[pid 16175] 1028893593.137671 read(3, "[payload removed: 200 characters]"..., 4096) = 4096
[pid 16175] 1028893593.139086 read(3, "604D44C7C6EA98D561294D4F7AB061432CAB8BBDCEC3659DE64F65265E6B9FC5F46879BB17CC34993853CA28BBF\n20010329032045 2 6 100 2046 2 7ED0888B660A818F15E5F76A7F2BF10C99D74129DA04446C60116C9C800501060B8AFF075DCE0C"..., 4096) = 4096
[pid 16175] 1028893593.140551 read(3, "[payload removed: 200 characters]"..., 4096) = 4096
[pid 16175] 1028893593.141961 read(3, "DE64F65265E6B9FC5F46879BB17CC34993853FD7EAAF\n20010329090209 2 6 100 2046 5 7ED0888B660A818F15E5F76A7F2BF10C99D74129DA04446C60116C9C800501060B8AFF075DCE0C08CEFDF695440E6F16FCCDB06359D080EF62D6485CBAEB9"..., 4096) = 4096
[pid 16175] 1028893593.143427 read(3, "[payload removed: 200 characters]"..., 4096) = 4096
[pid 16175] 1028893593.144814 read(3, "2AC3E3772709FC815B0AC56CFF\n20010404053436 2 6 100 3190 5 669BA3ED661F226A090BE5644A2BB4209371B78FC3E6848A095821993F59084CA5EE12052F977D01F0666F03F6573B199DFEC9AB94588C2C60DE3B3E7CF5094587919FCC3FB40A6"..., 4096) = 4096
[pid 16175] 1028893593.146223 read(3, "0A2991A1FFE5B271FEDE54375896A29F968BE1D511BA466A92AC3E3772709FC815B0D5D012B\n20010404174625 2 6 100 3190 5 669BA3ED661F226A090BE5644A2BB4209371B78FC3E6848A095821993F59084CA5EE12052F977D01F0666F03F6573B"..., 4096) = 4096
[pid 16175] 1028893593.147700 read(3, "3788956651919E26A315EAD1D26E7C98FC4CFA35A0F04DD400A2991A1FFE5B271FEDE54375896A29F968BE1D511BA466A92AC3E3772709FC815B10DD9FC3\n20010405053429 2 6 100 3190 5 669BA3ED661F226A090BE5644A2BB4209371B78FC3E68"..., 4096) = 4096
[pid 16175] 1028893593.149133 read(3, "6E10BE7FA5B1A706AEB4C356F49807A22072CD00559AF0A863788956651919E26A315EAD1D26E7C98FC4CFA35A0F04DD400A2991A1FFE5B271FEDE54375896A29F968BE1D511BA466A92AC3E3772709FC815B12612ED3\n20010405182035 2 6 100 319"..., 4096) = 4096
[pid 16175] 1028893593.150472 read(3, "[payload removed: 200 characters]"..., 4096) = 4096
[pid 16175] 1028893593.152253 read(3, "[payload removed: 200 characters]"..., 4096) = 4096
[pid 16175] 1028893593.153880 read(3, "[payload removed: 200 characters]"..., 4096) = 4096
[pid 16175] 1028893593.155425 read(3, "[payload removed: 200 characters]"..., 4096) = 4096
[pid 16175] 1028893593.156843 read(3, "[payload removed: 200 characters]"..., 4096) = 4096
[pid 16175] 1028893593.158287 read(3, "[payload removed: 200 characters]"..., 4096) = 4096
[pid 16175] 1028893593.158983 close(3)  = 0
[pid 16175] 1028893593.159094 munmap(0x40014000, 4096) = 0
[pid 16175] 1028893593.159536 write(5, "\0\0\2\v\1", 5) = 5
[pid 16176] 1028893593.159748 <... read resumed> "\0\0\2\v", 4) = 4
[pid 16176] 1028893593.159847 read(3, "\1", 523) = 1
[pid 16176] 1028893593.159972 read(3,  <unfinished ...>
[pid 16175] 1028893593.160045 write(5, "\1\0\0\2\0e\265\271\365\354\372\333L\3138\321\274\211C\2\351[HC)\17\32z@W\235\363\342\377\230\301\323\332\237!\10W\307\204C=\363*\337\236\f\200\22\22\21i\16\37\373A\270\333N\206\257\343\210\240\234\233\262\311\216\334X\34.e\325\177a\273\222\f=\33{\5\213_\255\377e\326\7\332\377D;\213\241\254\341\243\247\261n\240q?bS|f\211\343\304\240\366\21\230\363\260T\374\361@\317\255\330b,\16v!\231\203"..., 522) = 522
