8c5e43b216a8e0574dc409f4098db92f06da401a969ea59b4b713e0c87fb4893

Analysis

max time kernel
18s
max time network
129s
platform
ubuntu-18.04_amd64
resource
ubuntu1804-amd64-20261019-en
resource tags

arch:amd64arch:i386image:ubuntu1804-amd64-20261019-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system
submitted
04/11/2026, 18:13

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
meshagent
Size 3.6MB
Sample261104-wtrvbseb59
SHA256 8c5e43b216a8e0574dc409f4098db92f06da401a969ea59b4b713e0c87fb4893
MD5 6de7b384c03bad8e2a78b33844848708
SHA1 2fcd7a2dccd9768cf6773d397f185ae7fa29ef71
SHA512 e0980da6ed099eb6f279ea3998fb47d64b5d7bd4a4018cb2d4f716fb65bed5020ea1538dcbd28034865eb79be9857a2c62eeec32746875ef35d29945b1c2f5b1
SSDEEP 98304:q3iVhgLD6VGW+HqZN0pBeu2ZiHC3e2Nr2+vbDpbA:qS47Ze8
TLSH
T1CD066D43A4A614BDC69BD070CA6F91266BF0B45803B4BE7B3544E6F13F62E707B2A711
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

discovery

Malware Config

Signatures

Enumerates running processes
Discovers information about currently running processes on the system

Reads CPU attributes 1 TTPs 16 IoCs

discovery

System Information Discovery

T1082

description	ioc	Process
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps
File opened for reading	/sys/devices/system/cpu/online	ps

Reads runtime system information 64 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/1202/cmdline	ps
File opened for reading	/proc/486/cmdline	ps
File opened for reading	/proc/599/status	ps
File opened for reading	/proc/559/cmdline	ps
File opened for reading	/proc/1088/status	ps
File opened for reading	/proc/521/cmdline	ps
File opened for reading	/proc/1090/stat	ps
File opened for reading	/proc/98/status	ps
File opened for reading	/proc/468/stat	ps
File opened for reading	/proc/25/status	ps
File opened for reading	/proc/559/stat	ps
File opened for reading	/proc/599/stat	ps
File opened for reading	/proc/998/status	ps
File opened for reading	/proc/1148/status	ps
File opened for reading	/proc/171/status	ps
File opened for reading	/proc/909/status	ps
File opened for reading	/proc/25/cmdline	ps
File opened for reading	/proc/175/status	ps
File opened for reading	/proc/6/stat	ps
File opened for reading	/proc/909/cmdline	ps
File opened for reading	/proc/998/stat	ps
File opened for reading	/proc/988/stat	ps
File opened for reading	/proc/522/cmdline	ps
File opened for reading	/proc/17/stat	ps
File opened for reading	/proc/1025/stat	ps
File opened for reading	/proc/492/cmdline	ps
File opened for reading	/proc/437/stat	ps
File opened for reading	/proc/1055/stat	ps
File opened for reading	/proc/sys/kernel/osrelease	systemd-escape
File opened for reading	/proc/2/stat	ps
File opened for reading	/proc/169/cmdline	ps
File opened for reading	/proc/1025/status	ps
File opened for reading	/proc/1066/stat	ps
File opened for reading	/proc/89/status	ps
File opened for reading	/proc/200/stat	ps
File opened for reading	/proc/98/status	ps
File opened for reading	/proc/942/stat	ps
File opened for reading	/proc/sys/kernel/osrelease	loginctl
File opened for reading	/proc/998/status	ps
File opened for reading	/proc/159/stat	ps
File opened for reading	/proc/1517/status	ps
File opened for reading	/proc/1382/stat	ps
File opened for reading	/proc/163/stat	ps
File opened for reading	/proc/1068/status	ps
File opened for reading	/proc/1025/cmdline	ps
File opened for reading	/proc/464/cmdline	ps
File opened for reading	/proc/8/status	ps
File opened for reading	/proc/1042/status	ps
File opened for reading	/proc/30/status	ps
File opened for reading	/proc/169/stat	ps
File opened for reading	/proc/sys/kernel/osrelease	ps
File opened for reading	/proc/98/status	ps
File opened for reading	/proc/965/stat	ps
File opened for reading	/proc/984/status	ps
File opened for reading	/proc/1069/stat	ps
File opened for reading	/proc/1632/cmdline	ps
File opened for reading	/proc/923/cmdline	ps
File opened for reading	/proc/1017/cmdline	ps
File opened for reading	/proc/1/status	ps
File opened for reading	/proc/629/stat	ps
File opened for reading	/proc/468/stat	ps
File opened for reading	/proc/502/status	ps
File opened for reading	/proc/6/cmdline	ps
File opened for reading	/proc/1491/cmdline	ps

