Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:05.196{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5ed252cb66406fb32021-12-21 11:39:05.196root 11241100x8000000000000000556633Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:05.196{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.fbb3b6acbc6c89432021-12-21 11:39:05.196root 11241100x8000000000000000556634Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:05.196{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7db0b041c8b47f852021-12-21 11:39:05.196root 11241100x8000000000000000556635Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:05.196{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.44d4ab165dc4f3a92021-12-21 11:39:05.196root 11241100x8000000000000000556636Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:05.196{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f096e5ddeb8810922021-12-21 11:39:05.196root 11241100x8000000000000000556637Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:05.196{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c21a8b2993ee35af2021-12-21 11:39:05.196root 11241100x8000000000000000556638Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:05.196{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.cde870cafa24f7cf2021-12-21 11:39:05.196root 11241100x8000000000000000556639Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:05.196{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7cd959b3a6fc7d5a2021-12-21 11:39:05.196root 11241100x8000000000000000556640Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:05.197{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.84d2cf3fbc040ab52021-12-21 11:39:05.197root 11241100x8000000000000000556641Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:05.197{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.cbe499f05b6937ff2021-12-21 11:39:05.197root 11241100x8000000000000000556642Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:05.197{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2d4ccc8f2c9f70dc2021-12-21 11:39:05.197root 11241100x8000000000000000556643Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:05.197{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0e4c07f1e5b2c2e52021-12-21 11:39:05.197root 11241100x8000000000000000556644Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:05.197{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.eabfad6e33d2f0172021-12-21 11:39:05.197root 11241100x8000000000000000556645Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:05.197{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6756a70f007e35b22021-12-21 11:39:05.197root 11241100x8000000000000000556646Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:05.197{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d284fb4dabf83f402021-12-21 11:39:05.197root 11241100x8000000000000000556647Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:05.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ef451379db64b9082021-12-21 11:39:05.693root 11241100x8000000000000000556648Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:05.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.44d972269c2454e42021-12-21 11:39:05.693root 11241100x8000000000000000556649Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:05.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3b49f30940fcd10c2021-12-21 11:39:05.693root 11241100x8000000000000000556650Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:05.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.515d54b3094677dd2021-12-21 11:39:05.694root 11241100x8000000000000000556651Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:05.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b039467c2fc934b92021-12-21 11:39:05.694root 11241100x8000000000000000556652Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:05.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.225b53c782bd4c872021-12-21 11:39:05.694root 11241100x8000000000000000556653Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:05.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8985003e6f51f9b82021-12-21 11:39:05.694root 11241100x8000000000000000556654Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:05.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.55a37a9eff04d8ba2021-12-21 11:39:05.694root 11241100x8000000000000000556655Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:05.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.09ef9e79045d86d92021-12-21 11:39:05.694root 11241100x8000000000000000556656Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:05.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4d67dd8c2a53ba342021-12-21 11:39:05.694root 11241100x8000000000000000556657Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:05.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ac4742b1debaa2d02021-12-21 11:39:05.694root 11241100x8000000000000000556658Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:05.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d6944273c04000d52021-12-21 11:39:05.694root 11241100x8000000000000000556659Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:05.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.cccb2590c5391fbb2021-12-21 11:39:05.694root 11241100x8000000000000000556660Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:05.695{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.344c1800b74ee7162021-12-21 11:39:05.695root 11241100x8000000000000000556661Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:05.695{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.98e420d66919554c2021-12-21 11:39:05.695root 11241100x8000000000000000556662Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:05.695{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b5b9b25856d3ace52021-12-21 11:39:05.695root 11241100x8000000000000000556663Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:05.695{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6cf8a1f0af9c84022021-12-21 11:39:05.695root 11241100x8000000000000000556664Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:05.695{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3bd368e3306e110f2021-12-21 11:39:05.695root 11241100x8000000000000000556665Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:05.695{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ea4fff20d6c7a4452021-12-21 11:39:05.695root 11241100x8000000000000000556666Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:05.695{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f699a275793895a32021-12-21 11:39:05.695root 11241100x8000000000000000556667Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:05.695{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a11e179c79d5f4312021-12-21 11:39:05.695root 11241100x8000000000000000556668Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:05.695{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b68b9657b6cfb2f52021-12-21 11:39:05.695root 11241100x8000000000000000556669Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:05.695{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f207ec766800cc252021-12-21 11:39:05.695root 11241100x8000000000000000556670Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:05.695{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5426a4d33e2766e52021-12-21 11:39:05.695root 11241100x8000000000000000556671Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:05.695{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5fce447edda4a8a82021-12-21 11:39:05.695root 11241100x8000000000000000556672Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:05.695{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.03aac5c260e8bb352021-12-21 11:39:05.695root 11241100x8000000000000000556673Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:05.696{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3fe6226fb7e1e12e2021-12-21 11:39:05.696root 11241100x8000000000000000556674Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:05.696{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d960ce116bdd57392021-12-21 11:39:05.696root 11241100x8000000000000000556675Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:05.696{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f2093257c1f0dfc52021-12-21 11:39:05.696root 11241100x8000000000000000556676Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:05.696{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4c1a97b3f2478f5b2021-12-21 11:39:05.696root 11241100x8000000000000000556677Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:05.696{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ec4c7d2253157fdf2021-12-21 11:39:05.696root 11241100x8000000000000000556678Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:05.696{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.42f27e979559add52021-12-21 11:39:05.696root 11241100x8000000000000000556679Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:05.696{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.29953996bc17e1af2021-12-21 11:39:05.696root 11241100x8000000000000000556680Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:05.696{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1a64540d21a9a2f82021-12-21 11:39:05.696root 11241100x8000000000000000556681Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:05.696{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ac22720c6c8aa1532021-12-21 11:39:05.696root 11241100x8000000000000000556682Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:05.696{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ad4447ee71d67f482021-12-21 11:39:05.696root 11241100x8000000000000000556683Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:05.697{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.aa4a6c27fd65f0a82021-12-21 11:39:05.697root 11241100x8000000000000000556684Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:05.697{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.00d1379b3ba0aa142021-12-21 11:39:05.697root 11241100x8000000000000000556685Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:05.697{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5285441a0531502f2021-12-21 11:39:05.697root 11241100x8000000000000000556686Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:05.697{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.12397174c65df5842021-12-21 11:39:05.697root 11241100x8000000000000000556687Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:06.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.56c2d20d8001699c2021-12-21 11:39:06.193root 11241100x8000000000000000556688Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:06.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.981e261b9e5367a02021-12-21 11:39:06.193root 11241100x8000000000000000556689Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:06.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2e4de1c6c87e632a2021-12-21 11:39:06.194root 11241100x8000000000000000556690Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:06.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4022a62ccac488ae2021-12-21 11:39:06.194root 11241100x8000000000000000556691Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:06.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d51c97f606b123752021-12-21 11:39:06.194root 11241100x8000000000000000556692Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:06.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1e51ef5bb943aaf42021-12-21 11:39:06.194root 11241100x8000000000000000556693Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:06.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.89655533ff9575262021-12-21 11:39:06.194root 11241100x8000000000000000556694Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:06.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.50b743eaf27ad7922021-12-21 11:39:06.194root 11241100x8000000000000000556695Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:06.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.745b6b5e50397f172021-12-21 11:39:06.194root 11241100x8000000000000000556696Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:06.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0bfa5e7ff816750b2021-12-21 11:39:06.194root 11241100x8000000000000000556697Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:06.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c3191a37da2016c12021-12-21 11:39:06.194root 11241100x8000000000000000556698Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:06.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f62f9f0bb6ee99e22021-12-21 11:39:06.194root 11241100x8000000000000000556699Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:06.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a5b9dd509a8d2b2c2021-12-21 11:39:06.194root 11241100x8000000000000000556700Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:06.195{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c447d103ccf209e42021-12-21 11:39:06.195root 11241100x8000000000000000556701Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:06.195{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.313f7cd3c8a5131e2021-12-21 11:39:06.195root 11241100x8000000000000000556702Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:06.195{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.aa76dfc92f48cc6c2021-12-21 11:39:06.195root 11241100x8000000000000000556703Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:06.195{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.469d494f24512c552021-12-21 11:39:06.195root 11241100x8000000000000000556704Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:06.195{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.23c5260ef645aa4b2021-12-21 11:39:06.195root 11241100x8000000000000000556705Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:06.195{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.710f63bd03b32b592021-12-21 11:39:06.195root 11241100x8000000000000000556706Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:06.195{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.df0eda89c92bf5f82021-12-21 11:39:06.195root 11241100x8000000000000000556707Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:06.195{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.99de68e65c953cd92021-12-21 11:39:06.195root 11241100x8000000000000000556708Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:06.195{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.74ee3357d5f832912021-12-21 11:39:06.195root 11241100x8000000000000000556709Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:06.195{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8947a97ebcf10a942021-12-21 11:39:06.195root 11241100x8000000000000000556710Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:06.196{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.86ff07beb57d52ea2021-12-21 11:39:06.196root 11241100x8000000000000000556711Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:06.196{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.77beb137b2ae8f1e2021-12-21 11:39:06.196root 11241100x8000000000000000556712Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:06.196{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.933bfb7711924f782021-12-21 11:39:06.196root 11241100x8000000000000000556713Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:06.196{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.85ab92089f44ca422021-12-21 11:39:06.196root 11241100x8000000000000000556714Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:06.196{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2e62767edf6d46b92021-12-21 11:39:06.196root 11241100x8000000000000000556715Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:06.196{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.bb793f83ef6f9cef2021-12-21 11:39:06.196root 11241100x8000000000000000556716Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:06.196{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6bd72de96609b76d2021-12-21 11:39:06.196root 11241100x8000000000000000556717Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:06.196{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.02afac867f0fb00a2021-12-21 11:39:06.196root 11241100x8000000000000000556718Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:06.196{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8b93bdb0403626112021-12-21 11:39:06.196root 11241100x8000000000000000556719Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:06.196{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5215bfe387e3f4b12021-12-21 11:39:06.196root 11241100x8000000000000000556720Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:06.197{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.dff8bef11ae346ed2021-12-21 11:39:06.197root 11241100x8000000000000000556721Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:06.197{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.58f9d5ef795cf8cc2021-12-21 11:39:06.197root 11241100x8000000000000000556722Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:06.197{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9e3523fbeabbc4f72021-12-21 11:39:06.197root 11241100x8000000000000000556723Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:06.197{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.826357fe86658fbe2021-12-21 11:39:06.197root 11241100x8000000000000000556724Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:06.197{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.428f85c66bb974532021-12-21 11:39:06.197root 11241100x8000000000000000556725Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:06.197{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9b6bb696ba7577da2021-12-21 11:39:06.197root 11241100x8000000000000000556726Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:06.198{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f7af6196cb3ad6c52021-12-21 11:39:06.198root 11241100x8000000000000000556727Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:06.198{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b4808561e64696a12021-12-21 11:39:06.198root 11241100x8000000000000000556728Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:06.198{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.909fb058f20a61f92021-12-21 11:39:06.198root 11241100x8000000000000000556729Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:06.326{ec2b6afe-95d2-61c1-3038-b84203560000}5272/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/spool/splunk/tracker.log2021-12-21 11:39:06.326root 11241100x8000000000000000556730Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:06.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9559d8b074e8f35a2021-12-21 11:39:06.693root 11241100x8000000000000000556731Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:06.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4797cd8c7fca0d892021-12-21 11:39:06.694root 11241100x8000000000000000556732Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:06.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6c18e711957639c02021-12-21 11:39:06.694root 11241100x8000000000000000556733Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:06.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f9cf08fc283918312021-12-21 11:39:06.694root 11241100x8000000000000000556734Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:06.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9f8aadb7f5d032bf2021-12-21 11:39:06.694root 11241100x8000000000000000556735Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:06.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.677d44960da134292021-12-21 11:39:06.694root 11241100x8000000000000000556736Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:06.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f993d0e35cdd254b2021-12-21 11:39:06.694root 11241100x8000000000000000556737Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:06.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0ad014e8ac626c662021-12-21 11:39:06.694root 11241100x8000000000000000556738Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:06.695{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0eab13e67e3585fd2021-12-21 11:39:06.695root 11241100x8000000000000000556739Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:06.695{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.45bb02ded540971a2021-12-21 11:39:06.695root 11241100x8000000000000000556740Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:06.695{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c2566ef647140a3e2021-12-21 11:39:06.695root 11241100x8000000000000000556741Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:06.695{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ed9dffe5e1af35292021-12-21 11:39:06.695root 11241100x8000000000000000556742Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:06.695{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0d06157b4a62cf082021-12-21 11:39:06.695root 11241100x8000000000000000556743Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:06.695{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.76b893873d1fee652021-12-21 11:39:06.695root 11241100x8000000000000000556744Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:06.695{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9c2725cf7ec1aded2021-12-21 11:39:06.695root 11241100x8000000000000000556745Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:06.695{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.28851b5026c99a112021-12-21 11:39:06.695root 11241100x8000000000000000556746Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:06.696{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.827c8fe8dc9d56ad2021-12-21 11:39:06.696root 11241100x8000000000000000556747Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:06.696{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.12d55a8446e04d012021-12-21 11:39:06.696root 11241100x8000000000000000556748Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:06.696{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b0443ed03183e0a82021-12-21 11:39:06.696root 11241100x8000000000000000556749Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:06.696{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.fbe04e5ef7cc49492021-12-21 11:39:06.696root 11241100x8000000000000000556750Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:06.696{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.94b26af4ac37c8d22021-12-21 11:39:06.696root 11241100x8000000000000000556751Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:06.696{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ecbf0d2cea9ce5802021-12-21 11:39:06.696root 11241100x8000000000000000556752Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:06.696{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.eb7bcef2821f5af12021-12-21 11:39:06.696root 11241100x8000000000000000556753Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:06.697{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d4a8ff555c3bca5e2021-12-21 11:39:06.697root 11241100x8000000000000000556754Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:06.697{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.59ae590bfd2a57cf2021-12-21 11:39:06.697root 11241100x8000000000000000556755Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:06.697{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7f5acf9b00f5cf472021-12-21 11:39:06.697root 11241100x8000000000000000556756Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:06.697{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9546ee0ef578b3e42021-12-21 11:39:06.697root 11241100x8000000000000000556757Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:06.697{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.efb6f7541f5121eb2021-12-21 11:39:06.697root 11241100x8000000000000000556758Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:06.697{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.006a0831dbbd00352021-12-21 11:39:06.697root 11241100x8000000000000000556759Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:06.697{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3648000d9378af1d2021-12-21 11:39:06.697root 11241100x8000000000000000556760Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:06.697{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d92e141aba161e7c2021-12-21 11:39:06.697root 11241100x8000000000000000556761Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:06.697{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f1d9b17f04d34f012021-12-21 11:39:06.697root 11241100x8000000000000000556762Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:06.697{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6d7932ea416e928e2021-12-21 11:39:06.697root 11241100x8000000000000000556763Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:06.697{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.931a6f91e637f3da2021-12-21 11:39:06.697root 11241100x8000000000000000556764Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:06.698{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ce2596150317bbd12021-12-21 11:39:06.698root 11241100x8000000000000000556765Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:06.698{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e27770940f8559982021-12-21 11:39:06.698root 11241100x8000000000000000556766Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:06.698{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.08f919d4504a7ec12021-12-21 11:39:06.698root 11241100x8000000000000000556767Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:06.698{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.984497685c2e98922021-12-21 11:39:06.698root 11241100x8000000000000000556768Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:06.698{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4f44f360f7026adb2021-12-21 11:39:06.698root 11241100x8000000000000000556769Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:06.698{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4d9046fa23063d8a2021-12-21 11:39:06.698root 11241100x8000000000000000556770Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:06.698{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.84ecc762ac9793032021-12-21 11:39:06.698root 11241100x8000000000000000556771Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:06.698{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f80e2047aa7b60222021-12-21 11:39:06.698root 11241100x8000000000000000556772Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:07.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d5275c1e9476f8c42021-12-21 11:39:07.193root 11241100x8000000000000000556773Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:07.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3d604da6fa772a972021-12-21 11:39:07.193root 11241100x8000000000000000556774Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:07.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.fa1638ea8e20f46e2021-12-21 11:39:07.193root 11241100x8000000000000000556775Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:07.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9f4e3ddd013056aa2021-12-21 11:39:07.193root 11241100x8000000000000000556776Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:07.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.657ecdef2b1b20152021-12-21 11:39:07.193root 11241100x8000000000000000556777Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:07.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1d92083b79ea9ba32021-12-21 11:39:07.193root 11241100x8000000000000000556778Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:07.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0d907ddeca28df2e2021-12-21 11:39:07.194root 11241100x8000000000000000556779Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:07.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a22ed1bcb48eac3d2021-12-21 11:39:07.194root 11241100x8000000000000000556780Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:07.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.20caac8e0a4e02312021-12-21 11:39:07.194root 11241100x8000000000000000556781Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:07.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5eac64a860ba44bd2021-12-21 11:39:07.194root 11241100x8000000000000000556782Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:07.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7f5c016e905916b52021-12-21 11:39:07.194root 11241100x8000000000000000556783Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:07.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d40d4cdcf0befa3a2021-12-21 11:39:07.194root 11241100x8000000000000000556784Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:07.195{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e1432faededa98de2021-12-21 11:39:07.195root 11241100x8000000000000000556785Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:07.195{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c9e30a23cf0961632021-12-21 11:39:07.195root 11241100x8000000000000000556786Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:07.195{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ee3dee260f403b632021-12-21 11:39:07.195root 11241100x8000000000000000556787Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:07.195{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e0698eda595738f72021-12-21 11:39:07.195root 11241100x8000000000000000556788Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:07.195{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2c3d7b30c63a0a532021-12-21 11:39:07.195root 11241100x8000000000000000556789Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:07.195{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2d104e71dfab998f2021-12-21 11:39:07.195root 11241100x8000000000000000556790Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:07.195{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c6e9cde29a29fae82021-12-21 11:39:07.195root 11241100x8000000000000000556791Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:07.195{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.758ec004deb062af2021-12-21 11:39:07.195root 11241100x8000000000000000556792Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:07.195{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.cc3359ca0f187b832021-12-21 11:39:07.195root 11241100x8000000000000000556793Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:07.196{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.bebc438b7bc51cca2021-12-21 11:39:07.196root 11241100x8000000000000000556794Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:07.196{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7098c86124c9253e2021-12-21 11:39:07.196root 11241100x8000000000000000556795Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:07.196{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3ed73496c23a02c22021-12-21 11:39:07.196root 11241100x8000000000000000556796Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:07.196{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e498f77e599878572021-12-21 11:39:07.196root 11241100x8000000000000000556797Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:07.196{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2cad31f9f837c1e12021-12-21 11:39:07.196root 11241100x8000000000000000556798Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:07.196{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d02840fe38451f592021-12-21 11:39:07.196root 11241100x8000000000000000556799Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:07.196{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7ba0efbe0d2a7da52021-12-21 11:39:07.196root 11241100x8000000000000000556800Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:07.196{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1cb9128d65fa94512021-12-21 11:39:07.196root 11241100x8000000000000000556801Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:07.196{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d95a245880056e432021-12-21 11:39:07.196root 11241100x8000000000000000556802Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:07.196{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.84bfbbb3d3671c872021-12-21 11:39:07.196root 11241100x8000000000000000556803Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:07.196{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.400f6014aabeac892021-12-21 11:39:07.196root 11241100x8000000000000000556804Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:07.196{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7b6478b6915a916f2021-12-21 11:39:07.196root 11241100x8000000000000000556805Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:07.196{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c0b0ea194f9f288b2021-12-21 11:39:07.196root 11241100x8000000000000000556806Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:07.197{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5db3ed93d37e2cd32021-12-21 11:39:07.197root 11241100x8000000000000000556807Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:07.197{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f0d14d34098d7abd2021-12-21 11:39:07.197root 11241100x8000000000000000556808Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:07.197{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ae3255dd4621ceb72021-12-21 11:39:07.197root 11241100x8000000000000000556809Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:07.197{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.55662f694eddd87b2021-12-21 11:39:07.197root 11241100x8000000000000000556810Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:07.197{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.bc15c39b1cecf5a82021-12-21 11:39:07.197root 11241100x8000000000000000556811Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:07.197{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.74b9eef0327598fb2021-12-21 11:39:07.197root 11241100x8000000000000000556812Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:07.197{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3a0b762cfa1703572021-12-21 11:39:07.197root 11241100x8000000000000000556813Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:07.197{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0f4ea1e7321617d12021-12-21 11:39:07.197root 11241100x8000000000000000556814Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:07.197{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6e35ef6d0431a25e2021-12-21 11:39:07.197root 11241100x8000000000000000556815Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:07.197{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d8e5a5e3d887fcaf2021-12-21 11:39:07.197root 11241100x8000000000000000556816Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:07.198{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c4232ab20ac39f5e2021-12-21 11:39:07.198root 11241100x8000000000000000556817Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:07.198{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.68bf44b6b40a72202021-12-21 11:39:07.198root 11241100x8000000000000000556818Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:07.198{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9c518b6b789e207b2021-12-21 11:39:07.198root 11241100x8000000000000000556819Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:07.198{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f95c854e4a5ac6232021-12-21 11:39:07.198root 11241100x8000000000000000556820Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:07.198{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.62a91f15e4d631312021-12-21 11:39:07.198root 11241100x8000000000000000556821Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:07.198{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2e3266ae38bbf8912021-12-21 11:39:07.198root 11241100x8000000000000000556822Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:07.198{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4017c5a70ea93e402021-12-21 11:39:07.198root 11241100x8000000000000000556823Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:07.198{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.443812baae6f82932021-12-21 11:39:07.198root 11241100x8000000000000000556824Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:07.198{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.09b052c8ba5af2c62021-12-21 11:39:07.198root 354300x8000000000000000556825Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:07.255{ec2b6afe-95d9-61c1-5175-3a0400000000}5346/opt/splunkforwarder/etc/apps/Splunk_TA_stream/linux_x86_64/bin/streamfwdroottcptruefalse10.0.1.25-48852-false10.0.1.12-8000- 11241100x8000000000000000556826Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:07.692{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.cfa3f0c72070654b2021-12-21 11:39:07.692root 11241100x8000000000000000556827Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:07.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b9185a3d17e4838d2021-12-21 11:39:07.693root 11241100x8000000000000000556828Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:07.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c0e62a4f791f49452021-12-21 11:39:07.693root 11241100x8000000000000000556829Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:07.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.fd66939830aeebbc2021-12-21 11:39:07.693root 11241100x8000000000000000556830Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:07.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7501bb1a9fb97be42021-12-21 11:39:07.693root 11241100x8000000000000000556831Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:07.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b7e6f8bb6809397e2021-12-21 11:39:07.693root 11241100x8000000000000000556832Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:07.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.103289fc5da251432021-12-21 11:39:07.693root 11241100x8000000000000000556833Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:07.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.108a54c02a6947ca2021-12-21 11:39:07.693root 11241100x8000000000000000556834Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:07.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.48126634063915ea2021-12-21 11:39:07.693root 11241100x8000000000000000556835Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:07.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8161fd124f8613842021-12-21 11:39:07.693root 11241100x8000000000000000556836Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:07.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.456323f458adea2f2021-12-21 11:39:07.693root 11241100x8000000000000000556837Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:07.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4c1b33810c2052ac2021-12-21 11:39:07.694root 11241100x8000000000000000556838Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:07.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.aef585f46f580a212021-12-21 11:39:07.694root 11241100x8000000000000000556839Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:07.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b53fa0152caba2dd2021-12-21 11:39:07.694root 11241100x8000000000000000556840Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:07.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.784eea95b4b095cf2021-12-21 11:39:07.694root 11241100x8000000000000000556841Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:07.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8f3fddd5b88663d02021-12-21 11:39:07.694root 11241100x8000000000000000556842Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:07.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b5367f6a2f33f8212021-12-21 11:39:07.694root 11241100x8000000000000000556843Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:07.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7213986499d504112021-12-21 11:39:07.694root 11241100x8000000000000000556844Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:07.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.909d42b02404940e2021-12-21 11:39:07.694root 11241100x8000000000000000556845Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:07.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.74b988102205fe472021-12-21 11:39:07.694root 11241100x8000000000000000556846Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:07.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e41d0d97b3ed15e22021-12-21 11:39:07.694root 11241100x8000000000000000556847Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:07.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c04a588868bcc3ce2021-12-21 11:39:07.694root 11241100x8000000000000000556848Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:07.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0587afba9feb9a0c2021-12-21 11:39:07.694root 11241100x8000000000000000556849Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:07.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a2c4c950b1d2b87b2021-12-21 11:39:07.694root 11241100x8000000000000000556850Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:07.695{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.372cbbb6d06505a32021-12-21 11:39:07.695root 11241100x8000000000000000556851Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:07.695{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d1901d4bf3a1c24f2021-12-21 11:39:07.695root 11241100x8000000000000000556852Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:07.695{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7158c69d9891053c2021-12-21 11:39:07.695root 11241100x8000000000000000556853Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:07.695{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1699c4f7753f47702021-12-21 11:39:07.695root 11241100x8000000000000000556854Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:07.695{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.bb4e4873f5f701982021-12-21 11:39:07.695root 11241100x8000000000000000556855Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:07.695{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a143e18d9f3d33192021-12-21 11:39:07.695root 11241100x8000000000000000556856Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:07.695{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0dc24bb1f3df199c2021-12-21 11:39:07.695root 11241100x8000000000000000556857Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:07.695{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e04b1d214fdb272f2021-12-21 11:39:07.695root 11241100x8000000000000000556858Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:07.695{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1301913125bc4fcd2021-12-21 11:39:07.695root 11241100x8000000000000000556859Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:07.695{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.05801e6151f644712021-12-21 11:39:07.695root 11241100x8000000000000000556860Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:07.695{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.53bbc1c00cf8feee2021-12-21 11:39:07.695root 11241100x8000000000000000556861Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:07.695{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ab5718b939e54c9b2021-12-21 11:39:07.695root 11241100x8000000000000000556862Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:07.695{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.702c0419abde2d952021-12-21 11:39:07.695root 11241100x8000000000000000556863Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:07.696{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c4cab53110a25b7d2021-12-21 11:39:07.696root 11241100x8000000000000000556864Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:07.696{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6029e93dced9d0d92021-12-21 11:39:07.696root 11241100x8000000000000000556865Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:07.696{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a5c7c6fd2d7e54ea2021-12-21 11:39:07.696root 11241100x8000000000000000556866Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:07.696{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2ede81aed7baf0fb2021-12-21 11:39:07.696root 11241100x8000000000000000556867Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:07.696{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1abe25a373f28de32021-12-21 11:39:07.696root 11241100x8000000000000000556868Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:07.696{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.854f96b5b8c2a6922021-12-21 11:39:07.696root 11241100x8000000000000000556869Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:07.696{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9d9b57225bc8d7d72021-12-21 11:39:07.696root 11241100x8000000000000000556870Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:07.696{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e852c294f5b253df2021-12-21 11:39:07.696root 11241100x8000000000000000556871Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:07.696{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6800db5c3eeeb90e2021-12-21 11:39:07.696root 11241100x8000000000000000556872Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:08.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7ba976b1244a11de2021-12-21 11:39:08.193root 11241100x8000000000000000556873Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:08.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1eec27e288af585e2021-12-21 11:39:08.193root 11241100x8000000000000000556874Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:08.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.70a27399f3d464832021-12-21 11:39:08.193root 11241100x8000000000000000556875Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:08.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1bf686b70415088f2021-12-21 11:39:08.194root 11241100x8000000000000000556876Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:08.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.da4ab76f3d4c2e992021-12-21 11:39:08.194root 11241100x8000000000000000556877Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:08.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6a89a82dcf7c0cf02021-12-21 11:39:08.194root 11241100x8000000000000000556878Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:08.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4949461dc0309d9e2021-12-21 11:39:08.194root 11241100x8000000000000000556879Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:08.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5f0552c6467ac37d2021-12-21 11:39:08.194root 11241100x8000000000000000556880Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:08.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.74ce590fa895ca542021-12-21 11:39:08.194root 11241100x8000000000000000556881Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:08.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.69e9651987035a7a2021-12-21 11:39:08.194root 11241100x8000000000000000556882Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:08.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0fdb4b79d73448ba2021-12-21 11:39:08.194root 11241100x8000000000000000556883Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:08.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d09324314f3f2d912021-12-21 11:39:08.194root 11241100x8000000000000000556884Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:08.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.87aa2982054f71a52021-12-21 11:39:08.194root 11241100x8000000000000000556885Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:08.195{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.41ff0f7447a55b072021-12-21 11:39:08.195root 11241100x8000000000000000556886Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:08.195{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a278e43353ad4ff42021-12-21 11:39:08.195root 11241100x8000000000000000556887Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:08.195{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3de75edbfd7698732021-12-21 11:39:08.195root 11241100x8000000000000000556888Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:08.195{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2ff8921fd9af2a162021-12-21 11:39:08.195root 11241100x8000000000000000556889Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:08.195{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a4a7e5067ba1833a2021-12-21 11:39:08.195root 11241100x8000000000000000556890Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:08.195{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e120440026acbc022021-12-21 11:39:08.195root 11241100x8000000000000000556891Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:08.195{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0585002c3178f2632021-12-21 11:39:08.195root 11241100x8000000000000000556892Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:08.195{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.15134b7291e79ad32021-12-21 11:39:08.195root 11241100x8000000000000000556893Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:08.195{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.87c3028c6fb9141c2021-12-21 11:39:08.195root 11241100x8000000000000000556894Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:08.196{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.600eff7e482fad2f2021-12-21 11:39:08.196root 11241100x8000000000000000556895Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:08.196{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.786d8126aa74d7212021-12-21 11:39:08.196root 11241100x8000000000000000556896Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:08.196{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.245c9e74331fd5772021-12-21 11:39:08.196root 11241100x8000000000000000556897Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:08.196{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6218061eadf7c6822021-12-21 11:39:08.196root 11241100x8000000000000000556898Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:08.196{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.abf6c80dca5fd6d92021-12-21 11:39:08.196root 11241100x8000000000000000556899Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:08.196{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.55afc286e4b09a222021-12-21 11:39:08.196root 11241100x8000000000000000556900Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:08.196{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b12cc32d3830bf492021-12-21 11:39:08.196root 11241100x8000000000000000556901Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:08.196{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.eae620d325e8a7b22021-12-21 11:39:08.196root 11241100x8000000000000000556902Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:08.196{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9ede68a5b588094b2021-12-21 11:39:08.196root 11241100x8000000000000000556903Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:08.196{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.802518af591660b12021-12-21 11:39:08.196root 11241100x8000000000000000556904Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:08.196{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f58dcac96e1797dc2021-12-21 11:39:08.196root 11241100x8000000000000000556905Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:08.196{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.cd4f6bacf83faec02021-12-21 11:39:08.196root 11241100x8000000000000000556906Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:08.197{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4930d90bc5ddede42021-12-21 11:39:08.197root 11241100x8000000000000000556907Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:08.197{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ab9b39e0139b5f912021-12-21 11:39:08.197root 11241100x8000000000000000556908Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:08.197{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c3bd7173d73c21602021-12-21 11:39:08.197root 11241100x8000000000000000556909Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:08.197{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.795bc4d85c57c1e02021-12-21 11:39:08.197root 11241100x8000000000000000556910Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:08.197{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8dde6f2234e476722021-12-21 11:39:08.197root 11241100x8000000000000000556911Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:08.197{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9e0fe64e7c6406432021-12-21 11:39:08.197root 11241100x8000000000000000556912Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:08.197{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d0126c09d0798a6d2021-12-21 11:39:08.197root 11241100x8000000000000000556913Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:08.197{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.42ce8e9ef0c1fa7a2021-12-21 11:39:08.197root 11241100x8000000000000000556914Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:08.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6cafafd40876e8682021-12-21 11:39:08.693root 11241100x8000000000000000556915Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:08.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.90774d620466309f2021-12-21 11:39:08.693root 11241100x8000000000000000556916Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:08.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e38299fec8b93b752021-12-21 11:39:08.693root 11241100x8000000000000000556917Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:08.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6b7a4555854b67a72021-12-21 11:39:08.693root 11241100x8000000000000000556918Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:08.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a8be4de5dcf506b42021-12-21 11:39:08.693root 11241100x8000000000000000556919Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:08.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.df4f5f6f127243042021-12-21 11:39:08.694root 11241100x8000000000000000556920Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:08.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0dff18c490df4b1c2021-12-21 11:39:08.694root 11241100x8000000000000000556921Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:08.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.52576f5d8b46ab422021-12-21 11:39:08.694root 11241100x8000000000000000556922Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:08.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e2a11b4542d47ebb2021-12-21 11:39:08.694root 11241100x8000000000000000556923Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:08.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2aebfbc06cdf89f22021-12-21 11:39:08.694root 11241100x8000000000000000556924Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:08.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.37df1aefc078e4c42021-12-21 11:39:08.694root 11241100x8000000000000000556925Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:08.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6f387c349a1484132021-12-21 11:39:08.694root 11241100x8000000000000000556926Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:08.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.161f11b7d9e6794b2021-12-21 11:39:08.694root 11241100x8000000000000000556927Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:08.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.84e3b7d87e8c1b4f2021-12-21 11:39:08.694root 11241100x8000000000000000556928Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:08.695{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e3db9066eebfef952021-12-21 11:39:08.695root 11241100x8000000000000000556929Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:08.695{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.adc02a59612cf3442021-12-21 11:39:08.695root 11241100x8000000000000000556930Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:08.695{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9a5420890e183bfd2021-12-21 11:39:08.695root 11241100x8000000000000000556931Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:08.695{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.788e7406829acaa32021-12-21 11:39:08.695root 11241100x8000000000000000556932Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:08.695{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3a221142c7a2698d2021-12-21 11:39:08.695root 11241100x8000000000000000556933Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:08.695{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2bda39704f442fa32021-12-21 11:39:08.695root 11241100x8000000000000000556934Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:08.695{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0e0090e33c4041162021-12-21 11:39:08.695root 11241100x8000000000000000556935Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:08.695{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ce24433678405e882021-12-21 11:39:08.695root 11241100x8000000000000000556936Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:08.695{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.70e070032141caaf2021-12-21 11:39:08.695root 11241100x8000000000000000556937Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:08.695{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.46a66e318c7af2cc2021-12-21 11:39:08.695root 11241100x8000000000000000556938Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:08.695{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4078ccd47a4d3de02021-12-21 11:39:08.695root 11241100x8000000000000000556939Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:08.696{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f2f6067100c99ff82021-12-21 11:39:08.696root 11241100x8000000000000000556940Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:08.696{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ee2cebb3663b0a552021-12-21 11:39:08.696root 11241100x8000000000000000556941Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:08.696{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e3b7500290e79ed22021-12-21 11:39:08.696root 11241100x8000000000000000556942Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:08.696{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.96f4fc448501dd822021-12-21 11:39:08.696root 11241100x8000000000000000556943Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:08.696{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7c5a04bef48768232021-12-21 11:39:08.696root 11241100x8000000000000000556944Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:08.696{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.05fb5238c2f65d152021-12-21 11:39:08.696root 11241100x8000000000000000556945Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:08.696{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a6348c14b6dbf2782021-12-21 11:39:08.696root 11241100x8000000000000000556946Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:08.696{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7f05a6a1723d2fab2021-12-21 11:39:08.696root 11241100x8000000000000000556947Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:08.696{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.cc074151131b99882021-12-21 11:39:08.696root 11241100x8000000000000000556948Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:08.697{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e6a87bf42152edcf2021-12-21 11:39:08.697root 11241100x8000000000000000556949Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:08.697{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.307d2c607bbcd6a32021-12-21 11:39:08.697root 11241100x8000000000000000556950Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:08.697{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ddf0b9efd10dd3c52021-12-21 11:39:08.697root 11241100x8000000000000000556951Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:08.697{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e9a0f66a0e7474442021-12-21 11:39:08.697root 11241100x8000000000000000556952Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:08.697{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ee02b85ce7891eee2021-12-21 11:39:08.697root 11241100x8000000000000000556953Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:08.697{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5a73a8a6b8dda84d2021-12-21 11:39:08.697root 11241100x8000000000000000556954Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:08.697{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4596ccceb9a4cb052021-12-21 11:39:08.697root 11241100x8000000000000000556955Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:08.697{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6d90713a2f2832ec2021-12-21 11:39:08.697root 11241100x8000000000000000556956Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:08.697{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1441a2674705d34d2021-12-21 11:39:08.697root 11241100x8000000000000000556957Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:08.697{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2594cae325c42c6d2021-12-21 11:39:08.697root 11241100x8000000000000000556958Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:08.697{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1d588f1e373f6b0c2021-12-21 11:39:08.697root 11241100x8000000000000000556959Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:08.698{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.13434d14cc8c181d2021-12-21 11:39:08.698root 11241100x8000000000000000556960Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:08.698{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7ee7f5e52460f3a72021-12-21 11:39:08.698root 11241100x8000000000000000556961Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:08.698{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9451aaf8992282b52021-12-21 11:39:08.698root 11241100x8000000000000000556962Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:08.698{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a35341a0d9354d002021-12-21 11:39:08.698root 11241100x8000000000000000556963Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:09.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7115fb2578bd20a12021-12-21 11:39:09.193root 11241100x8000000000000000556964Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:09.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f6c8c7489fc38ba82021-12-21 11:39:09.193root 11241100x8000000000000000556965Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:09.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.15957c595aaf2ec42021-12-21 11:39:09.193root 11241100x8000000000000000556966Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:09.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.49ab8615d01147d32021-12-21 11:39:09.193root 11241100x8000000000000000556967Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:09.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3979d79cfd81ccd62021-12-21 11:39:09.193root 11241100x8000000000000000556968Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:09.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.df48eb9e0c0335242021-12-21 11:39:09.193root 11241100x8000000000000000556969Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:09.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c82bbc6afbec1b132021-12-21 11:39:09.193root 11241100x8000000000000000556970Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:09.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7bfa0ddd1de44d592021-12-21 11:39:09.193root 11241100x8000000000000000556971Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:09.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8e8822e36a88eee12021-12-21 11:39:09.194root 11241100x8000000000000000556972Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:09.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.060feda6d9a40ad92021-12-21 11:39:09.194root 11241100x8000000000000000556973Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:09.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.68e6bb701729f77a2021-12-21 11:39:09.194root 11241100x8000000000000000556974Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:09.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4cb9c20a8778d6762021-12-21 11:39:09.194root 11241100x8000000000000000556975Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:09.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5e516a1afe70d0862021-12-21 11:39:09.194root 11241100x8000000000000000556976Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:09.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.124cfc2b862312782021-12-21 11:39:09.194root 11241100x8000000000000000556977Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:09.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9c09c095e67d96e42021-12-21 11:39:09.194root 11241100x8000000000000000556978Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:09.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3d7d76164e79f9a32021-12-21 11:39:09.194root 11241100x8000000000000000556979Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:09.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9dd7f3fe298c24292021-12-21 11:39:09.194root 11241100x8000000000000000556980Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:09.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6cdb2ae06aef912e2021-12-21 11:39:09.194root 11241100x8000000000000000556981Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:09.195{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1107ff337f99fbb12021-12-21 11:39:09.195root 11241100x8000000000000000556982Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:09.195{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.75af3691b0d8e5242021-12-21 11:39:09.195root 11241100x8000000000000000556983Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:09.195{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.25a830790cb64f042021-12-21 11:39:09.195root 11241100x8000000000000000556984Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:09.195{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1c964418940a2f662021-12-21 11:39:09.195root 11241100x8000000000000000556985Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:09.195{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f79719b6a8eb63412021-12-21 11:39:09.195root 11241100x8000000000000000556986Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:09.195{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.bfa09b402518278b2021-12-21 11:39:09.195root 11241100x8000000000000000556987Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:09.195{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0ed9cdb6df41fcaf2021-12-21 11:39:09.195root 11241100x8000000000000000556988Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:09.195{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9e6ac75c7189d58b2021-12-21 11:39:09.195root 11241100x8000000000000000556989Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:09.195{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f56ebf4d1263663b2021-12-21 11:39:09.195root 11241100x8000000000000000556990Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:09.195{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.25f7715d385676b82021-12-21 11:39:09.195root 11241100x8000000000000000556991Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:09.196{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.04407fb6e26e2c542021-12-21 11:39:09.196root 11241100x8000000000000000556992Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:09.196{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.10b121471aeb3dca2021-12-21 11:39:09.196root 11241100x8000000000000000556993Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:09.196{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.dc0a30cfb7d271972021-12-21 11:39:09.196root 11241100x8000000000000000556994Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:09.196{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.68aac285698e9e132021-12-21 11:39:09.196root 11241100x8000000000000000556995Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:09.196{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d9f50d8a1c431c582021-12-21 11:39:09.196root 11241100x8000000000000000556996Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:09.196{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a8d0fdf7b0e6cfdf2021-12-21 11:39:09.196root 11241100x8000000000000000556997Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:09.196{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.face2dbc15ec390b2021-12-21 11:39:09.196root 11241100x8000000000000000556998Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:09.196{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6b6b62129a9d6b832021-12-21 11:39:09.196root 11241100x8000000000000000556999Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:09.196{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.776cfc514bb48fdb2021-12-21 11:39:09.196root 11241100x8000000000000000557000Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:09.196{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.55b507418811b43b2021-12-21 11:39:09.196root 11241100x8000000000000000557001Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:09.197{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.81458f0aed07ade92021-12-21 11:39:09.197root 11241100x8000000000000000557002Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:09.197{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.911bf11d5c5230422021-12-21 11:39:09.197root 11241100x8000000000000000557003Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:09.197{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.911d62b366b291c32021-12-21 11:39:09.197root 11241100x8000000000000000557004Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:09.197{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2a931fa2fc822c3a2021-12-21 11:39:09.197root 11241100x8000000000000000557005Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:09.197{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f5c71221520c4fa22021-12-21 11:39:09.197root 11241100x8000000000000000557006Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:09.197{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8b930c5496a14ec12021-12-21 11:39:09.197root 11241100x8000000000000000557007Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:09.197{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e9c75be2e648fc9e2021-12-21 11:39:09.197root 11241100x8000000000000000557008Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:09.197{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8d61c2f51bfa49172021-12-21 11:39:09.197root 11241100x8000000000000000557009Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:09.197{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0d1b89e2b0cc17b92021-12-21 11:39:09.197root 11241100x8000000000000000557010Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:09.197{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.072056ce459f25282021-12-21 11:39:09.197root 11241100x8000000000000000557011Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:09.198{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9092595d1e2b9aa62021-12-21 11:39:09.198root 11241100x8000000000000000557012Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:09.198{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.621bcd970f910ffa2021-12-21 11:39:09.198root 11241100x8000000000000000557013Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:09.198{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ef1d026858ff73572021-12-21 11:39:09.198root 11241100x8000000000000000557014Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:09.198{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.42f67738d4545b662021-12-21 11:39:09.198root 11241100x8000000000000000557015Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:09.198{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a2c6e3dc49d809a12021-12-21 11:39:09.198root 11241100x8000000000000000557016Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:09.198{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ef9ad8d9289782ff2021-12-21 11:39:09.198root 11241100x8000000000000000557017Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:09.198{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.bbc369475b0b2bc02021-12-21 11:39:09.198root 23542300x8000000000000000557018Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:09.328{ec2b6afe-95d2-61c1-3038-b84203560000}5272root/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/spool/splunk/tracker.log--- 11241100x8000000000000000557019Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:09.