Two engagements, traced step by step

1. T+00:00 Ingress pushes a hidden, randomly named binary into a world-writable temp directory over SSHone SSH session per step; the filename changes with every drop, the hash does not
2. T+00:01 Ingress marks the dropped file executablea second session from the same source, one second later
3. T+00:05 Ingress launches it detached, output redirected to a hidden sibling logmark-executable, then a detached launch from a temp path: a pre-encryption detection seam
4. T+00:07 Maneuver starts, then unlinks its own binary, log and lock filegone from disk within seconds, still held open by the running process
5. T+ ··:·· Maneuver enumerates running processes and stops database enginesbefore any file is touched; failures are logged, not blocking
6. T+01:13 Effects writes a victim-ID file whose name encodes the infection timethe filename alone dates the infection to the nanosecond
7. T+01:13 Effects encrypts user files and appends a new extension241 files in about 15 seconds in one observed cycle
8. T+ ··:·· Maneuver fans out SSH brute-force scanning from the same processconcurrent with encryption: by the time files change, the next targets are already being tried
9. T+01:28 Effects completes the encryption passa zero-byte marker flags the host as already processed; its path, not its hash, is the indicator

Illustrative sequence based on published OHIIHO Research: Catching Sorry-worm in the wild [1/3] ↗. Composite and sanitized; timings from the published session record, untimed steps are ordered, not timed.