/tmp/meshagent
/tmp/meshagent
1⤵
PID:1524
- /bin/sh
  sh
  2⤵
  PID:1533
- - /usr/bin/awk
    awk "{ yes=0; a=split(\$0, b, \":\"); for(x=1;x<=a;++x) { if(b[x]==\"/sbin\") { yes=1; } } print yes; }"
    3⤵
    PID:1535
- /bin/sh
  sh
  2⤵
  PID:1536
- - /usr/bin/awk
    awk "{ print \$2 }"
    3⤵
    PID:1538
- - /usr/bin/whereis
    whereis pgrep
    3⤵
    PID:1537
- /bin/sh
  sh
  2⤵
  PID:1539
- - /usr/bin/awk
    awk "{ print \$2 }"
    3⤵
    PID:1541
- - /usr/bin/whereis
    whereis systemd-escape
    3⤵
    PID:1540
- /bin/systemd-escape
  systemd-escape meshagent
  2⤵
  - Reads runtime system information
  PID:1542
- /usr/bin/id
  id -u
  2⤵
  PID:1543
- /bin/sh
  sh
  2⤵
  PID:1544
- - /usr/bin/awk
    awk "{ print \$2 }"
    3⤵
    PID:1546
- - /usr/bin/whereis
    whereis zenity
    3⤵
    PID:1545
- /bin/sh
  sh
  2⤵
  PID:1547
- - /usr/bin/awk
    awk "{ print \$2 }"
    3⤵
    PID:1549
- - /usr/bin/whereis
    whereis notify-send
    3⤵
    PID:1548
- /bin/sh
  sh
  2⤵
  PID:1550
- - /usr/bin/awk
    awk "{printf \"[\";del=\"\";n=split(\$0, lines, \"`\");for(i=1;i<n;++i){ split(lines[i], tok, \" \"); if((tok[2]+0)>=1000) { if(tok[4]==\"\" || tok[4]~/^pts\\//) { continue; } printf \"%s{\\\"uid\\\": \\\"%s\\\", \\\"sid\\\": \\\"%s\\\"}\", del, tok[2], tok[1]; del=\",\"; }}printf \"]\";}"
    3⤵
    PID:1560
- - /usr/bin/tr
    tr "\\n" "`"
    3⤵
    PID:1559
- - /bin/loginctl
    loginctl list-sessions
    3⤵
    PID:1558
- /bin/sh
  sh
  2⤵
  PID:1551
- - /usr/bin/awk
    awk "{ print \$2 }"
    3⤵
    PID:1553
- - /usr/bin/whereis
    whereis loginctl
    3⤵
    PID:1552
- /bin/sh
  sh
  2⤵
  PID:1554
- - /usr/bin/awk
    awk "{ if(\$1==\"UID_MIN\") { print \$2; } }"
    3⤵
    PID:1557
- - /bin/grep
    grep UID_
    3⤵
    PID:1556
- - /bin/cat
    cat /etc/login.defs
    3⤵
    PID:1555
- /bin/sh
  sh
  2⤵
  PID:1561
- - /bin/grep
    grep "State="
    3⤵
    PID:1563
- - /usr/bin/tr
    tr "\\n" "`"
    3⤵
    PID:1564
- - /usr/bin/awk
    awk "-F`" "{ for(n=1;n<NF;++n) { if(\$n==\"State=active\") { print n; break; } } if(n==NF) { print 0; }}"
    3⤵
    PID:1565
- - /bin/loginctl
    loginctl show-session -p State
    3⤵
    PID:1562
- /bin/sh
  sh
  2⤵
  PID:1566
- - /usr/bin/awk
    awk "{ if(\$1==\"UID_MIN\") { print \$2; } }"
    3⤵
    PID:1569
- - /bin/grep
    grep UID_
    3⤵
    PID:1568
- - /bin/cat
    cat /etc/login.defs
    3⤵
    PID:1567
- /bin/sh
  sh
  2⤵
  PID:1570
- - /usr/bin/awk
    awk "{ first=\"\"; printf(\"{\"); n=split(\$0, lines, \"`\"); for(i=1;i<n;++i) { split(lines[i],A,\":\"); printf \"%s\\\"%s\\\": {\\\"user\\\":\\\"%s\\\", \\\"desc\\\":\\\"%s\\\"}\", first, A[3], A[1], A[5]; first=\",\"; } printf(\"}\");}"
    3⤵
    PID:1573
- - /usr/bin/tr
    tr "\\n" "`"
    3⤵
    PID:1572
- - /usr/bin/getent
    getent passwd
    3⤵
    PID:1571
- /bin/sh
  sh
  2⤵
  PID:1574
- - /usr/bin/awk
    awk "{printf \"[\";del=\"\";n=split(\$0, lines, \"`\");for(i=2;i<n;++i){ split(lines[i], tok, \" \"); if(tok[4]==\"\") { continue; } printf \"%s{\\\"Username\\\": \\\"%s\\\", \\\"SessionId\\\": \\\"%s\\\", \\\"State\\\": \\\"Online\\\", \\\"uid\\\": \\\"%s\\\"}\", del, tok[3], tok[1], tok[2]; del=\",\";}printf \"]\";}"
    3⤵
    PID:1577
- - /usr/bin/tr
    tr "\\n" "`"
    3⤵
    PID:1576
- - /bin/loginctl
    loginctl list-sessions
    3⤵
    PID:1575
- /bin/sh
  sh
  2⤵
  PID:1578
- - /usr/bin/awk
    awk -F: "{ print \$3 }"
    3⤵
    PID:1582
- - /usr/bin/tr
    tr "\\n" "`"
    3⤵
    PID:1581
- - /bin/grep
    grep "Gnome Display Manager"
    3⤵
    PID:1580
- - /usr/bin/getent
    getent passwd
    3⤵
    PID:1579
- /bin/sh
  sh
  2⤵
  PID:1583
- - /usr/bin/awk
    awk "{ print \$2 }"
    3⤵
    PID:1585
- - /usr/bin/whereis
    whereis ldconfig
    3⤵
    PID:1584
- /bin/sh
  sh
  2⤵
  PID:1586
- - /usr/bin/awk
    awk "-F^" "{ printf \"[\"; for(i=1;i<=NF;++i) { split(\$i, plat, \")\"); split(plat[1], plat2, \"(\"); ifox=split(plat2[2], ifo, \",\"); libc=\"\"; hwcap=\"0\"; for(ifoi=1;ifoi<=ifox;++ifoi) { if(split(ifo[ifoi], jnk, \"libc\")==2) { libc=ifo[ifoi]; } if(split(ifo[ifoi], jnk, \"hwcap:\")==2) { split(ifo[ifoi], jnk, \"0x\"); hwcap=jnk[2]; } } x=split(\$i, tok, \" \"); if(tok[1]!=\"\") { printf \"%s{\\\"lib\\\": \\\"%s\\\", \\\"path\\\": \\\"%s\\\", \\\"hwcap\\\": \\\"%s\\\", \\\"libc\\\": \\\"%s\\\"}\", (i!=1?\",\":\"\"), tok[1], tok[x], hwcap, libc; }} printf \"]\"; }"
    3⤵
    PID:1590
- - /usr/bin/tr
    tr "\\n" "^"
    3⤵