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.165959f0a59f773d2021-12-21 11:39:09.693root 11241100x8000000000000000557020Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:09.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b02d4cad91056aea2021-12-21 11:39:09.693root 11241100x8000000000000000557021Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:09.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.eafe96b20486247b2021-12-21 11:39:09.694root 11241100x8000000000000000557022Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:09.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f698cedae167370b2021-12-21 11:39:09.694root 11241100x8000000000000000557023Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:09.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.59fb033f9270732c2021-12-21 11:39:09.694root 11241100x8000000000000000557024Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:09.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.551210ef5d704a562021-12-21 11:39:09.694root 11241100x8000000000000000557025Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:09.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.508dda8b432a6f8b2021-12-21 11:39:09.694root 11241100x8000000000000000557026Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:09.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4571424655b77bb92021-12-21 11:39:09.694root 11241100x8000000000000000557027Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:09.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e255f1587a581c0a2021-12-21 11:39:09.694root 11241100x8000000000000000557028Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:09.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f9d0f1e6256904332021-12-21 11:39:09.694root 11241100x8000000000000000557029Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:09.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.20ed4823cacbdb532021-12-21 11:39:09.694root 11241100x8000000000000000557030Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:09.695{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ec32b14904f5ed592021-12-21 11:39:09.695root 11241100x8000000000000000557031Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:09.695{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.397ab40b4914307b2021-12-21 11:39:09.695root 11241100x8000000000000000557032Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:09.695{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1b7ab58ece1f49ec2021-12-21 11:39:09.695root 11241100x8000000000000000557033Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:09.695{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e20c8901e3135b042021-12-21 11:39:09.695root 11241100x8000000000000000557034Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:09.695{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.bfbdbc29bdb7e8a22021-12-21 11:39:09.695root 11241100x8000000000000000557035Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:09.695{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2f32c383595109922021-12-21 11:39:09.695root 11241100x8000000000000000557036Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:09.695{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.99c93c5fd2c211492021-12-21 11:39:09.695root 11241100x8000000000000000557037Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:09.695{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ae80e07a7f63bdf52021-12-21 11:39:09.695root 11241100x8000000000000000557038Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:09.695{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.cfce08bc7cfc498a2021-12-21 11:39:09.695root 11241100x8000000000000000557039Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:09.695{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c245577ca629a5d32021-12-21 11:39:09.695root 11241100x8000000000000000557040Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:09.696{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.51adab75775ecae12021-12-21 11:39:09.696root 11241100x8000000000000000557041Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:09.696{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.15da3aa63929b9e42021-12-21 11:39:09.696root 11241100x8000000000000000557042Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:09.696{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a8e737eaf65997492021-12-21 11:39:09.696root 11241100x8000000000000000557043Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:09.696{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1ea39335bc26766f2021-12-21 11:39:09.696root 11241100x8000000000000000557044Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:09.696{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b77cac4e96f60a412021-12-21 11:39:09.696root 11241100x8000000000000000557045Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:09.696{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9962cb8e839ac7862021-12-21 11:39:09.696root 11241100x8000000000000000557046Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:09.696{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.708fefe1bc4f5cff2021-12-21 11:39:09.696root 11241100x8000000000000000557047Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:09.696{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9723f9a588eceaa12021-12-21 11:39:09.696root 11241100x8000000000000000557048Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:09.696{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.dcbe9eac8d996a502021-12-21 11:39:09.696root 11241100x8000000000000000557049Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:09.696{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8cd6edf830de282e2021-12-21 11:39:09.696root 11241100x8000000000000000557050Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:09.696{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.444ae2f80f1204d72021-12-21 11:39:09.696root 11241100x8000000000000000557051Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:09.697{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c33277c28278a8ab2021-12-21 11:39:09.697root 11241100x8000000000000000557052Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:09.697{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a3a16a0c003fb0962021-12-21 11:39:09.697root 11241100x8000000000000000557053Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:09.697{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d139b97f335568762021-12-21 11:39:09.697root 11241100x8000000000000000557054Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:09.697{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.fe7f39bf9618296a2021-12-21 11:39:09.697root 11241100x8000000000000000557055Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:09.697{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d26b443351ddea202021-12-21 11:39:09.697root 354300x8000000000000000557100Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:19.114{ec2b6afe-95d9-61c1-5175-3a0400000000}5346/opt/splunkforwarder/etc/apps/Splunk_TA_stream/linux_x86_64/bin/streamfwdroottcptruefalse10.0.1.25-48856-false10.0.1.12-8000- 11241100x8000000000000000557101Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:19.442{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.78341d633ff8c43c2021-12-21 11:39:19.442root 11241100x8000000000000000557102Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:19.942{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2d92da07305cd93e2021-12-21 11:39:19.942root 11241100x8000000000000000557103Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:20.442{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.fef98f68fb8d1fa12021-12-21 11:39:20.442root 11241100x8000000000000000557104Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:20.942{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d48897ae48cfc6a12021-12-21 11:39:20.942root 11241100x8000000000000000557105Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:21.442{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f137eddd70f194922021-12-21 11:39:21.442root 11241100x8000000000000000557106Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:21.942{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.962198be686bd3b02021-12-21 11:39:21.942root 11241100x8000000000000000557107Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:22.442{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.749ac4eda85528752021-12-21 11:39:22.442root 11241100x8000000000000000557108Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:22.942{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.03f85a6e8995603e2021-12-21 11:39:22.942root 11241100x8000000000000000557109Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:23.442{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4fe8a2b449b12c492021-12-21 11:39:23.442root 11241100x8000000000000000557110Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:23.942{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.04715f28d35108202021-12-21 11:39:23.942root 354300x8000000000000000557111Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:24.129{ec2b6afe-95d9-61c1-5175-3a0400000000}5346/opt/splunkforwarder/etc/apps/Splunk_TA_stream/linux_x86_64/bin/streamfwdroottcptruefalse10.0.1.25-48858-false10.0.1.12-8000- 11241100x8000000000000000557112Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:24.442{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.77afdc15b895daaf2021-12-21 11:39:24.442root 11241100x8000000000000000557113Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:24.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.95a754fa474c97f32021-12-21 11:39:24.443root 11241100x8000000000000000557114Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:24.942{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.315c18e636a6b9e32021-12-21 11:39:24.942root 11241100x8000000000000000557115Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:24.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3aea9f67ce3b04a12021-12-21 11:39:24.943root 11241100x8000000000000000557116Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:25.442{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3390eb5e750e47432021-12-21 11:39:25.442root 11241100x8000000000000000557117Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:25.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b9ee4fa3b0b157822021-12-21 11:39:25.443root 354300x8000000000000000557118Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:25.528{ec2b6afe-95d2-61c1-3038-b84203560000}5272/opt/splunkforwarder/bin/splunkdroottcptruefalse10.0.1.25-35924-false10.0.1.12-8089- 11241100x8000000000000000557119Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:25.942{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.dd31e4c1368cad622021-12-21 11:39:25.942root 11241100x8000000000000000557120Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:25.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.fb546b30ec907a592021-12-21 11:39:25.943root 11241100x8000000000000000557121Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:25.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9466fffff3c1bb6a2021-12-21 11:39:25.943root 11241100x8000000000000000557122Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:26.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1f16e271e82ec2702021-12-21 11:39:26.443root 11241100x8000000000000000557123Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:26.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d0ef19fb482954c62021-12-21 11:39:26.443root 11241100x8000000000000000557124Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:26.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ca254f3c68c4c95c2021-12-21 11:39:26.443root 11241100x8000000000000000557125Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:26.942{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b4e311c78411971e2021-12-21 11:39:26.942root 11241100x8000000000000000557126Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:26.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f6efc631bae9b0262021-12-21 11:39:26.943root 11241100x8000000000000000557127Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:26.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b0e479d632c528cb2021-12-21 11:39:26.943root 11241100x8000000000000000557128Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:27.442{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e09901da921d370f2021-12-21 11:39:27.442root 11241100x8000000000000000557129Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:27.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1e4dcc75ed4acc022021-12-21 11:39:27.443root 11241100x8000000000000000557130Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:27.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0a4b3fa3b64d80ee2021-12-21 11:39:27.443root 11241100x8000000000000000557131Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:27.942{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.fba000d76e5f125b2021-12-21 11:39:27.942root 11241100x8000000000000000557132Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:27.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.598ed25c4887e5ed2021-12-21 11:39:27.943root 11241100x8000000000000000557133Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:27.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4a93369c2ee0bb062021-12-21 11:39:27.943root 154100x8000000000000000557134Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:28.083{ec2b6afe-bcf0-61c1-68a4-ece39d550000}9939/bin/ps-----ps -e -o pid,ppid,state,command/var/snap/amazon-ssm-agent/4046root{ec2b6afe-0000-0000-0000-000000000000}04294967295no level-{00000000-0000-0000-0000-000000000000}2319--- 534500x8000000000000000557135Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:28.096{ec2b6afe-bcf0-61c1-68a4-ece39d550000}9939/bin/psroot 11241100x8000000000000000557136Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:28.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8136b9295dd923c32021-12-21 11:39:28.443root 11241100x8000000000000000557137Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:28.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b2266527a387c4d02021-12-21 11:39:28.443root 11241100x8000000000000000557138Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:28.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.39475084a45558ff2021-12-21 11:39:28.443root 11241100x8000000000000000557139Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:28.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5156d35df6a6e8042021-12-21 11:39:28.443root 11241100x8000000000000000557140Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:28.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8c550bda66283d472021-12-21 11:39:28.443root 11241100x8000000000000000557141Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:28.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.61dbf6a2660999fb2021-12-21 11:39:28.943root 11241100x8000000000000000557142Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:28.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.443317bdcf16416c2021-12-21 11:39:28.943root 11241100x8000000000000000557143Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:28.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.183945ea642252162021-12-21 11:39:28.943root 11241100x8000000000000000557144Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:28.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f8249b1864eb15e62021-12-21 11:39:28.943root 11241100x8000000000000000557145Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:28.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.44cdfca04752bd0e2021-12-21 11:39:28.943root 354300x8000000000000000557146Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:29.240{ec2b6afe-95d9-61c1-5175-3a0400000000}5346/opt/splunkforwarder/etc/apps/Splunk_TA_stream/linux_x86_64/bin/streamfwdroottcptruefalse10.0.1.25-48862-false10.0.1.12-8000- 11241100x8000000000000000557147Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:29.241{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a36e7bc05fff6da82021-12-21 11:39:29.241root 11241100x8000000000000000557148Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:29.241{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.be21a53aaab4cabd2021-12-21 11:39:29.241root 11241100x8000000000000000557149Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:29.241{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9447545ce69c88c42021-12-21 11:39:29.241root 11241100x8000000000000000557150Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:29.241{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0f5604f77e97b9112021-12-21 11:39:29.241root 11241100x8000000000000000557151Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:29.241{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c3aa9d504efedb3b2021-12-21 11:39:29.241root 11241100x8000000000000000557152Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:29.241{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6b98eac4ec81717d2021-12-21 11:39:29.241root 11241100x8000000000000000557153Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:29.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e09bb07b022b6eaa2021-12-21 11:39:29.693root 11241100x8000000000000000557154Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:29.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.13da365e1531bd882021-12-21 11:39:29.693root 11241100x8000000000000000557155Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:29.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7924390e05f0bc6d2021-12-21 11:39:29.693root 11241100x8000000000000000557156Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:29.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4a9a6c1527b6538d2021-12-21 11:39:29.693root 11241100x8000000000000000557157Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:29.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1809e2eb75f2cbf42021-12-21 11:39:29.693root 11241100x8000000000000000557158Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:29.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2841fd5cd5a7b08d2021-12-21 11:39:29.693root 11241100x8000000000000000557159Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:30.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3413cc727c29fc522021-12-21 11:39:30.193root 11241100x8000000000000000557160Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:30.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f31f4eb30cca381d2021-12-21 11:39:30.193root 11241100x8000000000000000557161Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:30.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d9307d31d17a7c332021-12-21 11:39:30.193root 11241100x8000000000000000557162Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:30.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.49ac92cf63c6a7b32021-12-21 11:39:30.193root 11241100x8000000000000000557163Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:30.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.400b64c3824026bf2021-12-21 11:39:30.193root 11241100x8000000000000000557164Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:30.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.36fd090f08e113202021-12-21 11:39:30.193root 11241100x8000000000000000557165Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:30.692{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.badf3caa1bbe8ed92021-12-21 11:39:30.692root 11241100x8000000000000000557166Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:30.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8f9996c9057e7ad22021-12-21 11:39:30.693root 11241100x8000000000000000557167Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:30.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.868b38ff9803b97c2021-12-21 11:39:30.693root 11241100x8000000000000000557168Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:30.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5bbda343dc837a5a2021-12-21 11:39:30.693root 11241100x8000000000000000557169Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:30.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b7f648bb6d35d5042021-12-21 11:39:30.693root 11241100x8000000000000000557170Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:30.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.93e0bf620afd52b42021-12-21 11:39:30.693root 11241100x8000000000000000557171Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:31.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.70c9cf93b052fc112021-12-21 11:39:31.193root 11241100x8000000000000000557172Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:31.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7170bb04f299f6ba2021-12-21 11:39:31.193root 11241100x8000000000000000557173Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:31.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a6c555e8fa4f67c32021-12-21 11:39:31.193root 11241100x8000000000000000557174Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:31.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1f74c8a5ef75d6d32021-12-21 11:39:31.193root 11241100x8000000000000000557175Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:31.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.182f06065762f1f12021-12-21 11:39:31.193root 11241100x8000000000000000557176Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:31.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5a437e6db585e2932021-12-21 11:39:31.193root 11241100x8000000000000000557177Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:31.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8baf523ed1e5ba6e2021-12-21 11:39:31.693root 11241100x8000000000000000557178Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:31.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ff93f5239eb81d962021-12-21 11:39:31.693root 11241100x8000000000000000557179Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:31.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9b2c0adc905f880a2021-12-21 11:39:31.693root 11241100x8000000000000000557180Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:31.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c40139e6bf8147f02021-12-21 11:39:31.693root 11241100x8000000000000000557181Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:31.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.74738694580dd4982021-12-21 11:39:31.693root 11241100x8000000000000000557182Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:31.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.32d3bb6a6898117e2021-12-21 11:39:31.693root 11241100x8000000000000000557183Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:32.192{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.10d9b76a06ac40402021-12-21 11:39:32.192root 11241100x8000000000000000557184Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:32.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d351dc1d18697d8c2021-12-21 11:39:32.193root 11241100x8000000000000000557185Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:32.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c68cb66b070816de2021-12-21 11:39:32.193root 11241100x8000000000000000557186Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:32.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9ca86eab9caf06fe2021-12-21 11:39:32.193root 11241100x8000000000000000557187Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:32.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b92d6893f3a7e4422021-12-21 11:39:32.193root 11241100x8000000000000000557188Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:32.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1030be92e0fcb1842021-12-21 11:39:32.193root 11241100x8000000000000000557189Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:32.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3f986ed36a7920ef2021-12-21 11:39:32.693root 11241100x8000000000000000557190Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:32.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8e1166194988b4d22021-12-21 11:39:32.693root 11241100x8000000000000000557191Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:32.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f1a698a61d3ab8282021-12-21 11:39:32.693root 11241100x8000000000000000557192Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:32.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e866b5bcda1863322021-12-21 11:39:32.693root 11241100x8000000000000000557193Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:32.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.450dedd68fe4ae032021-12-21 11:39:32.693root 11241100x8000000000000000557194Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:32.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d27199178604e0822021-12-21 11:39:32.693root 11241100x8000000000000000557195Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:33.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.640f0eeaa5924e882021-12-21 11:39:33.193root 11241100x8000000000000000557196Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:33.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ea8b521b4f9173e72021-12-21 11:39:33.193root 11241100x8000000000000000557197Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:33.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c423936c97f7ec712021-12-21 11:39:33.193root 11241100x8000000000000000557198Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:33.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9670a327cc126ebc2021-12-21 11:39:33.193root 11241100x8000000000000000557199Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:33.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2aa1eeb8e7195b702021-12-21 11:39:33.193root 11241100x8000000000000000557200Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:33.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9b7542c7a7c89bf22021-12-21 11:39:33.193root 11241100x8000000000000000557201Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:33.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.fa2af13bc09a8ae32021-12-21 11:39:33.693root 11241100x8000000000000000557202Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:33.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ce9a487c027035152021-12-21 11:39:33.693root 11241100x8000000000000000557203Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:33.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f1cf2c6347aec1e62021-12-21 11:39:33.693root 11241100x8000000000000000557204Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:33.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b20f6bced4a7feb52021-12-21 11:39:33.693root 11241100x8000000000000000557205Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:33.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7e54a1b310aaafa02021-12-21 11:39:33.693root 11241100x8000000000000000557206Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:33.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.64eb5927ac23003e2021-12-21 11:39:33.693root 11241100x8000000000000000557207Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:34.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3fabdf1a973dc7a22021-12-21 11:39:34.193root 11241100x8000000000000000557208Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:34.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.835a88ba16f84cfe2021-12-21 11:39:34.193root 11241100x8000000000000000557209Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:34.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f88ed858ad4e2fc62021-12-21 11:39:34.193root 11241100x8000000000000000557210Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:34.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c12c2f65329669df2021-12-21 11:39:34.193root 11241100x8000000000000000557211Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:34.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.18778685da32c2a22021-12-21 11:39:34.193root 11241100x8000000000000000557212Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:34.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c10c73f0e35e4de72021-12-21 11:39:34.193root 11241100x8000000000000000557213Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:34.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ed0bf3782b352e2d2021-12-21 11:39:34.693root 11241100x8000000000000000557214Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:34.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ff3c92ea61683d4b2021-12-21 11:39:34.693root 11241100x8000000000000000557215Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:34.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c1feb0e754a7380e2021-12-21 11:39:34.693root 11241100x8000000000000000557216Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:34.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4e96c3eeafa390012021-12-21 11:39:34.693root 11241100x8000000000000000557217Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:34.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.94ab154fbaa9771c2021-12-21 11:39:34.693root 11241100x8000000000000000557218Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:34.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3ffed4b9496f20952021-12-21 11:39:34.693root 354300x8000000000000000557219Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:35.113{ec2b6afe-95d9-61c1-5175-3a0400000000}5346/opt/splunkforwarder/etc/apps/Splunk_TA_stream/linux_x86_64/bin/streamfwdroottcptruefalse10.0.1.25-48864-false10.0.1.12-8000- 11241100x8000000000000000557220Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:35.114{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6541b100f8e0f30f2021-12-21 11:39:35.114root 11241100x8000000000000000557221Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:35.114{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.678991bec1148edf2021-12-21 11:39:35.114root 11241100x8000000000000000557222Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:35.114{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.afdb08b965a697632021-12-21 11:39:35.114root 11241100x8000000000000000557223Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:35.114{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.be66c0309ae63c152021-12-21 11:39:35.114root 11241100x8000000000000000557224Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:35.115{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.fdd1292c06e85a6b2021-12-21 11:39:35.115root 11241100x8000000000000000557225Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:35.115{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.52efbd27531cb6a32021-12-21 11:39:35.115root 11241100x8000000000000000557226Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:35.115{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9244039169460ab12021-12-21 11:39:35.115root 11241100x8000000000000000557227Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:35.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8872ebb579b2f4572021-12-21 11:39:35.443root 11241100x8000000000000000557228Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:35.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3dbf2742b0e07a742021-12-21 11:39:35.443root 11241100x8000000000000000557229Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:35.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5df5869879f754ef2021-12-21 11:39:35.443root 11241100x8000000000000000557230Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:35.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f82e5f8c5ac841bb2021-12-21 11:39:35.443root 11241100x8000000000000000557231Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:35.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.36170286e11feafa2021-12-21 11:39:35.443root 11241100x8000000000000000557232Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:35.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6fd8e162f21285c32021-12-21 11:39:35.444root 11241100x8000000000000000557233Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:35.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3dde8be0f965a6ef2021-12-21 11:39:35.444root 11241100x8000000000000000557234Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:35.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d4b66a19b70e59152021-12-21 11:39:35.943root 11241100x8000000000000000557235Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:35.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a7d2bca20110d9032021-12-21 11:39:35.943root 11241100x8000000000000000557236Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:35.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1ad5af20e7c78c632021-12-21 11:39:35.943root 11241100x8000000000000000557237Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:35.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.afd29b7e646225f12021-12-21 11:39:35.943root 11241100x8000000000000000557238Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:35.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.271252d976b599e62021-12-21 11:39:35.943root 11241100x8000000000000000557239Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:35.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.fbfe1000354032032021-12-21 11:39:35.943root 11241100x8000000000000000557240Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:35.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.85f1c544595213962021-12-21 11:39:35.943root 11241100x8000000000000000557241Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:36.326{ec2b6afe-95d2-61c1-3038-b84203560000}5272/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/spool/splunk/tracker.log2021-12-21 11:39:36.326root 11241100x8000000000000000557242Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:36.327{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d7312dfba62951172021-12-21 11:39:36.327root 11241100x8000000000000000557243Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:36.327{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5dd335e9d734457c2021-12-21 11:39:36.327root 11241100x8000000000000000557244Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:36.327{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c2be2fb7fdff7f082021-12-21 11:39:36.327root 11241100x8000000000000000557245Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:36.327{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.aa1a8434bc4663432021-12-21 11:39:36.327root 11241100x8000000000000000557246Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:36.327{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4c69be543a28466e2021-12-21 11:39:36.327root 11241100x8000000000000000557247Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:36.328{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f06de8f3b1bd59be2021-12-21 11:39:36.328root 11241100x8000000000000000557248Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:36.328{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.80f9bf76a4c063302021-12-21 11:39:36.328root 11241100x8000000000000000557249Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:36.328{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d2e492921e3366142021-12-21 11:39:36.328root 11241100x8000000000000000557250Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:36.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ff7cdd0cebf75eed2021-12-21 11:39:36.693root 11241100x8000000000000000557251Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:36.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1642e7c773b136482021-12-21 11:39:36.693root 11241100x8000000000000000557252Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:36.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.504c4e4860fcdf852021-12-21 11:39:36.693root 11241100x8000000000000000557253Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:36.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.56e9a8863d35c1a92021-12-21 11:39:36.693root 11241100x8000000000000000557254Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:36.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.99e5058a80fec2e32021-12-21 11:39:36.693root 11241100x8000000000000000557255Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:36.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f625e079b7eae6c92021-12-21 11:39:36.693root 11241100x8000000000000000557256Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:36.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.468320aa77517f322021-12-21 11:39:36.693root 11241100x8000000000000000557257Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:36.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4c18b52a46e9f7512021-12-21 11:39:36.693root 11241100x8000000000000000557258Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:37.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.425a5b82b3bc98792021-12-21 11:39:37.193root 11241100x8000000000000000557259Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:37.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.270cbe1056a6ddad2021-12-21 11:39:37.193root 11241100x8000000000000000557260Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:37.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.fb2b762d9934842a2021-12-21 11:39:37.193root 11241100x8000000000000000557261Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:37.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c10bf0c2606544b02021-12-21 11:39:37.193root 11241100x8000000000000000557262Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:37.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e09ff258c0b1ae122021-12-21 11:39:37.193root 11241100x8000000000000000557263Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:37.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b86515d5e0c6b4222021-12-21 11:39:37.193root 11241100x8000000000000000557264Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:37.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3b3c78061842fdd82021-12-21 11:39:37.193root 11241100x8000000000000000557265Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:37.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.61938146ab07690e2021-12-21 11:39:37.193root 11241100x8000000000000000557266Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:37.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0889fcd40791ca582021-12-21 11:39:37.693root 11241100x8000000000000000557267Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:37.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3986c33c3deeaf0f2021-12-21 11:39:37.693root 11241100x8000000000000000557268Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:37.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.cef19c1f06780fbd2021-12-21 11:39:37.693root 11241100x8000000000000000557269Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:37.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0c16d2079871cefe2021-12-21 11:39:37.693root 11241100x8000000000000000557270Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:37.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.58a56e213c5f27042021-12-21 11:39:37.693root 11241100x8000000000000000557271Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:37.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.db78498c7ff998952021-12-21 11:39:37.694root 11241100x8000000000000000557272Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:37.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.587e765a60d5deae2021-12-21 11:39:37.694root 11241100x8000000000000000557273Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:37.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8589390972670cc52021-12-21 11:39:37.694root 11241100x8000000000000000557274Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:38.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5d008b22196b13042021-12-21 11:39:38.193root 11241100x8000000000000000557275Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:38.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.93c72e5e87beecfe2021-12-21 11:39:38.193root 11241100x8000000000000000557276Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:38.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c96fb6f6579e12502021-12-21 11:39:38.193root 11241100x8000000000000000557277Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:38.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b0751b8eca7b6d532021-12-21 11:39:38.194root 11241100x8000000000000000557278Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:38.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0491a788f645f06d2021-12-21 11:39:38.194root 11241100x8000000000000000557279Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:38.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5d747009e8107fc32021-12-21 11:39:38.194root 11241100x8000000000000000557280Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:38.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6023b7b82cfe30352021-12-21 11:39:38.194root 11241100x8000000000000000557281Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:38.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.fa58b8783e8c9dcc2021-12-21 11:39:38.194root 11241100x8000000000000000557282Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:38.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.683f650ea02ba7222021-12-21 11:39:38.693root 11241100x8000000000000000557283Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:38.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.12a0bb64cf3955812021-12-21 11:39:38.693root 11241100x8000000000000000557284Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:38.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.bf8ba2521cce403a2021-12-21 11:39:38.693root 11241100x8000000000000000557285Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:38.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3f7f090cd848b9bf2021-12-21 11:39:38.693root 11241100x8000000000000000557286Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:38.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a59ef67874f87f542021-12-21 11:39:38.693root 11241100x8000000000000000557287Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:38.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.75c080919f85008c2021-12-21 11:39:38.693root 11241100x8000000000000000557288Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:38.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3634b39b6fae01582021-12-21 11:39:38.693root 11241100x8000000000000000557289Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:38.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.af105357322b01632021-12-21 11:39:38.693root 11241100x8000000000000000557290Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:39.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4d257077adb275d42021-12-21 11:39:39.193root 11241100x8000000000000000557291Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:39.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.bad92cb41a6937a12021-12-21 11:39:39.193root 11241100x8000000000000000557292Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:39.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.76f690e043c172f52021-12-21 11:39:39.193root 11241100x8000000000000000557293Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:39.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5432260a52ef1db32021-12-21 11:39:39.193root 11241100x8000000000000000557294Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:39.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4d6c3377762d01312021-12-21 11:39:39.194root 11241100x8000000000000000557295Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:39.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.393d8f55544f66062021-12-21 11:39:39.194root 11241100x8000000000000000557296Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:39.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6d493088bfc064b92021-12-21 11:39:39.194root 11241100x8000000000000000557297Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:39.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.27f83689dfd45ef62021-12-21 11:39:39.194root 23542300x8000000000000000557298Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:39.328{ec2b6afe-95d2-61c1-3038-b84203560000}5272root/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/spool/splunk/tracker.log--- 11241100x8000000000000000557299Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:39.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5220cc82636f2ea52021-12-21 11:39:39.693root 11241100x8000000000000000557300Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:39.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e40f1c4b1421e48e2021-12-21 11:39:39.693root 11241100x8000000000000000557301Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:39.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.edc4678cabc7b18c2021-12-21 11:39:39.693root 11241100x8000000000000000557302Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:39.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d9e81afedb7b91d92021-12-21 11:39:39.693root 11241100x8000000000000000557303Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:39.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5c6d7756ec7c0b502021-12-21 11:39:39.694root 11241100x8000000000000000557304Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:39.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b550253a1d9a283e2021-12-21 11:39:39.694root 11241100x8000000000000000557305Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:39.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4e3f5bd23b43ed562021-12-21 11:39:39.694root 11241100x8000000000000000557306Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:39.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.22914b42b88ef5752021-12-21 11:39:39.694root 11241100x8000000000000000557307Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:39.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.cc80190e6a46f0f72021-12-21 11:39:39.694root 11241100x8000000000000000557308Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:40.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.bb2b385e5024b3062021-12-21 11:39:40.193root 11241100x8000000000000000557309Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:40.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.02c8e3706f52b6582021-12-21 11:39:40.193root 11241100x8000000000000000557310Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:40.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4beb164234eac1b72021-12-21 11:39:40.193root 11241100x8000000000000000557311Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:40.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.eb668e339b8927962021-12-21 11:39:40.193root 11241100x8000000000000000557312Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:40.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8afd0ccf6586da272021-12-21 11:39:40.193root 11241100x8000000000000000557313Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:40.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1ce1ada77ce1c8652021-12-21 11:39:40.193root 11241100x8000000000000000557314Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:40.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a786625850e30f242021-12-21 11:39:40.193root 11241100x8000000000000000557315Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:40.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9769fcca33522ee92021-12-21 11:39:40.193root 11241100x8000000000000000557316Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:40.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.50771975106941fb2021-12-21 11:39:40.193root 354300x8000000000000000557317Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:40.196{ec2b6afe-95d9-61c1-5175-3a0400000000}5346/opt/splunkforwarder/etc/apps/Splunk_TA_stream/linux_x86_64/bin/streamfwdroottcptruefalse10.0.1.25-48866-false10.0.1.12-8000- 11241100x8000000000000000557318Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:40.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ed9bbb9e28a1725a2021-12-21 11:39:40.693root 11241100x8000000000000000557319Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:40.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.af7ef4d5a16f0f652021-12-21 11:39:40.693root 11241100x8000000000000000557320Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:40.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9bcc08e6b6ffd8212021-12-21 11:39:40.693root 11241100x8000000000000000557321Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:40.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2169ce6a595160d82021-12-21 11:39:40.693root 11241100x8000000000000000557322Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:40.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.37ca3e51a84f0cb32021-12-21 11:39:40.694root 11241100x8000000000000000557323Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:40.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.44830a6e9420f90d2021-12-21 11:39:40.694root 11241100x8000000000000000557324Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:40.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.300beda0beb3a7512021-12-21 11:39:40.694root 11241100x8000000000000000557325Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:40.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.675d2c26ce8447162021-12-21 11:39:40.694root 11241100x8000000000000000557326Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:40.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.83164e42f03cdac12021-12-21 11:39:40.694root 11241100x8000000000000000557327Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:40.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2c1d3f86354c20c32021-12-21 11:39:40.694root 11241100x8000000000000000557328Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:41.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.37c655cc68b6dd402021-12-21 11:39:41.193root 11241100x8000000000000000557329Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:41.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d4a956a6773667922021-12-21 11:39:41.193root 11241100x8000000000000000557330Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:41.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2fc33dbe91da1a4a2021-12-21 11:39:41.193root 11241100x8000000000000000557331Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:41.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.68c5cdfbf44994602021-12-21 11:39:41.193root 11241100x8000000000000000557332Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:41.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2abd452680fc3ee12021-12-21 11:39:41.194root 11241100x8000000000000000557333Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:41.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4178cfd5b025062b2021-12-21 11:39:41.194root 11241100x8000000000000000557334Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:41.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.783fb76b4bb9e5c42021-12-21 11:39:41.194root 11241100x8000000000000000557335Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:41.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.804673ec270f4c832021-12-21 11:39:41.194root 11241100x8000000000000000557336Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:41.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.796a9991e8099f1a2021-12-21 11:39:41.194root 11241100x8000000000000000557337Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:41.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d9afba6872bce2f32021-12-21 11:39:41.194root 11241100x8000000000000000557338Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:41.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e500c84f73ec533a2021-12-21 11:39:41.693root 11241100x8000000000000000557339Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:41.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c3ee4e90ea3947432021-12-21 11:39:41.693root 11241100x8000000000000000557340Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:41.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.24940b7b8f00b2182021-12-21 11:39:41.693root 11241100x8000000000000000557341Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:41.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5c8f0eb463e0207c2021-12-21 11:39:41.693root 11241100x8000000000000000557342Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:41.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f1d201123f3cf8902021-12-21 11:39:41.694root 11241100x8000000000000000557343Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:41.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.213dde08ff120fc32021-12-21 11:39:41.694root 11241100x8000000000000000557344Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:41.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d276957913c161a62021-12-21 11:39:41.694root 11241100x8000000000000000557345Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:41.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d5b27c280521820e2021-12-21 11:39:41.694root 11241100x8000000000000000557346Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:41.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1f654accb64fcdd32021-12-21 11:39:41.694root 11241100x8000000000000000557347Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:41.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.89e1c05bc7a753342021-12-21 11:39:41.694root 11241100x8000000000000000557348Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:42.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5cab00991a94825f2021-12-21 11:39:42.193root 11241100x8000000000000000557349Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:42.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ae4a519a0be29a6e2021-12-21 11:39:42.193root 11241100x8000000000000000557350Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:42.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.cd10c96f9a948fe92021-12-21 11:39:42.193root 11241100x8000000000000000557351Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:42.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.63b70d6bbd35c0792021-12-21 11:39:42.193root 11241100x8000000000000000557352Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:42.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.51fd864118d431f12021-12-21 11:39:42.193root 11241100x8000000000000000557353Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:42.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a251942fbe667cce2021-12-21 11:39:42.194root 11241100x8000000000000000557354Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:42.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3ddee77d7f8fcd6e2021-12-21 11:39:42.194root 11241100x8000000000000000557355Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:42.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e35187bba176ccab2021-12-21 11:39:42.194root 11241100x8000000000000000557356Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:42.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e6b99538444678992021-12-21 11:39:42.194root 11241100x8000000000000000557357Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:42.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.43d2275333d7e6332021-12-21 11:39:42.194root 11241100x8000000000000000557358Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:42.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1ab4353c63c5c6082021-12-21 11:39:42.693root 11241100x8000000000000000557359Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:42.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.37ab5aab2b1deb942021-12-21 11:39:42.693root 11241100x8000000000000000557360Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:42.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.116e17ac568466352021-12-21 11:39:42.693root 11241100x8000000000000000557361Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:42.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.95db041ffcc92f5f2021-12-21 11:39:42.693root 11241100x8000000000000000557362Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:42.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a63b96e9c260b2102021-12-21 11:39:42.693root 11241100x8000000000000000557363Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:42.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8760f429327399b32021-12-21 11:39:42.693root 11241100x8000000000000000557364Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:42.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ad6b51863134c3842021-12-21 11:39:42.693root 11241100x8000000000000000557365Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:42.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d7dd5f1f3f49562b2021-12-21 11:39:42.693root 11241100x8000000000000000557366Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:42.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3d6c9f14666ea7932021-12-21 11:39:42.693root 11241100x8000000000000000557367Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:42.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1a29804cc6a53a282021-12-21 11:39:42.694root 11241100x8000000000000000557368Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:43.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.cac3dc2b1bbba4e62021-12-21 11:39:43.193root 11241100x8000000000000000557369Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:43.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.86c7be4b52ac5a2e2021-12-21 11:39:43.193root 11241100x8000000000000000557370Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:43.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4d1830df3d00e4c62021-12-21 11:39:43.193root 11241100x8000000000000000557371Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:43.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.80127b227b0ff6a62021-12-21 11:39:43.193root 11241100x8000000000000000557372Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:43.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c4b3c2bcd54771cc2021-12-21 11:39:43.193root 11241100x8000000000000000557373Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:43.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.76a3550dcd2f2f062021-12-21 11:39:43.193root 11241100x8000000000000000557374Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:43.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.fe3543af148468182021-12-21 11:39:43.193root 11241100x8000000000000000557375Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:43.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b3e4cb981d74d8812021-12-21 11:39:43.193root 11241100x8000000000000000557376Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:43.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ad8b91c21fe1741f2021-12-21 11:39:43.193root 11241100x8000000000000000557377Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:43.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.fbac36f2aa40bf6d2021-12-21 11:39:43.193root 11241100x8000000000000000557378Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:43.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.924e9f6f375908dd2021-12-21 11:39:43.693root 11241100x8000000000000000557379Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:43.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9ab089f4996513662021-12-21 11:39:43.693root 11241100x8000000000000000557380Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:43.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.fb1ca01e1762be812021-12-21 11:39:43.693root 11241100x8000000000000000557381Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:43.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.569015c3a8bd0a2a2021-12-21 11:39:43.693root 11241100x8000000000000000557382Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:43.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7b1993a520f484712021-12-21 11:39:43.693root 11241100x8000000000000000557383Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:43.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.89fdf4113eec41582021-12-21 11:39:43.693root 11241100x8000000000000000557384Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:43.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.82d0c6e8b3b8d0012021-12-21 11:39:43.693root 11241100x8000000000000000557385Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:43.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f02dc00c9259ffe02021-12-21 11:39:43.693root 11241100x8000000000000000557386Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:43.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5dbb415e2ee628962021-12-21 11:39:43.693root 11241100x8000000000000000557387Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:43.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.73e47a15b7e493652021-12-21 11:39:43.693root 11241100x8000000000000000557388Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:44.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a7ee484feec75e482021-12-21 11:39:44.193root 11241100x8000000000000000557389Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:44.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.cde0b4bee1e8648e2021-12-21 11:39:44.193root 11241100x8000000000000000557390Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:44.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b3de8ab8c9c19fb12021-12-21 11:39:44.193root 11241100x8000000000000000557391Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:44.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.46a24b18bdf27ee42021-12-21 11:39:44.193root 11241100x8000000000000000557392Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:44.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a15bc39d243e5d7b2021-12-21 11:39:44.193root 11241100x8000000000000000557393Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:44.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.42d101f8a1a6ccb92021-12-21 11:39:44.193root 11241100x8000000000000000557394Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:44.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e3fe1edb4a959b152021-12-21 11:39:44.193root 11241100x8000000000000000557395Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:44.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e22ff37908b3b0b82021-12-21 11:39:44.193root 11241100x8000000000000000557396Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:44.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.340e88e6ea047cb22021-12-21 11:39:44.193root 11241100x8000000000000000557397Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:44.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d3aa7492cdd3faf82021-12-21 11:39:44.193root 11241100x8000000000000000557398Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:44.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f15b48d8b1996cf72021-12-21 11:39:44.693root 11241100x8000000000000000557399Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:44.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b6cc3cedae91fd712021-12-21 11:39:44.693root 11241100x8000000000000000557400Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:44.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.11a8b407f68a2da72021-12-21 11:39:44.693root 11241100x8000000000000000557401Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:44.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9ff758ff2eb175472021-12-21 11:39:44.693root 11241100x8000000000000000557402Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:44.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.62ae231add3465272021-12-21 11:39:44.693root 11241100x8000000000000000557403Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:44.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.eb6c9f8892ddd72e2021-12-21 11:39:44.693root 11241100x8000000000000000557404Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:44.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.50ecfac7f30a65162021-12-21 11:39:44.693root 11241100x8000000000000000557405Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:44.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1ebcf751c43adf7a2021-12-21 11:39:44.693root 11241100x8000000000000000557406Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:44.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.dc63ff23ea6f6e8c2021-12-21 11:39:44.693root 11241100x8000000000000000557407Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:44.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9d14271439fe36a72021-12-21 11:39:44.693root 11241100x8000000000000000557408Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:45.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7982a78b0c6e9de12021-12-21 11:39:45.193root 11241100x8000000000000000557409Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:45.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.16358d27aef2e52b2021-12-21 11:39:45.193root 11241100x8000000000000000557410Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:45.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1eeb02016364b5aa2021-12-21 11:39:45.193root 11241100x8000000000000000557411Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:45.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c32b1fcab08151782021-12-21 11:39:45.193root 11241100x8000000000000000557412Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:45.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.bf0bde3f156daf162021-12-21 11:39:45.193root 11241100x8000000000000000557413Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:45.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ff2033660add84ff2021-12-21 11:39:45.193root 11241100x8000000000000000557414Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:45.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.88d649153d2740292021-12-21 11:39:45.193root 11241100x8000000000000000557415Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:45.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e49741b32ac48f8b2021-12-21 11:39:45.193root 11241100x8000000000000000557416Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:45.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.64bf89236457e6d42021-12-21 11:39:45.193root 11241100x8000000000000000557417Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:45.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d19d8ba83f5e5b442021-12-21 11:39:45.193root 354300x8000000000000000557418Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:45.205{ec2b6afe-95d9-61c1-5175-3a0400000000}5346/opt/splunkforwarder/etc/apps/Splunk_TA_stream/linux_x86_64/bin/streamfwdroottcptruefalse10.0.1.25-48868-false10.0.1.12-8000- 11241100x8000000000000000557419Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:45.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.fa691397d046f0a82021-12-21 11:39:45.693root 11241100x8000000000000000557420Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:45.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e01d7b61fe1ace6b2021-12-21 11:39:45.693root 11241100x8000000000000000557421Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:45.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.055a153e2a5ee1722021-12-21 11:39:45.693root 11241100x8000000000000000557422Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:45.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0ccc86c34398d7d72021-12-21 11:39:45.693root 11241100x8000000000000000557423Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:45.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1f179287ec2401432021-12-21 11:39:45.693root 11241100x8000000000000000557424Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:45.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c7ce5343dbba74742021-12-21 11:39:45.694root 11241100x8000000000000000557425Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:45.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9ee18343e64766c62021-12-21 11:39:45.694root 11241100x8000000000000000557426Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:45.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b6b5d522dc2017682021-12-21 11:39:45.694root 11241100x8000000000000000557427Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:45.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.826365ccf597efeb2021-12-21 11:39:45.694root 11241100x8000000000000000557428Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:45.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.524278a50886f67a2021-12-21 11:39:45.694root 11241100x8000000000000000557429Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:45.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9ec51f20bfd120cc2021-12-21 11:39:45.694root 11241100x8000000000000000557430Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:46.192{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.99a6e26874a621152021-12-21 11:39:46.192root 11241100x8000000000000000557431Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:46.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.22238fb0497679dc2021-12-21 11:39:46.193root 11241100x8000000000000000557432Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:46.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8afe33797eec7e2b2021-12-21 11:39:46.193root 11241100x8000000000000000557433Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:46.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d91b42c4fc5225672021-12-21 11:39:46.193root 11241100x8000000000000000557434Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:46.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2ad8428086b3b8a82021-12-21 11:39:46.193root 11241100x8000000000000000557435Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:46.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.80eaaeddeabb980e2021-12-21 11:39:46.193root 11241100x8000000000000000557436Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:46.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0c399a43c5bef9ea2021-12-21 11:39:46.193root 11241100x8000000000000000557437Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:46.