process		user	tty	cpu time		time started
---------------------------------------------------------------------
sh			root	??	0.14 secs	Mon Sep 25 00:45
killall		root 	??	0.05 secs	Mon Sep 25 00:45
cat			root	??	0.02 secs	Mon Sep 25 00:45
cat			root	??	0.02 secs	Mon Sep 25 00:45
rm			root	??	0.01 secs	Mon Sep 25 00:45
strip		root	??	0.07 secs	Mon Sep 25 00:45
gcc			root	??	0.05 secs	Mon Sep 25 00:45
collect2		root	??	0.03 secs	Mon Sep 25 00:45
ld			root	??	0.23 secs	Mon Sep 25 00:45
as			root	??	0.07 secs	Mon Sep 25 00:45
cc1			root	??	0.34 secs	Mon Sep 25 00:45
cpp			root	??	0.05 secs	Mon Sep 25 00:45
cp			root	??	0.01 secs	Mon Sep 25 00:45
cat			root	??	0.02 secs	Mon Sep 25 00:45
id			root	??	0.02 secs	Mon Sep 25 00:45
ls			root	??	0.03 secs	Mon Sep 25 00:45

Figure 2: Commands executed by the intruder. The commands are listed in reverse order of completion. The information shown is a reconstruction.