    PID:1589
- - /bin/grep
    grep libX11.so.
    3⤵
    PID:1588
- - /sbin/ldconfig
    /sbin/ldconfig -p
    3⤵
    PID:1587
- - /sbin/ldconfig.real
    /sbin/ldconfig.real -p
    3⤵
    PID:1587
- /bin/sh
  sh
  2⤵
  PID:1591
- - /usr/bin/awk
    awk "{ print \$2 }"
    3⤵
    PID:1593
- - /usr/bin/whereis
    whereis ldconfig
    3⤵
    PID:1592
- /bin/sh
  sh
  2⤵
  PID:1594
- - /usr/bin/awk
    awk "-F^" "{ printf \"[\"; for(i=1;i<=NF;++i) { split(\$i, plat, \")\"); split(plat[1], plat2, \"(\"); ifox=split(plat2[2], ifo, \",\"); libc=\"\"; hwcap=\"0\"; for(ifoi=1;ifoi<=ifox;++ifoi) { if(split(ifo[ifoi], jnk, \"libc\")==2) { libc=ifo[ifoi]; } if(split(ifo[ifoi], jnk, \"hwcap:\")==2) { split(ifo[ifoi], jnk, \"0x\"); hwcap=jnk[2]; } } x=split(\$i, tok, \" \"); if(tok[1]!=\"\") { printf \"%s{\\\"lib\\\": \\\"%s\\\", \\\"path\\\": \\\"%s\\\", \\\"hwcap\\\": \\\"%s\\\", \\\"libc\\\": \\\"%s\\\"}\", (i!=1?\",\":\"\"), tok[1], tok[x], hwcap, libc; }} printf \"]\"; }"
    3⤵
    PID:1598
- - /usr/bin/tr
    tr "\\n" "^"
    3⤵
    PID:1597
- - /bin/grep
    grep libXtst.so.
    3⤵
    PID:1596
- - /sbin/ldconfig
    /sbin/ldconfig -p
    3⤵
    PID:1595
- - /sbin/ldconfig.real
    /sbin/ldconfig.real -p
    3⤵
    PID:1595
- /bin/sh
  sh
  2⤵
  PID:1599
- - /usr/bin/awk
    awk "{ print \$2 }"
    3⤵
    PID:1601
- - /usr/bin/whereis
    whereis ldconfig
    3⤵
    PID:1600
- /bin/sh
  sh
  2⤵
  PID:1602
- - /usr/bin/awk
    awk "-F^" "{ printf \"[\"; for(i=1;i<=NF;++i) { split(\$i, plat, \")\"); split(plat[1], plat2, \"(\"); ifox=split(plat2[2], ifo, \",\"); libc=\"\"; hwcap=\"0\"; for(ifoi=1;ifoi<=ifox;++ifoi) { if(split(ifo[ifoi], jnk, \"libc\")==2) { libc=ifo[ifoi]; } if(split(ifo[ifoi], jnk, \"hwcap:\")==2) { split(ifo[ifoi], jnk, \"0x\"); hwcap=jnk[2]; } } x=split(\$i, tok, \" \"); if(tok[1]!=\"\") { printf \"%s{\\\"lib\\\": \\\"%s\\\", \\\"path\\\": \\\"%s\\\", \\\"hwcap\\\": \\\"%s\\\", \\\"libc\\\": \\\"%s\\\"}\", (i!=1?\",\":\"\"), tok[1], tok[x], hwcap, libc; }} printf \"]\"; }"
    3⤵
    PID:1606
- - /usr/bin/tr
    tr "\\n" "^"
    3⤵
    PID:1605
- - /bin/grep
    grep libXext.so.
    3⤵
    PID:1604
- - /sbin/ldconfig
    /sbin/ldconfig -p
    3⤵
    PID:1603
- - /sbin/ldconfig.real
    /sbin/ldconfig.real -p
    3⤵
    PID:1603
- /bin/sh
  sh
  2⤵
  PID:1607
- - /usr/bin/awk
    awk "{ print \$2 }"
    3⤵
    PID:1609
- - /usr/bin/whereis
    whereis ldconfig
    3⤵
    PID:1608
- /bin/sh
  sh
  2⤵
  PID:1610
- - /usr/bin/awk
    awk "-F^" "{ printf \"[\"; for(i=1;i<=NF;++i) { split(\$i, plat, \")\"); split(plat[1], plat2, \"(\"); ifox=split(plat2[2], ifo, \",\"); libc=\"\"; hwcap=\"0\"; for(ifoi=1;ifoi<=ifox;++ifoi) { if(split(ifo[ifoi], jnk, \"libc\")==2) { libc=ifo[ifoi]; } if(split(ifo[ifoi], jnk, \"hwcap:\")==2) { split(ifo[ifoi], jnk, \"0x\"); hwcap=jnk[2]; } } x=split(\$i, tok, \" \"); if(tok[1]!=\"\") { printf \"%s{\\\"lib\\\": \\\"%s\\\", \\\"path\\\": \\\"%s\\\", \\\"hwcap\\\": \\\"%s\\\", \\\"libc\\\": \\\"%s\\\"}\", (i!=1?\",\":\"\"), tok[1], tok[x], hwcap, libc; }} printf \"]\"; }"
    3⤵
    PID:1614
- - /usr/bin/tr
    tr "\\n" "^"
    3⤵
    PID:1613
- - /bin/grep
    grep libXfixes.so.
    3⤵
    PID:1612
- - /sbin/ldconfig
    /sbin/ldconfig -p
    3⤵
    PID:1611
- - /sbin/ldconfig.real
    /sbin/ldconfig.real -p
    3⤵
    PID:1611
- /bin/sh
  sh
  2⤵
  PID:1615
- - /usr/bin/awk
    awk "{ print \$2 }"
    3⤵
    PID:1617
- - /usr/bin/whereis
    whereis ldconfig
    3⤵
    PID:1616
- /bin/sh
  sh
  2⤵
  PID:1618
- - /usr/bin/awk
    awk "-F^" "{ printf \"[\"; for(i=1;i<=NF;++i) { split(\$i, plat, \")\"); split(plat[1], plat2, \"(\"); ifox=split(plat2[2], ifo, \",\"); libc=\"\"; hwcap=\"0\"; for(ifoi=1;ifoi<=ifox;++ifoi) { if(split(ifo[ifoi], jnk, \"libc\")==2) { libc=ifo[ifoi]; } if(split(ifo[ifoi], jnk, \"hwcap:\")==2) { split(ifo[ifoi], jnk, \"0x\"); hwcap=jnk[2]; } } x=split(\$i, tok, \" \"); if(tok[1]!=\"\") { printf \"%s{\\\"lib\\\": \\\"%s\\\", \\\"path\\\": \\\"%s\\\", \\\"hwcap\\\": \\\"%s\\\", \\\"libc\\\": \\\"%s\\\"}\", (i!=1?\",\":\"\"), tok[1], tok[x], hwcap, libc; }} printf \"]\"; }"
    3⤵
    PID:1622
- - /usr/bin/tr
    tr "\\n" "^"
    3⤵
    PID:1621
- - /bin/grep
    grep libxkbfile.so.
    3⤵
    PID:1620
- - /sbin/ldconfig
    /sbin/ldconfig -p
    3⤵
    PID:1619
- - /sbin/ldconfig.real
    /sbin/ldconfig.real -p
    3⤵
    PID:1619
- /bin/sh
  sh
  2⤵
  PID:1623
- - /bin/grep
    grep X
    3⤵
    PID:1625
- - /bin/ps
    ps -e