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e3335b100c6434f12021-12-21 11:39:46.193root 11241100x8000000000000000557438Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:46.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f5f802014ea7089a2021-12-21 11:39:46.193root 11241100x8000000000000000557439Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:46.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.bb161ddc05479bc92021-12-21 11:39:46.193root 11241100x8000000000000000557440Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:46.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c798a6438c123a912021-12-21 11:39:46.194root 11241100x8000000000000000557441Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:46.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5942f8c7b3d0e5752021-12-21 11:39:46.693root 11241100x8000000000000000557442Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:46.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f1585df8ac3c21942021-12-21 11:39:46.693root 11241100x8000000000000000557443Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:46.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.65c62ac054f59bf82021-12-21 11:39:46.693root 11241100x8000000000000000557444Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:46.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f356a8c2e72166062021-12-21 11:39:46.693root 11241100x8000000000000000557445Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:46.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.dc9d97e9a16374a12021-12-21 11:39:46.693root 11241100x8000000000000000557446Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:46.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f8a42fbdf08fd6fa2021-12-21 11:39:46.693root 11241100x8000000000000000557447Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:46.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b26d1a392b0a4f4b2021-12-21 11:39:46.693root 11241100x8000000000000000557448Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:46.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2485f24cd1a0bcef2021-12-21 11:39:46.693root 11241100x8000000000000000557449Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:46.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.65bcd05a1b7802102021-12-21 11:39:46.693root 11241100x8000000000000000557450Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:46.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.405c66faca05a9fe2021-12-21 11:39:46.693root 11241100x8000000000000000557451Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:46.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8f662b18689de73a2021-12-21 11:39:46.694root 11241100x8000000000000000557452Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:47.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.518fbc3c34da91612021-12-21 11:39:47.193root 11241100x8000000000000000557453Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:47.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.15281a946d0a263e2021-12-21 11:39:47.193root 11241100x8000000000000000557454Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:47.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a3462be0e5920bd82021-12-21 11:39:47.193root 11241100x8000000000000000557455Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:47.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1b0afbe4cd395fac2021-12-21 11:39:47.193root 11241100x8000000000000000557456Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:47.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.06cb7cfbbea826ea2021-12-21 11:39:47.193root 11241100x8000000000000000557457Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:47.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.347e084e6a8d83572021-12-21 11:39:47.193root 11241100x8000000000000000557458Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:47.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9f350310df9bd39e2021-12-21 11:39:47.193root 11241100x8000000000000000557459Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:47.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.75f3f1dbd265d9bd2021-12-21 11:39:47.193root 11241100x8000000000000000557460Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:47.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5ae05b590ff0f0da2021-12-21 11:39:47.193root 11241100x8000000000000000557461Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:47.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6b90b44f197fcec12021-12-21 11:39:47.193root 11241100x8000000000000000557462Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:47.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d5c6908dcb5f0b862021-12-21 11:39:47.193root 11241100x8000000000000000557463Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:47.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b66b31be5c8ff6832021-12-21 11:39:47.693root 11241100x8000000000000000557464Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:47.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.87089d163d8e4e6e2021-12-21 11:39:47.693root 11241100x8000000000000000557465Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:47.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2d6c718e538b59062021-12-21 11:39:47.693root 11241100x8000000000000000557466Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:47.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3246527336265c1e2021-12-21 11:39:47.693root 11241100x8000000000000000557467Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:47.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.276fc9c9648daff12021-12-21 11:39:47.693root 11241100x8000000000000000557468Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:47.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f5aff090a7ee14612021-12-21 11:39:47.693root 11241100x8000000000000000557469Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:47.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5a616b9a5075b5552021-12-21 11:39:47.693root 11241100x8000000000000000557470Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:47.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.469d5ab55d28d3d42021-12-21 11:39:47.693root 11241100x8000000000000000557471Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:47.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2c52a258d115e1742021-12-21 11:39:47.693root 11241100x8000000000000000557472Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:47.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c00aa252600255d32021-12-21 11:39:47.693root 11241100x8000000000000000557473Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:47.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.739220053be4a65a2021-12-21 11:39:47.694root 11241100x8000000000000000557474Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:48.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1fe3d8c6320a21892021-12-21 11:39:48.193root 11241100x8000000000000000557475Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:48.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.80bb4a7a904303672021-12-21 11:39:48.193root 11241100x8000000000000000557476Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:48.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1aedd440c15ac80e2021-12-21 11:39:48.193root 11241100x8000000000000000557477Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:48.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3e20743989674f912021-12-21 11:39:48.193root 11241100x8000000000000000557478Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:48.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.35605cece10a7e882021-12-21 11:39:48.193root 11241100x8000000000000000557479Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:48.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.baebea0cfa2b39922021-12-21 11:39:48.193root 11241100x8000000000000000557480Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:48.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6e0edd3d68fd65032021-12-21 11:39:48.193root 11241100x8000000000000000557481Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:48.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c1d0ce3a97c490062021-12-21 11:39:48.193root 11241100x8000000000000000557482Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:48.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7af24b46c97e77bb2021-12-21 11:39:48.193root 11241100x8000000000000000557483Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:48.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4160b57002acb9dd2021-12-21 11:39:48.193root 11241100x8000000000000000557484Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:48.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.02de32af5f6517252021-12-21 11:39:48.194root 11241100x8000000000000000557485Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:48.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.02e7233225e3361d2021-12-21 11:39:48.693root 11241100x8000000000000000557486Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:48.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.04cfb661417561152021-12-21 11:39:48.693root 11241100x8000000000000000557487Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:48.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.aada4f989dc3bf762021-12-21 11:39:48.693root 11241100x8000000000000000557488Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:48.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e8b666afc21739372021-12-21 11:39:48.693root 11241100x8000000000000000557489Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:48.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d808db7a17dd21fb2021-12-21 11:39:48.694root 11241100x8000000000000000557490Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:48.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e520f050061b39bc2021-12-21 11:39:48.694root 11241100x8000000000000000557491Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:48.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.124e86a81da0d4ef2021-12-21 11:39:48.694root 11241100x8000000000000000557492Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:48.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0eab5df2740b75e02021-12-21 11:39:48.694root 11241100x8000000000000000557493Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:48.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.012895c6ecdb47892021-12-21 11:39:48.694root 11241100x8000000000000000557494Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:48.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.90e93fad41624cba2021-12-21 11:39:48.694root 11241100x8000000000000000557495Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:48.695{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.de9486157a29034a2021-12-21 11:39:48.695root 11241100x8000000000000000557496Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:49.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.eea237e0461ce9672021-12-21 11:39:49.193root 11241100x8000000000000000557497Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:49.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d2d9fceb9cacec802021-12-21 11:39:49.193root 11241100x8000000000000000557498Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:49.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a2224ca2b35e2add2021-12-21 11:39:49.193root 11241100x8000000000000000557499Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:49.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0f8a19634102a89e2021-12-21 11:39:49.193root 11241100x8000000000000000557500Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:49.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e4af8e85ad81f4d92021-12-21 11:39:49.194root 11241100x8000000000000000557501Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:49.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b79085b85c8c8ee82021-12-21 11:39:49.194root 11241100x8000000000000000557502Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:49.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.aa693c79ac626d162021-12-21 11:39:49.194root 11241100x8000000000000000557503Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:49.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5ece895c2c8b238c2021-12-21 11:39:49.194root 11241100x8000000000000000557504Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:49.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.fa83e193bae5146c2021-12-21 11:39:49.194root 11241100x8000000000000000557505Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:49.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9d5eebc56f0f606b2021-12-21 11:39:49.194root 11241100x8000000000000000557506Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:49.195{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a8f6a833f735236f2021-12-21 11:39:49.195root 11241100x8000000000000000557507Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:49.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1b81198e5141f9d42021-12-21 11:39:49.693root 11241100x8000000000000000557508Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:49.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.42143d41fc918ed72021-12-21 11:39:49.693root 11241100x8000000000000000557509Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:49.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5c64b86dc7d4862b2021-12-21 11:39:49.693root 11241100x8000000000000000557510Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:49.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c226f48ea68140232021-12-21 11:39:49.693root 11241100x8000000000000000557511Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:49.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e4529d6a58f5f7312021-12-21 11:39:49.694root 11241100x8000000000000000557512Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:49.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.bb370e0ce70c64652021-12-21 11:39:49.694root 11241100x8000000000000000557513Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:49.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5860225b660994a22021-12-21 11:39:49.694root 11241100x8000000000000000557514Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:49.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2f2bd65130df7db12021-12-21 11:39:49.694root 11241100x8000000000000000557515Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:49.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ebed22a5ff8e6eaf2021-12-21 11:39:49.694root 11241100x8000000000000000557516Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:49.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5e03bea9126f8b0c2021-12-21 11:39:49.694root 11241100x8000000000000000557517Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:49.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d5cfd15c0158d8752021-12-21 11:39:49.694root 11241100x8000000000000000557518Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:50.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7e70aaa1fbee32442021-12-21 11:39:50.193root 11241100x8000000000000000557519Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:50.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d526e7abdd5c7a032021-12-21 11:39:50.193root 11241100x8000000000000000557520Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:50.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8b10350ebd5153e42021-12-21 11:39:50.193root 11241100x8000000000000000557521Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:50.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b06a737d292ea6802021-12-21 11:39:50.193root 11241100x8000000000000000557522Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:50.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.63bee999527bc9df2021-12-21 11:39:50.194root 11241100x8000000000000000557523Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:50.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3c62084172de66e62021-12-21 11:39:50.194root 11241100x8000000000000000557524Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:50.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.07273b9a2f0997742021-12-21 11:39:50.194root 11241100x8000000000000000557525Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:50.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.644d835bd024cfa32021-12-21 11:39:50.194root 11241100x8000000000000000557526Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:50.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.28045d240e54ac432021-12-21 11:39:50.194root 11241100x8000000000000000557527Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:50.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.db96469995e36d212021-12-21 11:39:50.194root 11241100x8000000000000000557528Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:50.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.69969575e12ae6982021-12-21 11:39:50.194root 11241100x8000000000000000557529Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:50.692{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.56a245e05a8502e92021-12-21 11:39:50.692root 11241100x8000000000000000557530Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:50.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.dca1694b6c2965f62021-12-21 11:39:50.693root 11241100x8000000000000000557531Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:50.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.76096802355bd7f12021-12-21 11:39:50.693root 11241100x8000000000000000557532Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:50.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.99f5576a80b952332021-12-21 11:39:50.693root 11241100x8000000000000000557533Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:50.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ae4cc9e4ebc330232021-12-21 11:39:50.694root 11241100x8000000000000000557534Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:50.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.953e6f90642ffd602021-12-21 11:39:50.694root 11241100x8000000000000000557535Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:50.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6d3e62f5e3af89992021-12-21 11:39:50.694root 11241100x8000000000000000557536Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:50.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.eb4f1a0d19821f432021-12-21 11:39:50.694root 11241100x8000000000000000557537Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:50.695{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.169c43bc79c846f32021-12-21 11:39:50.695root 11241100x8000000000000000557538Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:50.695{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2a0a9aa79e16340f2021-12-21 11:39:50.695root 11241100x8000000000000000557539Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:50.695{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.96661df572a14f652021-12-21 11:39:50.695root 354300x8000000000000000557540Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:51.016{ec2b6afe-95d9-61c1-5175-3a0400000000}5346/opt/splunkforwarder/etc/apps/Splunk_TA_stream/linux_x86_64/bin/streamfwdroottcptruefalse10.0.1.25-48870-false10.0.1.12-8000- 11241100x8000000000000000557541Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:51.016{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.801092b46f49925b2021-12-21 11:39:51.016root 11241100x8000000000000000557542Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:51.017{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8918b6f7920876be2021-12-21 11:39:51.017root 11241100x8000000000000000557543Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:51.017{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.aca0f0e385195df32021-12-21 11:39:51.017root 11241100x8000000000000000557544Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:51.017{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.185213c99b9bbdd92021-12-21 11:39:51.017root 11241100x8000000000000000557545Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:51.017{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ecb3faf9c6177bb92021-12-21 11:39:51.017root 11241100x8000000000000000557546Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:51.017{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.64fe8f4a964dbdf12021-12-21 11:39:51.017root 11241100x8000000000000000557547Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:51.017{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.55a1f41aa5a2a6772021-12-21 11:39:51.017root 11241100x8000000000000000557548Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:51.018{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f6b1d9010204f1f52021-12-21 11:39:51.018root 11241100x8000000000000000557549Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:51.018{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1354fe118e7d9b102021-12-21 11:39:51.018root 11241100x8000000000000000557550Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:51.018{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7120f66fb73f34be2021-12-21 11:39:51.018root 11241100x8000000000000000557551Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:51.018{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ed307345fb24dcb22021-12-21 11:39:51.018root 11241100x8000000000000000557552Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:51.018{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5778a5ef73da00af2021-12-21 11:39:51.018root 11241100x8000000000000000557553Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:51.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.eb035e81aeaf52a02021-12-21 11:39:51.443root 11241100x8000000000000000557554Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:51.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.08565c71570f20942021-12-21 11:39:51.443root 11241100x8000000000000000557555Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:51.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0e79cd8e2bdd611c2021-12-21 11:39:51.443root 11241100x8000000000000000557556Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:51.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d197eb1994703b512021-12-21 11:39:51.443root 11241100x8000000000000000557557Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:51.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2bb7345f2a3908832021-12-21 11:39:51.443root 11241100x8000000000000000557558Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:51.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.fd6d79b2119619d92021-12-21 11:39:51.443root 11241100x8000000000000000557559Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:51.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a5d36d2d4136abd32021-12-21 11:39:51.443root 11241100x8000000000000000557560Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:51.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.88b324c8882a85f32021-12-21 11:39:51.443root 11241100x8000000000000000557561Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:51.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.13c9fb0907938be42021-12-21 11:39:51.443root 11241100x8000000000000000557562Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:51.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5ca447b3541a5d682021-12-21 11:39:51.443root 11241100x8000000000000000557563Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:51.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1c223c39ea35ce4f2021-12-21 11:39:51.444root 11241100x8000000000000000557564Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:51.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e4f599cafc4ba3772021-12-21 11:39:51.444root 11241100x8000000000000000557565Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:51.942{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d31a3d26993cd3532021-12-21 11:39:51.942root 11241100x8000000000000000557566Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:51.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.667ae7ab27e7e5302021-12-21 11:39:51.943root 11241100x8000000000000000557567Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:51.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.edb4fa7e7db942702021-12-21 11:39:51.943root 11241100x8000000000000000557568Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:51.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.28e467ca0075e7132021-12-21 11:39:51.943root 11241100x8000000000000000557569Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:51.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a34d6979279e0aa82021-12-21 11:39:51.943root 11241100x8000000000000000557570Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:51.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7ef1989dbdfc88dc2021-12-21 11:39:51.943root 11241100x8000000000000000557571Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:51.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.bfe0763dfcd71eb02021-12-21 11:39:51.943root 11241100x8000000000000000557572Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:51.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.91306d92bf9b2d2b2021-12-21 11:39:51.943root 11241100x8000000000000000557573Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:51.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4f4e53a95a4d4c4e2021-12-21 11:39:51.943root 11241100x8000000000000000557574Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:51.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2716cbef95a19ac52021-12-21 11:39:51.943root 11241100x8000000000000000557575Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:51.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b50253c56d5a3d3e2021-12-21 11:39:51.943root 11241100x8000000000000000557576Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:51.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e61c7bac7087f33f2021-12-21 11:39:51.944root 11241100x8000000000000000557577Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:52.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8bf8c369564776582021-12-21 11:39:52.443root 11241100x8000000000000000557578Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:52.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ebe2bbd4670584272021-12-21 11:39:52.443root 11241100x8000000000000000557579Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:52.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4d87a30a1aed35f82021-12-21 11:39:52.443root 11241100x8000000000000000557580Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:52.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.08bbe6666beadae82021-12-21 11:39:52.443root 11241100x8000000000000000557581Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:52.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.449dda1da1fbb8292021-12-21 11:39:52.443root 11241100x8000000000000000557582Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:52.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8aa5472af61df6102021-12-21 11:39:52.443root 11241100x8000000000000000557583Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:52.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.be3e3c415cf5ba502021-12-21 11:39:52.443root 11241100x8000000000000000557584Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:52.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4111d6a510438ab22021-12-21 11:39:52.443root 11241100x8000000000000000557585Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:52.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8a8eb4d9100f4bbf2021-12-21 11:39:52.444root 11241100x8000000000000000557586Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:52.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2b0cf2a042ba858b2021-12-21 11:39:52.444root 11241100x8000000000000000557587Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:52.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5d504d95b4e95f692021-12-21 11:39:52.444root 11241100x8000000000000000557588Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:52.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8e8ee3a46be986042021-12-21 11:39:52.444root 11241100x8000000000000000557589Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:52.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5079b1326abe41ee2021-12-21 11:39:52.943root 11241100x8000000000000000557590Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:52.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ddf2a24a57485f502021-12-21 11:39:52.943root 11241100x8000000000000000557591Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:52.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3885e21b273086c42021-12-21 11:39:52.943root 11241100x8000000000000000557592Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:52.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.319eeaece704e0782021-12-21 11:39:52.943root 11241100x8000000000000000557593Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:52.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1795b4bed8d3b6d62021-12-21 11:39:52.943root 11241100x8000000000000000557594Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:52.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1e301fbee8a105242021-12-21 11:39:52.943root 11241100x8000000000000000557595Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:52.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5350666d2181e6362021-12-21 11:39:52.943root 11241100x8000000000000000557596Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:52.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4690fa97e96189a12021-12-21 11:39:52.944root 11241100x8000000000000000557597Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:52.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8a1427d05698be442021-12-21 11:39:52.944root 11241100x8000000000000000557598Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:52.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.93b7e60d045b482c2021-12-21 11:39:52.944root 11241100x8000000000000000557599Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:52.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3429924a12d2304f2021-12-21 11:39:52.944root 11241100x8000000000000000557600Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:52.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f7bee2c2d8fa21bf2021-12-21 11:39:52.944root 11241100x8000000000000000557601Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:53.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.39c59351444e03012021-12-21 11:39:53.443root 11241100x8000000000000000557602Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:53.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d25c4be322725cb82021-12-21 11:39:53.443root 11241100x8000000000000000557603Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:53.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.33ec82ccf9993cb72021-12-21 11:39:53.443root 11241100x8000000000000000557604Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:53.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.fab5726c9e4a3ab62021-12-21 11:39:53.443root 11241100x8000000000000000557605Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:53.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6efa9c42c240a7612021-12-21 11:39:53.443root 11241100x8000000000000000557606Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:53.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4dcabccfdb2dba0a2021-12-21 11:39:53.443root 11241100x8000000000000000557607Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:53.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.05baecc1925938ca2021-12-21 11:39:53.443root 11241100x8000000000000000557608Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:53.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.88bbc198201c0b032021-12-21 11:39:53.444root 11241100x8000000000000000557609Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:53.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1b700f23b5a3b57d2021-12-21 11:39:53.444root 11241100x8000000000000000557610Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:53.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.08afc5aa591fc7202021-12-21 11:39:53.444root 11241100x8000000000000000557611Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:53.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2ff75ce765d76b8f2021-12-21 11:39:53.444root 11241100x8000000000000000557612Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:53.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b3e82190f92b3a742021-12-21 11:39:53.444root 11241100x8000000000000000557613Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:53.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.fdbf5561065289312021-12-21 11:39:53.943root 11241100x8000000000000000557614Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:53.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5a104c1b01f0735e2021-12-21 11:39:53.943root 11241100x8000000000000000557615Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:53.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1098faffad1ef5252021-12-21 11:39:53.943root 11241100x8000000000000000557616Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:53.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.92f64bd558426aea2021-12-21 11:39:53.943root 11241100x8000000000000000557617Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:53.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d6c72751fe9208512021-12-21 11:39:53.943root 11241100x8000000000000000557618Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:53.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.12ec678b437441282021-12-21 11:39:53.943root 11241100x8000000000000000557619Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:53.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.653f922e696645e52021-12-21 11:39:53.943root 11241100x8000000000000000557620Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:53.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1ab1703028022da22021-12-21 11:39:53.944root 11241100x8000000000000000557621Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:53.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.cdd7db730441e5822021-12-21 11:39:53.944root 11241100x8000000000000000557622Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:53.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.db3443f8dacfe5352021-12-21 11:39:53.944root 11241100x8000000000000000557623Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:53.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.bebb8d3a45b7e8202021-12-21 11:39:53.944root 11241100x8000000000000000557624Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:53.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7eb708d74bb36bbe2021-12-21 11:39:53.944root 11241100x8000000000000000557625Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:54.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f5fb8d3156f02ba02021-12-21 11:39:54.443root 11241100x8000000000000000557626Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:54.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4e919c7a839ddd092021-12-21 11:39:54.443root 11241100x8000000000000000557627Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:54.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.bc9a9498786b92bc2021-12-21 11:39:54.443root 11241100x8000000000000000557628Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:54.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.dcf66ff9f84751e32021-12-21 11:39:54.443root 11241100x8000000000000000557629Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:54.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d3018f3b6473d2dc2021-12-21 11:39:54.443root 11241100x8000000000000000557630Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:54.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.919574a76525f3542021-12-21 11:39:54.443root 11241100x8000000000000000557631Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:54.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.14eeff53575b61572021-12-21 11:39:54.443root 11241100x8000000000000000557632Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:54.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b84a6564a537bf872021-12-21 11:39:54.444root 11241100x8000000000000000557633Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:54.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4699bda3e6ae13342021-12-21 11:39:54.444root 11241100x8000000000000000557634Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:54.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.acd37acff1f8da882021-12-21 11:39:54.444root 11241100x8000000000000000557635Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:54.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.21a838ce55c5918d2021-12-21 11:39:54.444root 11241100x8000000000000000557636Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:54.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0c7be2fbfffd8a522021-12-21 11:39:54.444root 11241100x8000000000000000557637Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:54.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f0d44aff237e445c2021-12-21 11:39:54.943root 11241100x8000000000000000557638Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:54.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f69a4d16b6032c952021-12-21 11:39:54.943root 11241100x8000000000000000557639Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:54.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4ebecbcbf51f4d7d2021-12-21 11:39:54.943root 11241100x8000000000000000557640Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:54.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8d42aede90698d992021-12-21 11:39:54.943root 11241100x8000000000000000557641Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:54.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e1c1a4eb45b37bdc2021-12-21 11:39:54.943root 11241100x8000000000000000557642Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:54.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b7a987efea9eff632021-12-21 11:39:54.943root 11241100x8000000000000000557643Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:54.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1fb9e2403fb732c72021-12-21 11:39:54.943root 11241100x8000000000000000557644Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:54.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f1604050ee49e6622021-12-21 11:39:54.944root 11241100x8000000000000000557645Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:54.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.33d2899d53cf0e3b2021-12-21 11:39:54.944root 11241100x8000000000000000557646Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:54.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f91e43136ecb3d302021-12-21 11:39:54.944root 11241100x8000000000000000557647Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:54.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.89bfe440a7b0dc312021-12-21 11:39:54.944root 11241100x8000000000000000557648Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:54.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e50f9d5eebe6bb4d2021-12-21 11:39:54.944root 11241100x8000000000000000557649Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:55.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d675a9a2e95f9c212021-12-21 11:39:55.443root 11241100x8000000000000000557650Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:55.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.16a62450bd040fd52021-12-21 11:39:55.443root 11241100x8000000000000000557651Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:55.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1112628533e7d91d2021-12-21 11:39:55.443root 11241100x8000000000000000557652Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:55.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7cecd6033ce589262021-12-21 11:39:55.443root 11241100x8000000000000000557653Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:55.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.66bbce6bb4377c7f2021-12-21 11:39:55.443root 11241100x8000000000000000557654Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:55.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ed3d2556aa1c22492021-12-21 11:39:55.443root 11241100x8000000000000000557655Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:55.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.da86af871e7445572021-12-21 11:39:55.443root 11241100x8000000000000000557656Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:55.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ff0501afec37448d2021-12-21 11:39:55.443root 11241100x8000000000000000557657Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:55.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.293ed7d05bad65742021-12-21 11:39:55.444root 11241100x8000000000000000557658Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:55.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1a4096517dd5d0f42021-12-21 11:39:55.444root 11241100x8000000000000000557659Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:55.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c46686aad9ccfdc42021-12-21 11:39:55.444root 11241100x8000000000000000557660Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:55.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c098dd181e330fbf2021-12-21 11:39:55.444root 11241100x8000000000000000557661Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:55.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2e00c55ee2cc6e1b2021-12-21 11:39:55.943root 11241100x8000000000000000557662Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:55.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6d6264f6dfd77a242021-12-21 11:39:55.943root 11241100x8000000000000000557663Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:55.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6554858542ac87b62021-12-21 11:39:55.943root 11241100x8000000000000000557664Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:55.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.aadfa123d06a71382021-12-21 11:39:55.944root 11241100x8000000000000000557665Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:55.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4cbecc05b93c24cc2021-12-21 11:39:55.944root 11241100x8000000000000000557666Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:55.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4f53981c7e43ebaf2021-12-21 11:39:55.944root 11241100x8000000000000000557667Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:55.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0b33aa07a32bb2622021-12-21 11:39:55.944root 11241100x8000000000000000557668Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:55.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d709d2ef9abe7c4f2021-12-21 11:39:55.944root 11241100x8000000000000000557669Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:55.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2f16462db50752822021-12-21 11:39:55.944root 11241100x8000000000000000557670Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:55.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.66869717beee41e72021-12-21 11:39:55.944root 11241100x8000000000000000557671Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:55.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.47144c72ff0f2fea2021-12-21 11:39:55.945root 11241100x8000000000000000557672Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:55.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e0cb3d8066d78b162021-12-21 11:39:55.945root 354300x8000000000000000557673Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:56.143{ec2b6afe-95d9-61c1-5175-3a0400000000}5346/opt/splunkforwarder/etc/apps/Splunk_TA_stream/linux_x86_64/bin/streamfwdroottcptruefalse10.0.1.25-48872-false10.0.1.12-8000- 11241100x8000000000000000557674Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:56.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8145bf4501b0010f2021-12-21 11:39:56.443root 11241100x8000000000000000557675Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:56.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3260c00c0ca74e442021-12-21 11:39:56.443root 11241100x8000000000000000557676Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:56.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4ae055ddc3b7a1472021-12-21 11:39:56.443root 11241100x8000000000000000557677Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:56.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1071d7e5f59deb832021-12-21 11:39:56.443root 11241100x8000000000000000557678Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:56.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4d09003a342cae2c2021-12-21 11:39:56.443root 11241100x8000000000000000557679Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:56.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b53630acff1914422021-12-21 11:39:56.443root 11241100x8000000000000000557680Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:56.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8949a1c6a6be61ae2021-12-21 11:39:56.443root 11241100x8000000000000000557681Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:56.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d5b7d695179596fa2021-12-21 11:39:56.443root 11241100x8000000000000000557682Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:56.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.455c316d7506c98b2021-12-21 11:39:56.444root 11241100x8000000000000000557683Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:56.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.78ffa794d86e0f0e2021-12-21 11:39:56.444root 11241100x8000000000000000557684Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:56.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a394a6245cc11ff62021-12-21 11:39:56.444root 11241100x8000000000000000557685Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:56.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f1bdad81b2fe29252021-12-21 11:39:56.444root 11241100x8000000000000000557686Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:56.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.dbce737b4be2b6702021-12-21 11:39:56.444root 11241100x8000000000000000557687Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:56.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ac4d2e9ce36fa0882021-12-21 11:39:56.943root 11241100x8000000000000000557688Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:56.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6033aeebd97dede12021-12-21 11:39:56.943root 11241100x8000000000000000557689Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:56.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.60b652fec41603632021-12-21 11:39:56.943root 11241100x8000000000000000557690Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:56.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b5b7bf2679eb8e0a2021-12-21 11:39:56.943root 11241100x8000000000000000557691Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:56.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.69ad7f053bafddf92021-12-21 11:39:56.944root 11241100x8000000000000000557692Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:56.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.02b318e8171895012021-12-21 11:39:56.944root 11241100x8000000000000000557693Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:56.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.86118446aec80ecb2021-12-21 11:39:56.944root 11241100x8000000000000000557694Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:56.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d613dff9fcda49ac2021-12-21 11:39:56.944root 11241100x8000000000000000557695Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:56.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.de0fd8719898516b2021-12-21 11:39:56.944root 11241100x8000000000000000557696Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:56.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0660187a3ff7984f2021-12-21 11:39:56.944root 11241100x8000000000000000557697Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:56.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.03efc3475257e9ec2021-12-21 11:39:56.944root 11241100x8000000000000000557698Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:56.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2397465fd05d4a1b2021-12-21 11:39:56.945root 11241100x8000000000000000557699Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:56.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.22e3d079b82a7be72021-12-21 11:39:56.945root 11241100x8000000000000000557700Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:57.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0dcfb6bd72f502c62021-12-21 11:39:57.443root 11241100x8000000000000000557701Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:57.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.063033e49aaf595a2021-12-21 11:39:57.443root 11241100x8000000000000000557702Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:57.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.84a93f3168780f932021-12-21 11:39:57.443root 11241100x8000000000000000557703Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:57.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e089d7eb46138abe2021-12-21 11:39:57.444root 11241100x8000000000000000557704Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:57.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2724b0e6eec03b7a2021-12-21 11:39:57.444root 11241100x8000000000000000557705Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:57.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6563e344fb2ae5452021-12-21 11:39:57.444root 11241100x8000000000000000557706Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:57.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3328a4b49fb2098d2021-12-21 11:39:57.444root 11241100x8000000000000000557707Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:57.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.df742ebad976d6382021-12-21 11:39:57.444root 11241100x8000000000000000557708Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:57.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b620cf95644dc73a2021-12-21 11:39:57.444root 11241100x8000000000000000557709Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:57.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ca8d16658687b1802021-12-21 11:39:57.444root 11241100x8000000000000000557710Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:57.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.73604fed3ba223a22021-12-21 11:39:57.444root 11241100x8000000000000000557711Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:57.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.38c3a7f8cbb7a0ed2021-12-21 11:39:57.444root 11241100x8000000000000000557712Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:57.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4ffc4552b1a8d04a2021-12-21 11:39:57.445root 11241100x8000000000000000557713Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:57.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.57de5be4848abb002021-12-21 11:39:57.445root 11241100x8000000000000000557714Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:57.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.debc7d0c3621b88e2021-12-21 11:39:57.943root 11241100x8000000000000000557715Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:57.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7081e74e9e99cc532021-12-21 11:39:57.943root 11241100x8000000000000000557716Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:57.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.60676668b9baaf6e2021-12-21 11:39:57.943root 11241100x8000000000000000557717Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:57.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.cc81fc87c0690cfb2021-12-21 11:39:57.943root 11241100x8000000000000000557718Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:57.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a04d701d2d883fe42021-12-21 11:39:57.943root 11241100x8000000000000000557719Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:57.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8b14169ea44964922021-12-21 11:39:57.943root 11241100x8000000000000000557720Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:57.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.af42d5198644a71c2021-12-21 11:39:57.944root 11241100x8000000000000000557721Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:57.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4c7c7c33b8d952622021-12-21 11:39:57.944root 11241100x8000000000000000557722Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:57.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0b6e884e07db014c2021-12-21 11:39:57.944root 11241100x8000000000000000557723Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:57.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.46fee0b2e534f7c82021-12-21 11:39:57.944root 11241100x8000000000000000557724Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:57.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.fa80ddbcc258c1852021-12-21 11:39:57.944root 11241100x8000000000000000557725Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:57.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d3aa4f878ea104212021-12-21 11:39:57.944root 11241100x8000000000000000557726Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:57.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1f414f87b28d0d9c2021-12-21 11:39:57.944root 11241100x8000000000000000557727Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:58.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b2b9138be8104e012021-12-21 11:39:58.443root 11241100x8000000000000000557728Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:58.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.082228c63a5dd4092021-12-21 11:39:58.443root 11241100x8000000000000000557729Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:58.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d2e40daaddbebf9d2021-12-21 11:39:58.444root 11241100x8000000000000000557730Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:58.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d10584282eeb81222021-12-21 11:39:58.444root 11241100x8000000000000000557731Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:58.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.21daaac68a6a6be32021-12-21 11:39:58.444root 11241100x8000000000000000557732Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:58.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.377ff9ff0aef03992021-12-21 11:39:58.445root 11241100x8000000000000000557733Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:58.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e246546b2c4a59f92021-12-21 11:39:58.445root 11241100x8000000000000000557734Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:58.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.835f56e5763f6c2b2021-12-21 11:39:58.445root 11241100x8000000000000000557735Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:58.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e29214ad2541e96f2021-12-21 11:39:58.445root 11241100x8000000000000000557736Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:58.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.97dba8a237a2c2352021-12-21 11:39:58.445root 11241100x8000000000000000557737Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:58.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0243f5f3aecea29d2021-12-21 11:39:58.445root 11241100x8000000000000000557738Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:58.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d49638010c8452902021-12-21 11:39:58.445root 11241100x8000000000000000557739Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:58.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.72a21a045307e38e2021-12-21 11:39:58.445root 11241100x8000000000000000557740Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:58.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d5d8b0084bab4a7b2021-12-21 11:39:58.943root 11241100x8000000000000000557741Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:58.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.52bd2c0f06e181692021-12-21 11:39:58.943root 11241100x8000000000000000557742Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:58.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9dae56bf7d9557ab2021-12-21 11:39:58.943root 11241100x8000000000000000557743Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:58.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.052f95f81d48aaac2021-12-21 11:39:58.943root 11241100x8000000000000000557744Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:58.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.28ecfcf01314437d2021-12-21 11:39:58.943root 11241100x8000000000000000557745Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:58.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.feb26928ffa633112021-12-21 11:39:58.944root 11241100x8000000000000000557746Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:58.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3ff763db71aa35a42021-12-21 11:39:58.944root 11241100x8000000000000000557747Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:58.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8fe697c80336bd952021-12-21 11:39:58.944root 11241100x8000000000000000557748Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:58.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.fc69ab3868050d542021-12-21 11:39:58.944root 11241100x8000000000000000557749Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:58.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8b6e7d4cf82922f42021-12-21 11:39:58.944root 11241100x8000000000000000557750Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:58.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9e1e44164094e46d2021-12-21 11:39:58.944root 11241100x8000000000000000557751Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:58.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.415a20f2f98a5d742021-12-21 11:39:58.944root 11241100x8000000000000000557752Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:58.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b21b9d936b9e5db82021-12-21 11:39:58.944root 11241100x8000000000000000557753Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:59.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6df72d0bf0618bf22021-12-21 11:39:59.443root 11241100x8000000000000000557754Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:59.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5159a248dc5ac40c2021-12-21 11:39:59.443root 11241100x8000000000000000557755Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:59.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0d0c1b26e61a36052021-12-21 11:39:59.443root 11241100x8000000000000000557756Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:59.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d860bd0d61004a442021-12-21 11:39:59.443root 11241100x8000000000000000557757Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:59.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.27488e91d1bb5e8d2021-12-21 11:39:59.443root 11241100x8000000000000000557758Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:59.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7484b15e77a2ca452021-12-21 11:39:59.443root 11241100x8000000000000000557759Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:59.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9128d223513fb45f2021-12-21 11:39:59.444root 11241100x8000000000000000557760Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:59.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ac0225e79d8768f62021-12-21 11:39:59.444root 11241100x8000000000000000557761Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:59.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7e93626431995eca2021-12-21 11:39:59.444root 11241100x8000000000000000557762Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:59.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.746558c40273a0b52021-12-21 11:39:59.444root 11241100x8000000000000000557763Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:59.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.cbeab27a73252e882021-12-21 11:39:59.444root 11241100x8000000000000000557764Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:59.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6d2796352957e8b92021-12-21 11:39:59.444root 11241100x8000000000000000557765Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:59.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1ebfffabf459a9892021-12-21 11:39:59.444root 11241100x8000000000000000557766Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:59.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a1bbae510570e4042021-12-21 11:39:59.943root 11241100x8000000000000000557767Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:59.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0b85d68d5946d2d92021-12-21 11:39:59.943root 11241100x8000000000000000557768Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:59.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.935baaaf299590d22021-12-21 11:39:59.943root 11241100x8000000000000000557769Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:59.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ea74cb506d66bdbf2021-12-21 11:39:59.943root 11241100x8000000000000000557770Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:59.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.516bf55b18f3bcca2021-12-21 11:39:59.944root 11241100x8000000000000000557771Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:59.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.43a2a7cdff39983f2021-12-21 11:39:59.944root 11241100x8000000000000000557772Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:59.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.771f3a5cce304dd22021-12-21 11:39:59.944root 11241100x8000000000000000557773Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:59.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.fa844bb7f7f5d3dd2021-12-21 11:39:59.944root 11241100x8000000000000000557774Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:59.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e68bda74088065232021-12-21 11:39:59.944root 11241100x8000000000000000557775Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:59.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a20628834d7c18682021-12-21 11:39:59.944root 11241100x8000000000000000557776Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:59.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c2c04d4c644834d52021-12-21 11:39:59.944root 11241100x8000000000000000557777Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:59.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.aa0e577c95a998932021-12-21 11:39:59.945root 11241100x8000000000000000557778Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:39:59.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6ddbd53e69c9b45c2021-12-21 11:39:59.945root 11241100x8000000000000000557779Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:00.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.dde4f6d0efa985042021-12-21 11:40:00.443root 11241100x8000000000000000557780Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:00.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5ff147214b4733092021-12-21 11:40:00.443root 11241100x8000000000000000557781Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:00.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.16a5a66e6c2149ba2021-12-21 11:40:00.443root 11241100x8000000000000000557782Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:00.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b3f01c9fc17101922021-12-21 11:40:00.444root 11241100x8000000000000000557783Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:00.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5c9d49057ad19b592021-12-21 11:40:00.444root 11241100x8000000000000000557784Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:00.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.75e9353d6c23cdd42021-12-21 11:40:00.444root 11241100x8000000000000000557785Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:00.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1749005c7b6b58192021-12-21 11:40:00.444root 11241100x8000000000000000557786Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:00.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.314b9aa02e39d2522021-12-21 11:40:00.444root 11241100x8000000000000000557787Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:00.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.edeb59778ed0ff0b2021-12-21 11:40:00.444root 11241100x8000000000000000557788Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:00.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7cb4129b8b923e932021-12-21 11:40:00.444root 11241100x8000000000000000557789Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:00.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7b2b7bb79563efd02021-12-21 11:40:00.444root 11241100x8000000000000000557790Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:00.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e6ee01093a68dfe32021-12-21 11:40:00.444root 11241100x8000000000000000557791Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:00.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e946e1ee890a5bb12021-12-21 11:40:00.445root 11241100x8000000000000000557792Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:00.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7d5a3332463856a62021-12-21 11:40:00.943root 11241100x8000000000000000557793Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:00.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.85e25932ee8243b72021-12-21 11:40:00.943root 11241100x8000000000000000557794Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:00.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.16525c8346a5c2da2021-12-21 11:40:00.943root 11241100x8000000000000000557795Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:00.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9a906fb8503ae6962021-12-21 11:40:00.943root 11241100x8000000000000000557796Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:00.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9b8df2f5dcc6aa882021-12-21 11:40:00.943root 11241100x8000000000000000557797Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:00.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1104b83c62cee6822021-12-21 11:40:00.943root 11241100x8000000000000000557798Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:00.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c75be844a465aa962021-12-21 11:40:00.943root 11241100x8000000000000000557799Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:00.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4ddb82e6830db1222021-12-21 11:40:00.943root 11241100x8000000000000000557800Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:00.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.44041fd6e69f5b262021-12-21 11:40:00.944root 11241100x8000000000000000557801Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:00.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c5ca9352c7fff5522021-12-21 11:40:00.944root 11241100x8000000000000000557802Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:00.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.53c0ae6a2c23b0342021-12-21 11:40:00.944root 11241100x8000000000000000557803Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:00.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.02d773a15c3bc5462021-12-21 11:40:00.944root 11241100x8000000000000000557804Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:00.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a178d65bbcfe56822021-12-21 11:40:00.944root 11241100x8000000000000000557805Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:01.442{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b8fbcc8f9f8ee9372021-12-21 11:40:01.442root 11241100x8000000000000000557806Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:01.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.575078f8038129b52021-12-21 11:40:01.443root 11241100x8000000000000000557807Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:01.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.bcb00e533b7aad2a2021-12-21 11:40:01.443root 11241100x8000000000000000557808Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:01.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f1cee41b6dfe36d92021-12-21 11:40:01.443root 11241100x8000000000000000557809Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:01.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e9742792d664eaa32021-12-21 11:40:01.443root 11241100x8000000000000000557810Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:01.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5ad428d2a465c4ba2021-12-21 11:40:01.443root 11241100x8000000000000000557811Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:01.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3f6e98a4165522842021-12-21 11:40:01.443root 11241100x8000000000000000557812Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:01.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0bc667ab532d12dd2021-12-21 11:40:01.443root 11241100x8000000000000000557813Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:01.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.cc337e027c58e6d42021-12-21 11:40:01.444root 11241100x8000000000000000557814Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:01.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.367d62f17eac53802021-12-21 11:40:01.444root 11241100x8000000000000000557815Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:01.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.82d2bdbde879b9ff2021-12-21 11:40:01.444root 11241100x8000000000000000557816Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:01.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.224685b40d67ce9c2021-12-21 11:40:01.444root 11241100x8000000000000000557817Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:01.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ec7667a64f3ffa032021-12-21 11:40:01.444root 11241100x8000000000000000557818Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:01.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.bed7e00632ea141e2021-12-21 11:40:01.444root 11241100x8000000000000000557819Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:01.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b919db5708a805752021-12-21 11:40:01.943root 11241100x8000000000000000557820Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:01.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a494f13c569dc5912021-12-21 11:40:01.943root 11241100x8000000000000000557821Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:01.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a360573537c320f02021-12-21 11:40:01.943root 11241100x8000000000000000557822Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:01.