[pid 16176] 1028893593.160594 <... read resumed> "\1\0\0\2\0e\265\271\365\354\372\333L\3138\321\274\211C\2\351[HC)\17\32z@W\235\363\342\377\230\301\323\332\237!\10W\307\204C=\363*\337\236\f\200\22\22\21i\16\37\373A\270\333N\206\257\343\210\240\234\233\262\311\216\334X\34.e\325\177a\273\222\f=\33{\5\213_\255\377e\326\7\332\377D;\213\241\254\341\243\247\261n\240q?bS|f\211\343\304\240\366\21\230\363\260T\374\361@\317\255\330b,\16v!\231\203"..., 522) = 522
[pid 16176] 1028893593.161325 write(4, "\0\0\2\24\t\37\0\0\2\0e\265\271\365\354\372\333L\3138\321\274\211C\2\351[HC)\17\32z@W\235\363\342\377\230\301\323\332\237!\10W\307\204C=\363*\337\236\f\200\22\22\21i\16\37\373A\270\333N\206\257\343\210\240\234\233\262\311\216\334X\34.e\325\177a\273\222\f=\33{\5\213_\255\377e\326\7\332\377D;\213\241\254\341\243\247\261n\240q?bS|f\211\343\304\240\366\21\230\363\260T\374\361@\317\255\330b,\16"..., 536) = 536
[pid 16176] 1028893593.162022 time([1028893593]) = 1028893593
[pid 16176] 1028893593.162218 getpid()  = 16176
[pid 16176] 1028893593.162315 getpid()  = 16176
[pid 16176] 1028893593.164625 brk(0x809e000) = 0x809e000
[pid 16176] 1028893593.165548 brk(0x809f000) = 0x809f000
[pid 16175] 1028893593.227585 read(5,  <unfinished ...>
[pid 16176] 1028893593.619364 select(5, [4], NULL, NULL, NULL





) = 1 (in [4])
[pid 16176] 1028893602.566365 read(4, "\0\0\2\f\6 \0\0\2\0\20)\314\302rU\177\212\210#\16/]1`\21\373Y\275\201\244k\237h\331\334\301\277\fD\272\7\372R\371\206\302\372\345F)\337\211R}.\204\330M\356,\226.Y,\362\241V\307N\356\3179\221\311o\335\364\5\352\264\v\330\31\354\220\331\24h\314)\252\256\371\206*\232V\330ys\207\32\242\233\202U_\377\300\223\30\242\30\5h\33\305p^h<Anu\26\324cKB\207\257\237\227\342\361\264_\356!^*\315\226\271\217"..., 8192) = 528
[pid 16176] 1028893602.574378 brk(0x80a0000) = 0x80a0000
[pid 16176] 1028893602.580644 brk(0x80a1000) = 0x80a1000
[pid 16176] 1028893602.586855 brk(0x80a2000) = 0x80a2000
[pid 16176] 1028893602.592905 brk(0x80a3000) = 0x80a3000
[pid 16176] 1028893603.124179 write(3, "\0\0\0\35\4", 5) = 5
[pid 16175] 1028893603.125181 <... read resumed> "\0\0\0\35", 4) = 4
[pid 16175] 1028893603.125314 read(5, "\4", 29) = 1
[pid 16175] 1028893603.125442 read(5,  <unfinished ...>
[pid 16176] 1028893603.125962 write(3, "\0\0\0\1\0\0\0\24\307\272/W\204\273\374\236\301h1P\237-\303\0373\300\373\323", 28) = 28
[pid 16175] 1028893603.126756 <... read resumed> "\0\0\0\1\0\0\0\24\307\272/W\204\273\374\236\301h1P\237-\303\0373\300\373\323", 28) = 28
[pid 16175] 1028893603.127267 time([1028893603]) = 1028893603
[pid 16175] 1028893603.127452 getpid()  = 16175
[pid 16175] 1028893603.127581 getpid()  = 16175
[pid 16175] 1028893603.129470 brk(0x809c000) = 0x809c000
[pid 16175] 1028893603.151381 write(5, "\0\0\0<\5", 5) = 5
[pid 16175] 1028893603.152200 write(5, "\0\0\0007\0\0\0\7ssh-dss\0\0\0(\243ys\17\224\224Gt\274_\226\3207\361\21yr\365\353\17\216I\3677\232\355d\375\246l\212\266\271\241\320i\5\242b\256", 59) = 59
[pid 16175] 1028893603.153155 read(5,  <unfinished ...>
[pid 16176] 1028893603.153508 read(3, "\0\0\0<", 4) = 4
[pid 16176] 1028893603.154129 read(3, "\5\0\0\0007\0\0\0\7ssh-dss\0\0\0(\243ys\17\224\224Gt\274_\226\3207\361\21yr\365\353\17\216I\3677\232\355d\375\246l\212\266\271\241\320i\5\242b\256", 60) = 60