    3⤵
    - Reads CPU attributes
    - Reads runtime system information
    PID:1624
- /bin/sh
  sh
  2⤵
  PID:1626
- - /usr/bin/awk
    awk -F: "{print \$1}"
    3⤵
    PID:1628
- - /usr/bin/getent
    getent passwd 121
    3⤵
    PID:1627
- /bin/sh
  sh
  2⤵
  PID:1629
- - /usr/bin/awk
    awk "{ display=\"\"; if(\$4~/^:/) { display=\$4; } match(\$0, /-auth .+/); split(substr(\$0,RSTART+6,RLENGTH-6), _authtok, \" \"); _auth = _authtok[1]; if(\$1==\"121\" && _auth!=\"\") { printf \"%s,%s,%s,%s\",\$1,\$2,_auth,display; } }"
    3⤵
    PID:1632
- - /bin/grep
    grep X
    3⤵
    PID:1631
- - /bin/ps
    ps -e -o uid -o tty -o command
    3⤵
    - Reads CPU attributes
    - Reads runtime system information
    PID:1630
- /bin/sh
  sh
  2⤵
  PID:1633
- - /usr/bin/awk
    awk "{printf \"[\";del=\"\";n=split(\$0, lines, \"`\");for(i=1;i<n;++i){ split(lines[i], tok, \" \"); if((tok[2]+0)==121) { if(tok[4]==\"\") { continue; } printf \"%s{\\\"Username\\\": \\\"%s\\\", \\\"SessionId\\\": \\\"%s\\\", \\\"State\\\": \\\"Online\\\", \\\"uid\\\": \\\"%s\\\", \\\"tty\\\": \\\"%s\\\"}\", del, tok[3], tok[1], tok[2], tok[5]; del=\",\"; }}printf \"]\";}"
    3⤵
    PID:1636
- - /usr/bin/tr
    tr "\\n" "`"
    3⤵
    PID:1635
- - /bin/loginctl
    loginctl list-sessions
    3⤵
    PID:1634
- /bin/sh
  sh
  2⤵
  PID:1637
- - /usr/bin/awk
    awk "{ len=split(\$0,tok,\"``\"); for(n=1;n<=len;++n) { len2=split(tok[n],val,\"`\"); display=\"\"; active=\"\"; for(i=1;i<=len2;++i) { if(val[i] ~ /^Display=/) { gsub(/^Display=/,\"\",val[i]); display=val[i]; } if(val[i] ~ /^State=/) { gsub(/^State=/,\"\",val[i]); active=val[i]; } } if(active==\"active\") { print display; break; } }}"
    3⤵
    PID:1640
- - /usr/bin/tr
    tr "\\n" "`"
    3⤵
    PID:1639
- - /bin/loginctl
    loginctl show-session -p State -p Display
    3⤵
    PID:1638
- /bin/sh
  sh
  2⤵
  PID:1641
- - /usr/bin/awk
    awk -F: "{print \$6}"
    3⤵
    PID:1643
- - /usr/bin/getent
    getent passwd 121
    3⤵
    PID:1642
- /bin/sh
  sh
  2⤵
  PID:1644
- - /usr/bin/awk
    awk "{len=split(\$0,X,\"`\");Z=\"\";printf \"[\";for(i=1;i<=len;++i){ if(X[i]~/^.+├─/) { gsub(/^.+├─/,\"\",X[i]); split(X[i],VAL,\" \"); printf \"%s%s\",Z,VAL[1]; Z=\",\"; }}printf \"]\";}"
    3⤵
    PID:1647
- - /usr/bin/tr
    tr "\\n" "`"
    3⤵
    PID:1646
- - /bin/loginctl
    loginctl session-status
    3⤵
    PID:1645
- /bin/sh
  sh
  2⤵
  PID:1648
- - /usr/bin/awk
    awk "{ if(\$1==\"UID_MIN\") { print \$2; } }"
    3⤵
    PID:1651
- - /bin/grep
    grep UID_
    3⤵
    PID:1650
- - /bin/cat
    cat /etc/login.defs
    3⤵
    PID:1649
- /bin/sh
  sh
  2⤵
  PID:1652
- - /usr/bin/awk
    awk "{ first=\"\"; printf(\"{\"); n=split(\$0, lines, \"`\"); for(i=1;i<n;++i) { split(lines[i],A,\":\"); printf \"%s\\\"%s\\\": {\\\"user\\\":\\\"%s\\\", \\\"desc\\\":\\\"%s\\\"}\", first, A[3], A[1], A[5]; first=\",\"; } printf(\"}\");}"
    3⤵
    PID:1655
- - /usr/bin/tr
    tr "\\n" "`"
    3⤵
    PID:1654
- - /usr/bin/getent
    getent passwd
    3⤵
    PID:1653
- /bin/sh
  sh
  2⤵
  PID:1656
- - /usr/bin/awk
    awk "{printf \"[\";del=\"\";n=split(\$0, lines, \"`\");for(i=2;i<n;++i){ split(lines[i], tok, \" \"); if(tok[4]==\"\") { continue; } printf \"%s{\\\"Username\\\": \\\"%s\\\", \\\"SessionId\\\": \\\"%s\\\", \\\"State\\\": \\\"Online\\\", \\\"uid\\\": \\\"%s\\\"}\", del, tok[3], tok[1], tok[2]; del=\",\";}printf \"]\";}"
    3⤵
    PID:1659
- - /usr/bin/tr
    tr "\\n" "`"
    3⤵
    PID:1658
- - /bin/loginctl
    loginctl list-sessions
    3⤵
    PID:1657
- /bin/sh
  sh
  2⤵
  PID:1660
- - /usr/bin/awk
    awk -F: "{ print \$3 }"
    3⤵
    PID:1664
- - /usr/bin/tr
    tr "\\n" "`"
    3⤵
    PID:1663
- - /bin/grep
    grep "Gnome Display Manager"
    3⤵
    PID:1662
- - /usr/bin/getent
    getent passwd
    3⤵
    PID:1661
- /bin/sh
  sh
  2⤵
  PID:1665
- - /usr/bin/awk
    awk "{ xl=split(\$2,x,\"/\"); print x[xl]; }"
    3⤵
    PID:1670
- - /usr/bin/tr
    tr "\\n" "`"
    3⤵
    PID:1669
- - /bin/grep
    grep 121
    3⤵
    PID:1668
- - /bin/grep
    grep X
    3⤵
    PID:1667
- - /bin/ps
    ps -e -o uid -o cmd
    3⤵
    - Reads CPU attributes
    - Reads runtime system information
    PID:1666
- /bin/sh
  sh
  2⤵
  PID:1671
- - /usr/bin/awk
    awk -F: "{print \$1}"
    3⤵
    PID:1673
- - /usr/bin/getent
    getent passwd 0
    3⤵
    PID:1672
- /bin/sh
  sh
  2⤵
  PID:1674
- - /usr/bin/awk