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a40cf691f02c03cf2021-12-21 11:40:01.943root 11241100x8000000000000000557823Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:01.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.35dbdf97ea221fd72021-12-21 11:40:01.944root 11241100x8000000000000000557824Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:01.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3d79988ea264ce8f2021-12-21 11:40:01.944root 11241100x8000000000000000557825Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:01.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c181acba4b7f50d82021-12-21 11:40:01.944root 11241100x8000000000000000557826Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:01.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3e2aaf5e03c2f5b02021-12-21 11:40:01.944root 11241100x8000000000000000557827Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:01.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7d58491179061c652021-12-21 11:40:01.944root 11241100x8000000000000000557828Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:01.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6ad376779ef7a2482021-12-21 11:40:01.944root 11241100x8000000000000000557829Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:01.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d2184a01c43966442021-12-21 11:40:01.944root 11241100x8000000000000000557830Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:01.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.73a5bd2662833cb22021-12-21 11:40:01.944root 11241100x8000000000000000557831Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:01.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.96cb155287d293d22021-12-21 11:40:01.945root 354300x8000000000000000557832Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:02.082{ec2b6afe-95d9-61c1-5175-3a0400000000}5346/opt/splunkforwarder/etc/apps/Splunk_TA_stream/linux_x86_64/bin/streamfwdroottcptruefalse10.0.1.25-48874-false10.0.1.12-8000- 11241100x8000000000000000557833Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:02.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d5de7a52179604e12021-12-21 11:40:02.443root 11241100x8000000000000000557834Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:02.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b11e55e56267e29e2021-12-21 11:40:02.443root 11241100x8000000000000000557835Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:02.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4c379f76154e99462021-12-21 11:40:02.443root 11241100x8000000000000000557836Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:02.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ba7aef912dca93892021-12-21 11:40:02.443root 11241100x8000000000000000557837Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:02.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b182496640c66e0a2021-12-21 11:40:02.443root 11241100x8000000000000000557838Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:02.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.fe405ec48b5353ec2021-12-21 11:40:02.443root 11241100x8000000000000000557839Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:02.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f5ccc9d0ee77bea12021-12-21 11:40:02.443root 11241100x8000000000000000557840Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:02.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.fad17712b1c1d11e2021-12-21 11:40:02.443root 11241100x8000000000000000557841Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:02.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.02ab9bef7496a6f62021-12-21 11:40:02.444root 11241100x8000000000000000557842Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:02.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a664b7db3344ec382021-12-21 11:40:02.444root 11241100x8000000000000000557843Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:02.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f14ec4f5a6f89a902021-12-21 11:40:02.444root 11241100x8000000000000000557844Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:02.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2b8d9d66c23a75322021-12-21 11:40:02.444root 11241100x8000000000000000557845Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:02.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c55d92e7444a87fd2021-12-21 11:40:02.444root 11241100x8000000000000000557846Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:02.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.62cc8987401046a62021-12-21 11:40:02.444root 11241100x8000000000000000557847Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:02.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.49ae894d658325fa2021-12-21 11:40:02.943root 11241100x8000000000000000557848Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:02.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5ec1fdf3a0b272d72021-12-21 11:40:02.943root 11241100x8000000000000000557849Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:02.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.669314f14f33c6ec2021-12-21 11:40:02.943root 11241100x8000000000000000557850Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:02.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8b88c39360e381292021-12-21 11:40:02.943root 11241100x8000000000000000557851Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:02.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1bb83778b07305902021-12-21 11:40:02.943root 11241100x8000000000000000557852Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:02.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.352d98c7dcd6ab422021-12-21 11:40:02.943root 11241100x8000000000000000557853Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:02.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b9ea763ed227ced92021-12-21 11:40:02.943root 11241100x8000000000000000557854Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:02.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e032738d1af9f8312021-12-21 11:40:02.944root 11241100x8000000000000000557855Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:02.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7d368d6f02b839e82021-12-21 11:40:02.944root 11241100x8000000000000000557856Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:02.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.910c58735672ee1d2021-12-21 11:40:02.944root 11241100x8000000000000000557857Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:02.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b420039e7009811a2021-12-21 11:40:02.944root 11241100x8000000000000000557858Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:02.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7d87fcdea38dc8552021-12-21 11:40:02.944root 11241100x8000000000000000557859Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:02.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ed7c9af9dbc1aebf2021-12-21 11:40:02.944root 11241100x8000000000000000557860Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:02.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0b6aa74119bd95eb2021-12-21 11:40:02.944root 11241100x8000000000000000557861Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:03.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.82b6bcd40bae1fa82021-12-21 11:40:03.443root 11241100x8000000000000000557862Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:03.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ecf040c1d4b0d8c22021-12-21 11:40:03.443root 11241100x8000000000000000557863Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:03.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a3be87b847631edf2021-12-21 11:40:03.443root 11241100x8000000000000000557864Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:03.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b1a12c64f9fb2a2a2021-12-21 11:40:03.443root 11241100x8000000000000000557865Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:03.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3c8db162125d53822021-12-21 11:40:03.443root 11241100x8000000000000000557866Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:03.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.bf91afe135110cf62021-12-21 11:40:03.443root 11241100x8000000000000000557867Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:03.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c2e699e73044bac02021-12-21 11:40:03.443root 11241100x8000000000000000557868Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:03.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d899f933ab12d5342021-12-21 11:40:03.443root 11241100x8000000000000000557869Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:03.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.60cf79fa466c18ca2021-12-21 11:40:03.443root 11241100x8000000000000000557870Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:03.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2942f37db3ed83ac2021-12-21 11:40:03.443root 11241100x8000000000000000557871Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:03.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6fd6512e4a88a26c2021-12-21 11:40:03.444root 11241100x8000000000000000557872Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:03.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.06d023b971b0caf62021-12-21 11:40:03.444root 11241100x8000000000000000557873Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:03.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e04f6c169c794e762021-12-21 11:40:03.444root 11241100x8000000000000000557874Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:03.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5a123aeebfa7347d2021-12-21 11:40:03.444root 11241100x8000000000000000557875Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:03.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.fd1bb862214c2dda2021-12-21 11:40:03.444root 11241100x8000000000000000557876Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:03.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.19cc216a3897d4dd2021-12-21 11:40:03.444root 11241100x8000000000000000557877Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:03.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.bb235ef3a2e688912021-12-21 11:40:03.444root 11241100x8000000000000000557878Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:03.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.46457cee8c723d282021-12-21 11:40:03.943root 11241100x8000000000000000557879Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:03.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8033625a2895ba722021-12-21 11:40:03.943root 11241100x8000000000000000557880Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:03.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.769a329bfec3cd922021-12-21 11:40:03.943root 11241100x8000000000000000557881Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:03.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.284de3bbd604d9752021-12-21 11:40:03.943root 11241100x8000000000000000557882Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:03.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.91f7afaab0072a722021-12-21 11:40:03.944root 11241100x8000000000000000557883Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:03.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4a3ff68c69cca7542021-12-21 11:40:03.944root 11241100x8000000000000000557884Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:03.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.599ca6aaff83d4822021-12-21 11:40:03.944root 11241100x8000000000000000557885Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:03.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e3a003f7eecb90d12021-12-21 11:40:03.944root 11241100x8000000000000000557886Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:03.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d728d466b003e59b2021-12-21 11:40:03.944root 11241100x8000000000000000557887Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:03.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b54c51cbe69990b92021-12-21 11:40:03.945root 11241100x8000000000000000557888Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:03.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.150d76d0133dc69d2021-12-21 11:40:03.945root 11241100x8000000000000000557889Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:03.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.92bd3b3406d4263a2021-12-21 11:40:03.945root 11241100x8000000000000000557890Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:03.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5313e520d3b78c402021-12-21 11:40:03.945root 11241100x8000000000000000557891Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:03.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c1e24bb3aeab21e72021-12-21 11:40:03.945root 11241100x8000000000000000557892Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:04.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.61c006cebbda4b112021-12-21 11:40:04.443root 11241100x8000000000000000557893Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:04.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a19c11b3fefa60fa2021-12-21 11:40:04.443root 11241100x8000000000000000557894Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:04.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.84a7eb1a9d6a34d72021-12-21 11:40:04.443root 11241100x8000000000000000557895Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:04.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6bf0b6806dc315f62021-12-21 11:40:04.443root 11241100x8000000000000000557896Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:04.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a1f6b7a78908d1742021-12-21 11:40:04.443root 11241100x8000000000000000557897Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:04.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f59db8966f96bb632021-12-21 11:40:04.443root 11241100x8000000000000000557898Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:04.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e9c2f18d9ffe50e62021-12-21 11:40:04.443root 11241100x8000000000000000557899Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:04.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.479682988d9592d72021-12-21 11:40:04.443root 11241100x8000000000000000557900Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:04.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.af9d62e274c4b89b2021-12-21 11:40:04.443root 11241100x8000000000000000557901Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:04.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7568225eb3e10f002021-12-21 11:40:04.444root 11241100x8000000000000000557902Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:04.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.cab962da3bbaeb962021-12-21 11:40:04.444root 11241100x8000000000000000557903Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:04.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.31919dfc658c89362021-12-21 11:40:04.444root 11241100x8000000000000000557904Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:04.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.df37a2c048aa87842021-12-21 11:40:04.444root 11241100x8000000000000000557905Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:04.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b9d3ce9b13fc0bfa2021-12-21 11:40:04.444root 11241100x8000000000000000557906Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:04.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.163076d3a19713442021-12-21 11:40:04.943root 11241100x8000000000000000557907Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:04.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ced7ef32cb805d162021-12-21 11:40:04.943root 11241100x8000000000000000557908Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:04.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5765540320110cbd2021-12-21 11:40:04.944root 11241100x8000000000000000557909Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:04.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c00b2081e25ee4bd2021-12-21 11:40:04.944root 11241100x8000000000000000557910Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:04.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8bec1979f586694f2021-12-21 11:40:04.944root 11241100x8000000000000000557911Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:04.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7411450dbd7917f72021-12-21 11:40:04.944root 11241100x8000000000000000557912Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:04.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.79e02e0b5316dc0f2021-12-21 11:40:04.944root 11241100x8000000000000000557913Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:04.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.39be5bf4d0eb8f4b2021-12-21 11:40:04.944root 11241100x8000000000000000557914Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:04.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4c6e83fd275a49032021-12-21 11:40:04.944root 11241100x8000000000000000557915Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:04.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.215e013f6aaa16052021-12-21 11:40:04.944root 11241100x8000000000000000557916Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:04.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1a27a0a1cae4888d2021-12-21 11:40:04.944root 11241100x8000000000000000557917Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:04.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.fee348032470fee42021-12-21 11:40:04.944root 11241100x8000000000000000557918Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:04.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.addcf00cff88a59f2021-12-21 11:40:04.944root 11241100x8000000000000000557919Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:04.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b6041019b23484372021-12-21 11:40:04.944root 11241100x8000000000000000557920Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:05.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c93c55c55ecb72322021-12-21 11:40:05.443root 11241100x8000000000000000557921Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:05.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8aa27e46a401e8532021-12-21 11:40:05.443root 11241100x8000000000000000557922Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:05.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a7fba0776b65e8042021-12-21 11:40:05.443root 11241100x8000000000000000557923Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:05.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b9af9a232ac93f382021-12-21 11:40:05.443root 11241100x8000000000000000557924Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:05.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f6f68b5c4f1aeb672021-12-21 11:40:05.443root 11241100x8000000000000000557925Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:05.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9299dae79b9307532021-12-21 11:40:05.443root 11241100x8000000000000000557926Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:05.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c1ecda9f6968e5502021-12-21 11:40:05.444root 11241100x8000000000000000557927Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:05.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d3b27119b6b11c9d2021-12-21 11:40:05.444root 11241100x8000000000000000557928Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:05.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5d3e891dfd10a7852021-12-21 11:40:05.444root 11241100x8000000000000000557929Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:05.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5f052146f8e8a5e82021-12-21 11:40:05.444root 11241100x8000000000000000557930Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:05.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1c1145b76af385a82021-12-21 11:40:05.444root 11241100x8000000000000000557931Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:05.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f0f1205c06ef0fea2021-12-21 11:40:05.444root 11241100x8000000000000000557932Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:05.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a307a2adfd7a23da2021-12-21 11:40:05.444root 11241100x8000000000000000557933Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:05.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b0312fec653339772021-12-21 11:40:05.444root 11241100x8000000000000000557934Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:05.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3fc50c4ef4bf03002021-12-21 11:40:05.943root 11241100x8000000000000000557935Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:05.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.bbca8f3ddf8678092021-12-21 11:40:05.943root 11241100x8000000000000000557936Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:05.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f135b0b131c06c0a2021-12-21 11:40:05.943root 11241100x8000000000000000557937Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:05.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c718f5f533e1c8c72021-12-21 11:40:05.943root 11241100x8000000000000000557938Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:05.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.42efd6e36126fda82021-12-21 11:40:05.943root 11241100x8000000000000000557939Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:05.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.239947edd8b702da2021-12-21 11:40:05.943root 11241100x8000000000000000557940Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:05.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6fd489dbb70c8f522021-12-21 11:40:05.943root 11241100x8000000000000000557941Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:05.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0d281c79128f407d2021-12-21 11:40:05.943root 11241100x8000000000000000557942Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:05.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8b3fd04f348988c52021-12-21 11:40:05.943root 11241100x8000000000000000557943Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:05.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.81ed1452200544062021-12-21 11:40:05.944root 11241100x8000000000000000557944Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:05.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5ef274e467a10a502021-12-21 11:40:05.944root 11241100x8000000000000000557945Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:05.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6f89801219b10ef22021-12-21 11:40:05.944root 11241100x8000000000000000557946Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:05.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.26e3bbaeb15cb3292021-12-21 11:40:05.944root 11241100x8000000000000000557947Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:05.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.32bc6a234d072c9d2021-12-21 11:40:05.944root 11241100x8000000000000000557948Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:06.326{ec2b6afe-95d2-61c1-3038-b84203560000}5272/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/spool/splunk/tracker.log2021-12-21 11:40:06.326root 11241100x8000000000000000557949Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:06.327{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.991306f165f013822021-12-21 11:40:06.327root 11241100x8000000000000000557950Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:06.327{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.dacbe12c682d302a2021-12-21 11:40:06.327root 11241100x8000000000000000557951Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:06.327{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3c8befffff74aca62021-12-21 11:40:06.327root 11241100x8000000000000000557952Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:06.327{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.39ac42d9d63eb74b2021-12-21 11:40:06.327root 11241100x8000000000000000557953Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:06.327{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0633dec80e58b0112021-12-21 11:40:06.327root 11241100x8000000000000000557954Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:06.327{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.42792e6b5ae92c892021-12-21 11:40:06.327root 11241100x8000000000000000557955Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:06.327{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.50ef6edd4bff41c12021-12-21 11:40:06.327root 11241100x8000000000000000557956Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:06.327{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7b767f13c002ea402021-12-21 11:40:06.327root 11241100x8000000000000000557957Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:06.328{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4911bd8a4bc050b62021-12-21 11:40:06.328root 11241100x8000000000000000557958Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:06.328{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3370cf78fbf92ab32021-12-21 11:40:06.328root 11241100x8000000000000000557959Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:06.328{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5e068537b3e7e6672021-12-21 11:40:06.328root 11241100x8000000000000000557960Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:06.328{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.30354909ae8fc00a2021-12-21 11:40:06.328root 11241100x8000000000000000557961Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:06.328{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.97ad061d940d266c2021-12-21 11:40:06.328root 11241100x8000000000000000557962Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:06.329{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.75687b73c9d8f69c2021-12-21 11:40:06.329root 11241100x8000000000000000557963Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:06.329{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.46aa208a284be22d2021-12-21 11:40:06.329root 11241100x8000000000000000557964Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:06.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.bd0ff3a6f4bfcd492021-12-21 11:40:06.693root 11241100x8000000000000000557965Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:06.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.52cb95ae16ccd8042021-12-21 11:40:06.694root 11241100x8000000000000000557966Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:06.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4127ca734f9649292021-12-21 11:40:06.694root 11241100x8000000000000000557967Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:06.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.bbe040d4fb9ce1442021-12-21 11:40:06.694root 11241100x8000000000000000557968Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:06.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6181916fae2b63bb2021-12-21 11:40:06.694root 11241100x8000000000000000557969Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:06.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.11dfcaf84e46dd202021-12-21 11:40:06.694root 11241100x8000000000000000557970Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:06.695{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4c4560ce48a300ef2021-12-21 11:40:06.695root 11241100x8000000000000000557971Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:06.695{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e6da1aa410a201c02021-12-21 11:40:06.695root 11241100x8000000000000000557972Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:06.695{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.477e71d75e1c6d222021-12-21 11:40:06.695root 11241100x8000000000000000557973Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:06.695{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.17f4c69e53ed54c12021-12-21 11:40:06.695root 11241100x8000000000000000557974Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:06.695{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8c8b48889a21bd662021-12-21 11:40:06.695root 11241100x8000000000000000557975Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:06.695{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.31acfb9c99ff031d2021-12-21 11:40:06.695root 11241100x8000000000000000557976Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:06.695{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3384bab4b13b1a262021-12-21 11:40:06.695root 11241100x8000000000000000557977Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:06.695{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4abc24d059af92082021-12-21 11:40:06.695root 11241100x8000000000000000557978Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:06.696{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b362dcf7a1ce75002021-12-21 11:40:06.696root 354300x8000000000000000557979Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:07.153{ec2b6afe-95d9-61c1-5175-3a0400000000}5346/opt/splunkforwarder/etc/apps/Splunk_TA_stream/linux_x86_64/bin/streamfwdroottcptruefalse10.0.1.25-48876-false10.0.1.12-8000- 11241100x8000000000000000557980Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:07.154{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.06a429e71851fb3b2021-12-21 11:40:07.154root 11241100x8000000000000000557981Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:07.154{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f9bdece3000f897e2021-12-21 11:40:07.154root 11241100x8000000000000000557982Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:07.154{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.174e10035f54d4642021-12-21 11:40:07.154root 11241100x8000000000000000557983Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:07.155{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5b97eb4f152e9aeb2021-12-21 11:40:07.155root 11241100x8000000000000000557984Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:07.155{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.698dd0a1cb4cf2932021-12-21 11:40:07.155root 11241100x8000000000000000557985Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:07.155{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d9a13844c2d2bd3d2021-12-21 11:40:07.155root 11241100x8000000000000000557986Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:07.155{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a01271bcd3d45db32021-12-21 11:40:07.155root 11241100x8000000000000000557987Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:07.155{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a4cc50a53b2264a82021-12-21 11:40:07.155root 11241100x8000000000000000557988Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:07.155{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c109669a05df93622021-12-21 11:40:07.155root 11241100x8000000000000000557989Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:07.156{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.efbba766d212b6b72021-12-21 11:40:07.156root 11241100x8000000000000000557990Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:07.156{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e8acc4f1845cd77c2021-12-21 11:40:07.156root 11241100x8000000000000000557991Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:07.156{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.cfec9f7fa750358c2021-12-21 11:40:07.156root 11241100x8000000000000000557992Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:07.156{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5d005f5cedaf590b2021-12-21 11:40:07.156root 11241100x8000000000000000557993Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:07.156{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8fae5a557265f6882021-12-21 11:40:07.156root 11241100x8000000000000000557994Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:07.156{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.db479216341712be2021-12-21 11:40:07.156root 11241100x8000000000000000557995Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:07.156{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c72a83d77d1c9c492021-12-21 11:40:07.156root 11241100x8000000000000000557996Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:07.156{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ac2998eb6bd4f6ad2021-12-21 11:40:07.156root 11241100x8000000000000000557997Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:07.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.bd9259ef84191e8b2021-12-21 11:40:07.443root 11241100x8000000000000000557998Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:07.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e8effc88ff14cd892021-12-21 11:40:07.443root 11241100x8000000000000000557999Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:07.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5491772691c3eced2021-12-21 11:40:07.444root 11241100x8000000000000000558000Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:07.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b29f91743fa1fcd52021-12-21 11:40:07.444root 11241100x8000000000000000558001Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:07.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a0d327d61a654afa2021-12-21 11:40:07.444root 11241100x8000000000000000558002Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:07.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.439d07076142ac8a2021-12-21 11:40:07.444root 11241100x8000000000000000558003Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:07.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.78eb5bb33a5d74282021-12-21 11:40:07.444root 11241100x8000000000000000558004Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:07.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d5661646f3586edc2021-12-21 11:40:07.444root 11241100x8000000000000000558005Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:07.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2db054ea11f707812021-12-21 11:40:07.444root 11241100x8000000000000000558006Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:07.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.360f03afa343f0762021-12-21 11:40:07.444root 11241100x8000000000000000558007Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:07.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.074eba67a9ddd3712021-12-21 11:40:07.444root 11241100x8000000000000000558008Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:07.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.bdd3c1ff5caeb4862021-12-21 11:40:07.444root 11241100x8000000000000000558009Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:07.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ced6c2dc421bb35a2021-12-21 11:40:07.444root 11241100x8000000000000000558010Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:07.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.215ed5d6bff6b6972021-12-21 11:40:07.444root 11241100x8000000000000000558011Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:07.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.09a56c9da46164d12021-12-21 11:40:07.444root 11241100x8000000000000000558012Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:07.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5b27489d08dc63332021-12-21 11:40:07.444root 11241100x8000000000000000558013Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:07.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.22dba3e51658bb772021-12-21 11:40:07.943root 11241100x8000000000000000558014Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:07.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.951d65d5cca319272021-12-21 11:40:07.943root 11241100x8000000000000000558015Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:07.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5d7c69b093948c2a2021-12-21 11:40:07.943root 11241100x8000000000000000558016Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:07.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d497206781f6b65f2021-12-21 11:40:07.943root 11241100x8000000000000000558017Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:07.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.db6f162aef06d6752021-12-21 11:40:07.943root 11241100x8000000000000000558018Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:07.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4dedbee3b28655a22021-12-21 11:40:07.943root 11241100x8000000000000000558019Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:07.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e39e39baaad9372c2021-12-21 11:40:07.944root 11241100x8000000000000000558020Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:07.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b46bb3da6faa29b92021-12-21 11:40:07.944root 11241100x8000000000000000558021Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:07.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c36b38ceec9a71b12021-12-21 11:40:07.944root 11241100x8000000000000000558022Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:07.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ce0cbc6c69d54d1a2021-12-21 11:40:07.944root 11241100x8000000000000000558023Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:07.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a0af7e9e472d40452021-12-21 11:40:07.944root 11241100x8000000000000000558024Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:07.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d44107d95a682d2a2021-12-21 11:40:07.944root 11241100x8000000000000000558025Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:07.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1bf629ec25eef2d92021-12-21 11:40:07.944root 11241100x8000000000000000558026Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:07.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1d7af54ffc04ce0f2021-12-21 11:40:07.944root 11241100x8000000000000000558027Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:07.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.83f8374063d716a82021-12-21 11:40:07.944root 11241100x8000000000000000558028Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:07.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.57a2ddb2a950b8232021-12-21 11:40:07.945root 11241100x8000000000000000558029Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:08.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d92e29508c4e02072021-12-21 11:40:08.443root 11241100x8000000000000000558030Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:08.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a8a417a4f0d044ab2021-12-21 11:40:08.443root 11241100x8000000000000000558031Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:08.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.204928656a3257842021-12-21 11:40:08.443root 11241100x8000000000000000558032Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:08.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f5be79f7507e49ec2021-12-21 11:40:08.443root 11241100x8000000000000000558033Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:08.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2d4e43a405d0f5dc2021-12-21 11:40:08.443root 11241100x8000000000000000558034Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:08.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.27b31485fa11ec052021-12-21 11:40:08.443root 11241100x8000000000000000558035Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:08.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.527a523f87af4fef2021-12-21 11:40:08.444root 11241100x8000000000000000558036Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:08.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1af1787467442cf22021-12-21 11:40:08.444root 11241100x8000000000000000558037Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:08.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9cbb573b1138105f2021-12-21 11:40:08.444root 11241100x8000000000000000558038Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:08.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.21b96b5d59eef10e2021-12-21 11:40:08.444root 11241100x8000000000000000558039Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:08.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.10603e54999d691c2021-12-21 11:40:08.445root 11241100x8000000000000000558040Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:08.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.08286162fe1fb1442021-12-21 11:40:08.445root 11241100x8000000000000000558041Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:08.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4f69f9a4f7a4a4632021-12-21 11:40:08.445root 11241100x8000000000000000558042Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:08.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.60174bddeaf014842021-12-21 11:40:08.445root 11241100x8000000000000000558043Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:08.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e03745281402847d2021-12-21 11:40:08.445root 11241100x8000000000000000558044Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:08.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.48cc345f0b9f2db62021-12-21 11:40:08.445root 11241100x8000000000000000558045Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:08.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.88c0e066e95b1fd22021-12-21 11:40:08.943root 11241100x8000000000000000558046Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:08.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d963664b3c9e32e32021-12-21 11:40:08.943root 11241100x8000000000000000558047Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:08.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7787e6c7147afd332021-12-21 11:40:08.943root 11241100x8000000000000000558048Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:08.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2218010d5746dc962021-12-21 11:40:08.943root 11241100x8000000000000000558049Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:08.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3b2d1ab823212aba2021-12-21 11:40:08.944root 11241100x8000000000000000558050Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:08.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.175cb67ab34036d62021-12-21 11:40:08.944root 11241100x8000000000000000558051Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:08.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.467fbc383d89a7552021-12-21 11:40:08.944root 11241100x8000000000000000558052Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:08.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.31a8a3277be7e36b2021-12-21 11:40:08.944root 11241100x8000000000000000558053Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:08.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.15901bf4b9d7133c2021-12-21 11:40:08.944root 11241100x8000000000000000558054Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:08.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b9d7afa1f138d2462021-12-21 11:40:08.944root 11241100x8000000000000000558055Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:08.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b146c98fa95acee42021-12-21 11:40:08.944root 11241100x8000000000000000558056Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:08.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.08ac30d329f4db0b2021-12-21 11:40:08.944root 11241100x8000000000000000558057Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:08.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e364f9d1fb7cc6502021-12-21 11:40:08.944root 11241100x8000000000000000558058Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:08.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.855cfc75434dfbc12021-12-21 11:40:08.944root 11241100x8000000000000000558059Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:08.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b40b4ef1be734c2d2021-12-21 11:40:08.945root 11241100x8000000000000000558060Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:08.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a36c234243248d7c2021-12-21 11:40:08.945root 23542300x8000000000000000558061Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:09.327{ec2b6afe-95d2-61c1-3038-b84203560000}5272root/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/spool/splunk/tracker.log--- 11241100x8000000000000000558062Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:09.327{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6e5d5777c9626e642021-12-21 11:40:09.327root 11241100x8000000000000000558063Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:09.328{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.65a2b3620e7cfa612021-12-21 11:40:09.328root 11241100x8000000000000000558064Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:09.328{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.10022b53e899be432021-12-21 11:40:09.328root 11241100x8000000000000000558065Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:09.328{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e4f69b77cb8cee262021-12-21 11:40:09.328root 11241100x8000000000000000558066Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:09.328{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.180650cc380b3ad32021-12-21 11:40:09.328root 11241100x8000000000000000558067Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:09.328{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.dc92414cc005e3ae2021-12-21 11:40:09.328root 11241100x8000000000000000558068Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:09.328{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.18200c3d807df8952021-12-21 11:40:09.328root 11241100x8000000000000000558069Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:09.328{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b333101bed6fd1192021-12-21 11:40:09.328root 11241100x8000000000000000558070Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:09.328{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.32d4743c6e8efdee2021-12-21 11:40:09.328root 11241100x8000000000000000558071Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:09.328{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4bc0870f29bed28d2021-12-21 11:40:09.328root 11241100x8000000000000000558072Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:09.328{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.27e2160148f6a9262021-12-21 11:40:09.328root 11241100x8000000000000000558073Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:09.328{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c1c22d30dec9ee2b2021-12-21 11:40:09.328root 11241100x8000000000000000558074Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:09.328{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ca7a5147df978fd62021-12-21 11:40:09.328root 11241100x8000000000000000558075Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:09.328{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2962ea68ebb7855f2021-12-21 11:40:09.328root 11241100x8000000000000000558076Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:09.328{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9a66061b5cffa79a2021-12-21 11:40:09.328root 11241100x8000000000000000558077Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:09.329{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0b84ed31bc75f7192021-12-21 11:40:09.329root 11241100x8000000000000000558078Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:09.329{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c864d0cb25c5a96c2021-12-21 11:40:09.329root 11241100x8000000000000000558079Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:09.329{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.885543ceb36f43fd2021-12-21 11:40:09.329root 11241100x8000000000000000558080Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:09.329{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.de342aaeb43f21db2021-12-21 11:40:09.329root 11241100x8000000000000000558081Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:09.329{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5feb580d5177b1112021-12-21 11:40:09.329root 11241100x8000000000000000558082Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:09.329{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3316533f7caca0902021-12-21 11:40:09.329root 11241100x8000000000000000558083Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:09.329{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9c208af3d10db51e2021-12-21 11:40:09.329root 11241100x8000000000000000558084Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:09.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6eda6b3a327db6672021-12-21 11:40:09.693root 11241100x8000000000000000558085Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:09.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7301a0e7e3a3763f2021-12-21 11:40:09.693root 11241100x8000000000000000558086Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:09.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.445014d8fdd7bed12021-12-21 11:40:09.693root 11241100x8000000000000000558087Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:09.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6a2c0c6b8f8eecab2021-12-21 11:40:09.693root 11241100x8000000000000000558088Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:09.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c6565ee802a9a0642021-12-21 11:40:09.694root 11241100x8000000000000000558089Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:09.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7a8b05a4b94811c52021-12-21 11:40:09.694root 11241100x8000000000000000558090Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:09.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0d3c40f3b248eaf32021-12-21 11:40:09.694root 11241100x8000000000000000558091Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:09.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6d1ff4d2785ab9ee2021-12-21 11:40:09.694root 11241100x8000000000000000558092Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:09.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f1fbd674393062382021-12-21 11:40:09.694root 11241100x8000000000000000558093Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:09.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7ff0b4c5205d48c52021-12-21 11:40:09.694root 11241100x8000000000000000558094Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:09.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.be1fe1edab1573982021-12-21 11:40:09.694root 11241100x8000000000000000558095Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:09.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.732660d09953fe992021-12-21 11:40:09.694root 11241100x8000000000000000558096Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:09.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0575ddae6582febf2021-12-21 11:40:09.694root 11241100x8000000000000000558097Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:09.695{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0f4c286990cb711a2021-12-21 11:40:09.695root 11241100x8000000000000000558098Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:09.695{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.024ee510437218f32021-12-21 11:40:09.695root 11241100x8000000000000000558099Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:09.695{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.12d3a4d5ea0979532021-12-21 11:40:09.695root 11241100x8000000000000000558100Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:09.695{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.89f1677062eb39fa2021-12-21 11:40:09.695root 11241100x8000000000000000558101Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:10.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7a2f31128a2302f32021-12-21 11:40:10.193root 11241100x8000000000000000558102Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:10.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.db17bcd75291faaa2021-12-21 11:40:10.193root 11241100x8000000000000000558103Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:10.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9ef170939a97e5442021-12-21 11:40:10.193root 11241100x8000000000000000558104Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:10.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.881005d863c1d14f2021-12-21 11:40:10.193root 11241100x8000000000000000558105Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:10.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.fea37829afa82fde2021-12-21 11:40:10.193root 11241100x8000000000000000558106Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:10.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.408aecf154c417662021-12-21 11:40:10.193root 11241100x8000000000000000558107Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:10.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2fe0ecd23a359dea2021-12-21 11:40:10.193root 11241100x8000000000000000558108Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:10.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0d579c5fea87ef0c2021-12-21 11:40:10.194root 11241100x8000000000000000558109Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:10.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.152bfa1f4e48fcc02021-12-21 11:40:10.194root 11241100x8000000000000000558110Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:10.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.122d741d750baebf2021-12-21 11:40:10.194root 11241100x8000000000000000558111Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:10.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.08be08d0a994a5d52021-12-21 11:40:10.194root 11241100x8000000000000000558112Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:10.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6bd570a33ace2ebe2021-12-21 11:40:10.194root 11241100x8000000000000000558113Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:10.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0cb39e946d93f9ff2021-12-21 11:40:10.194root 11241100x8000000000000000558114Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:10.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.eb89f36a844e09b32021-12-21 11:40:10.194root 11241100x8000000000000000558115Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:10.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6562432e67b715ca2021-12-21 11:40:10.194root 11241100x8000000000000000558116Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:10.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e5fa2513c360cf9b2021-12-21 11:40:10.194root 11241100x8000000000000000558117Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:10.195{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.609a7d33b3d553102021-12-21 11:40:10.195root 11241100x8000000000000000558118Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:10.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.23b35db2775b156d2021-12-21 11:40:10.693root 11241100x8000000000000000558119Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:10.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f5bc8ed89e3acd9e2021-12-21 11:40:10.693root 11241100x8000000000000000558120Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:10.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1e85d36dfcc275c32021-12-21 11:40:10.693root 11241100x8000000000000000558121Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:10.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7f2e73b6035864262021-12-21 11:40:10.693root 11241100x8000000000000000558122Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:10.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a449f8e4146031ca2021-12-21 11:40:10.693root 11241100x8000000000000000558123Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:10.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f478ce3e1cc537cd2021-12-21 11:40:10.693root 11241100x8000000000000000558124Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:10.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8a604dc705d1a9242021-12-21 11:40:10.694root 11241100x8000000000000000558125Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:10.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9fde46f4b717873f2021-12-21 11:40:10.694root 11241100x8000000000000000558126Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:10.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.df6f4e2126a40e8c2021-12-21 11:40:10.694root 11241100x8000000000000000558127Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:10.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9986c4b2b3f115742021-12-21 11:40:10.694root 11241100x8000000000000000558128Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:10.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ffa384fc6f448ca12021-12-21 11:40:10.694root 11241100x8000000000000000558129Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:10.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e17abff28b6ae5542021-12-21 11:40:10.694root 11241100x8000000000000000558130Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:10.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ed4cbd5b72defff22021-12-21 11:40:10.694root 11241100x8000000000000000558131Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:10.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.eb95aa73a513f09d2021-12-21 11:40:10.694root 11241100x8000000000000000558132Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:10.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f0874168bf8f2fd32021-12-21 11:40:10.694root 11241100x8000000000000000558133Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:10.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c8875931f357a2832021-12-21 11:40:10.694root 11241100x8000000000000000558134Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:10.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5c562b504596897f2021-12-21 11:40:10.694root 11241100x8000000000000000558135Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:11.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c2327657e04dc7642021-12-21 11:40:11.193root 11241100x8000000000000000558136Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:11.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1c94bfc3df6fd99d2021-12-21 11:40:11.193root 11241100x8000000000000000558137Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:11.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7d8d4b21b7e6f1002021-12-21 11:40:11.193root 11241100x8000000000000000558138Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:11.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e6061a9b1e49e0142021-12-21 11:40:11.193root 11241100x8000000000000000558139Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:11.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d60608a616ca93422021-12-21 11:40:11.193root 11241100x8000000000000000558140Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:11.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8b1e97aa792f8f132021-12-21 11:40:11.193root 11241100x8000000000000000558141Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:11.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.67e25513905a8a752021-12-21 11:40:11.194root 11241100x8000000000000000558142Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:11.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.05d3c48080083dbc2021-12-21 11:40:11.194root 11241100x8000000000000000558143Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:11.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4aad0fd5aa33a6a22021-12-21 11:40:11.194root 11241100x8000000000000000558144Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:11.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.05f96a40077ec8952021-12-21 11:40:11.194root 11241100x8000000000000000558145Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:11.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.969cc6958470d4b22021-12-21 11:40:11.194root 11241100x8000000000000000558146Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:11.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.93c5ef957ab79ff92021-12-21 11:40:11.194root 11241100x8000000000000000558147Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:11.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9f548106ea9f20c52021-12-21 11:40:11.194root 11241100x8000000000000000558148Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:11.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f319ffa15b1053dd2021-12-21 11:40:11.194root 11241100x8000000000000000558149Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:11.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1c7583051723d4102021-12-21 11:40:11.194root 11241100x8000000000000000558150Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:11.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2e453bf182fc83c02021-12-21 11:40:11.194root 11241100x8000000000000000558151Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:11.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.25b271d9a330bad62021-12-21 11:40:11.194root 11241100x8000000000000000558152Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:11.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8c197e1c23c5dbb32021-12-21 11:40:11.693root 11241100x8000000000000000558153Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:11.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.44cc8e596bb32d2d2021-12-21 11:40:11.693root 11241100x8000000000000000558154Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:11.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.81600256a640038a2021-12-21 11:40:11.693root 11241100x8000000000000000558155Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:11.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6e404b8e8d79fe3d2021-12-21 11:40:11.693root 11241100x8000000000000000558156Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:11.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6e34a34f3622d10c2021-12-21 11:40:11.694root 11241100x8000000000000000558157Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:11.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0266df86df5e11c12021-12-21 11:40:11.694root 11241100x8000000000000000558158Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:11.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.07c04e91fc6ecae92021-12-21 11:40:11.694root 11241100x8000000000000000558159Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:11.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5010feeef00d74092021-12-21 11:40:11.694root 11241100x8000000000000000558160Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:11.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.144dc1ab4be58fb72021-12-21 11:40:11.694root 11241100x8000000000000000558161Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:11.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1fbd3a49eeb5f8952021-12-21 11:40:11.694root 11241100x8000000000000000558162Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:11.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.001252784be255532021-12-21 11:40:11.694root 11241100x8000000000000000558163Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:11.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.dd3f8769f03fbc742021-12-21 11:40:11.694root 11241100x8000000000000000558164Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:11.695{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.70332f7897c189842021-12-21 11:40:11.695root 11241100x8000000000000000558165Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:11.695{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.89c5f4469f7cd1fc2021-12-21 11:40:11.695root 11241100x8000000000000000558166Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:11.695{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9b9f8df819acfdc32021-12-21 11:40:11.695root 11241100x8000000000000000558167Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:11.695{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.dbfe912b63a692762021-12-21 11:40:11.695root 11241100x8000000000000000558168Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:11.695{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.62a978caa8dc3f552021-12-21 11:40:11.695root 354300x8000000000000000558169Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:12.186{ec2b6afe-95d9-61c1-5175-3a0400000000}5346/opt/splunkforwarder/etc/apps/Splunk_TA_stream/linux_x86_64/bin/streamfwdroottcptruefalse10.0.1.25-48878-false10.0.1.12-8000- 11241100x8000000000000000558170Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:12.187{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ec2a7c4b77439b492021-12-21 11:40:12.187root 11241100x8000000000000000558171Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:12.187{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.bcbff244388f3c382021-12-21 11:40:12.187root 11241100x8000000000000000558172Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:12.188{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c76bd412455507992021-12-21 11:40:12.188root 11241100x8000000000000000558173Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:12.188{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5366bcc150b0e3322021-12-21 11:40:12.188root 11241100x8000000000000000558174Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:12.188{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b58bcf12833db5742021-12-21 11:40:12.188root 11241100x8000000000000000558175Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:12.188{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e9286d3c6691ce782021-12-21 11:40:12.188root 11241100x8000000000000000558176Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:12.188{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f447399e6a62664b2021-12-21 11:40:12.188root 11241100x8000000000000000558177Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:12.188{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.cdd775d481ed09a62021-12-21 11:40:12.188root 11241100x8000000000000000558178Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:12.188{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9af8414906713f562021-12-21 11:40:12.188root 11241100x8000000000000000558179Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:12.188{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.28980583da2e52852021-12-21 11:40:12.188root 11241100x8000000000000000558180Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:12.189{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4bd08d3d39dc08b52021-12-21 11:40:12.189root 11241100x8000000000000000558181Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:12.189{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e2bb1651348839d92021-12-21 11:40:12.189root 11241100x8000000000000000558182Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:12.189{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.be9cab85dbe315d32021-12-21 11:40:12.189root 11241100x8000000000000000558183Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:12.189{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.204f82daf8d4334f2021-12-21 11:40:12.189root 11241100x8000000000000000558184Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:12.189{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3e39f14313e37af72021-12-21 11:40:12.189root 11241100x8000000000000000558185Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:12.189{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0ddef582a76055222021-12-21 11:40:12.189root 11241100x8000000000000000558186Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:12.189{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6c18c2620d0ec2a52021-12-21 11:40:12.189root 11241100x8000000000000000558187Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:12.189{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.78e01a5eb3aa81ec2021-12-21 11:40:12.189root 11241100x8000000000000000558188Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:12.189{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.17ab5e3d245556c42021-12-21 11:40:12.189root 11241100x8000000000000000558189Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:12.190{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.da321b68bb0aeb9e2021-12-21 11:40:12.190root 11241100x8000000000000000558190Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:12.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.934a6556970990692021-12-21 11:40:12.443root 11241100x8000000000000000558191Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:12.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5b0d3f7e05c85c472021-12-21 11:40:12.443root 11241100x8000000000000000558192Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:12.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d8e11e648464ae022021-12-21 11:40:12.443root 11241100x8000000000000000558193Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:12.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.127938abb64cadf82021-12-21 11:40:12.443root 11241100x8000000000000000558194Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:12.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b6d989a1c7005a702021-12-21 11:40:12.443root 11241100x8000000000000000558195Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:12.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a859c5ab65fa0ed12021-12-21 11:40:12.443root 11241100x8000000000000000558196Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:12.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0e1b5cb8e4e2d1b82021-12-21 11:40:12.443root 11241100x8000000000000000558197Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:12.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6eee022e62c4e2fd2021-12-21 11:40:12.444root 11241100x8000000000000000558198Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:12.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5a8031726c881ad92021-12-21 11:40:12.444root 11241100x8000000000000000558199Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:12.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.542001ca156551502021-12-21 11:40:12.444root 11241100x8000000000000000558200Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:12.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5e32b0c53ee9633c2021-12-21 11:40:12.444root 11241100x8000000000000000558201Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:12.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6daef02d8c3094f62021-12-21 11:40:12.444root 11241100x8000000000000000558202Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:12.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6e485bf0ca1c686a2021-12-21 11:40:12.444root 11241100x8000000000000000558203Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:12.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.555d531b315dd0802021-12-21 11:40:12.444root 11241100x8000000000000000558204Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:12.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.34c1e0de07b09a802021-12-21 11:40:12.444root 11241100x8000000000000000558205Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:12.