[pid 16176] 1028893603.156062 write(4, "\0\0\3\374\6!\0\0\1\261\0\0\0\7ssh-dss\0\0\0\201\0\372\327X\372@6r\2221\374E\256\7\321\\8\273\207G/v(j\305\277v\226\323\241\263\n\242\336\363\200u[B=\225\314\301n\2111i\212\245\'\26\243\301\3023F\374\2756\00116\202\22$\310,k[S\35\204\374>\273S\251x^\356\34\330\345\304Tq\217c\241-\376\204\326F\257\377\30\254\316\177\2112\372\266KY\233\2645\271\217\365\216\374\342\202\370Z\305\363d\35iE\311"..., 1040) = 1040
[pid 16176] 1028893603.157726 select(5, [4], NULL, NULL, NULL





) = 1 (in [4])
[pid 16176] 1028893614.123376 read(4, "\0\0\0\f\n\25J\0\0\0\347\0\0\0\317\0", 8192) = 16
[pid 16176] 1028893614.124375 select(5, [4], NULL, NULL, NULL) = 1 (in [4])
[pid 16176] 1028893614.127595 read(4, "|\276G_\203\30za\365\361\36\343$P\374\200\331\0307\27\1\271\264(\307\243#\2510V\261D?\361+1\221\226\331\357\312\225g~\0356\224v\366T\345J", 8192) = 52
[pid 16176] 1028893614.128844 write(4, "\316\36\362\300\264k\236Z\277\4-\2723>\35S\16t7]\225>\205Xw@Cb\10\277\321\"b\214\224\355R\360\371\210\303\23\6j\232\314T~~\230\207\"", 52) = 52
[pid 16176] 1028893614.129865 select(5, [4], NULL, NULL, NULL) = 1 (in [4])
[pid 16176] 1028893614.132419 read(4, "\314\202\212\347?je\270\33\373I\373|\"!\320\1\320\336\315\307\3\356|\260f\351\277\253\227\337\333\24k\20W_\32Mwv\346J\0\277\363\352T\313@\337\0258\214\0\300\346\254\344\360\326\315\375\251D\4\2512", 8192) = 68
[pid 16176] 1028893614.133524 write(3, "\0\0\0\t\6", 5) = 5
[pid 16175] 1028893614.134165 <... read resumed> "\0\0\0\t", 4) = 4
[pid 16175] 1028893614.134550 read(5, "\6", 9) = 1
[pid 16175] 1028893614.135140 read(5,  <unfinished ...>
[pid 16176] 1028893614.135448 write(3, "\0\0\0\4root", 8) = 8
[pid 16175] 1028893614.136068 <... read resumed> "\0\0\0\4root", 8) = 8
[pid 16175] 1028893614.136564 open("/etc/passwd", O_RDONLY) = 3
[pid 16175] 1028893614.137278 fcntl64(3, F_GETFD) = 0
[pid 16175] 1028893614.137872 fcntl64(3, F_SETFD, FD_CLOEXEC) = 0
[pid 16175] 1028893614.138005 fstat64(3, {st_mode=S_IFREG|0644, st_size=959, ...}) = 0
[pid 16175] 1028893614.138204 old_mmap(NULL, 4096, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x40014000
[pid 16175] 1028893614.138389 _llseek(3, 0, [0], SEEK_CUR) = 0
[pid 16175] 1028893614.138519 read(3, "root:x:0:0:root:/root:/bin/bash\ndaemon:x:1:1:daemon:/usr/sbin:/bin/sh\nbin:x:2:2:bin:/bin:/bin/sh\nsys:x:3:3:sys:/dev:/bin/sh\nsync:x:4:100:sync:/bin:/bin/sync\ngames:x:5:100:games:/usr/games:/bin/sh\nman:"..., 4096) = 959
[pid 16175] 1028893614.139121 close(3)  = 0
[pid 16175] 1028893614.139238 munmap(0x40014000, 4096) = 0
[pid 16175] 1028893614.139384 stat64("/bin/bash", {st_mode=S_IFREG|0755, st_size=511400, ...}) = 0
[pid 16175] 1028893614.139675 write(5, "\0\0\0M\7", 5) = 5
[pid 16175] 1028893614.139826 write(5, "\1\0\0\0\34\350F\t\10\370F\t\10\0\0\0\0\0\0\0\0\10G\t\10\30G\t\10(G\t\10\0\0\0\4root\0\0\0\1*\0\0\0\4root\0\0\0\5/root\0\0\0\t/bin/bash", 76) = 76
[pid 16175] 1028893614.140154 read(5,  <unfinished ...>
[pid 16176] 1028893614.141595 read(3, "\0\0\0M", 4) = 4
[pid 16176] 1028893614.142491 read(3, "\7\1\0\0\0\34\350F\t\10\370F\t\10\0\0\0\0\0\0\0\0\10G\t\10\30G\t\10(G\t\10\0\0\0\4root\0\0\0\1*\0\0\0\4root\0\0\0\5/root\0\0\0\t/bin/bash", 77) = 77
[pid 16176] 1028893614.143643 write(3, "\0\0\0\t%", 5) = 5
[pid 16175] 1028893614.144328 <... read resumed> "\0\0\0\t", 4) = 4
[pid 16175] 1028893614.144447 read(5, "%", 9) = 1