    awk "{ display=\"\"; if(\$4~/^:/) { display=\$4; } match(\$0, /-auth .+/); split(substr(\$0,RSTART+6,RLENGTH-6), _authtok, \" \"); _auth = _authtok[1]; if(\$1==\"0\" && _auth!=\"\") { printf \"%s,%s,%s,%s\",\$1,\$2,_auth,display; } }"
    3⤵
    PID:1677
- - /bin/grep
    grep X
    3⤵
    PID:1676
- - /bin/ps
    ps -e -o uid -o tty -o command
    3⤵
    - Reads CPU attributes
    - Reads runtime system information
    PID:1675
- /bin/sh
  sh
  2⤵
  PID:1678
- - /usr/bin/awk
    awk "{ print \$2 }"
    3⤵
    PID:1682
- - /bin/grep
    grep root
    3⤵
    PID:1681
- - /bin/grep
    grep tty1
    3⤵
    PID:1680
- - /bin/ps
    ps -e -o tty -o pid -o user:9999
    3⤵
    - Reads CPU attributes
    - Reads runtime system information
    PID:1679
- /bin/sh
  sh
  2⤵
  PID:1683
- - /usr/bin/awk
    awk "{ xl=split(\$2,x,\"/\"); print x[xl]; }"
    3⤵
    PID:1688
- - /usr/bin/tr
    tr "\\n" "`"
    3⤵
    PID:1687
- - /bin/grep
    grep 0
    3⤵
    PID:1686
- - /bin/grep
    grep X
    3⤵
    PID:1685
- - /bin/ps
    ps -e -o uid -o cmd
    3⤵
    - Reads CPU attributes
    - Reads runtime system information
    PID:1684
- /bin/sh
  sh
  2⤵
  PID:1689
- - /bin/grep
    grep extra-button
    3⤵
    PID:1691
- - /usr/bin/zenity
    /usr/bin/zenity --help-all
    3⤵
    PID:1690
- /bin/sh
  sh
  2⤵
  PID:1692
- - /usr/bin/awk
    awk "{ if(\$1==\"UID_MIN\") { print \$2; } }"
    3⤵
    PID:1695
- - /bin/grep
    grep UID_
    3⤵
    PID:1694
- - /bin/cat
    cat /etc/login.defs
    3⤵
    PID:1693
- /bin/sh
  sh
  2⤵
  PID:1696
- - /usr/bin/awk
    awk "{printf \"[\";del=\"\";n=split(\$0, lines, \"`\");for(i=1;i<n;++i){ split(lines[i], tok, \" \"); if((tok[2]+0)>=1000) { if(tok[4]==\"\" || tok[4]~/^pts\\//) { continue; } printf \"%s{\\\"uid\\\": \\\"%s\\\", \\\"sid\\\": \\\"%s\\\"}\", del, tok[2], tok[1]; del=\",\"; }}printf \"]\";}"
    3⤵
    PID:1703
- - /usr/bin/tr
    tr "\\n" "`"
    3⤵
    PID:1702
- - /bin/loginctl
    loginctl list-sessions
    3⤵
    PID:1701
- /bin/sh
  sh
  2⤵
  PID:1697
- - /usr/bin/awk
    awk "{ if(\$1==\"UID_MIN\") { print \$2; } }"
    3⤵
    PID:1700
- - /bin/grep
    grep UID_
    3⤵
    PID:1699
- - /bin/cat
    cat /etc/login.defs
    3⤵
    PID:1698
- /bin/sh
  sh
  2⤵
  PID:1704
- - /usr/bin/awk
    awk "-F`" "{ for(n=1;n<NF;++n) { if(\$n==\"State=active\") { print n; break; } } if(n==NF) { print 0; }}"
    3⤵
    PID:1708
- - /usr/bin/tr
    tr "\\n" "`"
    3⤵
    PID:1707
- - /bin/grep
    grep "State="
    3⤵
    PID:1706
- - /bin/loginctl
    loginctl show-session -p State
    3⤵
    PID:1705
- /bin/sh
  sh
  2⤵
  PID:1709
- - /usr/bin/awk
    awk "{ if(\$1==\"UID_MIN\") { print \$2; } }"
    3⤵
    PID:1712
- - /bin/grep
    grep UID_
    3⤵
    PID:1711
- - /bin/cat
    cat /etc/login.defs
    3⤵
    PID:1710
- /bin/sh
  sh
  2⤵
  PID:1713
- - /usr/bin/awk
    awk "{ first=\"\"; printf(\"{\"); n=split(\$0, lines, \"`\"); for(i=1;i<n;++i) { split(lines[i],A,\":\"); printf \"%s\\\"%s\\\": {\\\"user\\\":\\\"%s\\\", \\\"desc\\\":\\\"%s\\\"}\", first, A[3], A[1], A[5]; first=\",\"; } printf(\"}\");}"
    3⤵
    PID:1716
- - /usr/bin/tr
    tr "\\n" "`"
    3⤵
    PID:1715
- - /usr/bin/getent
    getent passwd
    3⤵
    PID:1714
- /bin/sh
  sh
  2⤵
  PID:1717
- - /usr/bin/awk
    awk "{printf \"[\";del=\"\";n=split(\$0, lines, \"`\");for(i=2;i<n;++i){ split(lines[i], tok, \" \"); if(tok[4]==\"\") { continue; } printf \"%s{\\\"Username\\\": \\\"%s\\\", \\\"SessionId\\\": \\\"%s\\\", \\\"State\\\": \\\"Online\\\", \\\"uid\\\": \\\"%s\\\"}\", del, tok[3], tok[1], tok[2]; del=\",\";}printf \"]\";}"
    3⤵
    PID:1720
- - /usr/bin/tr
    tr "\\n" "`"
    3⤵
    PID:1719
- - /bin/loginctl
    loginctl list-sessions
    3⤵
    PID:1718
- /bin/sh
  sh
  2⤵
  PID:1721
- - /usr/bin/awk
    awk -F: "{ print \$3 }"
    3⤵
    PID:1725
- - /usr/bin/tr
    tr "\\n" "`"
    3⤵
    PID:1724
- - /bin/grep
    grep "Gnome Display Manager"
    3⤵
    PID:1723
- - /usr/bin/getent
    getent passwd
    3⤵
    PID:1722
- /bin/sh
  sh
  2⤵
  PID:1726
- - /usr/bin/awk
    awk -F: "{print \$1}"
    3⤵
    PID:1728
- - /usr/bin/getent
    getent passwd 121
    3⤵
    PID:1727
- /bin/sh
  sh
  2⤵
  PID:1729
- - /usr/bin/awk
    awk "{ display=\"\"; if(\$4~/^:/) { display=\$4; } match(\$0, /-auth .+/); split(substr(\$0,RSTART+6,RLENGTH-6), _authtok, \" \"); _auth = _authtok[1]; if(\$1==\"121\" && _auth!=\"\") { printf \"%s,%s,%s,%s\",\$1,\$2,_auth,display; } }"
    3⤵
    PID:1732
- - /bin/grep
    grep X
    3⤵
    PID:1731
- - /bin/ps