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4ad16fec3e3bcf5a2021-12-21 11:40:12.444root 11241100x8000000000000000558206Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:12.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.68d8654f9eda95862021-12-21 11:40:12.444root 11241100x8000000000000000558207Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:12.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b132dbd92dfe24d12021-12-21 11:40:12.444root 11241100x8000000000000000558208Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:12.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.bdc9ff92aae17c0a2021-12-21 11:40:12.943root 11241100x8000000000000000558209Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:12.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2662b81dc526ab942021-12-21 11:40:12.943root 11241100x8000000000000000558210Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:12.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3c8ab8d8b8c227112021-12-21 11:40:12.943root 11241100x8000000000000000558211Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:12.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.20167284b1e222322021-12-21 11:40:12.943root 11241100x8000000000000000558212Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:12.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.aa6c701ec93707d92021-12-21 11:40:12.944root 11241100x8000000000000000558213Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:12.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.85fd7fcedb50df372021-12-21 11:40:12.944root 11241100x8000000000000000558214Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:12.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.cce00185338c4a9a2021-12-21 11:40:12.944root 11241100x8000000000000000558215Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:12.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b3de5d29ea0620682021-12-21 11:40:12.944root 11241100x8000000000000000558216Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:12.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.363a638b8826557c2021-12-21 11:40:12.944root 11241100x8000000000000000558217Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:12.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.fb31a776baf1d4bc2021-12-21 11:40:12.944root 11241100x8000000000000000558218Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:12.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e030f720a64d8c682021-12-21 11:40:12.944root 11241100x8000000000000000558219Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:12.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.cf011b2d830fe5d62021-12-21 11:40:12.944root 11241100x8000000000000000558220Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:12.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f0b6bdf517c39a7d2021-12-21 11:40:12.944root 11241100x8000000000000000558221Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:12.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.61d188e311fb584a2021-12-21 11:40:12.944root 11241100x8000000000000000558222Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:12.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7984aa1bcf2dad422021-12-21 11:40:12.944root 11241100x8000000000000000558223Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:12.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c06284bb5c41562a2021-12-21 11:40:12.944root 11241100x8000000000000000558224Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:12.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c7fb46d2a397ff252021-12-21 11:40:12.944root 11241100x8000000000000000558225Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:12.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.696c06763ccbe6fe2021-12-21 11:40:12.945root 11241100x8000000000000000558226Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:13.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9f3cdf5005fb1f662021-12-21 11:40:13.443root 11241100x8000000000000000558227Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:13.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.fc3df23fad9612db2021-12-21 11:40:13.443root 11241100x8000000000000000558228Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:13.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7f65347a232d2e5e2021-12-21 11:40:13.443root 11241100x8000000000000000558229Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:13.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.753f2b181bb40f282021-12-21 11:40:13.444root 11241100x8000000000000000558230Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:13.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ac61460bf254b16e2021-12-21 11:40:13.444root 11241100x8000000000000000558231Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:13.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e29f0357f5562ee02021-12-21 11:40:13.444root 11241100x8000000000000000558232Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:13.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e280624c3d51f7652021-12-21 11:40:13.444root 11241100x8000000000000000558233Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:13.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.003df008ef8567632021-12-21 11:40:13.444root 11241100x8000000000000000558234Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:13.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a8dc85e270d004cd2021-12-21 11:40:13.444root 11241100x8000000000000000558235Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:13.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.68988138f9b46d6b2021-12-21 11:40:13.444root 11241100x8000000000000000558236Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:13.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a358111fc0e5529a2021-12-21 11:40:13.444root 11241100x8000000000000000558237Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:13.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.58e211ff81c528bd2021-12-21 11:40:13.444root 11241100x8000000000000000558238Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:13.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.81efd14bb8025f3e2021-12-21 11:40:13.445root 11241100x8000000000000000558239Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:13.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ccdde2cbfc300fcc2021-12-21 11:40:13.445root 11241100x8000000000000000558240Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:13.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.93164208d12599372021-12-21 11:40:13.445root 11241100x8000000000000000558241Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:13.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.47a117d007731ea72021-12-21 11:40:13.445root 11241100x8000000000000000558242Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:13.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.354c340307281caf2021-12-21 11:40:13.445root 11241100x8000000000000000558243Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:13.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1ac7659149f8bafb2021-12-21 11:40:13.445root 11241100x8000000000000000558244Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:13.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c5189ab95c36c6682021-12-21 11:40:13.943root 11241100x8000000000000000558245Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:13.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.acd636843f3011402021-12-21 11:40:13.943root 11241100x8000000000000000558246Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:13.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.04c484048f77b7652021-12-21 11:40:13.943root 11241100x8000000000000000558247Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:13.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a1a3dc53bb8db56f2021-12-21 11:40:13.943root 11241100x8000000000000000558248Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:13.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.485bf5120edca1fe2021-12-21 11:40:13.943root 11241100x8000000000000000558249Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:13.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ac1aa910447051052021-12-21 11:40:13.943root 11241100x8000000000000000558250Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:13.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6e08319addc1ba192021-12-21 11:40:13.943root 11241100x8000000000000000558251Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:13.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.59379f1862f732442021-12-21 11:40:13.943root 11241100x8000000000000000558252Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:13.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7ce73028d6e19e9d2021-12-21 11:40:13.944root 11241100x8000000000000000558253Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:13.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9f139922e9f0238e2021-12-21 11:40:13.944root 11241100x8000000000000000558254Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:13.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0169ee3f846188f02021-12-21 11:40:13.944root 11241100x8000000000000000558255Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:13.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1871126b0e9943b12021-12-21 11:40:13.944root 11241100x8000000000000000558256Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:13.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a5258c99cb8b5f982021-12-21 11:40:13.944root 11241100x8000000000000000558257Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:13.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e5385afabb0315202021-12-21 11:40:13.944root 11241100x8000000000000000558258Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:13.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e0c5528068a0734a2021-12-21 11:40:13.944root 11241100x8000000000000000558259Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:13.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.04225df607e695e62021-12-21 11:40:13.944root 11241100x8000000000000000558260Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:13.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c56344195951e7332021-12-21 11:40:13.944root 11241100x8000000000000000558261Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:13.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.278a6625665321b82021-12-21 11:40:13.944root 11241100x8000000000000000558262Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:14.442{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4c35ddf4e89ddfd92021-12-21 11:40:14.442root 11241100x8000000000000000558263Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:14.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5bc7162eee2143c92021-12-21 11:40:14.443root 11241100x8000000000000000558264Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:14.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0b3fe97f1fff622a2021-12-21 11:40:14.443root 11241100x8000000000000000558265Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:14.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8ab84249db2ff9ad2021-12-21 11:40:14.443root 11241100x8000000000000000558266Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:14.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.517481bcce00f5c42021-12-21 11:40:14.443root 11241100x8000000000000000558267Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:14.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.55696dc3040319de2021-12-21 11:40:14.443root 11241100x8000000000000000558268Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:14.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3b9382fb0478d34c2021-12-21 11:40:14.443root 11241100x8000000000000000558269Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:14.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.514933a2a47735832021-12-21 11:40:14.443root 11241100x8000000000000000558270Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:14.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.32318541f1b9805a2021-12-21 11:40:14.444root 11241100x8000000000000000558271Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:14.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c7ab6a63058114272021-12-21 11:40:14.444root 11241100x8000000000000000558272Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:14.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.60d34d50c31649dc2021-12-21 11:40:14.444root 11241100x8000000000000000558273Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:14.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6b0b27aeeca2c6d42021-12-21 11:40:14.444root 11241100x8000000000000000558274Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:14.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a01c82780db1f8c02021-12-21 11:40:14.444root 11241100x8000000000000000558275Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:14.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.43b13be4c660e2bd2021-12-21 11:40:14.444root 11241100x8000000000000000558276Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:14.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.96281829a71571bf2021-12-21 11:40:14.444root 11241100x8000000000000000558277Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:14.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.892fdd8b6041dd772021-12-21 11:40:14.444root 11241100x8000000000000000558278Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:14.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4f99c95f8cfa7ee92021-12-21 11:40:14.444root 11241100x8000000000000000558279Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:14.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.fc7bbc02c4401a6a2021-12-21 11:40:14.444root 11241100x8000000000000000558280Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:14.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.425b05763fb37b072021-12-21 11:40:14.445root 11241100x8000000000000000558281Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:14.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e0f70a30c498665a2021-12-21 11:40:14.445root 11241100x8000000000000000558282Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:14.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.710aa9ab699b47832021-12-21 11:40:14.445root 11241100x8000000000000000558283Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:14.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2cf55adecd06ec9d2021-12-21 11:40:14.943root 11241100x8000000000000000558284Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:14.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7326ab6e2f1134302021-12-21 11:40:14.943root 11241100x8000000000000000558285Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:14.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c7c3f196ff5ae2aa2021-12-21 11:40:14.943root 11241100x8000000000000000558286Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:14.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e84d488a3a271c2c2021-12-21 11:40:14.943root 11241100x8000000000000000558287Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:14.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b4d084af6f1ee3a12021-12-21 11:40:14.944root 11241100x8000000000000000558288Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:14.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.79036a6c9b7274c82021-12-21 11:40:14.944root 11241100x8000000000000000558289Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:14.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.552aaf905ea555e22021-12-21 11:40:14.944root 11241100x8000000000000000558290Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:14.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.34482502ed3fedb22021-12-21 11:40:14.944root 11241100x8000000000000000558291Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:14.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8815581a56ca02ef2021-12-21 11:40:14.944root 11241100x8000000000000000558292Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:14.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7002dd0d8a494ca12021-12-21 11:40:14.944root 11241100x8000000000000000558293Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:14.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b7dc1a3078bb0b562021-12-21 11:40:14.944root 11241100x8000000000000000558294Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:14.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f18fe17bbb3374d52021-12-21 11:40:14.944root 11241100x8000000000000000558295Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:14.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ae5e34d144b7e0102021-12-21 11:40:14.944root 11241100x8000000000000000558296Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:14.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a6f9cee54f5583ad2021-12-21 11:40:14.944root 11241100x8000000000000000558297Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:14.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.eb0dd058b4bb14d62021-12-21 11:40:14.944root 11241100x8000000000000000558298Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:14.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d3f03db54936d1262021-12-21 11:40:14.944root 11241100x8000000000000000558299Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:14.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0be3e68d6d37e8e02021-12-21 11:40:14.945root 11241100x8000000000000000558300Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:14.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a262a94267a01fcb2021-12-21 11:40:14.945root 11241100x8000000000000000558301Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:15.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.97d38d4fabeb876e2021-12-21 11:40:15.443root 11241100x8000000000000000558302Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:15.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.91d343a55cc165522021-12-21 11:40:15.443root 11241100x8000000000000000558303Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:15.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2dc97e25e5aeacca2021-12-21 11:40:15.443root 11241100x8000000000000000558304Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:15.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9a079e1a6700ee0d2021-12-21 11:40:15.443root 11241100x8000000000000000558305Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:15.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.202ccf6eb0ae34262021-12-21 11:40:15.444root 11241100x8000000000000000558306Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:15.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.333416d6be38190f2021-12-21 11:40:15.444root 11241100x8000000000000000558307Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:15.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.31ae0b39c3de93c22021-12-21 11:40:15.444root 11241100x8000000000000000558308Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:15.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.fe66b7d0111945d02021-12-21 11:40:15.444root 11241100x8000000000000000558309Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:15.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9d3e8e3810899e7b2021-12-21 11:40:15.444root 11241100x8000000000000000558310Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:15.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.acef64bf078c36962021-12-21 11:40:15.444root 11241100x8000000000000000558311Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:15.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.04e1984966a9c8922021-12-21 11:40:15.444root 11241100x8000000000000000558312Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:15.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b31a94e8c98228312021-12-21 11:40:15.444root 11241100x8000000000000000558313Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:15.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b85a580e0942c5912021-12-21 11:40:15.444root 11241100x8000000000000000558314Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:15.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.48d019b0ec1fda642021-12-21 11:40:15.444root 11241100x8000000000000000558315Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:15.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0328c508d1a584442021-12-21 11:40:15.444root 11241100x8000000000000000558316Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:15.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.bf6bbc406300a81a2021-12-21 11:40:15.444root 11241100x8000000000000000558317Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:15.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3d77d526aa40d1f72021-12-21 11:40:15.444root 11241100x8000000000000000558318Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:15.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.515f7e589cc967902021-12-21 11:40:15.444root 11241100x8000000000000000558319Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:15.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.84f1deab31d35fa52021-12-21 11:40:15.943root 11241100x8000000000000000558320Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:15.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c4436f49423d3f222021-12-21 11:40:15.943root 11241100x8000000000000000558321Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:15.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7e0153a463baaa872021-12-21 11:40:15.943root 11241100x8000000000000000558322Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:15.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4e6ea88faf08e3b22021-12-21 11:40:15.943root 11241100x8000000000000000558323Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:15.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.579e3388fc1c46ed2021-12-21 11:40:15.944root 11241100x8000000000000000558324Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:15.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.70665a05552999992021-12-21 11:40:15.944root 11241100x8000000000000000558325Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:15.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.da176d0799c7b5f02021-12-21 11:40:15.944root 11241100x8000000000000000558326Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:15.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.40f1bb652d26ccee2021-12-21 11:40:15.944root 11241100x8000000000000000558327Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:15.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.bba7cbbb06b6fdb92021-12-21 11:40:15.944root 11241100x8000000000000000558328Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:15.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a83162ccb637ce1e2021-12-21 11:40:15.945root 11241100x8000000000000000558329Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:15.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7dd564c77ec4f4ef2021-12-21 11:40:15.945root 11241100x8000000000000000558330Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:15.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a68121f53cdec5722021-12-21 11:40:15.945root 11241100x8000000000000000558331Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:15.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.af5de81a8540ef012021-12-21 11:40:15.945root 11241100x8000000000000000558332Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:15.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c92bd069f13c39fe2021-12-21 11:40:15.945root 11241100x8000000000000000558333Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:15.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f538a69463232c672021-12-21 11:40:15.945root 11241100x8000000000000000558334Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:15.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1d685e1584203f652021-12-21 11:40:15.945root 11241100x8000000000000000558335Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:15.946{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a0041902db7344092021-12-21 11:40:15.946root 11241100x8000000000000000558336Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:15.946{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ea09291aeac4e0d72021-12-21 11:40:15.946root 11241100x8000000000000000558337Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:15.946{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3413a38452820b582021-12-21 11:40:15.946root 11241100x8000000000000000558338Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:16.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.bed7ca5925697e802021-12-21 11:40:16.443root 11241100x8000000000000000558339Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:16.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7b023493a00143c82021-12-21 11:40:16.443root 11241100x8000000000000000558340Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:16.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a7278dea8b0850842021-12-21 11:40:16.443root 11241100x8000000000000000558341Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:16.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.22527d099e8c97322021-12-21 11:40:16.443root 11241100x8000000000000000558342Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:16.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c2e37902aa232d692021-12-21 11:40:16.443root 11241100x8000000000000000558343Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:16.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c27e09b14991538e2021-12-21 11:40:16.443root 11241100x8000000000000000558344Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:16.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1a8d75c3088536e32021-12-21 11:40:16.443root 11241100x8000000000000000558345Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:16.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a8dc348189c0f4672021-12-21 11:40:16.443root 11241100x8000000000000000558346Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:16.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a6f0b9de9d38be5b2021-12-21 11:40:16.444root 11241100x8000000000000000558347Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:16.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4c1544be09acc7242021-12-21 11:40:16.444root 11241100x8000000000000000558348Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:16.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4444e4c702bc2ac62021-12-21 11:40:16.444root 11241100x8000000000000000558349Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:16.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5fe5a03fe219af442021-12-21 11:40:16.444root 11241100x8000000000000000558350Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:16.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0d4cfc9ced2a46e62021-12-21 11:40:16.444root 11241100x8000000000000000558351Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:16.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c579634be7ecd6e32021-12-21 11:40:16.444root 11241100x8000000000000000558352Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:16.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c045308d975d4df12021-12-21 11:40:16.445root 11241100x8000000000000000558353Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:16.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.36294aeff546eaaa2021-12-21 11:40:16.445root 11241100x8000000000000000558354Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:16.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d39b3daa397cce3f2021-12-21 11:40:16.445root 11241100x8000000000000000558355Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:16.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e719ad579e68a99d2021-12-21 11:40:16.445root 11241100x8000000000000000558356Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:16.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.caf8f6be5071d7762021-12-21 11:40:16.445root 11241100x8000000000000000558357Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:16.446{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5845da39a8d2864f2021-12-21 11:40:16.446root 11241100x8000000000000000558358Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:16.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.310f483923dd5cc52021-12-21 11:40:16.943root 11241100x8000000000000000558359Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:16.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.17802c3787b260c32021-12-21 11:40:16.943root 11241100x8000000000000000558360Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:16.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.52541c44f5d064452021-12-21 11:40:16.943root 11241100x8000000000000000558361Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:16.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.cdd793e1dee682802021-12-21 11:40:16.944root 11241100x8000000000000000558362Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:16.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.44ebca584c570f202021-12-21 11:40:16.944root 11241100x8000000000000000558363Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:16.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.11f10435750a69642021-12-21 11:40:16.944root 11241100x8000000000000000558364Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:16.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2f90dfd7d00def832021-12-21 11:40:16.944root 11241100x8000000000000000558365Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:16.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.bf3a1a8390bfef9f2021-12-21 11:40:16.944root 11241100x8000000000000000558366Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:16.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.963995f00b99ec842021-12-21 11:40:16.945root 11241100x8000000000000000558367Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:16.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.29d5ce76a9281d482021-12-21 11:40:16.945root 11241100x8000000000000000558368Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:16.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e242e9d70efc20732021-12-21 11:40:16.945root 11241100x8000000000000000558369Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:16.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ce73576e1d46790b2021-12-21 11:40:16.945root 11241100x8000000000000000558370Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:16.946{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.618b26f2b603312f2021-12-21 11:40:16.946root 11241100x8000000000000000558371Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:16.946{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a08c3957562622e32021-12-21 11:40:16.946root 11241100x8000000000000000558372Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:16.946{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c00b89179b7b7c182021-12-21 11:40:16.946root 11241100x8000000000000000558373Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:16.947{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5636b89df367e8702021-12-21 11:40:16.947root 11241100x8000000000000000558374Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:16.947{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.243a582b33cd77b72021-12-21 11:40:16.947root 11241100x8000000000000000558375Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:16.947{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.87f8d9480429f8762021-12-21 11:40:16.947root 11241100x8000000000000000558376Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:17.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c57c5808273d3a7b2021-12-21 11:40:17.443root 11241100x8000000000000000558377Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:17.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6d88136a76d649f02021-12-21 11:40:17.443root 11241100x8000000000000000558378Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:17.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.33aceb6b9bfba5ec2021-12-21 11:40:17.443root 11241100x8000000000000000558379Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:17.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1a3defacdcac1a562021-12-21 11:40:17.443root 11241100x8000000000000000558380Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:17.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f920280092ba907a2021-12-21 11:40:17.443root 11241100x8000000000000000558381Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:17.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4d5bab05c6eafcbe2021-12-21 11:40:17.443root 11241100x8000000000000000558382Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:17.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.eba28ab4cbab4af12021-12-21 11:40:17.443root 11241100x8000000000000000558383Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:17.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c79ece4160e19d212021-12-21 11:40:17.444root 11241100x8000000000000000558384Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:17.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3f873a7f618d58762021-12-21 11:40:17.444root 11241100x8000000000000000558385Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:17.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7a9c43c6cf4d50562021-12-21 11:40:17.444root 11241100x8000000000000000558386Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:17.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4025972c4b24908c2021-12-21 11:40:17.444root 11241100x8000000000000000558387Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:17.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.44d08c29f730a66d2021-12-21 11:40:17.444root 11241100x8000000000000000558388Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:17.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a0c1d4bca601dea62021-12-21 11:40:17.444root 11241100x8000000000000000558389Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:17.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c6c55309a7b69add2021-12-21 11:40:17.444root 11241100x8000000000000000558390Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:17.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3923c63c95c142912021-12-21 11:40:17.444root 11241100x8000000000000000558391Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:17.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.dc7105fa6212c93d2021-12-21 11:40:17.444root 11241100x8000000000000000558392Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:17.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.968f5da1fae11bf12021-12-21 11:40:17.445root 11241100x8000000000000000558393Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:17.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b7b649353fbe60032021-12-21 11:40:17.445root 11241100x8000000000000000558394Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:17.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.bfdcee3b37c7f40f2021-12-21 11:40:17.445root 11241100x8000000000000000558395Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:17.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9e220726e0165d562021-12-21 11:40:17.445root 11241100x8000000000000000558396Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:17.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c815424a88339e782021-12-21 11:40:17.943root 11241100x8000000000000000558397Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:17.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3dac3c8c6b73c9c82021-12-21 11:40:17.943root 11241100x8000000000000000558398Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:17.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.37015dd1449c60fa2021-12-21 11:40:17.944root 11241100x8000000000000000558399Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:17.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.bdcd3c03a835bed32021-12-21 11:40:17.944root 11241100x8000000000000000558400Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:17.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c006d1f1bd5e871e2021-12-21 11:40:17.944root 11241100x8000000000000000558401Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:17.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2c379863f1a377592021-12-21 11:40:17.944root 11241100x8000000000000000558402Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:17.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4e7eeb2f8fc864812021-12-21 11:40:17.944root 11241100x8000000000000000558403Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:17.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8695797345b1f95f2021-12-21 11:40:17.944root 11241100x8000000000000000558404Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:17.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.addae9ac515266682021-12-21 11:40:17.944root 11241100x8000000000000000558405Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:17.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ad3f92a4a0da7d172021-12-21 11:40:17.944root 11241100x8000000000000000558406Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:17.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.fecd01b9be90fab12021-12-21 11:40:17.944root 11241100x8000000000000000558407Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:17.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.32d462402a5d9c4f2021-12-21 11:40:17.944root 11241100x8000000000000000558408Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:17.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0917e2f99c0d7a882021-12-21 11:40:17.944root 11241100x8000000000000000558409Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:17.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0b919580060fd55d2021-12-21 11:40:17.944root 11241100x8000000000000000558410Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:17.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.258027c6a367a5872021-12-21 11:40:17.944root 11241100x8000000000000000558411Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:17.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e22f895a04f5dd4c2021-12-21 11:40:17.944root 11241100x8000000000000000558412Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:17.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9031e3ec2372696d2021-12-21 11:40:17.944root 11241100x8000000000000000558413Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:17.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c43fa235cd84b1822021-12-21 11:40:17.945root 354300x8000000000000000558414Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:18.108{ec2b6afe-95d9-61c1-5175-3a0400000000}5346/opt/splunkforwarder/etc/apps/Splunk_TA_stream/linux_x86_64/bin/streamfwdroottcptruefalse10.0.1.25-48880-false10.0.1.12-8000- 11241100x8000000000000000558415Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:18.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e3cc8aafba335b752021-12-21 11:40:18.443root 11241100x8000000000000000558416Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:18.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.560fbbc0ee23ecd82021-12-21 11:40:18.443root 11241100x8000000000000000558417Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:18.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1fd729d0deb405ed2021-12-21 11:40:18.444root 11241100x8000000000000000558418Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:18.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2b4bd46f5ebb66542021-12-21 11:40:18.444root 11241100x8000000000000000558419Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:18.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6deaf72406fe78c32021-12-21 11:40:18.444root 11241100x8000000000000000558420Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:18.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b89d04f111cde0102021-12-21 11:40:18.444root 11241100x8000000000000000558421Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:18.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e08c7ebbee7047b12021-12-21 11:40:18.444root 11241100x8000000000000000558422Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:18.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.60e7a5bf5ea23e5a2021-12-21 11:40:18.444root 11241100x8000000000000000558423Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:18.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.840ce6c0201a92b32021-12-21 11:40:18.444root 11241100x8000000000000000558424Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:18.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b5b5847dcdc70c962021-12-21 11:40:18.444root 11241100x8000000000000000558425Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:18.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ca10504dd16a88d62021-12-21 11:40:18.444root 11241100x8000000000000000558426Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:18.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b5445c159a5c9f0b2021-12-21 11:40:18.444root 11241100x8000000000000000558427Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:18.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7b036a608c97f2482021-12-21 11:40:18.444root 11241100x8000000000000000558428Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:18.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8287b4fad4fd92592021-12-21 11:40:18.444root 11241100x8000000000000000558429Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:18.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c80de743576d26c92021-12-21 11:40:18.445root 11241100x8000000000000000558430Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:18.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5a17e77f916382812021-12-21 11:40:18.445root 11241100x8000000000000000558431Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:18.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f9f7027c2280f3962021-12-21 11:40:18.445root 11241100x8000000000000000558432Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:18.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1cad8e91862b49492021-12-21 11:40:18.445root 11241100x8000000000000000558433Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:18.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5393777fe33d10ff2021-12-21 11:40:18.445root 11241100x8000000000000000558434Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:18.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4ea540949d4e41612021-12-21 11:40:18.943root 11241100x8000000000000000558435Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:18.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.fe44ea098d3998a72021-12-21 11:40:18.943root 11241100x8000000000000000558436Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:18.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.11ccac3ad10126062021-12-21 11:40:18.943root 11241100x8000000000000000558437Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:18.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1120444ef8a861d22021-12-21 11:40:18.943root 11241100x8000000000000000558438Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:18.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.11fdb77118c388e72021-12-21 11:40:18.943root 11241100x8000000000000000558439Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:18.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f38f63bb5a906cdc2021-12-21 11:40:18.943root 11241100x8000000000000000558440Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:18.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6aadf066dbb75ffe2021-12-21 11:40:18.943root 11241100x8000000000000000558441Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:18.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.049ece862cbfbf8a2021-12-21 11:40:18.944root 11241100x8000000000000000558442Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:18.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1ff99eae7bef6b142021-12-21 11:40:18.944root 11241100x8000000000000000558443Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:18.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.49acce64dd2aee632021-12-21 11:40:18.944root 11241100x8000000000000000558444Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:18.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.777ad0a7e5e464ea2021-12-21 11:40:18.944root 11241100x8000000000000000558445Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:18.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4746f67dae0d9cc02021-12-21 11:40:18.944root 11241100x8000000000000000558446Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:18.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ccdb74235e7781292021-12-21 11:40:18.944root 11241100x8000000000000000558447Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:18.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6f1200b6690a2a842021-12-21 11:40:18.944root 11241100x8000000000000000558448Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:18.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b4a26899a40b6f842021-12-21 11:40:18.944root 11241100x8000000000000000558449Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:18.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a2ec94f48d249dd22021-12-21 11:40:18.944root 11241100x8000000000000000558450Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:18.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8dd3ed6a9b2aa38f2021-12-21 11:40:18.945root 11241100x8000000000000000558451Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:18.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.dac909bb949041c22021-12-21 11:40:18.945root 11241100x8000000000000000558452Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:18.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b388aa72960d34512021-12-21 11:40:18.945root 11241100x8000000000000000558453Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:18.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.79e26b47c49f95a92021-12-21 11:40:18.945root 11241100x8000000000000000558454Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:18.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.cc5cad537c010c0e2021-12-21 11:40:18.945root 11241100x8000000000000000558455Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:18.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.de8a3a248d71ec4f2021-12-21 11:40:18.945root 11241100x8000000000000000558456Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:18.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b10d007e48b1a96b2021-12-21 11:40:18.945root 11241100x8000000000000000558457Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:18.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0658709921fc1ad52021-12-21 11:40:18.945root 11241100x8000000000000000558458Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:18.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.335a2492b7ac4e482021-12-21 11:40:18.945root 11241100x8000000000000000558459Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:19.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.aa7b1922073444132021-12-21 11:40:19.443root 11241100x8000000000000000558460Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:19.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7836878a6dd333272021-12-21 11:40:19.443root 11241100x8000000000000000558461Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:19.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9d9c9bded5917e2f2021-12-21 11:40:19.443root 11241100x8000000000000000558462Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:19.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.80d2cb877924de602021-12-21 11:40:19.443root 11241100x8000000000000000558463Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:19.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a6be4ce883da73a42021-12-21 11:40:19.443root 11241100x8000000000000000558464Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:19.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f68c18a2fad83c622021-12-21 11:40:19.444root 11241100x8000000000000000558465Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:19.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4a00902ce9c126b22021-12-21 11:40:19.444root 11241100x8000000000000000558466Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:19.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b700ea37fad979942021-12-21 11:40:19.444root 11241100x8000000000000000558467Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:19.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.18d1c1e7eacb05902021-12-21 11:40:19.444root 11241100x8000000000000000558468Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:19.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5b52b17d6b98ee362021-12-21 11:40:19.444root 11241100x8000000000000000558469Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:19.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.db255d81e3467aed2021-12-21 11:40:19.444root 11241100x8000000000000000558470Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:19.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e990b849e2901bef2021-12-21 11:40:19.444root 11241100x8000000000000000558471Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:19.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b35d511c421eeaa32021-12-21 11:40:19.444root 11241100x8000000000000000558472Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:19.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6b0870db865cf7c82021-12-21 11:40:19.444root 11241100x8000000000000000558473Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:19.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.01257753aefc0ec12021-12-21 11:40:19.444root 11241100x8000000000000000558474Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:19.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6a03bc5e252f02b72021-12-21 11:40:19.444root 11241100x8000000000000000558475Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:19.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f54f6b7a2fe0b53c2021-12-21 11:40:19.444root 11241100x8000000000000000558476Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:19.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b735a40e92a8562d2021-12-21 11:40:19.445root 11241100x8000000000000000558477Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:19.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d493e8b596c0d7e02021-12-21 11:40:19.445root 11241100x8000000000000000558478Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:19.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.93faaa772cf88bc82021-12-21 11:40:19.445root 11241100x8000000000000000558479Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:19.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b25414c424f4a9d62021-12-21 11:40:19.445root 11241100x8000000000000000558480Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:19.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.97630d5fc0aa8cd32021-12-21 11:40:19.445root 11241100x8000000000000000558481Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:19.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.782ba62006d9b5452021-12-21 11:40:19.445root 11241100x8000000000000000558482Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:19.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d2ff0335d91e1fd12021-12-21 11:40:19.445root 11241100x8000000000000000558483Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:19.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e95b92abd7cb3b452021-12-21 11:40:19.943root 11241100x8000000000000000558484Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:19.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c1e876d8c53d603c2021-12-21 11:40:19.943root 11241100x8000000000000000558485Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:19.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4fbc22d8fc45f3922021-12-21 11:40:19.943root 11241100x8000000000000000558486Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:19.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e2a752ad8f3a40cc2021-12-21 11:40:19.943root 11241100x8000000000000000558487Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:19.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8e4ccf2db4afa1642021-12-21 11:40:19.943root 11241100x8000000000000000558488Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:19.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.496be53ba71715ba2021-12-21 11:40:19.944root 11241100x8000000000000000558489Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:19.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.95a1c77f3ffdcc0b2021-12-21 11:40:19.944root 11241100x8000000000000000558490Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:19.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.584861b40d6303122021-12-21 11:40:19.944root 11241100x8000000000000000558491Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:19.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8c6e54dce65b8cbf2021-12-21 11:40:19.944root 11241100x8000000000000000558492Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:19.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.60666758537e3be22021-12-21 11:40:19.944root 11241100x8000000000000000558493Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:19.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d21ee49254a85ccd2021-12-21 11:40:19.944root 11241100x8000000000000000558494Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:19.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9849b5cb5954d76d2021-12-21 11:40:19.944root 11241100x8000000000000000558495Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:19.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b6128ed0f74ac1882021-12-21 11:40:19.944root 11241100x8000000000000000558496Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:19.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8da00231ca7d6cad2021-12-21 11:40:19.944root 11241100x8000000000000000558497Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:19.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d69ceda3f7bedfdd2021-12-21 11:40:19.944root 11241100x8000000000000000558498Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:19.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5ac19b61131b0caa2021-12-21 11:40:19.944root 11241100x8000000000000000558499Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:19.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5d15ab96cffb53fe2021-12-21 11:40:19.945root 11241100x8000000000000000558500Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:19.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0dcb59b9288be2542021-12-21 11:40:19.945root 11241100x8000000000000000558501Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:19.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.61abd0d429876d1a2021-12-21 11:40:19.945root 11241100x8000000000000000558502Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:19.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9593dd31e4d595562021-12-21 11:40:19.945root 11241100x8000000000000000558503Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:19.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0c3a0f8d100405ea2021-12-21 11:40:19.945root 11241100x8000000000000000558504Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:19.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.699f9d5065ad7bf22021-12-21 11:40:19.945root 11241100x8000000000000000558505Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:19.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.abab6551493fb1072021-12-21 11:40:19.945root 11241100x8000000000000000558506Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:20.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6d8f3a9132af82412021-12-21 11:40:20.443root 11241100x8000000000000000558507Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:20.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2b3ee2e2c7c593222021-12-21 11:40:20.443root 11241100x8000000000000000558508Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:20.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0ff9c4f5cfd72c0d2021-12-21 11:40:20.443root 11241100x8000000000000000558509Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:20.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.40c17ec77a8eb4152021-12-21 11:40:20.443root 11241100x8000000000000000558510Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:20.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f17fcfdd3b27ded52021-12-21 11:40:20.443root 11241100x8000000000000000558511Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:20.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.afce5dd305ae66b42021-12-21 11:40:20.444root 11241100x8000000000000000558512Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:20.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e5e7b63dbe4e83e52021-12-21 11:40:20.444root 11241100x8000000000000000558513Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:20.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.cc81250daea82dce2021-12-21 11:40:20.444root 11241100x8000000000000000558514Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:20.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.388e0440c32384d22021-12-21 11:40:20.444root 11241100x8000000000000000558515Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:20.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9749cf0cfe5355812021-12-21 11:40:20.444root 11241100x8000000000000000558516Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:20.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3875c624d48e9ad72021-12-21 11:40:20.444root 11241100x8000000000000000558517Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:20.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2a027efb31c8c8b52021-12-21 11:40:20.444root 11241100x8000000000000000558518Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:20.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.153324d9b4fa92ef2021-12-21 11:40:20.444root 11241100x8000000000000000558519Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:20.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2be22ac3c7f1e99f2021-12-21 11:40:20.444root 11241100x8000000000000000558520Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:20.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9d66db2b867f83e22021-12-21 11:40:20.444root 11241100x8000000000000000558521Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:20.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4c225aaa0fbdf8902021-12-21 11:40:20.444root 11241100x8000000000000000558522Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:20.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c2fbc8f0d3c8f6a52021-12-21 11:40:20.445root 11241100x8000000000000000558523Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:20.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.441a9a954deb55232021-12-21 11:40:20.445root 11241100x8000000000000000558524Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:20.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3d269d538eeb61ce2021-12-21 11:40:20.445root 11241100x8000000000000000558525Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:20.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3c0487baa2db2c092021-12-21 11:40:20.445root 11241100x8000000000000000558526Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:20.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.80ca1947dbe213422021-12-21 11:40:20.445root 11241100x8000000000000000558527Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:20.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.951546545bdd68432021-12-21 11:40:20.445root 11241100x8000000000000000558528Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:20.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.42c5070d80e07c7a2021-12-21 11:40:20.943root 11241100x8000000000000000558529Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:20.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.fdff834c6700f0ec2021-12-21 11:40:20.943root 11241100x8000000000000000558530Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:20.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.83edc9d22282e0a52021-12-21 11:40:20.943root 11241100x8000000000000000558531Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:20.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.fbd0b33510cc161f2021-12-21 11:40:20.944root 11241100x8000000000000000558532Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:20.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.73968232ebd5e41f2021-12-21 11:40:20.944root 11241100x8000000000000000558533Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:20.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7e14f1067d6e991b2021-12-21 11:40:20.944root 11241100x8000000000000000558534Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:20.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.de45d9e76ced992a2021-12-21 11:40:20.944root 11241100x8000000000000000558535Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:20.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.48cbb425ea35ebb92021-12-21 11:40:20.944root 11241100x8000000000000000558536Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:20.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d6760f597f288d2c2021-12-21 11:40:20.944root 11241100x8000000000000000558537Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:20.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f93760fa3a9291522021-12-21 11:40:20.945root 11241100x8000000000000000558538Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:20.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.84096c5cb08e5d122021-12-21 11:40:20.945root 11241100x8000000000000000558539Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:20.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.bd01873b282b95122021-12-21 11:40:20.945root 11241100x8000000000000000558540Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:20.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.dc83eb600ee246702021-12-21 11:40:20.945root 11241100x8000000000000000558541Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:20.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.048fc8ffe35f72722021-12-21 11:40:20.945root 11241100x8000000000000000558542Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:20.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.cb3da3f8388275992021-12-21 11:40:20.945root 11241100x8000000000000000558543Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:20.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.20c86343e6de688c2021-12-21 11:40:20.945root 11241100x8000000000000000558544Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:20.946{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3bbb7b0a1bb61b8c2021-12-21 11:40:20.946root 11241100x8000000000000000558545Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:20.946{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a35b89722faf21a92021-12-21 11:40:20.946root 11241100x8000000000000000558546Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:20.946{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a8d44a17c0841a852021-12-21 11:40:20.946root 11241100x8000000000000000558547Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:20.946{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.bfb7fc2887f1c5452021-12-21 11:40:20.946root 11241100x8000000000000000558548Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:21.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7dae3d7296a8f6fa2021-12-21 11:40:21.443root 11241100x8000000000000000558549Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:21.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a8301a70958cdda92021-12-21 11:40:21.443root 11241100x8000000000000000558550Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:21.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.96dd422a7beb08a92021-12-21 11:40:21.444root 11241100x8000000000000000558551Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:21.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e57fce79d9c6e0bd2021-12-21 11:40:21.444root 11241100x8000000000000000558552Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:21.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.dfd56f6d044ecf782021-12-21 11:40:21.444root 11241100x8000000000000000558553Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:21.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b63e30d1f7a35fd22021-12-21 11:40:21.444root 11241100x8000000000000000558554Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:21.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.46a5fb09b8a52dba2021-12-21 11:40:21.444root 11241100x8000000000000000558555Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:21.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7263c74f937ec6e62021-12-21 11:40:21.444root 11241100x8000000000000000558556Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:21.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.107e428d036629592021-12-21 11:40:21.445root 11241100x8000000000000000558557Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:21.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.10be451a67ab55fb2021-12-21 11:40:21.445root 11241100x8000000000000000558558Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:21.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8810caffa97a3ae32021-12-21 11:40:21.445root 11241100x8000000000000000558559Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:21.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e65e578a7849ebfa2021-12-21 11:40:21.445root 11241100x8000000000000000558560Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:21.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2d8fc60e08c4df322021-12-21 11:40:21.445root 11241100x8000000000000000558561Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:21.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.fd9d771b94b5a9772021-12-21 11:40:21.445root 11241100x8000000000000000558562Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:21.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.eed0738a320bc4d72021-12-21 11:40:21.445root 11241100x8000000000000000558563Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:21.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.256ac0ed3b2b19dd2021-12-21 11:40:21.445root 11241100x8000000000000000558564Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:21.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2c4dff1945e75e5d2021-12-21 11:40:21.445root 11241100x8000000000000000558565Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:21.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.22c183ea499c13ed2021-12-21 11:40:21.445root 11241100x8000000000000000558566Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:21.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a5833026ac5e2af52021-12-21 11:40:21.445root 11241100x8000000000000000558567Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:21.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.16032c53aef77f962021-12-21 11:40:21.943root 11241100x8000000000000000558568Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:21.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e56026073e40e1672021-12-21 11:40:21.943root 11241100x8000000000000000558569Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:21.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c963fd54347e02c32021-12-21 11:40:21.943root 11241100x8000000000000000558570Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:21.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c9cc315426e23aed2021-12-21 11:40:21.944root 11241100x8000000000000000558571Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:21.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.37352353de50b7a32021-12-21 11:40:21.944root 11241100x8000000000000000558572Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:21.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.354533412a16769b2021-12-21 11:40:21.944root 11241100x8000000000000000558573Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:21.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4c55d2fd2b9ed9032021-12-21 11:40:21.944root 11241100x8000000000000000558574Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:21.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.904a23aadd6a485f2021-12-21 11:40:21.944root 11241100x8000000000000000558575Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:21.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4259382f924fea8f2021-12-21 11:40:21.944root 11241100x8000000000000000558576Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:21.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ae2a5cb5e55c30602021-12-21 11:40:21.944root 11241100x8000000000000000558577Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:21.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4b386cf5ea5d8b552021-12-21 11:40:21.944root 11241100x8000000000000000558578Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:21.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.657efe9677dba0562021-12-21 11:40:21.944root 11241100x8000000000000000558579Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:21.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ac17312194d3f6542021-12-21 11:40:21.944root 11241100x8000000000000000558580Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:21.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.62e91f3d7fe8ea712021-12-21 11:40:21.944root 11241100x8000000000000000558581Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:21.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b45e61d915abcbf42021-12-21 11:40:21.944root 11241100x8000000000000000558582Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:21.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.90fd9086f76772032021-12-21 11:40:21.945root 11241100x8000000000000000558583Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:21.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a8f840260880c3bb2021-12-21 11:40:21.945root 11241100x8000000000000000558584Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:21.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7a2c491fe2c56c9f2021-12-21 11:40:21.945root 11241100x8000000000000000558585Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:21.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.577c5aa1737313f42021-12-21 11:40:21.945root 11241100x8000000000000000558586Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:22.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8872689a9f727f3f2021-12-21 11:40:22.443root 11241100x8000000000000000558587Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:22.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.77df57f8d9e30e562021-12-21 11:40:22.443root 11241100x8000000000000000558588Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:22.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.587f279ff69c5ca52021-12-21 11:40:22.443root 11241100x8000000000000000558589Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:22.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.54b7d00938d1c6352021-12-21 11:40:22.444root 11241100x8000000000000000558590Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:22.