    ps -e -o uid -o tty -o command
    3⤵
    - Reads CPU attributes
    - Reads runtime system information
    PID:1730
- /bin/sh
  sh
  2⤵
  PID:1733
- - /usr/bin/awk
    awk "{printf \"[\";del=\"\";n=split(\$0, lines, \"`\");for(i=1;i<n;++i){ split(lines[i], tok, \" \"); if((tok[2]+0)==121) { if(tok[4]==\"\") { continue; } printf \"%s{\\\"Username\\\": \\\"%s\\\", \\\"SessionId\\\": \\\"%s\\\", \\\"State\\\": \\\"Online\\\", \\\"uid\\\": \\\"%s\\\", \\\"tty\\\": \\\"%s\\\"}\", del, tok[3], tok[1], tok[2], tok[5]; del=\",\"; }}printf \"]\";}"
    3⤵
    PID:1736
- - /usr/bin/tr
    tr "\\n" "`"
    3⤵
    PID:1735
- - /bin/loginctl
    loginctl list-sessions
    3⤵
    PID:1734
- /bin/sh
  sh
  2⤵
  PID:1737
- - /usr/bin/awk
    awk "{ len=split(\$0,tok,\"``\"); for(n=1;n<=len;++n) { len2=split(tok[n],val,\"`\"); display=\"\"; active=\"\"; for(i=1;i<=len2;++i) { if(val[i] ~ /^Display=/) { gsub(/^Display=/,\"\",val[i]); display=val[i]; } if(val[i] ~ /^State=/) { gsub(/^State=/,\"\",val[i]); active=val[i]; } } if(active==\"active\") { print display; break; } }}"
    3⤵
    PID:1740
- - /usr/bin/tr
    tr "\\n" "`"
    3⤵
    PID:1739
- - /bin/loginctl
    loginctl show-session -p State -p Display
    3⤵
    PID:1738
- /bin/sh
  sh
  2⤵
  PID:1741
- - /usr/bin/awk
    awk -F: "{print \$6}"
    3⤵
    PID:1743
- - /usr/bin/getent
    getent passwd 121
    3⤵
    PID:1742
- /bin/sh
  sh
  2⤵
  PID:1744
- - /usr/bin/awk
    awk "{len=split(\$0,X,\"`\");Z=\"\";printf \"[\";for(i=1;i<=len;++i){ if(X[i]~/^.+├─/) { gsub(/^.+├─/,\"\",X[i]); split(X[i],VAL,\" \"); printf \"%s%s\",Z,VAL[1]; Z=\",\"; }}printf \"]\";}"
    3⤵
    PID:1747
- - /usr/bin/tr
    tr "\\n" "`"
    3⤵
    PID:1746
- - /bin/loginctl
    loginctl session-status
    3⤵
    PID:1745
- /bin/sh
  sh
  2⤵
  PID:1748
- - /usr/bin/awk
    awk "{ if(\$1==\"UID_MIN\") { print \$2; } }"
    3⤵
    PID:1751
- - /bin/grep
    grep UID_
    3⤵
    PID:1750
- - /bin/cat
    cat /etc/login.defs
    3⤵
    PID:1749
- /bin/sh
  sh
  2⤵
  PID:1752
- - /usr/bin/awk
    awk "{ first=\"\"; printf(\"{\"); n=split(\$0, lines, \"`\"); for(i=1;i<n;++i) { split(lines[i],A,\":\"); printf \"%s\\\"%s\\\": {\\\"user\\\":\\\"%s\\\", \\\"desc\\\":\\\"%s\\\"}\", first, A[3], A[1], A[5]; first=\",\"; } printf(\"}\");}"
    3⤵
    PID:1755
- - /usr/bin/tr
    tr "\\n" "`"
    3⤵
    PID:1754
- - /usr/bin/getent
    getent passwd
    3⤵
    PID:1753
- /bin/sh
  sh
  2⤵
  PID:1756
- - /usr/bin/awk
    awk "{printf \"[\";del=\"\";n=split(\$0, lines, \"`\");for(i=2;i<n;++i){ split(lines[i], tok, \" \"); if(tok[4]==\"\") { continue; } printf \"%s{\\\"Username\\\": \\\"%s\\\", \\\"SessionId\\\": \\\"%s\\\", \\\"State\\\": \\\"Online\\\", \\\"uid\\\": \\\"%s\\\"}\", del, tok[3], tok[1], tok[2]; del=\",\";}printf \"]\";}"
    3⤵
    PID:1759
- - /usr/bin/tr
    tr "\\n" "`"
    3⤵
    PID:1758
- - /bin/loginctl
    loginctl list-sessions
    3⤵
    PID:1757
- /bin/sh
  sh
  2⤵
  PID:1760
- - /usr/bin/awk
    awk -F: "{ print \$3 }"
    3⤵
    PID:1764
- - /usr/bin/tr
    tr "\\n" "`"
    3⤵
    PID:1763
- - /bin/grep
    grep "Gnome Display Manager"
    3⤵
    PID:1762
- - /usr/bin/getent
    getent passwd
    3⤵
    PID:1761
- /bin/sh
  sh
  2⤵
  PID:1765
- - /usr/bin/awk
    awk "{ xl=split(\$2,x,\"/\"); print x[xl]; }"
    3⤵
    PID:1770
- - /usr/bin/tr
    tr "\\n" "`"
    3⤵
    PID:1769
- - /bin/grep
    grep 121
    3⤵
    PID:1768
- - /bin/grep
    grep X
    3⤵
    PID:1767
- - /bin/ps
    ps -e -o uid -o cmd
    3⤵
    - Reads CPU attributes
    - Reads runtime system information
    PID:1766
- /bin/sh
  sh
  2⤵
  PID:1771
- - /usr/bin/awk
    awk -F: "{print \$1}"
    3⤵
    PID:1773
- - /usr/bin/getent
    getent passwd 0
    3⤵
    PID:1772
- /bin/sh
  sh
  2⤵
  PID:1774
- - /usr/bin/awk
    awk "{ display=\"\"; if(\$4~/^:/) { display=\$4; } match(\$0, /-auth .+/); split(substr(\$0,RSTART+6,RLENGTH-6), _authtok, \" \"); _auth = _authtok[1]; if(\$1==\"0\" && _auth!=\"\") { printf \"%s,%s,%s,%s\",\$1,\$2,_auth,display; } }"
    3⤵
    PID:1777
- - /bin/grep
    grep X
    3⤵
    PID:1776
- - /bin/ps
    ps -e -o uid -o tty -o command
    3⤵
    - Reads CPU attributes
    - Reads runtime system information
    PID:1775
- /bin/sh
  sh
  2⤵
  PID:1778
- - /usr/bin/awk
    awk "{ print \$2 }"
    3⤵
    PID:1782
- - /bin/grep
    grep root
    3⤵
    PID:1781
- - /bin/grep
    grep tty1
    3⤵
    PID:1780
- - /bin/ps
    ps -e -o tty -o pid -o user:9999
    3⤵