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.69081f253ab85c1f2021-12-21 11:40:22.444root 11241100x8000000000000000558591Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:22.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d27b09bf807ff9af2021-12-21 11:40:22.444root 11241100x8000000000000000558592Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:22.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.30ec9b5f3ae398b62021-12-21 11:40:22.444root 11241100x8000000000000000558593Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:22.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a34655b90790cdc32021-12-21 11:40:22.445root 11241100x8000000000000000558594Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:22.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.24038ac98b852fbc2021-12-21 11:40:22.445root 11241100x8000000000000000558595Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:22.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.909110d425c84a9b2021-12-21 11:40:22.445root 11241100x8000000000000000558596Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:22.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5cf1006321e0bbdf2021-12-21 11:40:22.445root 11241100x8000000000000000558597Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:22.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4e421f88e80a6d3a2021-12-21 11:40:22.445root 11241100x8000000000000000558598Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:22.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b2780b0d3421fff12021-12-21 11:40:22.445root 11241100x8000000000000000558599Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:22.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5e0a89b6acdb63d62021-12-21 11:40:22.445root 11241100x8000000000000000558600Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:22.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e7bad9bb015b6bdd2021-12-21 11:40:22.445root 11241100x8000000000000000558601Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:22.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f7f434c16aeeb6992021-12-21 11:40:22.445root 11241100x8000000000000000558602Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:22.446{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8e50b8165e4510f52021-12-21 11:40:22.446root 11241100x8000000000000000558603Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:22.446{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ebfef35592037cad2021-12-21 11:40:22.446root 11241100x8000000000000000558604Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:22.446{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.56c79ca26ea8222b2021-12-21 11:40:22.446root 11241100x8000000000000000558605Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:22.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.fa9e19266f0bb0d62021-12-21 11:40:22.943root 11241100x8000000000000000558606Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:22.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.dde3b21eb65055ed2021-12-21 11:40:22.943root 11241100x8000000000000000558607Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:22.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c2893a730c0787af2021-12-21 11:40:22.943root 11241100x8000000000000000558608Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:22.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6f3ef15820d3da502021-12-21 11:40:22.944root 11241100x8000000000000000558609Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:22.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.af2891d5526e6ad82021-12-21 11:40:22.944root 11241100x8000000000000000558610Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:22.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ebf387b899d1bdb72021-12-21 11:40:22.944root 11241100x8000000000000000558611Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:22.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.316a245a0dcb26262021-12-21 11:40:22.944root 11241100x8000000000000000558612Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:22.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d0f998f87a99d2612021-12-21 11:40:22.944root 11241100x8000000000000000558613Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:22.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a5c5f1f76aaeb5ea2021-12-21 11:40:22.945root 11241100x8000000000000000558614Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:22.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.30b6853fe892b8552021-12-21 11:40:22.945root 11241100x8000000000000000558615Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:22.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3d262ebccc831d592021-12-21 11:40:22.945root 11241100x8000000000000000558616Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:22.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2e45c62e42b78cce2021-12-21 11:40:22.945root 11241100x8000000000000000558617Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:22.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.99775a284663f5792021-12-21 11:40:22.945root 11241100x8000000000000000558618Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:22.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d78f075079da56552021-12-21 11:40:22.945root 11241100x8000000000000000558619Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:22.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c5409fa6bb892f812021-12-21 11:40:22.945root 11241100x8000000000000000558620Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:22.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8d26af688b6905022021-12-21 11:40:22.945root 11241100x8000000000000000558621Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:22.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f657beef6e0cfbf62021-12-21 11:40:22.945root 11241100x8000000000000000558622Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:22.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.88077cc457e96b132021-12-21 11:40:22.945root 11241100x8000000000000000558623Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:22.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e4fb847b0ad22e102021-12-21 11:40:22.945root 11241100x8000000000000000558624Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:22.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.afd8be4e7a9ec2252021-12-21 11:40:22.945root 11241100x8000000000000000558625Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:22.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0efb225ab681ef912021-12-21 11:40:22.945root 11241100x8000000000000000558626Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:23.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9a51206d913759742021-12-21 11:40:23.443root 11241100x8000000000000000558627Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:23.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e76fc2a8a648e7452021-12-21 11:40:23.443root 11241100x8000000000000000558628Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:23.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b30de9e30f963fc32021-12-21 11:40:23.443root 11241100x8000000000000000558629Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:23.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.53c44bb454f4364e2021-12-21 11:40:23.443root 11241100x8000000000000000558630Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:23.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.31e31794bec9f9572021-12-21 11:40:23.443root 11241100x8000000000000000558631Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:23.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.017dcbd2ba2848152021-12-21 11:40:23.443root 11241100x8000000000000000558632Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:23.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c5d940b0bd39d3732021-12-21 11:40:23.444root 11241100x8000000000000000558633Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:23.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.af190d686028f7542021-12-21 11:40:23.444root 11241100x8000000000000000558634Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:23.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5d7b0da0e505d88d2021-12-21 11:40:23.444root 11241100x8000000000000000558635Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:23.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7000c45f3879040f2021-12-21 11:40:23.444root 11241100x8000000000000000558636Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:23.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1c537f3618a1f0222021-12-21 11:40:23.444root 11241100x8000000000000000558637Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:23.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.62a804037944940e2021-12-21 11:40:23.444root 11241100x8000000000000000558638Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:23.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6f4cfb4157da3bf32021-12-21 11:40:23.444root 11241100x8000000000000000558639Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:23.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.55fd4cf0407bc2c42021-12-21 11:40:23.444root 11241100x8000000000000000558640Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:23.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.52044c2dc7c2ffa02021-12-21 11:40:23.445root 11241100x8000000000000000558641Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:23.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b55bc068ebc8bfd62021-12-21 11:40:23.445root 11241100x8000000000000000558642Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:23.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e64e3706fc065f352021-12-21 11:40:23.445root 11241100x8000000000000000558643Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:23.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b20f0e46acd0e7bb2021-12-21 11:40:23.445root 11241100x8000000000000000558644Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:23.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0f19995e1a1054c72021-12-21 11:40:23.445root 11241100x8000000000000000558645Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:23.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.11b9ed982e55e6902021-12-21 11:40:23.445root 11241100x8000000000000000558646Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:23.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6bb90fb8756f12642021-12-21 11:40:23.445root 11241100x8000000000000000558647Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:23.446{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.53a5b315f4ab769c2021-12-21 11:40:23.446root 11241100x8000000000000000558648Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:23.446{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.753461c9d5f883e02021-12-21 11:40:23.446root 11241100x8000000000000000558649Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:23.446{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2d2e609593d8530a2021-12-21 11:40:23.446root 11241100x8000000000000000558650Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:23.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.075f59a05f56eeac2021-12-21 11:40:23.943root 11241100x8000000000000000558651Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:23.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0ca96fff8f94379a2021-12-21 11:40:23.943root 11241100x8000000000000000558652Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:23.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.38cf30d219e912992021-12-21 11:40:23.943root 11241100x8000000000000000558653Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:23.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.324882693d13d6512021-12-21 11:40:23.943root 11241100x8000000000000000558654Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:23.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.de9159cb504a2f0c2021-12-21 11:40:23.944root 11241100x8000000000000000558655Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:23.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6faf4716bb4a0e312021-12-21 11:40:23.944root 11241100x8000000000000000558656Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:23.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.401eddd321cfeaf12021-12-21 11:40:23.944root 11241100x8000000000000000558657Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:23.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.cfe232ae89f7c10e2021-12-21 11:40:23.944root 11241100x8000000000000000558658Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:23.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.49865e8b84004ca72021-12-21 11:40:23.944root 11241100x8000000000000000558659Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:23.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.aff1b36fa4b6f22a2021-12-21 11:40:23.944root 11241100x8000000000000000558660Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:23.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.93ca62c3faddccc12021-12-21 11:40:23.944root 11241100x8000000000000000558661Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:23.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.dbe9d87f647ba36b2021-12-21 11:40:23.944root 11241100x8000000000000000558662Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:23.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.12f601554f9cd5952021-12-21 11:40:23.944root 11241100x8000000000000000558663Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:23.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b755742b83d1c04f2021-12-21 11:40:23.944root 11241100x8000000000000000558664Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:23.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9fe032524fe172962021-12-21 11:40:23.945root 11241100x8000000000000000558665Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:23.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.908ef5f94b35b9c52021-12-21 11:40:23.945root 11241100x8000000000000000558666Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:23.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.61cb8a48a0efff802021-12-21 11:40:23.945root 11241100x8000000000000000558667Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:23.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e730362d2db8f8ca2021-12-21 11:40:23.945root 11241100x8000000000000000558668Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:23.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f90a089c3b5a75802021-12-21 11:40:23.945root 354300x8000000000000000558669Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:24.013{ec2b6afe-95d9-61c1-5175-3a0400000000}5346/opt/splunkforwarder/etc/apps/Splunk_TA_stream/linux_x86_64/bin/streamfwdroottcptruefalse10.0.1.25-48882-false10.0.1.12-8000- 11241100x8000000000000000558670Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:24.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8a7d746787d57afb2021-12-21 11:40:24.443root 11241100x8000000000000000558671Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:24.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.98bdb1fe5225c7312021-12-21 11:40:24.443root 11241100x8000000000000000558672Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:24.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.583824c3bc7676e22021-12-21 11:40:24.443root 11241100x8000000000000000558673Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:24.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.07b106cbbf578e2f2021-12-21 11:40:24.443root 11241100x8000000000000000558674Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:24.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1b744f99c31feb612021-12-21 11:40:24.444root 11241100x8000000000000000558675Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:24.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.bbe37da5841d06242021-12-21 11:40:24.444root 11241100x8000000000000000558676Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:24.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.fd6f93e1193dbd512021-12-21 11:40:24.444root 11241100x8000000000000000558677Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:24.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3acbda13be8540a92021-12-21 11:40:24.444root 11241100x8000000000000000558678Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:24.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7079344d2ba9b74c2021-12-21 11:40:24.444root 11241100x8000000000000000558679Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:24.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ef507a8b7fdff00a2021-12-21 11:40:24.444root 11241100x8000000000000000558680Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:24.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3b42e82f4d6e513d2021-12-21 11:40:24.444root 11241100x8000000000000000558681Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:24.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7cb61af4ce58ae612021-12-21 11:40:24.444root 11241100x8000000000000000558682Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:24.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.daa2ca248aa5f1032021-12-21 11:40:24.444root 11241100x8000000000000000558683Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:24.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c3786b98c6e192be2021-12-21 11:40:24.444root 11241100x8000000000000000558684Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:24.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.39719ac1bd1e98f92021-12-21 11:40:24.444root 11241100x8000000000000000558685Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:24.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.68ba5ebf2657be652021-12-21 11:40:24.444root 11241100x8000000000000000558686Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:24.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c12e0f72711183d32021-12-21 11:40:24.445root 11241100x8000000000000000558687Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:24.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.39aa1d9515a1ccf12021-12-21 11:40:24.445root 11241100x8000000000000000558688Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:24.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.68c28c30d89dc2d92021-12-21 11:40:24.445root 11241100x8000000000000000558689Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:24.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6a89b2934ec6b1522021-12-21 11:40:24.445root 11241100x8000000000000000558690Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:24.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5227ead89bfb2c5d2021-12-21 11:40:24.943root 11241100x8000000000000000558691Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:24.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.23da1e421db672642021-12-21 11:40:24.943root 11241100x8000000000000000558692Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:24.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d8ae6187122b437b2021-12-21 11:40:24.943root 11241100x8000000000000000558693Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:24.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.fd2eff6d18e5b6f12021-12-21 11:40:24.943root 11241100x8000000000000000558694Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:24.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d7cacc7f5614ba1b2021-12-21 11:40:24.943root 11241100x8000000000000000558695Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:24.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5677a86206e586952021-12-21 11:40:24.944root 11241100x8000000000000000558696Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:24.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.cb6c67eda213dfc82021-12-21 11:40:24.944root 11241100x8000000000000000558697Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:24.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.099132bd165be8c52021-12-21 11:40:24.944root 11241100x8000000000000000558698Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:24.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.51a601eee3c0caa62021-12-21 11:40:24.944root 11241100x8000000000000000558699Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:24.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.11bb21a1ace6e11a2021-12-21 11:40:24.944root 11241100x8000000000000000558700Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:24.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.776115c76f283ac72021-12-21 11:40:24.944root 11241100x8000000000000000558701Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:24.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.89414a3f6dced9002021-12-21 11:40:24.944root 11241100x8000000000000000558702Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:24.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8150db5462218f8b2021-12-21 11:40:24.944root 11241100x8000000000000000558703Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:24.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.16604a7c2e155dfe2021-12-21 11:40:24.944root 11241100x8000000000000000558704Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:24.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.72342b1af9444be72021-12-21 11:40:24.944root 11241100x8000000000000000558705Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:24.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0056905851d741eb2021-12-21 11:40:24.944root 11241100x8000000000000000558706Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:24.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.53c878a8745e8b772021-12-21 11:40:24.944root 11241100x8000000000000000558707Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:24.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.cb57bf2e386392812021-12-21 11:40:24.945root 11241100x8000000000000000558708Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:24.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4f69df1a8119e2872021-12-21 11:40:24.945root 11241100x8000000000000000558709Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:24.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.de810ec698e894b42021-12-21 11:40:24.945root 11241100x8000000000000000558710Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:25.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4c2bc16b74222cdd2021-12-21 11:40:25.443root 11241100x8000000000000000558711Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:25.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.034e2f0ec5920a912021-12-21 11:40:25.443root 11241100x8000000000000000558712Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:25.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4b86df4f793e242a2021-12-21 11:40:25.443root 11241100x8000000000000000558713Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:25.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1be6c87a8b6c651b2021-12-21 11:40:25.443root 11241100x8000000000000000558714Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:25.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1300102b8e794adc2021-12-21 11:40:25.444root 11241100x8000000000000000558715Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:25.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.423ad72bc29758442021-12-21 11:40:25.444root 11241100x8000000000000000558716Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:25.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.be5bdb016d77c06d2021-12-21 11:40:25.444root 11241100x8000000000000000558717Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:25.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.75b31f33434c9fd02021-12-21 11:40:25.444root 11241100x8000000000000000558718Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:25.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9166978da6e8d9762021-12-21 11:40:25.445root 11241100x8000000000000000558719Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:25.446{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ac786e39008a29ff2021-12-21 11:40:25.446root 11241100x8000000000000000558720Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:25.446{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.cf78b33e43339fc82021-12-21 11:40:25.446root 11241100x8000000000000000558721Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:25.446{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8dad67bfb0be26b22021-12-21 11:40:25.446root 11241100x8000000000000000558722Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:25.446{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.508d5be54b5fa90d2021-12-21 11:40:25.446root 11241100x8000000000000000558723Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:25.446{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.688a69fe518019bb2021-12-21 11:40:25.446root 11241100x8000000000000000558724Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:25.447{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.538d7251cda742bf2021-12-21 11:40:25.447root 11241100x8000000000000000558725Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:25.447{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.405a3619971868da2021-12-21 11:40:25.447root 11241100x8000000000000000558726Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:25.447{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.14daa0dba8e15cde2021-12-21 11:40:25.447root 11241100x8000000000000000558727Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:25.447{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4e5758a23a6b6cc12021-12-21 11:40:25.447root 11241100x8000000000000000558728Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:25.448{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8038b7b5de0b20b72021-12-21 11:40:25.448root 11241100x8000000000000000558729Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:25.448{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.890741bfd6084d152021-12-21 11:40:25.448root 11241100x8000000000000000558730Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:25.448{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.84f5d5b2cf077b882021-12-21 11:40:25.448root 11241100x8000000000000000558731Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:25.448{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9532df4d85cc7b762021-12-21 11:40:25.448root 354300x8000000000000000558732Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:25.534{ec2b6afe-95d2-61c1-3038-b84203560000}5272/opt/splunkforwarder/bin/splunkdroottcptruefalse10.0.1.25-35948-false10.0.1.12-8089- 11241100x8000000000000000558733Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:25.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.694d066f444b04c72021-12-21 11:40:25.943root 11241100x8000000000000000558734Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:25.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7327c64c7fbaa1272021-12-21 11:40:25.943root 11241100x8000000000000000558735Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:25.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c6c30d4c4a89ec3f2021-12-21 11:40:25.943root 11241100x8000000000000000558736Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:25.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d4185ac5465fa6162021-12-21 11:40:25.943root 11241100x8000000000000000558737Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:25.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.98dd1d36806e4b582021-12-21 11:40:25.943root 11241100x8000000000000000558738Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:25.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5fe7822b043286b92021-12-21 11:40:25.943root 11241100x8000000000000000558739Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:25.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0b08bbd5aee4ead02021-12-21 11:40:25.944root 11241100x8000000000000000558740Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:25.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3eb4372868ea21ef2021-12-21 11:40:25.944root 11241100x8000000000000000558741Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:25.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.88d1a9d23cb6d0bc2021-12-21 11:40:25.944root 11241100x8000000000000000558742Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:25.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.76999e046777e6cd2021-12-21 11:40:25.944root 11241100x8000000000000000558743Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:25.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d24e0a126f27461b2021-12-21 11:40:25.944root 11241100x8000000000000000558744Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:25.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.bb3481e31764a2a92021-12-21 11:40:25.944root 11241100x8000000000000000558745Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:25.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.211386cd0566acb32021-12-21 11:40:25.944root 11241100x8000000000000000558746Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:25.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.93618eb290c27aeb2021-12-21 11:40:25.944root 11241100x8000000000000000558747Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:25.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0118dcb2b514bad92021-12-21 11:40:25.944root 11241100x8000000000000000558748Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:25.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8c4e0a4afe7027f02021-12-21 11:40:25.944root 11241100x8000000000000000558749Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:25.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.19d1450ffab7bcaf2021-12-21 11:40:25.944root 11241100x8000000000000000558750Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:25.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.014dd738031c237a2021-12-21 11:40:25.944root 11241100x8000000000000000558751Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:25.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b50e43e2feff81092021-12-21 11:40:25.945root 11241100x8000000000000000558752Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:25.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.edd1f6a44d35c1f22021-12-21 11:40:25.945root 11241100x8000000000000000558753Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:25.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a957532c3bc3e5422021-12-21 11:40:25.945root 11241100x8000000000000000558754Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:25.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4a3011f3bb2410a82021-12-21 11:40:25.945root 11241100x8000000000000000558755Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:25.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9a1f3ede46e95d422021-12-21 11:40:25.945root 11241100x8000000000000000558756Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:25.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a68c6cda83b0af432021-12-21 11:40:25.945root 11241100x8000000000000000558757Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:25.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a2ec0996285679c02021-12-21 11:40:25.945root 11241100x8000000000000000558758Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:26.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.86672f01fde3f0cf2021-12-21 11:40:26.443root 11241100x8000000000000000558759Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:26.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a48f63658104367f2021-12-21 11:40:26.443root 11241100x8000000000000000558760Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:26.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3d84605cc27fc84b2021-12-21 11:40:26.444root 11241100x8000000000000000558761Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:26.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0afce53d53aea2d32021-12-21 11:40:26.444root 11241100x8000000000000000558762Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:26.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5d5906dc1be0e1602021-12-21 11:40:26.444root 11241100x8000000000000000558763Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:26.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2845062c9fd3b43c2021-12-21 11:40:26.444root 11241100x8000000000000000558764Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:26.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5b94565e32fde97d2021-12-21 11:40:26.444root 11241100x8000000000000000558765Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:26.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.71acc6848bf936612021-12-21 11:40:26.444root 11241100x8000000000000000558766Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:26.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.852b07a40a7290762021-12-21 11:40:26.444root 11241100x8000000000000000558767Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:26.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.01e7993520b82ee12021-12-21 11:40:26.444root 11241100x8000000000000000558768Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:26.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.10333a5691434e5b2021-12-21 11:40:26.444root 11241100x8000000000000000558769Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:26.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.342ddfb900da50db2021-12-21 11:40:26.444root 11241100x8000000000000000558770Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:26.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.01d6e448ae12390a2021-12-21 11:40:26.444root 11241100x8000000000000000558771Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:26.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c8994a055ad097b82021-12-21 11:40:26.444root 11241100x8000000000000000558772Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:26.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.469ddb4625bc73752021-12-21 11:40:26.445root 11241100x8000000000000000558773Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:26.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1ebc1e937643bd322021-12-21 11:40:26.445root 11241100x8000000000000000558774Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:26.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e18474dc57edbb782021-12-21 11:40:26.445root 11241100x8000000000000000558775Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:26.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9649113b683c66082021-12-21 11:40:26.445root 11241100x8000000000000000558776Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:26.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.95141781541918862021-12-21 11:40:26.445root 11241100x8000000000000000558777Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:26.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7f6cc62dfcf52fbe2021-12-21 11:40:26.445root 11241100x8000000000000000558778Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:26.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.04634acebc406ddf2021-12-21 11:40:26.445root 11241100x8000000000000000558779Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:26.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.97dae696b6bc2ad62021-12-21 11:40:26.943root 11241100x8000000000000000558780Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:26.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8dd841fc6262e2a32021-12-21 11:40:26.943root 11241100x8000000000000000558781Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:26.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.91be315114aae8402021-12-21 11:40:26.943root 11241100x8000000000000000558782Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:26.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.48f52c713493bff12021-12-21 11:40:26.943root 11241100x8000000000000000558783Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:26.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.63c7d4d39930d0ba2021-12-21 11:40:26.944root 11241100x8000000000000000558784Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:26.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4398fb849564a5e82021-12-21 11:40:26.944root 11241100x8000000000000000558785Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:26.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e7c4de789c8807e82021-12-21 11:40:26.944root 11241100x8000000000000000558786Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:26.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a41272e31ed931c32021-12-21 11:40:26.944root 11241100x8000000000000000558787Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:26.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9eb488fb4602b5232021-12-21 11:40:26.944root 11241100x8000000000000000558788Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:26.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1cb72819a8a759662021-12-21 11:40:26.944root 11241100x8000000000000000558789Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:26.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b562bd07868205832021-12-21 11:40:26.944root 11241100x8000000000000000558790Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:26.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e8936272a687a5bc2021-12-21 11:40:26.944root 11241100x8000000000000000558791Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:26.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8fc9a15fc7c4c1112021-12-21 11:40:26.944root 11241100x8000000000000000558792Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:26.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e8993e05fb0710cc2021-12-21 11:40:26.944root 11241100x8000000000000000558793Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:26.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.128469a0c1e51f892021-12-21 11:40:26.944root 11241100x8000000000000000558794Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:26.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e7421e7c9997f6562021-12-21 11:40:26.944root 11241100x8000000000000000558795Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:26.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.cad752d66e8bbe472021-12-21 11:40:26.944root 11241100x8000000000000000558796Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:26.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.193146fa091131ef2021-12-21 11:40:26.944root 11241100x8000000000000000558797Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:26.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e0d551cecf6aaf302021-12-21 11:40:26.944root 11241100x8000000000000000558798Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:26.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0d464b48afa951902021-12-21 11:40:26.944root 11241100x8000000000000000558799Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:26.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4284835e95d362b82021-12-21 11:40:26.945root 11241100x8000000000000000558800Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:27.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5f5a070516f182ac2021-12-21 11:40:27.443root 11241100x8000000000000000558801Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:27.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.eccca77c0650a4242021-12-21 11:40:27.443root 11241100x8000000000000000558802Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:27.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.00d1e0b078d12c582021-12-21 11:40:27.445root 11241100x8000000000000000558803Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:27.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c0d57323ac1e81ce2021-12-21 11:40:27.445root 11241100x8000000000000000558804Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:27.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.775b49a2f6e5a9ab2021-12-21 11:40:27.445root 11241100x8000000000000000558805Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:27.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.01d19d92f07333382021-12-21 11:40:27.445root 11241100x8000000000000000558806Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:27.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.711f9fe9ed99d8ee2021-12-21 11:40:27.445root 11241100x8000000000000000558807Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:27.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a48f2e789cacf63d2021-12-21 11:40:27.445root 11241100x8000000000000000558808Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:27.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.73630b35dee5ed1e2021-12-21 11:40:27.445root 11241100x8000000000000000558809Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:27.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a0046bfcffb5ee492021-12-21 11:40:27.445root 11241100x8000000000000000558810Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:27.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.32cd13802fd2a78f2021-12-21 11:40:27.445root 11241100x8000000000000000558811Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:27.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b945caed44fe3ba22021-12-21 11:40:27.445root 11241100x8000000000000000558812Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:27.449{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.36db286d6371ff9b2021-12-21 11:40:27.449root 11241100x8000000000000000558813Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:27.449{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.77c56eeb194139db2021-12-21 11:40:27.449root 11241100x8000000000000000558814Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:27.449{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.560f8b92c36c29622021-12-21 11:40:27.449root 11241100x8000000000000000558815Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:27.450{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.acf084950fb5d1a42021-12-21 11:40:27.450root 11241100x8000000000000000558816Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:27.450{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d86a17fd6308ca7e2021-12-21 11:40:27.450root 11241100x8000000000000000558817Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:27.450{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8859de175e0a01bd2021-12-21 11:40:27.450root 11241100x8000000000000000558818Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:27.450{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.61e2d604778cf9272021-12-21 11:40:27.450root 11241100x8000000000000000558819Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:27.450{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.40e55b9455b58c4c2021-12-21 11:40:27.450root 11241100x8000000000000000558820Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:27.450{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0765ebbd0dc9d3a72021-12-21 11:40:27.450root 11241100x8000000000000000558821Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:27.450{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.98b86a602bdfa95b2021-12-21 11:40:27.450root 11241100x8000000000000000558822Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:27.450{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.21fe4809594722a72021-12-21 11:40:27.450root 11241100x8000000000000000558823Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:27.450{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d98e524cf9cfcb342021-12-21 11:40:27.450root 11241100x8000000000000000558824Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:27.451{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4f9792a23bd05e2b2021-12-21 11:40:27.451root 11241100x8000000000000000558825Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:27.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3ef3a3f32a5daddb2021-12-21 11:40:27.943root 11241100x8000000000000000558826Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:27.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3a423bde2a77c0572021-12-21 11:40:27.943root 11241100x8000000000000000558827Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:27.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b2d10e4c29aea7c12021-12-21 11:40:27.944root 11241100x8000000000000000558828Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:27.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7454e7708c5f3bc82021-12-21 11:40:27.944root 11241100x8000000000000000558829Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:27.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.cb6f0df1e68b29ab2021-12-21 11:40:27.944root 11241100x8000000000000000558830Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:27.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.614722c943ce1cbf2021-12-21 11:40:27.944root 11241100x8000000000000000558831Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:27.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1a6c286b749318432021-12-21 11:40:27.944root 11241100x8000000000000000558832Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:27.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.962c6a73426f3ff02021-12-21 11:40:27.944root 11241100x8000000000000000558833Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:27.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.62a75c7b18fbe7ba2021-12-21 11:40:27.945root 11241100x8000000000000000558834Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:27.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.37c7408bcdcab0262021-12-21 11:40:27.945root 11241100x8000000000000000558835Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:27.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.09cba177ca184dd72021-12-21 11:40:27.945root 11241100x8000000000000000558836Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:27.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0a9b6db7eb407fe92021-12-21 11:40:27.945root 11241100x8000000000000000558837Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:27.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d8e8f550a9781cf12021-12-21 11:40:27.945root 11241100x8000000000000000558838Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:27.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.217bc7d5e20cd9e92021-12-21 11:40:27.945root 11241100x8000000000000000558839Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:27.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.abfdac8d10be43ff2021-12-21 11:40:27.945root 11241100x8000000000000000558840Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:27.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c84c9b466e4e850e2021-12-21 11:40:27.945root 11241100x8000000000000000558841Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:27.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b05cd7185ddeed432021-12-21 11:40:27.945root 11241100x8000000000000000558842Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:27.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.fa057a703ac0007f2021-12-21 11:40:27.945root 11241100x8000000000000000558843Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:27.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.37ff50ee3a3b0c052021-12-21 11:40:27.945root 11241100x8000000000000000558844Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:27.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e329ae41b825bd802021-12-21 11:40:27.945root 11241100x8000000000000000558845Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:27.946{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.74dee2276bb731122021-12-21 11:40:27.946root 11241100x8000000000000000558846Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:28.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c39b957dbdf6e7492021-12-21 11:40:28.443root 11241100x8000000000000000558847Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:28.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.74336b7e26923ae32021-12-21 11:40:28.443root 11241100x8000000000000000558848Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:28.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.43032fccfb115d1a2021-12-21 11:40:28.444root 11241100x8000000000000000558849Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:28.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2fc0e5a95b29e2a22021-12-21 11:40:28.444root 11241100x8000000000000000558850Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:28.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4b813e4ffb0250962021-12-21 11:40:28.444root 11241100x8000000000000000558851Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:28.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.430f107f340b83a62021-12-21 11:40:28.444root 11241100x8000000000000000558852Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:28.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.73e6cd151956f9ce2021-12-21 11:40:28.444root 11241100x8000000000000000558853Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:28.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ec9361422aad8cdc2021-12-21 11:40:28.445root 11241100x8000000000000000558854Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:28.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f6d7b8a5eb6447e92021-12-21 11:40:28.445root 11241100x8000000000000000558855Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:28.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.cc8ddabb9d7c29ef2021-12-21 11:40:28.445root 11241100x8000000000000000558856Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:28.447{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8b18f0c360e0a4d42021-12-21 11:40:28.447root 11241100x8000000000000000558857Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:28.447{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a248aba35c7514cf2021-12-21 11:40:28.447root 11241100x8000000000000000558858Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:28.447{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.561e73cc72aa6e452021-12-21 11:40:28.447root 11241100x8000000000000000558859Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:28.447{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0b9d2c8c543dd7bf2021-12-21 11:40:28.447root 11241100x8000000000000000558860Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:28.447{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.07b38685d37f3b712021-12-21 11:40:28.447root 11241100x8000000000000000558861Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:28.448{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.20c549242f3495332021-12-21 11:40:28.448root 11241100x8000000000000000558862Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:28.448{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.92fbde6fe7da51262021-12-21 11:40:28.448root 11241100x8000000000000000558863Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:28.448{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a92e96a2f17a02312021-12-21 11:40:28.448root 11241100x8000000000000000558864Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:28.448{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6c35c69bc05ac2352021-12-21 11:40:28.448root 11241100x8000000000000000558865Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:28.448{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9b3122c0e76540202021-12-21 11:40:28.448root 11241100x8000000000000000558866Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:28.448{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.71bce4d9d1e011ed2021-12-21 11:40:28.448root 11241100x8000000000000000558867Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:28.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.35ca6d2b9316363c2021-12-21 11:40:28.943root 11241100x8000000000000000558868Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:28.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.852a49bf96a99fbf2021-12-21 11:40:28.943root 11241100x8000000000000000558869Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:28.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.238aadbb4ce8be212021-12-21 11:40:28.943root 11241100x8000000000000000558870Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:28.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0fa7835fd226e4cf2021-12-21 11:40:28.943root 11241100x8000000000000000558871Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:28.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a29cd827da2867772021-12-21 11:40:28.943root 11241100x8000000000000000558872Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:28.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c226c54c2fab34d32021-12-21 11:40:28.943root 11241100x8000000000000000558873Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:28.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d36680b741321a5e2021-12-21 11:40:28.943root 11241100x8000000000000000558874Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:28.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.67a33de1289954e22021-12-21 11:40:28.943root 11241100x8000000000000000558875Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:28.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.277811340bccdaf72021-12-21 11:40:28.944root 11241100x8000000000000000558876Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:28.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6a582045bb9f85ab2021-12-21 11:40:28.944root 11241100x8000000000000000558877Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:28.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.749c051e9d5244952021-12-21 11:40:28.944root 11241100x8000000000000000558878Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:28.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3c8fcb625304ac612021-12-21 11:40:28.944root 11241100x8000000000000000558879Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:28.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.dd99bad0f195e28d2021-12-21 11:40:28.944root 11241100x8000000000000000558880Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:28.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e38140eee325308a2021-12-21 11:40:28.944root 11241100x8000000000000000558881Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:28.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.39eadeb21066f94b2021-12-21 11:40:28.944root 11241100x8000000000000000558882Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:28.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6ba9b327bfe7918e2021-12-21 11:40:28.945root 11241100x8000000000000000558883Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:28.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.59701c2312f297a52021-12-21 11:40:28.945root 11241100x8000000000000000558884Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:28.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.324a9d58a6dd9ae62021-12-21 11:40:28.945root 11241100x8000000000000000558885Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:28.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.650eca84dec2f7b62021-12-21 11:40:28.945root 11241100x8000000000000000558886Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:28.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8f1b9899de0477572021-12-21 11:40:28.945root 11241100x8000000000000000558887Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:28.946{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.af9c79d3980999262021-12-21 11:40:28.946root 11241100x8000000000000000558888Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:28.946{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.54533cb1eb0498012021-12-21 11:40:28.946root 11241100x8000000000000000558889Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:28.946{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.58585f66947bb8892021-12-21 11:40:28.946root 11241100x8000000000000000558890Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:28.946{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.34c940e613d028e72021-12-21 11:40:28.946root 11241100x8000000000000000558891Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:28.947{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.610997d87a63a0132021-12-21 11:40:28.947root 11241100x8000000000000000558892Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:28.947{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0ff5db3ea20c4cd72021-12-21 11:40:28.947root 11241100x8000000000000000558893Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:28.947{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.398a12160e016dc92021-12-21 11:40:28.947root 11241100x8000000000000000558894Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:28.947{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ac842a94fac2af902021-12-21 11:40:28.947root 11241100x8000000000000000558895Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:28.947{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.208b77792273f23f2021-12-21 11:40:28.947root 11241100x8000000000000000558896Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:28.948{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.beed4a1b5d12ca0d2021-12-21 11:40:28.948root 11241100x8000000000000000558897Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:28.948{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.eea19ebd1ec739532021-12-21 11:40:28.948root 11241100x8000000000000000558898Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:28.948{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d4b716541871b53f2021-12-21 11:40:28.948root 154100x8000000000000000558899Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:29.097{ec2b6afe-bd2d-61c1-6884-45e1b0550000}9940/bin/ps-----ps -e -o pid,ppid,state,command/var/snap/amazon-ssm-agent/4046root{ec2b6afe-0000-0000-0000-000000000000}04294967295no level-{00000000-0000-0000-0000-000000000000}2319--- 534500x8000000000000000558900Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:29.108{ec2b6afe-bd2d-61c1-6884-45e1b0550000}9940/bin/psroot 354300x8000000000000000558901Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:29.132{ec2b6afe-95d9-61c1-5175-3a0400000000}5346/opt/splunkforwarder/etc/apps/Splunk_TA_stream/linux_x86_64/bin/streamfwdroottcptruefalse10.0.1.25-48886-false10.0.1.12-8000- 11241100x8000000000000000558902Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:29.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.497311b464883fd32021-12-21 11:40:29.443root 11241100x8000000000000000558903Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:29.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9c3d74d1fb86bc512021-12-21 11:40:29.443root 11241100x8000000000000000558904Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:29.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.16500c711f77ea612021-12-21 11:40:29.444root 11241100x8000000000000000558905Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:29.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.33749891c27bfe4c2021-12-21 11:40:29.444root 11241100x8000000000000000558906Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:29.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e09eb42794583e962021-12-21 11:40:29.444root 11241100x8000000000000000558907Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:29.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b3405240febb04512021-12-21 11:40:29.444root 11241100x8000000000000000558908Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:29.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d4572f430ac4c7e22021-12-21 11:40:29.444root 11241100x8000000000000000558909Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:29.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.76702dfb819d2fa82021-12-21 11:40:29.444root 11241100x8000000000000000558910Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:29.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5a1563a11b0065292021-12-21 11:40:29.444root 11241100x8000000000000000558911Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:29.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.394cb24db9babc412021-12-21 11:40:29.445root 11241100x8000000000000000558912Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:29.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3d2a7d7d824666e02021-12-21 11:40:29.445root 11241100x8000000000000000558913Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:29.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.fedb6cd3189a469e2021-12-21 11:40:29.445root 11241100x8000000000000000558914Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:29.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.83508188ef4e9b1d2021-12-21 11:40:29.445root 11241100x8000000000000000558915Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:29.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.790142f1ab1f96ee2021-12-21 11:40:29.445root 11241100x8000000000000000558916Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:29.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.634b09848117df982021-12-21 11:40:29.445root 11241100x8000000000000000558917Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:29.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.fb07341d0716a4972021-12-21 11:40:29.445root 11241100x8000000000000000558918Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:29.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.bee746cf71df0d652021-12-21 11:40:29.445root 11241100x8000000000000000558919Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:29.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a78ab12880d0cb0f2021-12-21 11:40:29.445root 11241100x8000000000000000558920Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:29.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5f1b0ff0a165de9a2021-12-21 11:40:29.445root 11241100x8000000000000000558921Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:29.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4af76278c9f5455d2021-12-21 11:40:29.445root 11241100x8000000000000000558922Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:29.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6832fcac37c0202c2021-12-21 11:40:29.445root 11241100x8000000000000000558923Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:29.446{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d1a8d44037cdbfe02021-12-21 11:40:29.446root 11241100x8000000000000000558924Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:29.446{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.af619dfbd188ba462021-12-21 11:40:29.446root 11241100x8000000000000000558925Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:29.446{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.675efd4f9ac925ba2021-12-21 11:40:29.446root 11241100x8000000000000000558926Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:29.446{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.466ee6226f63b7d42021-12-21 11:40:29.446root 11241100x8000000000000000558927Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:29.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b97b8116e9f5dd9d2021-12-21 11:40:29.943root 11241100x8000000000000000558928Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:29.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.92bf9cfcce3a438c2021-12-21 11:40:29.943root 11241100x8000000000000000558929Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:29.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2dc59f85f4f11a022021-12-21 11:40:29.943root 11241100x8000000000000000558930Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:29.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2029fb7eaa1a49b12021-12-21 11:40:29.943root 11241100x8000000000000000558931Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:29.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e7f2df0e83c9c7ad2021-12-21 11:40:29.944root 11241100x8000000000000000558932Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:29.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.81bdb4ea384c68742021-12-21 11:40:29.944root 11241100x8000000000000000558933Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:29.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c96724657b9f69762021-12-21 11:40:29.944root 11241100x8000000000000000558934Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:29.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c940da5ad5f4955e2021-12-21 11:40:29.944root 11241100x8000000000000000558935Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:29.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e6c48b15af1263cb2021-12-21 11:40:29.944root 11241100x8000000000000000558936Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:29.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3f523a56d12de7ea2021-12-21 11:40:29.944root 11241100x8000000000000000558937Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:29.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.afee16fc18da101a2021-12-21 11:40:29.945root 11241100x8000000000000000558938Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:29.946{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.df422f397bb426ec2021-12-21 11:40:29.946root 11241100x8000000000000000558939Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:29.946{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f78772122e403f982021-12-21 11:40:29.946root 11241100x8000000000000000558940Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:29.946{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.af08bcd5e5e465c12021-12-21 11:40:29.946root 11241100x8000000000000000558941Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:29.946{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.acbb2e906c589a3c2021-12-21 11:40:29.946root 11241100x8000000000000000558942Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:29.947{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.97dd6d11e4b41ba62021-12-21 11:40:29.947root 11241100x8000000000000000558943Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:29.948{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5c9ddfb3b07c602d2021-12-21 11:40:29.948root 11241100x8000000000000000558944Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:29.949{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ae7e74592a605b5a2021-12-21 11:40:29.949root 11241100x8000000000000000558945Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:29.950{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.44f7c3a8fd9c2aac2021-12-21 11:40:29.950root 11241100x8000000000000000558946Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:29.950{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.598052484db2d1dc2021-12-21 11:40:29.950root 11241100x8000000000000000558947Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:29.950{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c67c32e4e7c037df2021-12-21 11:40:29.950root 11241100x8000000000000000558948Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:29.950{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6765c1b88ecc35d02021-12-21 11:40:29.950root 11241100x8000000000000000558949Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:29.950{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.80c54de9d60a407e2021-12-21 11:40:29.950root 11241100x8000000000000000558950Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:29.952{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.fc028ab23668ae472021-12-21 11:40:29.952root 11241100x8000000000000000558951Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:29.952{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.033242513a9b2b9b2021-12-21 11:40:29.952root 11241100x8000000000000000558952Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:29.952{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2658964efbfd121a2021-12-21 11:40:29.952root 11241100x8000000000000000558953Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:29.952{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a1a0c468b35e98882021-12-21 11:40:29.952root 11241100x8000000000000000558954Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:29.952{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.29c27a0d62fceefa2021-12-21 11:40:29.952root 11241100x8000000000000000558955Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:29.953{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6bc01cd059c40b8a2021-12-21 11:40:29.953root 11241100x8000000000000000558956Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:29.954{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b81ae1a0f41ebc9b2021-12-21 11:40:29.954root 11241100x8000000000000000558957Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:29.954{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.fae5059fc820d87c2021-12-21 11:40:29.954root 11241100x8000000000000000558958Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:29.954{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.fff9ad2e2bb5524b2021-12-21 11:40:29.954root 11241100x8000000000000000558959Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:29.954{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8e5a349c3b0e75312021-12-21 11:40:29.954root 11241100x8000000000000000558960Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:29.957{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.472ac15f3350039c2021-12-21 11:40:29.957root 11241100x8000000000000000558961Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:29.957{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ab5f7c186be7f6332021-12-21 11:40:29.957root 11241100x8000000000000000558962Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:29.957{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.bb2eec61e7ee3e282021-12-21 11:40:29.957root 11241100x8000000000000000558963Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:29.957{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8259cae322b6e0102021-12-21 11:40:29.957root 11241100x8000000000000000558964Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:29.958{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5de520aa107bd3972021-12-21 11:40:29.958root 11241100x8000000000000000558965Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:29.958{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e8534738522035272021-12-21 11:40:29.958root 11241100x8000000000000000558966Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:29.958{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.05dbb0715c68b7cc2021-12-21 11:40:29.958root 11241100x8000000000000000558967Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:29.959{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e973906163de90d92021-12-21 11:40:29.959root 11241100x8000000000000000558968Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:29.959{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ea7aadf177514fb32021-12-21 11:40:29.959root 11241100x8000000000000000558969Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:29.960{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.31cf2d8173a79bf52021-12-21 11:40:29.960root 11241100x8000000000000000558970Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:29.960{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.34798dd612da784e2021-12-21 11:40:29.960root 11241100x8000000000000000558971Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:29.961{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0827683787d4b43e2021-12-21 11:40:29.961root 11241100x8000000000000000558972Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:29.961{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f6c7fe9c081d47052021-12-21 11:40:29.961root 11241100x8000000000000000558973Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:29.961{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a30f154d4d28f8a42021-12-21 11:40:29.961root 11241100x8000000000000000558974Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:29.961{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.316a9c1556979e182021-12-21 11:40:29.961root 11241100x8000000000000000558975Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:29.962{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e0bfe6b25aac8df92021-12-21 11:40:29.962root 11241100x8000000000000000558976Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:29.963{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6291f3705318443a2021-12-21 11:40:29.963root 11241100x8000000000000000558977Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:29.963{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f84716de2029c8db2021-12-21 11:40:29.963root 11241100x8000000000000000558978Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:29.963{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b4a0b37028a9fe9c2021-12-21 11:40:29.963root 11241100x8000000000000000558979Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:29.964{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ce2382fde8a5a1ce2021-12-21 11:40:29.964root 11241100x8000000000000000558980Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:29.964{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.176d066e350159762021-12-21 11:40:29.964root 11241100x8000000000000000558981Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:29.964{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.68af873a5b947b762021-12-21 11:40:29.964root 11241100x8000000000000000558982Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:29.964{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4fe8166927573e032021-12-21 11:40:29.964root 11241100x8000000000000000558983Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:29.964{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.55476b51078d86132021-12-21 11:40:29.964root 11241100x8000000000000000558984Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:29.964{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7f5dc8f3571c55d52021-12-21 11:40:29.964root 11241100x8000000000000000558985Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:29.964{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a4ae7a55d3315b182021-12-21 11:40:29.964root 11241100x8000000000000000558986Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:29.964{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6f7564387123ab0e2021-12-21 11:40:29.964root 11241100x8000000000000000558987Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:29.964{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.14e9889102320a3a2021-12-21 11:40:29.964root 11241100x8000000000000000558988Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:29.964{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b0a17cd98cb00b8d2021-12-21 11:40:29.964root 11241100x8000000000000000558989Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:29.965{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.347f79c206f1fa4b2021-12-21 11:40:29.965root 11241100x8000000000000000558990Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:29.965{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4b12152e6692f0c52021-12-21 11:40:29.965root 11241100x8000000000000000558991Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:29.965{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.fe9699340d482a512021-12-21 11:40:29.965root 11241100x8000000000000000558992Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:29.965{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.acebdf0a44cfed1e2021-12-21 11:40:29.965root 11241100x8000000000000000558993Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:29.965{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.838ff4b0f91cd9b12021-12-21 11:40:29.965root 11241100x8000000000000000558994Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:29.965{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7f1e8078f66e1bd62021-12-21 11:40:29.965root 11241100x8000000000000000558995Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:29.965{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ab753d582272d5b52021-12-21 11:40:29.965root 11241100x8000000000000000558996Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:29.965{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f987a841ce69c97a2021-12-21 11:40:29.965root 11241100x8000000000000000558997Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:29.965{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.dfd9d389cbac9c672021-12-21 11:40:29.965root 11241100x8000000000000000558998Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:29.965{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.cc46a109e36767be2021-12-21 11:40:29.965root 11241100x8000000000000000558999Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:30.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9eae29a27b373b052021-12-21 11:40:30.443root 11241100x8000000000000000559000Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:30.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b52342efd109d2e82021-12-21 11:40:30.443root 11241100x8000000000000000559001Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:30.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0795ab734a6673302021-12-21 11:40:30.443root 11241100x8000000000000000559002Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:30.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9fc21f9a1d7019b72021-12-21 11:40:30.444root 11241100x8000000000000000559003Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:30.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.91888b26a9555ca12021-12-21 11:40:30.444root 11241100x8000000000000000559004Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:30.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.35ee1d2ee6df363a2021-12-21 11:40:30.444root 11241100x8000000000000000559005Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:30.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2c12f2e0633685882021-12-21 11:40:30.444root 11241100x8000000000000000559006Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:30.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.cc1072880ec63b8f2021-12-21 11:40:30.444root 11241100x8000000000000000559007Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:30.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.21a3a020cec8e7602021-12-21 11:40:30.444root 11241100x8000000000000000559008Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:30.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ba4d9e7b228166672021-12-21 11:40:30.444root 11241100x8000000000000000559009Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:30.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4804f264b7744a9d2021-12-21 11:40:30.444root 11241100x8000000000000000559010Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:30.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.38da67abbab5628b2021-12-21 11:40:30.444root 11241100x8000000000000000559011Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:30.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d0b875fa7e903f932021-12-21 11:40:30.444root 11241100x8000000000000000559012Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:30.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a6dcb4d81a2bb1442021-12-21 11:40:30.444root 11241100x8000000000000000559013Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:30.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f505bb6544aed2f82021-12-21 11:40:30.444root 11241100x8000000000000000559014Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:30.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f2f0a7ef42bcf7b52021-12-21 11:40:30.445root 11241100x8000000000000000559015Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:30.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b0f22be71697998e2021-12-21 11:40:30.445root 11241100x8000000000000000559016Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:30.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0b9cab6129e09f652021-12-21 11:40:30.445root 11241100x8000000000000000559017Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:30.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6d97f1efd2282dce2021-12-21 11:40:30.445root 11241100x8000000000000000559018Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:30.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.cb745b3f790e153b2021-12-21 11:40:30.445root 11241100x8000000000000000559019Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:30.446{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.41a6c39e16014d272021-12-21 11:40:30.446root 11241100x8000000000000000559020Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:30.446{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6b99a64ca8097a282021-12-21 11:40:30.446root 11241100x8000000000000000559021Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:30.446{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.490e5c1853edcabe2021-12-21 11:40:30.446root 11241100x8000000000000000559022Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:30.446{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9b98f1608d6e7fac2021-12-21 11:40:30.446root 11241100x8000000000000000559023Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:30.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1a34ceb8c402987a2021-12-21 11:40:30.943root 11241100x8000000000000000559024Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:30.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.db2e924b4db2f8ef2021-12-21 11:40:30.943root 11241100x8000000000000000559025Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:30.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ead0e51b52741a482021-12-21 11:40:30.943root 11241100x8000000000000000559026Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:30.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b61fffbab8e1093d2021-12-21 11:40:30.944root 11241100x8000000000000000559027Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:30.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.40f425dea46a704c2021-12-21 11:40:30.944root 11241100x8000000000000000559028Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:30.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ece22be09d2db9902021-12-21 11:40:30.944root 11241100x8000000000000000559029Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:30.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d20e810cf5f687262021-12-21 11:40:30.944root 11241100x8000000000000000559030Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:30.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.968ad8500fc819bc2021-12-21 11:40:30.944root 11241100x8000000000000000559031Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:30.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.42fd24bd95afa7412021-12-21 11:40:30.945root 11241100x8000000000000000559032Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:30.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.89a445df3f3e895d2021-12-21 11:40:30.945root 11241100x8000000000000000559033Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:30.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.95f024a6bb9b81402021-12-21 11:40:30.945root 11241100x8000000000000000559034Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:30.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f24031e7cb460cdb2021-12-21 11:40:30.945root 11241100x8000000000000000559035Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:30.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.bff01c7d4f9faddc2021-12-21 11:40:30.945root 11241100x8000000000000000559036Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:30.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9a906583c9f4c73b2021-12-21 11:40:30.945root 11241100x8000000000000000559037Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:30.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.90f5c53a1d8422b62021-12-21 11:40:30.945root 11241100x8000000000000000559038Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:30.946{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0318cbbb6bf3d26d2021-12-21 11:40:30.946root 11241100x8000000000000000559039Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:30.946{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8a8ef8603a7c1beb2021-12-21 11:40:30.946root 11241100x8000000000000000559040Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:30.946{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.132162f10c29250d2021-12-21 11:40:30.946root 11241100x8000000000000000559041Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:30.946{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.93e4d7d837015d102021-12-21 11:40:30.946root 11241100x8000000000000000559042Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:30.946{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.07684461d560e3fa2021-12-21 11:40:30.946root 11241100x8000000000000000559043Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:30.946{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3367c082d399ec1a2021-12-21 11:40:30.946root 11241100x8000000000000000559044Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:30.946{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.41cde3b93f00519a2021-12-21 11:40:30.946root 11241100x8000000000000000559045Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:30.946{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5c634556aec59c7b2021-12-21 11:40:30.946root 11241100x8000000000000000559046Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:30.946{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.81fcc8ccbbb921ff2021-12-21 11:40:30.946root 11241100x8000000000000000559047Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:31.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f989aeb7440efb8f2021-12-21 11:40:31.443root 11241100x8000000000000000559048Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:31.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.490097c7568d668c2021-12-21 11:40:31.443root 11241100x8000000000000000559049Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:31.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b5e92bc90696a4f82021-12-21 11:40:31.443root 11241100x8000000000000000559050Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:31.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.44f43938d7b6445c2021-12-21 11:40:31.443root 11241100x8000000000000000559051Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:31.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2c2e633c83f37aae2021-12-21 11:40:31.444root 11241100x8000000000000000559052Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:31.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a1195404d9cd80f02021-12-21 11:40:31.444root 11241100x8000000000000000559053Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:31.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6c01b68580ba557b2021-12-21 11:40:31.444root 11241100x8000000000000000559054Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:31.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.603d2acf5b7ca4612021-12-21 11:40:31.444root 11241100x8000000000000000559055Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:31.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7afaa6053a92869e2021-12-21 11:40:31.445root 11241100x8000000000000000559056Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:31.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d7fcbff475f38e7d2021-12-21 11:40:31.445root 11241100x8000000000000000559057Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:31.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2830da583bb7a99a2021-12-21 11:40:31.445root 11241100x8000000000000000559058Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:31.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e05141ff546c5f312021-12-21 11:40:31.445root 11241100x8000000000000000559059Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:31.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.417d0b39af4f3f922021-12-21 11:40:31.445root 11241100x8000000000000000559060Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:31.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.124cb8af48b1bd4d2021-12-21 11:40:31.445root 11241100x8000000000000000559061Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:31.446{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.24036a7cabe355b82021-12-21 11:40:31.446root 11241100x8000000000000000559062Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:31.446{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ee4d8a31b9116b852021-12-21 11:40:31.446root 11241100x8000000000000000559063Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:31.446{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b6620e647121f55a2021-12-21 11:40:31.446root 11241100x8000000000000000559064Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:31.446{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a969ef9ee889ea212021-12-21 11:40:31.446root 11241100x8000000000000000559065Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:31.446{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7e0d879581d1aa932021-12-21 11:40:31.446root 11241100x8000000000000000559066Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:31.447{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f15b91f8de38d59c2021-12-21 11:40:31.447root 11241100x8000000000000000559067Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:31.447{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.facdfce49bf357942021-12-21 11:40:31.447root 11241100x8000000000000000559068Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:31.447{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.71819d3f075840a62021-12-21 11:40:31.447root 11241100x8000000000000000559069Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:31.447{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e5a370abd9df43eb2021-12-21 11:40:31.447root 11241100x8000000000000000559070Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:31.448{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c2046d59f8a584c12021-12-21 11:40:31.448root 11241100x8000000000000000559071Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:31.448{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.dab651eed099e8c22021-12-21 11:40:31.448root 11241100x8000000000000000559072Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:31.448{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2c6f750d406f4b722021-12-21 11:40:31.448root 11241100x8000000000000000559073Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:31.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.847ec6207523461f2021-12-21 11:40:31.943root 11241100x8000000000000000559074Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:31.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.23dc7a399ad022252021-12-21 11:40:31.943root 11241100x8000000000000000559075Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:31.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7aa27b910c5c56892021-12-21 11:40:31.943root 11241100x8000000000000000559076Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:31.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0c6317ea92bdd6112021-12-21 11:40:31.943root 11241100x8000000000000000559077Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:31.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.175a7fc083e72d832021-12-21 11:40:31.944root 11241100x8000000000000000559078Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:31.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.944c9fd236ea609f2021-12-21 11:40:31.944root 11241100x8000000000000000559079Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:31.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7cfcd4188b688e722021-12-21 11:40:31.944root 11241100x8000000000000000559080Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:31.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.84db012094cc2f012021-12-21 11:40:31.944root 11241100x8000000000000000559081Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:31.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9bff644be993e16a2021-12-21 11:40:31.944root 11241100x8000000000000000559082Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:31.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1ccea3d37cfe981c2021-12-21 11:40:31.944root 11241100x8000000000000000559083Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:31.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.79b6fc7cead0fe8a2021-12-21 11:40:31.944root 11241100x8000000000000000559084Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:31.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.cb8feb09669628722021-12-21 11:40:31.944root 11241100x8000000000000000559085Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:31.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ea08ea4b5c46e2862021-12-21 11:40:31.944root 11241100x8000000000000000559086Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:31.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8da3a93fcb2f15752021-12-21 11:40:31.944root 11241100x8000000000000000559087Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:31.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4840615d3a9ca82b2021-12-21 11:40:31.945root 11241100x8000000000000000559088Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:31.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.16b56d8f47bd8f4d2021-12-21 11:40:31.945root 11241100x8000000000000000559089Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:31.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.cb0d0a4089c518c42021-12-21 11:40:31.945root 11241100x8000000000000000559090Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:31.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.35b7816073b751de2021-12-21 11:40:31.945root 11241100x8000000000000000559091Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:31.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.470441465c3f2af82021-12-21 11:40:31.945root 11241100x8000000000000000559092Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:31.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.75466683c9e963e92021-12-21 11:40:31.945root 11241100x8000000000000000559093Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:31.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9baa04d070600be62021-12-21 11:40:31.945root 11241100x8000000000000000559094Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:31.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.509c3dce3b7731f12021-12-21 11:40:31.945root 11241100x8000000000000000559095Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:31.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3fa363408edd1a582021-12-21 11:40:31.945root 11241100x8000000000000000559096Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:31.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0a12dd85ad2055312021-12-21 11:40:31.945root 11241100x8000000000000000559097Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:32.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ba93b252004352b12021-12-21 11:40:32.443root 11241100x8000000000000000559098Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:32.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b02b031b9264cc102021-12-21 11:40:32.443root 11241100x8000000000000000559099Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:32.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.325c810ae227b9062021-12-21 11:40:32.443root 11241100x8000000000000000559100Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:32.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4b65ce6c7334aa872021-12-21 11:40:32.443root 11241100x8000000000000000559101Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:32.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.21abbfa1abba94e72021-12-21 11:40:32.443root 11241100x8000000000000000559102Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:32.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.59483d22ca0b74da2021-12-21 11:40:32.443root 11241100x8000000000000000559103Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:32.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.21e0e34370ae0f512021-12-21 11:40:32.443root 11241100x8000000000000000559104Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:32.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.554292034ca797772021-12-21 11:40:32.444root 11241100x8000000000000000559105Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:32.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f1eca270899d094d2021-12-21 11:40:32.444root 11241100x8000000000000000559106Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:32.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2ed0a920458d0a6c2021-12-21 11:40:32.444root 11241100x8000000000000000559107Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:32.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d148040060e0a9bf2021-12-21 11:40:32.444root 11241100x8000000000000000559108Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:32.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6d94d726fff032f42021-12-21 11:40:32.444root 11241100x8000000000000000559109Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:32.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.746c0dd8f4a139632021-12-21 11:40:32.444root 11241100x8000000000000000559110Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:32.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9dbaddd4580224602021-12-21 11:40:32.444root 11241100x8000000000000000559111Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:32.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ca32b3f1434512422021-12-21 11:40:32.444root 11241100x8000000000000000559112Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:32.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.92b076b1aecfbf992021-12-21 11:40:32.444root 11241100x8000000000000000559113Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:32.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5d220dac66c11e552021-12-21 11:40:32.444root 11241100x8000000000000000559114Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:32.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ab233bf8c955be462021-12-21 11:40:32.445root 11241100x8000000000000000559115Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:32.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2a1c62eda2a802fe2021-12-21 11:40:32.445root 11241100x8000000000000000559116Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:32.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3cf170196699ba5d2021-12-21 11:40:32.445root 11241100x8000000000000000559117Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:32.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f0ae23db6ad2167c2021-12-21 11:40:32.445root 11241100x8000000000000000559118Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:32.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b47e399e41606dea2021-12-21 11:40:32.445root 11241100x8000000000000000559119Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:32.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4f6626dddf4293782021-12-21 11:40:32.445root 11241100x8000000000000000559120Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:32.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.626a57acf1986cb92021-12-21 11:40:32.445root 11241100x8000000000000000559121Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:32.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4c1e2b13e94e24732021-12-21 11:40:32.445root 11241100x8000000000000000559122Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:32.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.fae1fd09b1d8fe0e2021-12-21 11:40:32.445root 11241100x8000000000000000559123Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:32.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a1085dac87b20bcb2021-12-21 11:40:32.445root 11241100x8000000000000000559124Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:32.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7294a4c7686b90ee2021-12-21 11:40:32.445root 11241100x8000000000000000559125Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:32.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.75063778a61166912021-12-21 11:40:32.445root 11241100x8000000000000000559126Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:32.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.758e70c71b4a1ea92021-12-21 11:40:32.445root 11241100x8000000000000000559127Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:32.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.379fdff8c24233222021-12-21 11:40:32.943root 11241100x8000000000000000559128Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:32.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.70cade23ebe665a52021-12-21 11:40:32.943root 11241100x8000000000000000559129Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:32.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.088c7896482741ca2021-12-21 11:40:32.943root 11241100x8000000000000000559130Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:32.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0e21ffb73649c6502021-12-21 11:40:32.943root 11241100x8000000000000000559131Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:32.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8ef893db673efd152021-12-21 11:40:32.943root 11241100x8000000000000000559132Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:32.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.bdda686e598dea7e2021-12-21 11:40:32.943root 11241100x8000000000000000559133Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:32.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.fb856b056e86b56e2021-12-21 11:40:32.943root 11241100x8000000000000000559134Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:32.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.291f3f3f376171db2021-12-21 11:40:32.943root 11241100x8000000000000000559135Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:32.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.60314976fe71f3372021-12-21 11:40:32.943root 11241100x8000000000000000559136Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:32.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6009b1dd70e069f22021-12-21 11:40:32.943root 11241100x8000000000000000559137Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:32.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9eb622223eff39e92021-12-21 11:40:32.943root 11241100x8000000000000000559138Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:32.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2a7b37fd83a168f62021-12-21 11:40:32.943root 11241100x8000000000000000559139Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:32.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0223613246ee15e02021-12-21 11:40:32.944root 11241100x8000000000000000559140Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:32.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.cd5a025f7972d21a2021-12-21 11:40:32.944root 11241100x8000000000000000559141Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:32.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5e25f7d45ed6063b2021-12-21 11:40:32.944root 11241100x8000000000000000559142Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:32.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f438c835b3bc387d2021-12-21 11:40:32.944root 11241100x8000000000000000559143Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:32.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0a28dc0e52d4533e2021-12-21 11:40:32.944root 11241100x8000000000000000559144Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:32.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b558e064ee3343c22021-12-21 11:40:32.944root 11241100x8000000000000000559145Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:32.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a96e2c4260e53a182021-12-21 11:40:32.944root 11241100x8000000000000000559146Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:32.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.81391877b41e8be52021-12-21 11:40:32.944root 11241100x8000000000000000559147Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:32.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.bd939f06c33734a82021-12-21 11:40:32.944root 11241100x8000000000000000559148Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:32.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0d490031dcbb0ba82021-12-21 11:40:32.944root 11241100x8000000000000000559149Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:32.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0add4c673b4cd40f2021-12-21 11:40:32.944root 11241100x8000000000000000559150Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:32.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5815b924fca9185e2021-12-21 11:40:32.945root 11241100x8000000000000000559151Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:32.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7a7ef9e61937bff02021-12-21 11:40:32.945root 11241100x8000000000000000559152Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:32.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3ff2ae6c2c60ade12021-12-21 11:40:32.945root 11241100x8000000000000000559153Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:32.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8f3034c86feb2b822021-12-21 11:40:32.945root 11241100x8000000000000000559154Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:32.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3b84b4761090b3622021-12-21 11:40:32.945root 11241100x8000000000000000559155Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:32.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.859a9105dccf926d2021-12-21 11:40:32.945root 11241100x8000000000000000559156Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:32.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4a31a9a3007d01292021-12-21 11:40:32.945root 11241100x8000000000000000559157Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:32.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.104337cf4f4dff5d2021-12-21 11:40:32.945root 11241100x8000000000000000559158Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:32.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c8f599111069a1b82021-12-21 11:40:32.945root 11241100x8000000000000000559159Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:32.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.92cf391affddd85d2021-12-21 11:40:32.945root 11241100x8000000000000000559160Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:32.946{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.017ca6d484a8da702021-12-21 11:40:32.946root 11241100x8000000000000000559161Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:32.946{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.bb52d79be2fa46012021-12-21 11:40:32.946root 11241100x8000000000000000559162Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:32.946{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a28556716cfa5adb2021-12-21 11:40:32.946root 11241100x8000000000000000559163Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:32.946{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f31f19b16b0e237b2021-12-21 11:40:32.946root 11241100x8000000000000000559164Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:32.946{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.16cbd8c95c962d082021-12-21 11:40:32.946root 11241100x8000000000000000559165Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:32.946{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d7654bd9f15eef3d2021-12-21 11:40:32.946root 11241100x8000000000000000559166Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:32.946{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c333b9aac03fad832021-12-21 11:40:32.946root 11241100x8000000000000000559167Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:32.946{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.df23dd63663801bc2021-12-21 11:40:32.946root 11241100x8000000000000000559168Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:32.946{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d215ed5e629185252021-12-21 11:40:32.946root 11241100x8000000000000000559169Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:32.947{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b3f60d7aba36337f2021-12-21 11:40:32.947root 11241100x8000000000000000559170Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:32.947{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a755fdb7f84eeeeb2021-12-21 11:40:32.947root 11241100x8000000000000000559171Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:32.947{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d10a8b46254c42af2021-12-21 11:40:32.947root 11241100x8000000000000000559172Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:32.947{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d029b6930f28c2dc2021-12-21 11:40:32.947root 11241100x8000000000000000559173Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:32.947{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8495c03d5f7737c02021-12-21 11:40:32.947root 11241100x8000000000000000559174Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:32.947{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9e956830cc29b02e2021-12-21 11:40:32.947root 11241100x8000000000000000559175Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:32.947{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6e355e335d919f942021-12-21 11:40:32.947root 11241100x8000000000000000559176Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:32.947{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9737e066fc6daf562021-12-21 11:40:32.947root 11241100x8000000000000000559177Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:32.948{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0fd532b980ca6a462021-12-21 11:40:32.948root 11241100x8000000000000000559178Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:32.948{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1c4e36271247b3f12021-12-21 11:40:32.948root 11241100x8000000000000000559179Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:32.948{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.77a9a23e8a1c2b072021-12-21 11:40:32.948root 11241100x8000000000000000559180Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:32.948{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e532d4dcf42f3b4f2021-12-21 11:40:32.948root 11241100x8000000000000000559181Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:32.948{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.fa610634630d23aa2021-12-21 11:40:32.948root 11241100x8000000000000000559182Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:32.948{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.34940b37156bddf62021-12-21 11:40:32.948root 11241100x8000000000000000559183Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:32.948{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.460c73b0824b86a32021-12-21 11:40:32.948root 11241100x8000000000000000559184Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:32.948{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.01c0e5c12c846acd2021-12-21 11:40:32.948root 11241100x8000000000000000559185Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:32.948{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.98269d89bbb5e9092021-12-21 11:40:32.948root 11241100x8000000000000000559186Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:32.948{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c86617182905c2d02021-12-21 11:40:32.948root 11241100x8000000000000000559187Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:32.948{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c98a7afc62542a972021-12-21 11:40:32.948root 11241100x8000000000000000559188Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:32.949{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.fcd4fb08bc7b0a7b2021-12-21 11:40:32.949root 11241100x8000000000000000559189Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:32.949{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6c414ea57aa7df4a2021-12-21 11:40:32.949root 11241100x8000000000000000559190Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:32.949{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.dd89736e1f611c2b2021-12-21 11:40:32.949root 11241100x8000000000000000559191Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:32.949{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8ab11a6e0ef92e7b2021-12-21 11:40:32.949root 11241100x8000000000000000559192Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:32.949{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.bbec8d8c36981a542021-12-21 11:40:32.949root 11241100x8000000000000000559193Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:32.949{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e09782c8ac6b62422021-12-21 11:40:32.949root 11241100x8000000000000000559194Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:32.949{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.54c88bfed24d2b8c2021-12-21 11:40:32.949root 11241100x8000000000000000559195Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:33.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.21bea80b41df643d2021-12-21 11:40:33.443root 11241100x8000000000000000559196Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:33.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a2d2d47853a12c952021-12-21 11:40:33.443root 11241100x8000000000000000559197Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:33.443{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.37bff90f0973c2452021-12-21 11:40:33.443root 11241100x8000000000000000559198Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:33.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f5e0a96003b41c7c2021-12-21 11:40:33.444root 11241100x8000000000000000559199Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:33.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ec41d8f14c2469f42021-12-21 11:40:33.444root 11241100x8000000000000000559200Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:33.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b8f8f99e27eea5c72021-12-21 11:40:33.444root 11241100x8000000000000000559201Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:33.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4c0c20e510062ca52021-12-21 11:40:33.444root 11241100x8000000000000000559202Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:33.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3d4bc7d1dadb39272021-12-21 11:40:33.444root 11241100x8000000000000000559203Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:33.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.99b12c46d041c75d2021-12-21 11:40:33.444root 11241100x8000000000000000559204Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:33.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ae3cbbf75ed17fce2021-12-21 11:40:33.444root 11241100x8000000000000000559205Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:33.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ada4b92fc15866c92021-12-21 11:40:33.444root 11241100x8000000000000000559206Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:33.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.41d3a20bde43f9e12021-12-21 11:40:33.444root 11241100x8000000000000000559207Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:33.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e80fce4235b5da3a2021-12-21 11:40:33.444root 11241100x8000000000000000559208Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:33.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0ab87f111052477a2021-12-21 11:40:33.444root 11241100x8000000000000000559209Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:33.444{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5d67e41c95afb0522021-12-21 11:40:33.444root 11241100x8000000000000000559210Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:33.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f9003c0f626f9ca22021-12-21 11:40:33.445root 11241100x8000000000000000559211Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:33.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.fbd0e3e033326c6a2021-12-21 11:40:33.445root 11241100x8000000000000000559212Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:33.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f8421d27cb3966ef2021-12-21 11:40:33.445root 11241100x8000000000000000559213Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:33.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2bd103d968553d4a2021-12-21 11:40:33.445root 11241100x8000000000000000559214Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:33.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b551adb019f000802021-12-21 11:40:33.445root 11241100x8000000000000000559215Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:33.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b0459102abc2a1462021-12-21 11:40:33.445root 11241100x8000000000000000559216Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:33.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f397d4a74cabb76c2021-12-21 11:40:33.445root 11241100x8000000000000000559217Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:33.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7fb4e2e05d7c73422021-12-21 11:40:33.445root 11241100x8000000000000000559218Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:33.445{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5b57fba6bf0742bc2021-12-21 11:40:33.445root 11241100x8000000000000000559219Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:33.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ea63af0ba78b9b452021-12-21 11:40:33.943root 11241100x8000000000000000559220Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:33.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ece1363afe4140252021-12-21 11:40:33.943root 11241100x8000000000000000559221Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:33.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ad3d05c4a56a52e02021-12-21 11:40:33.943root 11241100x8000000000000000559222Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:33.943{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.49cc6420c635e38e2021-12-21 11:40:33.943root 11241100x8000000000000000559223Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:33.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0b31acf7f1a13c3b2021-12-21 11:40:33.944root 11241100x8000000000000000559224Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:33.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5c6f3a3349dcd9132021-12-21 11:40:33.944root 11241100x8000000000000000559225Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:33.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4ea03364ba6fca4a2021-12-21 11:40:33.944root 11241100x8000000000000000559226Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:33.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a879e9151b3ab9ee2021-12-21 11:40:33.944root 11241100x8000000000000000559227Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:33.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6341f781da0cd4772021-12-21 11:40:33.944root 11241100x8000000000000000559228Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:33.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.43eee7afcf1218772021-12-21 11:40:33.944root 11241100x8000000000000000559229Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:33.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.83a38040012ef5a62021-12-21 11:40:33.944root 11241100x8000000000000000559230Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:33.944{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a29105d08556a6d72021-12-21 11:40:33.944root 11241100x8000000000000000559231Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:33.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2a4deb2a051678252021-12-21 11:40:33.945root 11241100x8000000000000000559232Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:33.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.798a0841451a03142021-12-21 11:40:33.945root 11241100x8000000000000000559233Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:33.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4da8acc55af25f472021-12-21 11:40:33.945root 11241100x8000000000000000559234Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:33.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f66b7f998e8d64aa2021-12-21 11:40:33.945root 11241100x8000000000000000559235Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:33.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.24513816996d06d82021-12-21 11:40:33.945root 11241100x8000000000000000559236Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:33.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.257148efb7646d602021-12-21 11:40:33.945root 11241100x8000000000000000559237Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:33.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1c588935a6a0287c2021-12-21 11:40:33.945root 11241100x8000000000000000559238Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:33.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9d828872f19c14bd2021-12-21 11:40:33.945root 11241100x8000000000000000559239Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:33.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.81dea1de2ea11b7e2021-12-21 11:40:33.945root 11241100x8000000000000000559240Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:33.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0529d021aa9121852021-12-21 11:40:33.945root 11241100x8000000000000000559241Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:33.945{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5db3de160b141ee02021-12-21 11:40:33.945root 11241100x8000000000000000559242Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:33.946{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d62b3d83ad328bcb2021-12-21 11:40:33.946root 354300x8000000000000000559243Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:34.215{ec2b6afe-95d9-61c1-5175-3a0400000000}5346/opt/splunkforwarder/etc/apps/Splunk_TA_stream/linux_x86_64/bin/streamfwdroottcptruefalse10.0.1.25-48888-false10.0.1.12-8000- 11241100x8000000000000000559244Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:34.215{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b32e8c8f2d3557f92021-12-21 11:40:34.215root 11241100x8000000000000000559245Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:34.215{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3e85579f4bc467d42021-12-21 11:40:34.215root 11241100x8000000000000000559246Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:34.215{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.dd496baa4103209e2021-12-21 11:40:34.215root 11241100x8000000000000000559247Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:34.216{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.50c37c6f36fa40172021-12-21 11:40:34.216root 11241100x8000000000000000559248Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:34.216{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e2657af1efce78242021-12-21 11:40:34.216root 11241100x8000000000000000559249Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:34.216{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a485416c30d9962d2021-12-21 11:40:34.216root 11241100x8000000000000000559250Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:34.216{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a5acc68a8addf2632021-12-21 11:40:34.216root 11241100x8000000000000000559251Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:34.216{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6127828b61469e772021-12-21 11:40:34.216root 11241100x8000000000000000559252Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:34.216{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b4674478653570282021-12-21 11:40:34.216root 11241100x8000000000000000559253Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:34.216{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3f380f3f3b3effe02021-12-21 11:40:34.216root 11241100x8000000000000000559254Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:34.217{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7f72996e758ac3542021-12-21 11:40:34.217root 11241100x8000000000000000559255Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:34.217{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.610219e6ecff9d2c2021-12-21 11:40:34.217root 11241100x8000000000000000559256Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:34.217{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8f2f22718e17a83c2021-12-21 11:40:34.217root 11241100x8000000000000000559257Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:34.217{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5a1002f4334935382021-12-21 11:40:34.217root 11241100x8000000000000000559258Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:34.217{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4357be36bdbd726e2021-12-21 11:40:34.217root 11241100x8000000000000000559259Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:34.217{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.22a9da7af82ad2452021-12-21 11:40:34.217root 11241100x8000000000000000559260Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:34.217{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3d1f31645684b0072021-12-21 11:40:34.217root 11241100x8000000000000000559261Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:34.217{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1c4ef362e3d968b12021-12-21 11:40:34.217root 11241100x8000000000000000559262Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:34.217{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3c694626c01d75c42021-12-21 11:40:34.217root 11241100x8000000000000000559263Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:34.217{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.bdf2658912828d162021-12-21 11:40:34.217root 11241100x8000000000000000559264Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:34.217{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8b02c5a751eed0142021-12-21 11:40:34.217root 11241100x8000000000000000559265Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:34.217{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.261a0a564fe774a12021-12-21 11:40:34.217root 11241100x8000000000000000559266Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:34.217{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.dfd54e4c13e02be12021-12-21 11:40:34.217root 11241100x8000000000000000559267Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:34.218{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ddb0d2ca326e05bd2021-12-21 11:40:34.218root 11241100x8000000000000000559268Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:34.218{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.39e9b13430ecae7c2021-12-21 11:40:34.218root 11241100x8000000000000000559269Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:34.218{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.451d35b6b89caac82021-12-21 11:40:34.218root 11241100x8000000000000000559270Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:34.218{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ca748a4550f8ab9c2021-12-21 11:40:34.218root 11241100x8000000000000000559271Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:34.218{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4876dd4d2656066c2021-12-21 11:40:34.218root 11241100x8000000000000000559272Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:34.218{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ccfefd4151e03dce2021-12-21 11:40:34.218root 11241100x8000000000000000559273Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:34.218{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.32944025fa3fc4542021-12-21 11:40:34.218root 11241100x8000000000000000559274Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:34.218{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c9397461be5ea5132021-12-21 11:40:34.218root 11241100x8000000000000000559275Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:34.218{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.30aa75ac9fca2e9a2021-12-21 11:40:34.218root 11241100x8000000000000000559276Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:34.218{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d4ca5edb2ea64c1a2021-12-21 11:40:34.218root 11241100x8000000000000000559277Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:34.218{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f2436f09b43f2f262021-12-21 11:40:34.218root 11241100x8000000000000000559278Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:34.218{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d2447247d9cbb3c32021-12-21 11:40:34.218root 11241100x8000000000000000559279Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:34.218{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.611a413abeff11c52021-12-21 11:40:34.218root 11241100x8000000000000000559280Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:34.218{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b3406420570f9aaa2021-12-21 11:40:34.218root 11241100x8000000000000000559281Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:34.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.097dbab91d9451db2021-12-21 11:40:34.693root 11241100x8000000000000000559282Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:34.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8764c174bf5b8fdb2021-12-21 11:40:34.693root 11241100x8000000000000000559283Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:34.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.15c7497a8e51c8e62021-12-21 11:40:34.694root 11241100x8000000000000000559284Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:34.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.62ffd0b4ef51631d2021-12-21 11:40:34.694root 11241100x8000000000000000559285Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:34.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.393165a258b15b792021-12-21 11:40:34.694root 11241100x8000000000000000559286Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:34.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e278cb534db032382021-12-21 11:40:34.694root 11241100x8000000000000000559287Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:34.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.579024d16c8258aa2021-12-21 11:40:34.694root 11241100x8000000000000000559288Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:34.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b1e66c1fc8e4fc552021-12-21 11:40:34.694root 11241100x8000000000000000559289Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:34.695{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.db90cc320eeff73a2021-12-21 11:40:34.695root 11241100x8000000000000000559290Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:34.695{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.00acee76715b11cf2021-12-21 11:40:34.695root 11241100x8000000000000000559291Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:34.695{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.20a6bdc6101967b02021-12-21 11:40:34.695root 11241100x8000000000000000559292Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:34.695{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6e9d614964a148d92021-12-21 11:40:34.695root 11241100x8000000000000000559293Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:34.696{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.492ce99687ac6a702021-12-21 11:40:34.696root 11241100x8000000000000000559294Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:34.696{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6b8e031aed16d02b2021-12-21 11:40:34.696root 11241100x8000000000000000559295Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:34.696{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.94fe146bd673278f2021-12-21 11:40:34.696root 11241100x8000000000000000559296Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:34.697{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9309843ede79f8872021-12-21 11:40:34.697root 11241100x8000000000000000559297Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:34.697{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.862a99b13223dcfa2021-12-21 11:40:34.697root 11241100x8000000000000000559298Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:34.697{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c55ff66d959a14212021-12-21 11:40:34.697root 11241100x8000000000000000559299Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:34.697{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2c675922eaf3a5e02021-12-21 11:40:34.697root 11241100x8000000000000000559300Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:34.697{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.020bd903b8abf7a22021-12-21 11:40:34.697root 11241100x8000000000000000559301Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:34.698{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5ecaefd88a12a1422021-12-21 11:40:34.698root 11241100x8000000000000000559302Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:34.698{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7901a453a97332a52021-12-21 11:40:34.698root 11241100x8000000000000000559303Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:34.698{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.041d1a020182434f2021-12-21 11:40:34.698root 11241100x8000000000000000559304Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:34.698{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.86a6f26ee01561542021-12-21 11:40:34.698root 11241100x8000000000000000559305Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:34.698{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b05788f7c1e040602021-12-21 11:40:34.698root 11241100x8000000000000000559306Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:35.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c550fd571a7c83302021-12-21 11:40:35.193root 11241100x8000000000000000559307Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:35.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.db45ab866b71b7082021-12-21 11:40:35.193root 11241100x8000000000000000559308Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:35.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.afc6a56585ba6a982021-12-21 11:40:35.193root 11241100x8000000000000000559309Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:35.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.aa8b38663c03e7ab2021-12-21 11:40:35.193root 11241100x8000000000000000559310Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:35.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3aa22c50ce6650992021-12-21 11:40:35.193root 11241100x8000000000000000559311Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:35.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.29e787f7242dc0fd2021-12-21 11:40:35.193root 11241100x8000000000000000559312Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:35.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ddef7f5c2b804e6d2021-12-21 11:40:35.193root 11241100x8000000000000000559313Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:35.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.900251777f7ac0562021-12-21 11:40:35.193root 11241100x8000000000000000559314Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:35.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5432f02947ea80a72021-12-21 11:40:35.194root 11241100x8000000000000000559315Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:35.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d1def87d4d24d3f52021-12-21 11:40:35.194root 11241100x8000000000000000559316Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:35.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.37a3aa1258fdf3dd2021-12-21 11:40:35.194root 11241100x8000000000000000559317Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:35.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.373c0907de2e30332021-12-21 11:40:35.194root 11241100x8000000000000000559318Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:35.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.59a39daade4805a72021-12-21 11:40:35.194root 11241100x8000000000000000559319Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:35.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.97f323cb19ed6cb32021-12-21 11:40:35.194root 11241100x8000000000000000559320Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:35.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.dbff42909727c3252021-12-21 11:40:35.194root 11241100x8000000000000000559321Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:35.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.fa58dc01294f4d4a2021-12-21 11:40:35.194root 11241100x8000000000000000559322Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:35.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f94afbae469f94672021-12-21 11:40:35.194root 11241100x8000000000000000559323Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:35.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1829146890bce31c2021-12-21 11:40:35.194root 11241100x8000000000000000559324Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:35.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c3f4c47b8b354fe42021-12-21 11:40:35.194root 11241100x8000000000000000559325Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:35.195{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b00d365054bb0b692021-12-21 11:40:35.195root 11241100x8000000000000000559326Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:35.195{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f8634aaa3a1299f92021-12-21 11:40:35.195root 11241100x8000000000000000559327Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:35.195{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2a264b66b8f417192021-12-21 11:40:35.195root 11241100x8000000000000000559328Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:35.195{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b3deb31f04328ea82021-12-21 11:40:35.195root 11241100x8000000000000000559329Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:35.195{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.aad2ef6ec88e91e22021-12-21 11:40:35.195root 11241100x8000000000000000559330Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:35.195{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.91a336cb812bfd292021-12-21 11:40:35.195root 11241100x8000000000000000559331Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:35.195{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8750fe60e9cadc542021-12-21 11:40:35.195root 11241100x8000000000000000559332Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:35.195{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b3871a634cebb2062021-12-21 11:40:35.195root 11241100x8000000000000000559333Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:35.196{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.597665424476a2e12021-12-21 11:40:35.196root 11241100x8000000000000000559334Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:35.196{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6b9f1980058306522021-12-21 11:40:35.196root 11241100x8000000000000000559335Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:35.196{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c4463b1566b216962021-12-21 11:40:35.196root 11241100x8000000000000000559336Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:35.196{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7d6a924e3170c6782021-12-21 11:40:35.196root 11241100x8000000000000000559337Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:35.197{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.cf18db20a85ca7052021-12-21 11:40:35.197root 11241100x8000000000000000559338Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:35.197{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3e9646dbe699654e2021-12-21 11:40:35.197root 11241100x8000000000000000559339Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:35.198{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f48a329970bccfe92021-12-21 11:40:35.198root 11241100x8000000000000000559340Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:35.198{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.66fe594daff922592021-12-21 11:40:35.198root 11241100x8000000000000000559341Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:35.199{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d82af339cbe83da12021-12-21 11:40:35.199root 11241100x8000000000000000559342Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:35.199{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f22e2de91f4fb8832021-12-21 11:40:35.199root 11241100x8000000000000000559343Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:35.200{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.16a462fc884ca2632021-12-21 11:40:35.200root 11241100x8000000000000000559344Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:35.200{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.18a29e8e496be3fe2021-12-21 11:40:35.200root 11241100x8000000000000000559345Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:35.201{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.155862a200935a392021-12-21 11:40:35.201root 11241100x8000000000000000559346Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:35.201{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2cdea514e7063fe02021-12-21 11:40:35.201root 11241100x8000000000000000559347Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:35.201{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7a331bce3aeb10a02021-12-21 11:40:35.201root 11241100x8000000000000000559348Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:35.202{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5e0ee902557a2a102021-12-21 11:40:35.202root 11241100x8000000000000000559349Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:35.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ea98034c58f604cc2021-12-21 11:40:35.693root 11241100x8000000000000000559350Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:35.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.dcb4322a512b743a2021-12-21 11:40:35.693root 11241100x8000000000000000559351Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:35.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3fa71cda2ab437df2021-12-21 11:40:35.693root 11241100x8000000000000000559352Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:35.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2404c6edbeff66b82021-12-21 11:40:35.693root 11241100x8000000000000000559353Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:35.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b2b7950db589e68f2021-12-21 11:40:35.693root 11241100x8000000000000000559354Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:35.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c40fde116d07136d2021-12-21 11:40:35.693root 11241100x8000000000000000559355Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:35.