    - Reads CPU attributes
    - Reads runtime system information
    PID:1779
- /bin/sh
  sh
  2⤵
  PID:1783
- - /usr/bin/awk
    awk "{ xl=split(\$2,x,\"/\"); print x[xl]; }"
    3⤵
    PID:1788
- - /usr/bin/tr
    tr "\\n" "`"
    3⤵
    PID:1787
- - /bin/grep
    grep 0
    3⤵
    PID:1786
- - /bin/grep
    grep X
    3⤵
    PID:1785
- - /bin/ps
    ps -e -o uid -o cmd
    3⤵
    - Reads CPU attributes
    - Reads runtime system information
    PID:1784
- /bin/sh
  sh
  2⤵
  PID:1789
- - /usr/bin/awk
    awk "{printf \"[\";del=\"\";n=split(\$0, lines, \"`\");for(i=1;i<n;++i){ split(lines[i], tok, \" \"); if((tok[2]+0)>=1000) { if(tok[4]==\"\" || tok[4]~/^pts\\//) { continue; } printf \"%s{\\\"uid\\\": \\\"%s\\\", \\\"sid\\\": \\\"%s\\\"}\", del, tok[2], tok[1]; del=\",\"; }}printf \"]\";}"
    3⤵
    PID:1796
- - /usr/bin/tr
    tr "\\n" "`"
    3⤵
    PID:1795
- - /bin/loginctl
    loginctl list-sessions
    3⤵
    PID:1794
- /bin/sh
  sh
  2⤵
  PID:1790
- - /usr/bin/awk
    awk "{ if(\$1==\"UID_MIN\") { print \$2; } }"
    3⤵
    PID:1793
- - /bin/grep
    grep UID_
    3⤵
    PID:1792
- - /bin/cat
    cat /etc/login.defs
    3⤵
    PID:1791
- /bin/sh
  sh
  2⤵
  PID:1797
- - /usr/bin/awk
    awk "-F`" "{ for(n=1;n<NF;++n) { if(\$n==\"State=active\") { print n; break; } } if(n==NF) { print 0; }}"
    3⤵
    PID:1801
- - /usr/bin/tr
    tr "\\n" "`"
    3⤵
    PID:1800
- - /bin/grep
    grep "State="
    3⤵
    PID:1799
- - /bin/loginctl
    loginctl show-session -p State
    3⤵
    PID:1798
- /bin/sh
  sh
  2⤵
  PID:1802
- - /usr/bin/awk
    awk "{ if(\$1==\"UID_MIN\") { print \$2; } }"
    3⤵
    PID:1805
- - /bin/grep
    grep UID_
    3⤵
    PID:1804
- - /bin/cat
    cat /etc/login.defs
    3⤵
    PID:1803
- /bin/sh
  sh
  2⤵
  PID:1806
- - /usr/bin/awk
    awk "{ first=\"\"; printf(\"{\"); n=split(\$0, lines, \"`\"); for(i=1;i<n;++i) { split(lines[i],A,\":\"); printf \"%s\\\"%s\\\": {\\\"user\\\":\\\"%s\\\", \\\"desc\\\":\\\"%s\\\"}\", first, A[3], A[1], A[5]; first=\",\"; } printf(\"}\");}"
    3⤵
    PID:1809
- - /usr/bin/tr
    tr "\\n" "`"
    3⤵
    PID:1808
- - /usr/bin/getent
    getent passwd
    3⤵
    PID:1807
- /bin/sh
  sh
  2⤵
  PID:1810
- - /usr/bin/awk
    awk "{printf \"[\";del=\"\";n=split(\$0, lines, \"`\");for(i=2;i<n;++i){ split(lines[i], tok, \" \"); if(tok[4]==\"\") { continue; } printf \"%s{\\\"Username\\\": \\\"%s\\\", \\\"SessionId\\\": \\\"%s\\\", \\\"State\\\": \\\"Online\\\", \\\"uid\\\": \\\"%s\\\"}\", del, tok[3], tok[1], tok[2]; del=\",\";}printf \"]\";}"
    3⤵
    PID:1813
- - /usr/bin/tr
    tr "\\n" "`"
    3⤵
    PID:1812
- - /bin/loginctl
    loginctl list-sessions
    3⤵
    PID:1811
- /bin/sh
  sh
  2⤵
  PID:1814
- - /usr/bin/awk
    awk -F: "{ print \$3 }"
    3⤵
    PID:1818
- - /usr/bin/tr
    tr "\\n" "`"
    3⤵
    PID:1817
- - /bin/grep
    grep "Gnome Display Manager"
    3⤵
    PID:1816
- - /usr/bin/getent
    getent passwd
    3⤵
    PID:1815
- /bin/sh
  sh
  2⤵
  PID:1819
- - /usr/bin/awk
    awk -F: "{print \$1}"
    3⤵
    PID:1821
- - /usr/bin/getent
    getent passwd 121
    3⤵
    PID:1820
- /bin/sh
  sh
  2⤵
  PID:1822
- - /usr/bin/awk
    awk "{ display=\"\"; if(\$4~/^:/) { display=\$4; } match(\$0, /-auth .+/); split(substr(\$0,RSTART+6,RLENGTH-6), _authtok, \" \"); _auth = _authtok[1]; if(\$1==\"121\" && _auth!=\"\") { printf \"%s,%s,%s,%s\",\$1,\$2,_auth,display; } }"
    3⤵
    PID:1825
- - /bin/grep
    grep X
    3⤵
    PID:1824
- - /bin/ps
    ps -e -o uid -o tty -o command
    3⤵
    - Reads CPU attributes
    - Reads runtime system information
    PID:1823
- /bin/sh
  sh
  2⤵
  PID:1826
- - /usr/bin/awk
    awk "{printf \"[\";del=\"\";n=split(\$0, lines, \"`\");for(i=1;i<n;++i){ split(lines[i], tok, \" \"); if((tok[2]+0)==121) { if(tok[4]==\"\") { continue; } printf \"%s{\\\"Username\\\": \\\"%s\\\", \\\"SessionId\\\": \\\"%s\\\", \\\"State\\\": \\\"Online\\\", \\\"uid\\\": \\\"%s\\\", \\\"tty\\\": \\\"%s\\\"}\", del, tok[3], tok[1], tok[2], tok[5]; del=\",\"; }}printf \"]\";}"
    3⤵
    PID:1829
- - /usr/bin/tr
    tr "\\n" "`"
    3⤵
    PID:1828
- - /bin/loginctl
    loginctl list-sessions
    3⤵
    - Reads runtime system information
    PID:1827
- /bin/sh
  sh
  2⤵
  PID:1830
- - /usr/bin/awk
    awk "{ len=split(\$0,tok,\"``\"); for(n=1;n<=len;++n) { len2=split(tok[n],val,\"`\"); display=\"\"; active=\"\"; for(i=1;i<=len2;++i) { if(val[i] ~ /^Display=/) { gsub(/^Display=/,\"\",val[i]); display=val[i]; } if(val[i] ~ /^State=/) { gsub(/^State=/,\"\",val[i]); active=val[i]; } } if(active==\"active\") { print display; break; } }}"