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5d001cf52a4260032021-12-21 11:40:35.693root 11241100x8000000000000000559356Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:35.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.692ae487bda38c9d2021-12-21 11:40:35.694root 11241100x8000000000000000559357Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:35.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.11ce4bb1f0ae37fa2021-12-21 11:40:35.694root 11241100x8000000000000000559358Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:35.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.70ac0b81a6dd812c2021-12-21 11:40:35.694root 11241100x8000000000000000559359Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:35.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a0810a7ce9ef127e2021-12-21 11:40:35.694root 11241100x8000000000000000559360Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:35.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.186284a48b04ddfe2021-12-21 11:40:35.694root 11241100x8000000000000000559361Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:35.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.03f71f3dbdc29d452021-12-21 11:40:35.694root 11241100x8000000000000000559362Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:35.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f0b7068d0b7dc9ec2021-12-21 11:40:35.694root 11241100x8000000000000000559363Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:35.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2682c8e868a2bf782021-12-21 11:40:35.694root 11241100x8000000000000000559364Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:35.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0b17ef0b4049c8c92021-12-21 11:40:35.694root 11241100x8000000000000000559365Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:35.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3cb87a73e533019e2021-12-21 11:40:35.694root 11241100x8000000000000000559366Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:35.695{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.51b162fc764be0472021-12-21 11:40:35.695root 11241100x8000000000000000559367Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:35.695{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ff70af21e7dc651c2021-12-21 11:40:35.695root 11241100x8000000000000000559368Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:35.695{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d86232ed7c5187a12021-12-21 11:40:35.695root 11241100x8000000000000000559369Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:35.695{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f37badc7a83ca3db2021-12-21 11:40:35.695root 11241100x8000000000000000559370Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:35.695{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0df1121487905e682021-12-21 11:40:35.695root 11241100x8000000000000000559371Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:35.695{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1c3790ad369f81cc2021-12-21 11:40:35.695root 11241100x8000000000000000559372Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:35.696{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.209e54169aeb09c12021-12-21 11:40:35.696root 11241100x8000000000000000559373Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:35.696{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d0ab0bea413f0adb2021-12-21 11:40:35.696root 11241100x8000000000000000559374Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:35.696{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.189d1803e6e920f32021-12-21 11:40:35.696root 11241100x8000000000000000559375Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:35.696{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.814be8f9a7d9e6a22021-12-21 11:40:35.696root 11241100x8000000000000000559376Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:35.697{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3589e8b7397803ba2021-12-21 11:40:35.697root 11241100x8000000000000000559377Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:35.697{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1d9c822352f620152021-12-21 11:40:35.697root 11241100x8000000000000000559378Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:35.697{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.038262a7a24626e52021-12-21 11:40:35.697root 11241100x8000000000000000559379Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:35.697{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5080518a1d28c3842021-12-21 11:40:35.697root 11241100x8000000000000000559380Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:35.697{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.61c51213cd948d1b2021-12-21 11:40:35.697root 11241100x8000000000000000559381Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:35.698{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b973b9f1089f28bd2021-12-21 11:40:35.698root 11241100x8000000000000000559382Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:35.698{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.80bb3be85f6630bb2021-12-21 11:40:35.698root 11241100x8000000000000000559383Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:35.698{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.178315918e7d26a22021-12-21 11:40:35.698root 11241100x8000000000000000559384Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:35.699{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2c728c06b3468d5b2021-12-21 11:40:35.699root 11241100x8000000000000000559385Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:36.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.35b4b2d6f8890a792021-12-21 11:40:36.193root 11241100x8000000000000000559386Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:36.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.13aaeda183724b502021-12-21 11:40:36.193root 11241100x8000000000000000559387Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:36.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a3a2b7143aa0be782021-12-21 11:40:36.193root 11241100x8000000000000000559388Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:36.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f544e024b73f12ef2021-12-21 11:40:36.193root 11241100x8000000000000000559389Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:36.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.bea134a7fc7d29eb2021-12-21 11:40:36.194root 11241100x8000000000000000559390Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:36.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ca64328b542951f92021-12-21 11:40:36.194root 11241100x8000000000000000559391Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:36.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.dec332f43f0e3cea2021-12-21 11:40:36.194root 11241100x8000000000000000559392Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:36.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d74b32b508f468162021-12-21 11:40:36.194root 11241100x8000000000000000559393Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:36.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f028501fd6c826b22021-12-21 11:40:36.194root 11241100x8000000000000000559394Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:36.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.851b8f2f7eedb2522021-12-21 11:40:36.194root 11241100x8000000000000000559395Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:36.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3f5a32ca5e4967ba2021-12-21 11:40:36.194root 11241100x8000000000000000559396Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:36.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7e46a0e16dd904f42021-12-21 11:40:36.194root 11241100x8000000000000000559397Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:36.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9abb5f48e25a3a3c2021-12-21 11:40:36.194root 11241100x8000000000000000559398Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:36.195{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.967b1e88a3ddd5072021-12-21 11:40:36.195root 11241100x8000000000000000559399Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:36.195{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.79ff69cb600efc212021-12-21 11:40:36.195root 11241100x8000000000000000559400Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:36.195{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.42c2e6e391fc304c2021-12-21 11:40:36.195root 11241100x8000000000000000559401Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:36.195{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b7beeb17708f48a72021-12-21 11:40:36.195root 11241100x8000000000000000559402Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:36.195{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.34d7cbb30f7ac0142021-12-21 11:40:36.195root 11241100x8000000000000000559403Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:36.195{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8da9d4242da2c6aa2021-12-21 11:40:36.195root 11241100x8000000000000000559404Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:36.195{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e9e01cfca98d9deb2021-12-21 11:40:36.195root 11241100x8000000000000000559405Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:36.195{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.326aea1c045632cc2021-12-21 11:40:36.195root 11241100x8000000000000000559406Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:36.195{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c4c254768aaf88782021-12-21 11:40:36.195root 11241100x8000000000000000559407Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:36.195{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.08c1521a9f7cbd562021-12-21 11:40:36.195root 11241100x8000000000000000559408Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:36.196{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a8fd5387f460c78a2021-12-21 11:40:36.196root 11241100x8000000000000000559409Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:36.196{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2204b2985b5d66402021-12-21 11:40:36.196root 11241100x8000000000000000559410Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:36.325{ec2b6afe-95d2-61c1-3038-b84203560000}5272/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/spool/splunk/tracker.log2021-12-21 11:40:36.325root 11241100x8000000000000000559411Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:36.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d86e92340c74425d2021-12-21 11:40:36.693root 11241100x8000000000000000559412Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:36.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3b08f65e26e85cbb2021-12-21 11:40:36.693root 11241100x8000000000000000559413Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:36.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7f3e67b514d7ef0a2021-12-21 11:40:36.693root 11241100x8000000000000000559414Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:36.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5abd0302719a46bb2021-12-21 11:40:36.693root 11241100x8000000000000000559415Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:36.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4439d3199dd438ea2021-12-21 11:40:36.693root 11241100x8000000000000000559416Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:36.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.220d541e0f44be562021-12-21 11:40:36.693root 11241100x8000000000000000559417Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:36.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.18b23fd770aefc502021-12-21 11:40:36.693root 11241100x8000000000000000559418Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:36.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.cbf122d2edf6b6d22021-12-21 11:40:36.693root 11241100x8000000000000000559419Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:36.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2585ec622b63b55b2021-12-21 11:40:36.694root 11241100x8000000000000000559420Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:36.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.aa30de846a1b992e2021-12-21 11:40:36.694root 11241100x8000000000000000559421Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:36.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0787e6fbbb5e7b6b2021-12-21 11:40:36.694root 11241100x8000000000000000559422Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:36.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a0f2f008b2e6fb0a2021-12-21 11:40:36.694root 11241100x8000000000000000559423Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:36.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.efb76136fc80886a2021-12-21 11:40:36.694root 11241100x8000000000000000559424Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:36.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7b29b7494e8b30372021-12-21 11:40:36.694root 11241100x8000000000000000559425Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:36.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.535e1c052a72e2ad2021-12-21 11:40:36.694root 11241100x8000000000000000559426Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:36.695{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e0c43f8a75eda6c82021-12-21 11:40:36.695root 11241100x8000000000000000559427Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:36.695{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c71d5c2c473c45192021-12-21 11:40:36.695root 11241100x8000000000000000559428Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:36.695{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1503256b12d3b3902021-12-21 11:40:36.695root 11241100x8000000000000000559429Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:36.695{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.43554b74cbd7b3732021-12-21 11:40:36.695root 11241100x8000000000000000559430Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:36.695{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9afe2ed9cd6f48fb2021-12-21 11:40:36.695root 11241100x8000000000000000559431Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:36.695{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8d0184e97b5ea5e42021-12-21 11:40:36.695root 11241100x8000000000000000559432Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:36.695{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e40b4729a0f017ed2021-12-21 11:40:36.695root 11241100x8000000000000000559433Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:36.695{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d514fd291ab0723c2021-12-21 11:40:36.695root 11241100x8000000000000000559434Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:36.695{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2b3ef6ecd0bef3442021-12-21 11:40:36.695root 11241100x8000000000000000559435Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:36.695{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.73ed5eff0c3671ec2021-12-21 11:40:36.695root 11241100x8000000000000000559436Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:36.696{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.55228f51f04af3002021-12-21 11:40:36.696root 11241100x8000000000000000559437Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:37.192{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.bcf4baecc5d259ac2021-12-21 11:40:37.192root 11241100x8000000000000000559438Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:37.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a75c31cfe5c6d9902021-12-21 11:40:37.193root 11241100x8000000000000000559439Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:37.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.747b45a8ea503e5d2021-12-21 11:40:37.193root 11241100x8000000000000000559440Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:37.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.48cdf66fcdef49b02021-12-21 11:40:37.193root 11241100x8000000000000000559441Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:37.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.92f14f4a0350432f2021-12-21 11:40:37.193root 11241100x8000000000000000559442Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:37.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.bc81a8a06e1945f02021-12-21 11:40:37.193root 11241100x8000000000000000559443Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:37.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b110a74a6a7217942021-12-21 11:40:37.193root 11241100x8000000000000000559444Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:37.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.655e9a04c00e18cb2021-12-21 11:40:37.193root 11241100x8000000000000000559445Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:37.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9d9a9ff892365bb92021-12-21 11:40:37.193root 11241100x8000000000000000559446Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:37.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.31e2c5739a3f605b2021-12-21 11:40:37.193root 11241100x8000000000000000559447Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:37.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.67a584abe0f4e3ba2021-12-21 11:40:37.193root 11241100x8000000000000000559448Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:37.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3b393b30c91055242021-12-21 11:40:37.193root 11241100x8000000000000000559449Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:37.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ce0f0d20bfcee5be2021-12-21 11:40:37.193root 11241100x8000000000000000559450Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:37.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1eb376dc5556854c2021-12-21 11:40:37.193root 11241100x8000000000000000559451Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:37.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.34edf68253341a0a2021-12-21 11:40:37.194root 11241100x8000000000000000559452Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:37.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0439b282aebaa3252021-12-21 11:40:37.194root 11241100x8000000000000000559453Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:37.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a40ea62c8322041a2021-12-21 11:40:37.194root 11241100x8000000000000000559454Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:37.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.076acfed5f1607092021-12-21 11:40:37.194root 11241100x8000000000000000559455Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:37.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.56a1126a575926cc2021-12-21 11:40:37.194root 11241100x8000000000000000559456Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:37.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.52cf427c89190d5e2021-12-21 11:40:37.194root 11241100x8000000000000000559457Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:37.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e81a932dca8ea89d2021-12-21 11:40:37.194root 11241100x8000000000000000559458Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:37.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.263d1cea27e2ebe22021-12-21 11:40:37.194root 11241100x8000000000000000559459Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:37.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d3043844427f2cdd2021-12-21 11:40:37.194root 11241100x8000000000000000559460Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:37.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d3c5a4ca240daf032021-12-21 11:40:37.194root 11241100x8000000000000000559461Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:37.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9f3dd78e40c2aee62021-12-21 11:40:37.194root 11241100x8000000000000000559462Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:37.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0146a1d3028ac4432021-12-21 11:40:37.194root 11241100x8000000000000000559463Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:37.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.24dfdb862f7366af2021-12-21 11:40:37.194root 11241100x8000000000000000559464Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:37.195{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7aeb392f77493f702021-12-21 11:40:37.195root 11241100x8000000000000000559465Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:37.195{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.428369ea475c4e052021-12-21 11:40:37.195root 11241100x8000000000000000559466Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:37.195{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ad171378a8fb9cb52021-12-21 11:40:37.195root 11241100x8000000000000000559467Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:37.195{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.faafe8e4cee69e1d2021-12-21 11:40:37.195root 11241100x8000000000000000559468Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:37.195{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9cd61554644988922021-12-21 11:40:37.195root 11241100x8000000000000000559469Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:37.195{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.96cec93c060f850c2021-12-21 11:40:37.195root 11241100x8000000000000000559470Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:37.195{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ce86224aae70d4d22021-12-21 11:40:37.195root 11241100x8000000000000000559471Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:37.195{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a30e71d00a6ebd2f2021-12-21 11:40:37.195root 11241100x8000000000000000559472Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:37.195{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e83f772ee5ba2f502021-12-21 11:40:37.195root 11241100x8000000000000000559473Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:37.195{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.853e1fd6cded78d92021-12-21 11:40:37.195root 11241100x8000000000000000559474Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:37.195{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0acde6cdb7a7baaa2021-12-21 11:40:37.195root 11241100x8000000000000000559475Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:37.196{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a2265f68dd17715e2021-12-21 11:40:37.196root 11241100x8000000000000000559476Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:37.196{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d55a0f951b8ab3272021-12-21 11:40:37.196root 11241100x8000000000000000559477Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:37.196{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.39f8e4b54c23661b2021-12-21 11:40:37.196root 11241100x8000000000000000559478Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:37.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4ec6b7df954c433b2021-12-21 11:40:37.693root 11241100x8000000000000000559479Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:37.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a28973cb25fcc6012021-12-21 11:40:37.693root 11241100x8000000000000000559480Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:37.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.de9812ea832a083d2021-12-21 11:40:37.693root 11241100x8000000000000000559481Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:37.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3fefa6eec44d4d3a2021-12-21 11:40:37.693root 11241100x8000000000000000559482Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:37.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e7ff75ad5dc719cc2021-12-21 11:40:37.693root 11241100x8000000000000000559483Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:37.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c2d2f2cfa4cc4f772021-12-21 11:40:37.693root 11241100x8000000000000000559484Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:37.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.603333a41b8c34f72021-12-21 11:40:37.693root 11241100x8000000000000000559485Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:37.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.00bf496c57d391042021-12-21 11:40:37.693root 11241100x8000000000000000559486Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:37.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7a4c8bea9bf154882021-12-21 11:40:37.693root 11241100x8000000000000000559487Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:37.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0446046a5cc286d32021-12-21 11:40:37.694root 11241100x8000000000000000559488Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:37.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.433cbd2d74d08a9e2021-12-21 11:40:37.694root 11241100x8000000000000000559489Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:37.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.fa2fa6ead89551322021-12-21 11:40:37.694root 11241100x8000000000000000559490Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:37.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d1fb3799b0184a4a2021-12-21 11:40:37.694root 11241100x8000000000000000559491Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:37.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4ab628a623e65cdc2021-12-21 11:40:37.694root 11241100x8000000000000000559492Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:37.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.97943853fa54e5c82021-12-21 11:40:37.694root 11241100x8000000000000000559493Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:37.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5ae312aa630548ca2021-12-21 11:40:37.694root 11241100x8000000000000000559494Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:37.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ad7da8fd8c9da0842021-12-21 11:40:37.694root 11241100x8000000000000000559495Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:37.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d9e2d919c9dfc5472021-12-21 11:40:37.694root 11241100x8000000000000000559496Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:37.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.dd1e69039e04f5972021-12-21 11:40:37.694root 11241100x8000000000000000559497Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:37.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.486c376315fbb6a62021-12-21 11:40:37.694root 11241100x8000000000000000559498Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:37.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a629b1629c8280aa2021-12-21 11:40:37.694root 11241100x8000000000000000559499Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:37.695{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.49d6ad1805975dd42021-12-21 11:40:37.695root 11241100x8000000000000000559500Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:37.695{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0db005e0ddad69582021-12-21 11:40:37.695root 11241100x8000000000000000559501Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:37.695{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.59fc1a0d949891302021-12-21 11:40:37.695root 11241100x8000000000000000559502Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:37.695{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e9c1b94c4a9136532021-12-21 11:40:37.695root 11241100x8000000000000000559503Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:37.695{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3213b4e7e05d56042021-12-21 11:40:37.695root 11241100x8000000000000000559504Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:37.695{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f9fd52968d1a37a72021-12-21 11:40:37.695root 11241100x8000000000000000559505Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:37.695{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.151557cbde8521e42021-12-21 11:40:37.695root 11241100x8000000000000000559506Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:37.695{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6603ee8ed9e32d2a2021-12-21 11:40:37.695root 11241100x8000000000000000559507Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:37.695{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2771ca61bdffa1132021-12-21 11:40:37.695root 11241100x8000000000000000559508Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:37.695{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.500369818269ad542021-12-21 11:40:37.695root 11241100x8000000000000000559509Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:38.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d7ac42de797656cd2021-12-21 11:40:38.193root 11241100x8000000000000000559510Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:38.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.82105c245fb71a822021-12-21 11:40:38.193root 11241100x8000000000000000559511Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:38.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.bf8d412b615f06132021-12-21 11:40:38.193root 11241100x8000000000000000559512Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:38.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8f21d7c469fdd73d2021-12-21 11:40:38.193root 11241100x8000000000000000559513Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:38.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4f9e2b9b818454002021-12-21 11:40:38.194root 11241100x8000000000000000559514Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:38.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.bcff4d1af3d89a192021-12-21 11:40:38.194root 11241100x8000000000000000559515Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:38.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.fcd647b70fe47b612021-12-21 11:40:38.194root 11241100x8000000000000000559516Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:38.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.84df6d55c7ab8eb22021-12-21 11:40:38.194root 11241100x8000000000000000559517Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:38.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3106d27812c5ff642021-12-21 11:40:38.194root 11241100x8000000000000000559518Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:38.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.00294ead43d7a0d02021-12-21 11:40:38.194root 11241100x8000000000000000559519Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:38.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0a55e7edd27035fa2021-12-21 11:40:38.194root 11241100x8000000000000000559520Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:38.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c3e0e1567d82484d2021-12-21 11:40:38.194root 11241100x8000000000000000559521Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:38.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.58e5b0c7e30ac9662021-12-21 11:40:38.194root 11241100x8000000000000000559522Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:38.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.bd101743128cfe512021-12-21 11:40:38.194root 11241100x8000000000000000559523Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:38.195{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.302fa4966c7978d62021-12-21 11:40:38.195root 11241100x8000000000000000559524Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:38.195{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.80135673c57052f62021-12-21 11:40:38.195root 11241100x8000000000000000559525Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:38.195{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3d0d0b144aec157f2021-12-21 11:40:38.195root 11241100x8000000000000000559526Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:38.195{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c0e7e8ee546fb3c72021-12-21 11:40:38.195root 11241100x8000000000000000559527Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:38.195{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c8cb886fbad34b342021-12-21 11:40:38.195root 11241100x8000000000000000559528Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:38.195{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.62d872683ddd702f2021-12-21 11:40:38.195root 11241100x8000000000000000559529Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:38.195{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f0140947b38200d12021-12-21 11:40:38.195root 11241100x8000000000000000559530Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:38.195{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c86c71e8291d7e622021-12-21 11:40:38.195root 11241100x8000000000000000559531Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:38.195{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a847b58f9602aea42021-12-21 11:40:38.195root 11241100x8000000000000000559532Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:38.195{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4176f5b7a842374f2021-12-21 11:40:38.195root 11241100x8000000000000000559533Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:38.195{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e4f45f06bcbad0c02021-12-21 11:40:38.195root 11241100x8000000000000000559534Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:38.196{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.12f2d933050f6ba12021-12-21 11:40:38.196root 11241100x8000000000000000559535Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:38.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8186abe6a9d591012021-12-21 11:40:38.693root 11241100x8000000000000000559536Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:38.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.27a35abfda46ac092021-12-21 11:40:38.693root 11241100x8000000000000000559537Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:38.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.378f0763a93426c82021-12-21 11:40:38.693root 11241100x8000000000000000559538Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:38.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9028711f949dd4c62021-12-21 11:40:38.694root 11241100x8000000000000000559539Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:38.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c50a8a715aa85d9e2021-12-21 11:40:38.694root 11241100x8000000000000000559540Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:38.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.51433cc4ccee3bd42021-12-21 11:40:38.694root 11241100x8000000000000000559541Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:38.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7cc5e45722ff8f612021-12-21 11:40:38.694root 11241100x8000000000000000559542Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:38.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2bd1a556a985d47e2021-12-21 11:40:38.694root 11241100x8000000000000000559543Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:38.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.70687c6b8b7708332021-12-21 11:40:38.694root 11241100x8000000000000000559544Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:38.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.34a88d04c45c24012021-12-21 11:40:38.694root 11241100x8000000000000000559545Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:38.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.54cdea899eba53972021-12-21 11:40:38.694root 11241100x8000000000000000559546Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:38.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.65e9f614b3ba4f672021-12-21 11:40:38.694root 11241100x8000000000000000559547Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:38.695{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.dbccde5075043cd72021-12-21 11:40:38.695root 11241100x8000000000000000559548Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:38.695{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.926bafc952cd11862021-12-21 11:40:38.695root 11241100x8000000000000000559549Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:38.695{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2e6d3be86879a31e2021-12-21 11:40:38.695root 11241100x8000000000000000559550Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:38.695{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.33e0b1105defdc432021-12-21 11:40:38.695root 11241100x8000000000000000559551Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:38.695{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.97cab6532c71dc6c2021-12-21 11:40:38.695root 11241100x8000000000000000559552Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:38.695{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.01a6423d90d1d1b62021-12-21 11:40:38.695root 11241100x8000000000000000559553Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:38.695{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7698533f11013e9e2021-12-21 11:40:38.695root 11241100x8000000000000000559554Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:38.695{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.029c6821c60f3ab62021-12-21 11:40:38.695root 11241100x8000000000000000559555Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:38.695{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f2a95dae7d5e85542021-12-21 11:40:38.695root 11241100x8000000000000000559556Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:38.695{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.31c83998f310e7882021-12-21 11:40:38.695root 11241100x8000000000000000559557Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:38.696{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.898b3893479882b62021-12-21 11:40:38.696root 11241100x8000000000000000559558Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:38.696{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7403a4f3d1c28e6e2021-12-21 11:40:38.696root 11241100x8000000000000000559559Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:38.696{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.be932b184171113b2021-12-21 11:40:38.696root 11241100x8000000000000000559560Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:38.696{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.01c511ad40b987192021-12-21 11:40:38.696root 11241100x8000000000000000559561Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:39.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d80eda32c89cb0722021-12-21 11:40:39.193root 11241100x8000000000000000559562Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:39.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.cf98ffc03861db202021-12-21 11:40:39.193root 11241100x8000000000000000559563Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:39.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5e7c59f0b32620a32021-12-21 11:40:39.194root 11241100x8000000000000000559564Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:39.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.47b3377c1865ca622021-12-21 11:40:39.194root 11241100x8000000000000000559565Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:39.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6ed1fceb79b2940d2021-12-21 11:40:39.194root 11241100x8000000000000000559566Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:39.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.47109513f51615172021-12-21 11:40:39.194root 11241100x8000000000000000559567Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:39.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.29a01885f641411e2021-12-21 11:40:39.194root 11241100x8000000000000000559568Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:39.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5f223e3c41cea24a2021-12-21 11:40:39.194root 11241100x8000000000000000559569Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:39.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5718af3ac3f6db542021-12-21 11:40:39.194root 11241100x8000000000000000559570Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:39.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.31cb4f820fc1dfaf2021-12-21 11:40:39.194root 11241100x8000000000000000559571Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:39.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f82e008b80decbb12021-12-21 11:40:39.194root 11241100x8000000000000000559572Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:39.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f10848ee5a5f87042021-12-21 11:40:39.194root 11241100x8000000000000000559573Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:39.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.fbf13e81e27f0e812021-12-21 11:40:39.194root 11241100x8000000000000000559574Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:39.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.93e1980ba9d5c5e72021-12-21 11:40:39.194root 11241100x8000000000000000559575Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:39.195{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.971fd3f8ce4b2ec52021-12-21 11:40:39.195root 11241100x8000000000000000559576Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:39.195{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b56b1fd33529874e2021-12-21 11:40:39.195root 11241100x8000000000000000559577Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:39.195{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.058735ac1a2538672021-12-21 11:40:39.195root 11241100x8000000000000000559578Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:39.195{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4b4d07fd2818d43c2021-12-21 11:40:39.195root 11241100x8000000000000000559579Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:39.195{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8d3be461ed7780e52021-12-21 11:40:39.195root 11241100x8000000000000000559580Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:39.195{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.cd5d2c8c6178572a2021-12-21 11:40:39.195root 11241100x8000000000000000559581Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:39.195{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9b51289ebee4645a2021-12-21 11:40:39.195root 11241100x8000000000000000559582Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:39.195{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1c7fca6dc77ce8b42021-12-21 11:40:39.195root 11241100x8000000000000000559583Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:39.195{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.55864e52e0eef1662021-12-21 11:40:39.195root 11241100x8000000000000000559584Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:39.195{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f4ff6a882125d05d2021-12-21 11:40:39.195root 11241100x8000000000000000559585Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:39.195{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7ca1d2f696fcdbbf2021-12-21 11:40:39.195root 11241100x8000000000000000559586Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:39.195{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6b5993d18ad556132021-12-21 11:40:39.195root 354300x8000000000000000559587Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:39.248{ec2b6afe-95d9-61c1-5175-3a0400000000}5346/opt/splunkforwarder/etc/apps/Splunk_TA_stream/linux_x86_64/bin/streamfwdroottcptruefalse10.0.1.25-48890-false10.0.1.12-8000- 23542300x8000000000000000559588Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:39.327{ec2b6afe-95d2-61c1-3038-b84203560000}5272root/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/spool/splunk/tracker.log--- 11241100x8000000000000000559589Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:39.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d42fe12c0f6daaba2021-12-21 11:40:39.693root 11241100x8000000000000000559590Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:39.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f491079054e939042021-12-21 11:40:39.693root 11241100x8000000000000000559591Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:39.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.89b7c4db46c4de1d2021-12-21 11:40:39.693root 11241100x8000000000000000559592Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:39.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.56ffd8b6d23b7db22021-12-21 11:40:39.693root 11241100x8000000000000000559593Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:39.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2803450058c03d112021-12-21 11:40:39.693root 11241100x8000000000000000559594Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:39.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.879d45d27b49425b2021-12-21 11:40:39.694root 11241100x8000000000000000559595Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:39.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0005673b73fe55e82021-12-21 11:40:39.694root 11241100x8000000000000000559596Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:39.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4b5b5d3cd2be24b62021-12-21 11:40:39.694root 11241100x8000000000000000559597Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:39.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.eda32279d9f11bbb2021-12-21 11:40:39.694root 11241100x8000000000000000559598Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:39.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.751dd875ff287b4f2021-12-21 11:40:39.694root 11241100x8000000000000000559599Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:39.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5b9b04bdea759c2e2021-12-21 11:40:39.694root 11241100x8000000000000000559600Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:39.695{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6e4f9770bbc731552021-12-21 11:40:39.695root 11241100x8000000000000000559601Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:39.695{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a22defe72f146ca02021-12-21 11:40:39.695root 11241100x8000000000000000559602Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:39.695{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c8b0d0670c8477ac2021-12-21 11:40:39.695root 11241100x8000000000000000559603Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:39.695{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c00d13dc6b6074b42021-12-21 11:40:39.695root 11241100x8000000000000000559604Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:39.695{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.08fec90274ee44a92021-12-21 11:40:39.695root 11241100x8000000000000000559605Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:39.695{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.bd5790d659cbfc252021-12-21 11:40:39.695root 11241100x8000000000000000559606Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:39.695{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4b34e7be2f6e78052021-12-21 11:40:39.695root 11241100x8000000000000000559607Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:39.695{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.86b453d4286c2c352021-12-21 11:40:39.695root 11241100x8000000000000000559608Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:39.696{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.11950228e385b26c2021-12-21 11:40:39.696root 11241100x8000000000000000559609Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:39.696{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7ba1859b3a00c60d2021-12-21 11:40:39.696root 11241100x8000000000000000559610Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:39.696{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.bb50edd138b8b6a42021-12-21 11:40:39.696root 11241100x8000000000000000559611Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:39.696{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f7149e75120e24262021-12-21 11:40:39.696root 11241100x8000000000000000559612Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:39.696{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.af3cd97822e9c54f2021-12-21 11:40:39.696root 11241100x8000000000000000559613Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:39.696{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c1729bc5f4cc2f8e2021-12-21 11:40:39.696root 11241100x8000000000000000559614Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:39.696{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e361d091a9a53e772021-12-21 11:40:39.696root 11241100x8000000000000000559615Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:39.696{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1fd6820ac4cba44b2021-12-21 11:40:39.696root 11241100x8000000000000000559616Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:39.696{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f55df561aa196b782021-12-21 11:40:39.696root 11241100x8000000000000000559617Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:39.696{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e20057bdc151815d2021-12-21 11:40:39.696root 11241100x8000000000000000559618Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:39.696{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.632106155d89621a2021-12-21 11:40:39.696root 11241100x8000000000000000559619Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:39.696{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.74d560c6336aaed22021-12-21 11:40:39.696root 11241100x8000000000000000559620Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:39.697{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ac6021dd61406bca2021-12-21 11:40:39.697root 11241100x8000000000000000559621Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:39.697{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.37a19097cd86da862021-12-21 11:40:39.697root 11241100x8000000000000000559622Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:39.697{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ef4919a0a5b369882021-12-21 11:40:39.697root 11241100x8000000000000000559623Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:40.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5140e5c66f97df282021-12-21 11:40:40.193root 11241100x8000000000000000559624Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:40.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0acb0cb80a33ed8b2021-12-21 11:40:40.194root 11241100x8000000000000000559625Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:40.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.fd1c86f292f517392021-12-21 11:40:40.194root 11241100x8000000000000000559626Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:40.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.57c7d220b5ad41f32021-12-21 11:40:40.194root 11241100x8000000000000000559627Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:40.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c056b83728c5ba5d2021-12-21 11:40:40.194root 11241100x8000000000000000559628Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:40.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b0a178c024727f9d2021-12-21 11:40:40.194root 11241100x8000000000000000559629Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:40.195{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.320e31c32f6b3ba82021-12-21 11:40:40.195root 11241100x8000000000000000559630Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:40.195{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.70b198f97d980cb12021-12-21 11:40:40.195root 11241100x8000000000000000559631Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:40.195{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ed65ad54751b2a732021-12-21 11:40:40.195root 11241100x8000000000000000559632Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:40.195{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9bda6a346ea9ac0d2021-12-21 11:40:40.195root 11241100x8000000000000000559633Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:40.195{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.47c9223e42cbc5d12021-12-21 11:40:40.195root 11241100x8000000000000000559634Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:40.195{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e4d01f0e4702f93f2021-12-21 11:40:40.195root 11241100x8000000000000000559635Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:40.195{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.49b2b977bcee81ea2021-12-21 11:40:40.195root 11241100x8000000000000000559636Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:40.195{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a87d32b2235e67a22021-12-21 11:40:40.195root 11241100x8000000000000000559637Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:40.195{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.b6125ca8da7111302021-12-21 11:40:40.195root 11241100x8000000000000000559638Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:40.195{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0e395c1bdef37a332021-12-21 11:40:40.195root 11241100x8000000000000000559639Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:40.195{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.446a7202a5d18cfc2021-12-21 11:40:40.195root 11241100x8000000000000000559640Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:40.196{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.dafbaf6f673b39392021-12-21 11:40:40.196root 11241100x8000000000000000559641Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:40.196{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c0ae48cee6b9b3f82021-12-21 11:40:40.196root 11241100x8000000000000000559642Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:40.196{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ce14dccd13bb6bcc2021-12-21 11:40:40.196root 11241100x8000000000000000559643Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:40.196{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d69e0d5cd9f2d5232021-12-21 11:40:40.196root 11241100x8000000000000000559644Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:40.196{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.296b79a62131f0422021-12-21 11:40:40.196root 11241100x8000000000000000559645Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:40.196{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.48a16ef9637041ce2021-12-21 11:40:40.196root 11241100x8000000000000000559646Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:40.196{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a8be8f69ace7e1142021-12-21 11:40:40.196root 11241100x8000000000000000559647Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:40.196{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.02b5f73dfe6d46b02021-12-21 11:40:40.196root 11241100x8000000000000000559648Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:40.196{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1c99e44936c1cc442021-12-21 11:40:40.196root 11241100x8000000000000000559649Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:40.196{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0959ae36d09e68292021-12-21 11:40:40.196root 11241100x8000000000000000559650Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:40.196{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.637a1ca5c6c75fc82021-12-21 11:40:40.196root 11241100x8000000000000000559651Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:40.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c0a57808f0e2c7032021-12-21 11:40:40.693root 11241100x8000000000000000559652Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:40.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9b0f4df6b1b9067f2021-12-21 11:40:40.693root 11241100x8000000000000000559653Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:40.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.478b8d591cf1daa02021-12-21 11:40:40.694root 11241100x8000000000000000559654Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:40.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8ae7a50e7bb3b76d2021-12-21 11:40:40.694root 11241100x8000000000000000559655Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:40.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3c0c3455e7d1493e2021-12-21 11:40:40.694root 11241100x8000000000000000559656Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:40.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.53751117e25b92a52021-12-21 11:40:40.694root 11241100x8000000000000000559657Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:40.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f07125056285588d2021-12-21 11:40:40.694root 11241100x8000000000000000559658Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:40.695{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.7c4fb1f0447c65452021-12-21 11:40:40.695root 11241100x8000000000000000559659Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:40.695{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.bf73344735babd932021-12-21 11:40:40.695root 11241100x8000000000000000559660Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:40.695{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.276e5942c50762be2021-12-21 11:40:40.695root 11241100x8000000000000000559661Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:40.695{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0d22e072f5ae98cb2021-12-21 11:40:40.695root 11241100x8000000000000000559662Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:40.695{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.3c26ae3225df704f2021-12-21 11:40:40.695root 11241100x8000000000000000559663Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:40.695{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8f25bb21beaf35b42021-12-21 11:40:40.695root 11241100x8000000000000000559664Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:40.695{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8479312ce5b0b2e82021-12-21 11:40:40.695root 11241100x8000000000000000559665Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:40.695{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d35ed85ea5fddfae2021-12-21 11:40:40.695root 11241100x8000000000000000559666Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:40.695{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1c2bff7a03d0143d2021-12-21 11:40:40.695root 11241100x8000000000000000559667Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:40.695{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.52181eb3bdd698282021-12-21 11:40:40.695root 11241100x8000000000000000559668Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:40.696{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d164bc7061a85cd32021-12-21 11:40:40.696root 11241100x8000000000000000559669Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:40.696{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8118fe5ac930ef642021-12-21 11:40:40.696root 11241100x8000000000000000559670Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:40.696{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.43d38ccae86946492021-12-21 11:40:40.696root 11241100x8000000000000000559671Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:40.696{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.ba912ea8787c53762021-12-21 11:40:40.696root 11241100x8000000000000000559672Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:40.696{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6cf88cc0006223ad2021-12-21 11:40:40.696root 11241100x8000000000000000559673Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:40.696{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f71a5d632963f5242021-12-21 11:40:40.696root 11241100x8000000000000000559674Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:40.696{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.27f93ed0afa977922021-12-21 11:40:40.696root 11241100x8000000000000000559675Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:40.696{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.bbb8f366d978b5532021-12-21 11:40:40.696root 11241100x8000000000000000559676Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:40.696{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.45622b5f4171f1d42021-12-21 11:40:40.696root 11241100x8000000000000000559677Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:40.696{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.75375594203fa5d72021-12-21 11:40:40.696root 11241100x8000000000000000559678Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:40.697{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d7c07dc0dce78fe82021-12-21 11:40:40.697root 11241100x8000000000000000559679Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:41.193{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.69396693d7218ed72021-12-21 11:40:41.193root 11241100x8000000000000000559680Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:41.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.78c62a962fae88a92021-12-21 11:40:41.194root 11241100x8000000000000000559681Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:41.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8e937bfc11fa52df2021-12-21 11:40:41.194root 11241100x8000000000000000559682Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:41.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6e91db09371cb4992021-12-21 11:40:41.194root 11241100x8000000000000000559683Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:41.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.44aa7016444d61932021-12-21 11:40:41.194root 11241100x8000000000000000559684Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:41.194{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d81e5b65815dcc022021-12-21 11:40:41.194root 11241100x8000000000000000559685Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:41.195{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c168a857b27d468c2021-12-21 11:40:41.195root 11241100x8000000000000000559686Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:41.195{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.05a0a28cd97b77b92021-12-21 11:40:41.195root 11241100x8000000000000000559687Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:41.195{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.529df06a0c8658252021-12-21 11:40:41.195root 11241100x8000000000000000559688Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:41.195{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.aace93668bb9da412021-12-21 11:40:41.195root 11241100x8000000000000000559689Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:41.195{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5b80f495f04b95532021-12-21 11:40:41.195root 11241100x8000000000000000559690Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:41.195{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.266daa26ca235fe62021-12-21 11:40:41.195root 11241100x8000000000000000559691Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:41.195{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e28c3ad2e9832ed22021-12-21 11:40:41.195root 11241100x8000000000000000559692Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:41.195{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4af01973ec2731472021-12-21 11:40:41.195root 11241100x8000000000000000559693Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:41.195{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.9f7794568bfbfca92021-12-21 11:40:41.195root 11241100x8000000000000000559694Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:41.195{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.a551acac565cdfa02021-12-21 11:40:41.195root 11241100x8000000000000000559695Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:41.195{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1c99128398bcb8532021-12-21 11:40:41.195root 11241100x8000000000000000559696Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:41.196{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.844ec43769a1014e2021-12-21 11:40:41.196root 11241100x8000000000000000559697Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:41.196{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0668f42fd4847fea2021-12-21 11:40:41.196root 11241100x8000000000000000559698Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:41.196{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.98db022001d196e02021-12-21 11:40:41.196root 11241100x8000000000000000559699Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:41.196{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e728df085630c4322021-12-21 11:40:41.196root 11241100x8000000000000000559700Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:41.196{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d4d5553340e237d92021-12-21 11:40:41.196root 11241100x8000000000000000559701Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:41.196{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6286e8ff0ee339942021-12-21 11:40:41.196root 11241100x8000000000000000559702Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:41.196{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.04fbe127e48b6a352021-12-21 11:40:41.196root 11241100x8000000000000000559703Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:41.196{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e8436a3a928a32502021-12-21 11:40:41.196root 11241100x8000000000000000559704Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:41.196{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f1c37bb60514137a2021-12-21 11:40:41.196root 11241100x8000000000000000559705Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:41.196{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.dd9efca6ba92ef752021-12-21 11:40:41.196root 11241100x8000000000000000559706Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:41.196{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.21e8f4775cb4df042021-12-21 11:40:41.196root 11241100x8000000000000000559707Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:41.196{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.e85f64ac7137a3e52021-12-21 11:40:41.196root 11241100x8000000000000000559708Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:41.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d05353e35f319d812021-12-21 11:40:41.693root 11241100x8000000000000000559709Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:41.693{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.192cee8c339815a82021-12-21 11:40:41.693root 11241100x8000000000000000559710Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:41.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.88b2743a57eaf2a92021-12-21 11:40:41.694root 11241100x8000000000000000559711Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:41.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0571bd52d54e1da72021-12-21 11:40:41.694root 11241100x8000000000000000559712Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:41.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.8dde17f7348e45c82021-12-21 11:40:41.694root 11241100x8000000000000000559713Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:41.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.6e8832a68748f4f02021-12-21 11:40:41.694root 11241100x8000000000000000559714Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:41.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c756029f7b6bb2612021-12-21 11:40:41.694root 11241100x8000000000000000559715Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:41.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.d8833af75f6dd2012021-12-21 11:40:41.694root 11241100x8000000000000000559716Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:41.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.78b2a31d2d7dc6252021-12-21 11:40:41.694root 11241100x8000000000000000559717Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:41.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.88950be396918d002021-12-21 11:40:41.694root 11241100x8000000000000000559718Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:41.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.170609ea3f60c9cf2021-12-21 11:40:41.694root 11241100x8000000000000000559719Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:41.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2291a93b5cd584d02021-12-21 11:40:41.694root 11241100x8000000000000000559720Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:41.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c3f9d75065d11fc22021-12-21 11:40:41.694root 11241100x8000000000000000559721Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:41.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.f2fc54590886f8362021-12-21 11:40:41.694root 11241100x8000000000000000559722Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:41.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.95025e23f1be6be72021-12-21 11:40:41.694root 11241100x8000000000000000559723Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:41.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.057a909826d916f72021-12-21 11:40:41.694root 11241100x8000000000000000559724Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:41.694{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2b8fec6f3e35da222021-12-21 11:40:41.694root 11241100x8000000000000000559725Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:41.695{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.4139a1628f5b091e2021-12-21 11:40:41.695root 11241100x8000000000000000559726Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:41.695{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.dd069df9750a69692021-12-21 11:40:41.695root 11241100x8000000000000000559727Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:41.695{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.0df891e08e973d372021-12-21 11:40:41.695root 11241100x8000000000000000559728Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:41.695{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2a414fd6e0bd74ac2021-12-21 11:40:41.695root 11241100x8000000000000000559729Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:41.695{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.66d8def5cd742b9b2021-12-21 11:40:41.695root 11241100x8000000000000000559730Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:41.695{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.c3afacc63cc3e6d42021-12-21 11:40:41.695root 11241100x8000000000000000559731Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:41.695{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.5eeb4aac504d3a1b2021-12-21 11:40:41.695root 11241100x8000000000000000559732Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:41.695{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.2edae3f52f05db622021-12-21 11:40:41.695root 11241100x8000000000000000559733Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:41.695{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.fe50043de0b21f4e2021-12-21 11:40:41.695root 11241100x8000000000000000559734Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:41.695{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.829767462ee71acf2021-12-21 11:40:41.695root 11241100x8000000000000000559735Linux-Sysmon/Operationalsysmonlinux-tcontreras-attack-range-643-2021-12-21 11:40:41.695{ec2b6afe-95d7-61c1-3048-d63b52560000}5340/opt/splunkforwarder/bin/splunkd/opt/splunkforwarder/var/lib/splunk/modinputs/journald/sysmon.checkpoint.tmp.1a90c0e1b129c2fb2021-12-21 11:40:41.695root