    3⤵
    PID:1833
- - /usr/bin/tr
    tr "\\n" "`"
    3⤵
    PID:1832
- - /bin/loginctl
    loginctl show-session -p State -p Display
    3⤵
    PID:1831
- /bin/sh
  sh
  2⤵
  PID:1834
- - /usr/bin/awk
    awk -F: "{print \$6}"
    3⤵
    PID:1836
- - /usr/bin/getent
    getent passwd 121
    3⤵
    PID:1835
- /bin/sh
  sh
  2⤵
  PID:1837
- - /usr/bin/awk
    awk "{len=split(\$0,X,\"`\");Z=\"\";printf \"[\";for(i=1;i<=len;++i){ if(X[i]~/^.+├─/) { gsub(/^.+├─/,\"\",X[i]); split(X[i],VAL,\" \"); printf \"%s%s\",Z,VAL[1]; Z=\",\"; }}printf \"]\";}"
    3⤵
    PID:1840
- - /usr/bin/tr
    tr "\\n" "`"
    3⤵
    PID:1839
- - /bin/loginctl
    loginctl session-status
    3⤵
    PID:1838
- /bin/sh
  sh
  2⤵
  PID:1841
- - /usr/bin/awk
    awk "{ if(\$1==\"UID_MIN\") { print \$2; } }"
    3⤵
    PID:1844
- - /bin/grep
    grep UID_
    3⤵
    PID:1843
- - /bin/cat
    cat /etc/login.defs
    3⤵
    PID:1842
- /bin/sh
  sh
  2⤵
  PID:1845
- - /usr/bin/awk
    awk "{ first=\"\"; printf(\"{\"); n=split(\$0, lines, \"`\"); for(i=1;i<n;++i) { split(lines[i],A,\":\"); printf \"%s\\\"%s\\\": {\\\"user\\\":\\\"%s\\\", \\\"desc\\\":\\\"%s\\\"}\", first, A[3], A[1], A[5]; first=\",\"; } printf(\"}\");}"
    3⤵
    PID:1848
- - /usr/bin/tr
    tr "\\n" "`"
    3⤵
    PID:1847
- - /usr/bin/getent
    getent passwd
    3⤵
    PID:1846
- /bin/sh
  sh
  2⤵
  PID:1849
- - /usr/bin/awk
    awk "{printf \"[\";del=\"\";n=split(\$0, lines, \"`\");for(i=2;i<n;++i){ split(lines[i], tok, \" \"); if(tok[4]==\"\") { continue; } printf \"%s{\\\"Username\\\": \\\"%s\\\", \\\"SessionId\\\": \\\"%s\\\", \\\"State\\\": \\\"Online\\\", \\\"uid\\\": \\\"%s\\\"}\", del, tok[3], tok[1], tok[2]; del=\",\";}printf \"]\";}"
    3⤵
    PID:1852
- - /usr/bin/tr
    tr "\\n" "`"
    3⤵
    PID:1851
- - /bin/loginctl
    loginctl list-sessions
    3⤵
    PID:1850
- /bin/sh
  sh
  2⤵
  PID:1853
- - /usr/bin/awk
    awk -F: "{ print \$3 }"
    3⤵
    PID:1857
- - /usr/bin/tr
    tr "\\n" "`"
    3⤵
    PID:1856
- - /bin/grep
    grep "Gnome Display Manager"
    3⤵
    PID:1855
- - /usr/bin/getent
    getent passwd
    3⤵
    PID:1854
- /bin/sh
  sh
  2⤵
  PID:1858
- - /usr/bin/awk
    awk "{ xl=split(\$2,x,\"/\"); print x[xl]; }"
    3⤵
    PID:1863
- - /usr/bin/tr
    tr "\\n" "`"
    3⤵
    PID:1862
- - /bin/grep
    grep 121
    3⤵
    PID:1861
- - /bin/grep
    grep X
    3⤵
    PID:1860
- - /bin/ps
    ps -e -o uid -o cmd
    3⤵
    - Reads CPU attributes
    - Reads runtime system information
    PID:1859
- /bin/sh
  sh
  2⤵
  PID:1864
- - /usr/bin/awk
    awk -F: "{print \$1}"
    3⤵
    PID:1866
- - /usr/bin/getent
    getent passwd 0
    3⤵
    PID:1865
- /bin/sh
  sh
  2⤵
  PID:1867
- - /usr/bin/awk
    awk "{ display=\"\"; if(\$4~/^:/) { display=\$4; } match(\$0, /-auth .+/); split(substr(\$0,RSTART+6,RLENGTH-6), _authtok, \" \"); _auth = _authtok[1]; if(\$1==\"0\" && _auth!=\"\") { printf \"%s,%s,%s,%s\",\$1,\$2,_auth,display; } }"
    3⤵
    PID:1870
- - /bin/grep
    grep X
    3⤵
    PID:1869
- - /bin/ps
    ps -e -o uid -o tty -o command
    3⤵
    - Reads CPU attributes
    - Reads runtime system information
    PID:1868
- /bin/sh
  sh
  2⤵
  PID:1871
- - /usr/bin/awk
    awk "{ print \$2 }"
    3⤵
    PID:1875
- - /bin/grep
    grep root
    3⤵
    PID:1874
- - /bin/grep
    grep tty1
    3⤵
    PID:1873
- - /bin/ps
    ps -e -o tty -o pid -o user:9999
    3⤵
    - Reads CPU attributes
    - Reads runtime system information
    PID:1872
- /bin/sh
  sh
  2⤵
  PID:1876
- - /usr/bin/awk
    awk "{ xl=split(\$2,x,\"/\"); print x[xl]; }"
    3⤵
    PID:1881
- - /usr/bin/tr
    tr "\\n" "`"
    3⤵
    PID:1880
- - /bin/grep
    grep 0
    3⤵
    PID:1879
- - /bin/grep
    grep X
    3⤵
    PID:1878
- - /bin/ps
    ps -e -o uid -o cmd
    3⤵
    - Reads CPU attributes
    - Reads runtime system information
    PID:1877
- /bin/sh
  sh
  2⤵
  PID:1882
- - /bin/grep
    grep timeout
    3⤵
    PID:1884
- - /usr/bin/zenity
    /usr/bin/zenity --help-all
    3⤵
    PID:1883
- /usr/bin/zenity
  zenity --info "--ok-label=Install" "--extra-button=Connect" "--extra-button=Cancel" "--title=MeshCentral Agent Setup" "--text=Agent: NOT INSTALLED Device Group: linux Server URL: wss://13.232.188.82:443/agent.ashx " --no-wrap "--timeout=99999"
  2⤵
  PID:1885

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads