From 21564d3a00c3835c4dd5e8cebb94243ab37add7e Mon Sep 17 00:00:00 2001 From: homelab-runtime-publisher Date: Wed, 7 Oct 2026 04:00:20 +0000 Subject: [PATCH] runtime: publish SUPPORT-261007-WINDOWS-DACHA-MISSING-REVERSE-PLINK-RCA-99753R1 --- ...CHA-MISSING-REVERSE-PLINK-RCA-99753R1.json | 38 +++ ...ACHA-MISSING-REVERSE-PLINK-RCA-99753R1.txt | 200 +++++++++++++ runtime/latest.json | 16 +- runtime/latest.txt | 282 ++++++++++-------- 4 files changed, 403 insertions(+), 133 deletions(-) create mode 100644 runtime/history/SUPPORT-261007-WINDOWS-DACHA-MISSING-REVERSE-PLINK-RCA-99753R1.json create mode 100644 runtime/history/SUPPORT-261007-WINDOWS-DACHA-MISSING-REVERSE-PLINK-RCA-99753R1.txt diff --git a/runtime/history/SUPPORT-261007-WINDOWS-DACHA-MISSING-REVERSE-PLINK-RCA-99753R1.json b/runtime/history/SUPPORT-261007-WINDOWS-DACHA-MISSING-REVERSE-PLINK-RCA-99753R1.json new file mode 100644 index 00000000..4f867823 --- /dev/null +++ b/runtime/history/SUPPORT-261007-WINDOWS-DACHA-MISSING-REVERSE-PLINK-RCA-99753R1.json @@ -0,0 +1,38 @@ +{ + "schema_version": 1, + "channel": "homelab-runtime", + "command_id": "SUPPORT-261007-WINDOWS-DACHA-MISSING-REVERSE-PLINK-RCA-99753R1", + "status": "OK", + "rc": 0, + "host": "pve01", + "mode": "read-only", + "component": "windows-dacha-missing-reverse-plink-rca", + "started_at_utc": "2026-10-07T04:00:19Z", + "finished_at_utc": "2026-10-07T04:00:19Z", + "reference_register_checked": true, + "reference_sha256": "5a3d8e5154c41cb582a4e0aca68090be1f0138918bf82131a948df326f9d8d66", + "error_register_checked": true, + "error_register_sha256": "3b09a553ec0f527ed3afeed4753f52a74ee3036045bbfb3c685e9f8af4ba7ba0", + "command_sha256": "d289d7bc43289666a4ccfe7fc59455bd687b7f7c352661d10fe80b0e98985c4a", + "duplicate_failed_command_blocked": false, + "block_reason": null, + "execution_started": true, + "change_declared": false, + "result_contract_valid": true, + "result_contract_status": null, + "result_contract_error": null, + "command_rc": 0, + "changes_made": false, + "rollback_started": false, + "rollback_restored": null, + "mutation_outcome": "NO_MUTATION", + "sanitized": true, + "secrets_included": false, + "private_addresses_included": false, + "raw_evidence_retained_locally": true, + "raw_evidence_sha256": "6018d2046ced7926ff69efd1924f09f46e9f3502f93d25f53709946add9baa9b", + "sanitized_output_sha256": "6018d2046ced7926ff69efd1924f09f46e9f3502f93d25f53709946add9baa9b", + "output_truncated_in_json": false, + "full_sanitized_output_url": "https://git.gram1.ru/.well-known/homelab-runtime/latest.txt", + "output": "WINDOWS_DACHA_MISSING_REVERSE_PLINK_RCA=V1\nMODE=read-only\nNO_MUTATION=true\nWINDOWS_LOCAL_INSPECT_RC=0\nWINDOWS_EVIDENCE_PRESENT=true\nREC|PLINK_PROC|IDX=1|PID=14608|SESSION=1\nPLINK1_OWNER_QUERY_RC=0\nPLINK1_PAGEANT_SAME_OWNER_SESSION_COUNT=1\nPLINK1_CMD_AVAILABLE=true\nPLINK1_HAS_AGENT=true\nPLINK1_HAS_NOAGENT=false\nPLINK1_HAS_BATCH=true\nPLINK1_HAS_LOAD=false\nPLINK1_HAS_KEYFILE=false\nPLINK1_HAS_PROXYCMD=false\nPLINK1_HAS_N=true\nPLINK_PROCESS_COUNT=1\nSTARTUP_FOLDER_PRESENT=true\nREC|STARTUP_ALL|IDX=1|EXT=lnk|TARGET_BASENAME=cloud.exe|ARG_LENGTH=10|HAS_64020=false|HAS_64022=false|HAS_PLINK=false|HAS_PAGEANT=false|HAS_POWERSHELL=false\nSTARTUP1_ARGS_CMD_AVAILABLE=true\nSTARTUP1_ARGS_HAS_AGENT=false\nSTARTUP1_ARGS_HAS_NOAGENT=false\nSTARTUP1_ARGS_HAS_BATCH=false\nSTARTUP1_ARGS_HAS_LOAD=false\nSTARTUP1_ARGS_HAS_KEYFILE=false\nSTARTUP1_ARGS_HAS_PROXYCMD=false\nSTARTUP1_ARGS_HAS_N=false\nREC|STARTUP_ALL|IDX=2|EXT=ini\nREC|STARTUP_ALL|IDX=3|EXT=lnk|TARGET_BASENAME=fscapture.exe|ARG_LENGTH=7|HAS_64020=false|HAS_64022=false|HAS_PLINK=false|HAS_PAGEANT=false|HAS_POWERSHELL=false\nSTARTUP3_ARGS_CMD_AVAILABLE=true\nSTARTUP3_ARGS_HAS_AGENT=false\nSTARTUP3_ARGS_HAS_NOAGENT=false\nSTARTUP3_ARGS_HAS_BATCH=false\nSTARTUP3_ARGS_HAS_LOAD=false\nSTARTUP3_ARGS_HAS_KEYFILE=false\nSTARTUP3_ARGS_HAS_PROXYCMD=false\nSTARTUP3_ARGS_HAS_N=false\nREC|STARTUP_ALL|IDX=4|EXT=lnk|TARGET_BASENAME=powershell.exe|ARG_LENGTH=120|HAS_64020=false|HAS_64022=false|HAS_PLINK=false|HAS_PAGEANT=false|HAS_POWERSHELL=true\nSTARTUP4_ARGS_CMD_AVAILABLE=true\nSTARTUP4_ARGS_HAS_AGENT=false\nSTARTUP4_ARGS_HAS_NOAGENT=false\nSTARTUP4_ARGS_HAS_BATCH=false\nSTARTUP4_ARGS_HAS_LOAD=false\nSTARTUP4_ARGS_HAS_KEYFILE=false\nSTARTUP4_ARGS_HAS_PROXYCMD=false\nSTARTUP4_ARGS_HAS_N=false\nREC|STARTUP_ARG_REF|IDX=4|BASENAME=proxystackstartup.ps1|EXT=ps1\nREC|STARTUP_ALL|IDX=5|EXT=lnk|TARGET_BASENAME=pageant.exe|ARG_LENGTH=61|HAS_64020=false|HAS_64022=false|HAS_PLINK=false|HAS_PAGEANT=true|HAS_POWERSHELL=false\nSTARTUP5_ARGS_CMD_AVAILABLE=true\nSTARTUP5_ARGS_HAS_AGENT=false\nSTARTUP5_ARGS_HAS_NOAGENT=false\nSTARTUP5_ARGS_HAS_BATCH=false\nSTARTUP5_ARGS_HAS_LOAD=false\nSTARTUP5_ARGS_HAS_KEYFILE=false\nSTARTUP5_ARGS_HAS_PROXYCMD=false\nSTARTUP5_ARGS_HAS_N=false\nREC|STARTUP_ALL|IDX=6|EXT=backup\nREC|STARTUP_ALL|IDX=7|EXT=lnk|TARGET_BASENAME=punto.exe|ARG_LENGTH=0|HAS_64020=false|HAS_64022=false|HAS_PLINK=false|HAS_PAGEANT=false|HAS_POWERSHELL=false\nSTARTUP7_ARGS_CMD_AVAILABLE=false\nREC|STARTUP_ALL|IDX=8|EXT=lnk|TARGET_BASENAME=powershell.exe|ARG_LENGTH=131|HAS_64020=false|HAS_64022=false|HAS_PLINK=false|HAS_PAGEANT=false|HAS_POWERSHELL=true\nSTARTUP8_ARGS_CMD_AVAILABLE=true\nSTARTUP8_ARGS_HAS_AGENT=false\nSTARTUP8_ARGS_HAS_NOAGENT=false\nSTARTUP8_ARGS_HAS_BATCH=false\nSTARTUP8_ARGS_HAS_LOAD=false\nSTARTUP8_ARGS_HAS_KEYFILE=false\nSTARTUP8_ARGS_HAS_PROXYCMD=false\nSTARTUP8_ARGS_HAS_N=false\nREC|STARTUP_ARG_REF|IDX=8|BASENAME=watchdog.ps1|EXT=ps1\nREC|STARTUP_ALL|IDX=9|EXT=lnk|TARGET_BASENAME=powershell.exe|ARG_LENGTH=171|HAS_64020=true|HAS_64022=true|HAS_PLINK=false|HAS_PAGEANT=false|HAS_POWERSHELL=true\nSTARTUP9_ARGS_CMD_AVAILABLE=true\nSTARTUP9_ARGS_HAS_AGENT=false\nSTARTUP9_ARGS_HAS_NOAGENT=false\nSTARTUP9_ARGS_HAS_BATCH=false\nSTARTUP9_ARGS_HAS_LOAD=false\nSTARTUP9_ARGS_HAS_KEYFILE=false\nSTARTUP9_ARGS_HAS_PROXYCMD=false\nSTARTUP9_ARGS_HAS_N=false\nREC|STARTUP_ARG_REF|IDX=9|BASENAME=bridge.ps1|EXT=ps1\nREC|STARTUP_ALL|IDX=10|EXT=lnk|TARGET_BASENAME=powershell.exe|ARG_LENGTH=171|HAS_64020=true|HAS_64022=true|HAS_PLINK=false|HAS_PAGEANT=false|HAS_POWERSHELL=true\nSTARTUP10_ARGS_CMD_AVAILABLE=true\nSTARTUP10_ARGS_HAS_AGENT=false\nSTARTUP10_ARGS_HAS_NOAGENT=false\nSTARTUP10_ARGS_HAS_BATCH=false\nSTARTUP10_ARGS_HAS_LOAD=false\nSTARTUP10_ARGS_HAS_KEYFILE=false\nSTARTUP10_ARGS_HAS_PROXYCMD=false\nSTARTUP10_ARGS_HAS_N=false\nREC|STARTUP_ARG_REF|IDX=10|BASENAME=bridge.ps1|EXT=ps1\nSTARTUP_TOTAL_FILE_COUNT=10\nREC|POWERSHELL_PROC|IDX=1|PID=11432|SESSION=1\nPOWERSHELL1_CMD_AVAILABLE=true\nPOWERSHELL1_HAS_AGENT=false\nPOWERSHELL1_HAS_NOAGENT=false\nPOWERSHELL1_HAS_BATCH=false\nPOWERSHELL1_HAS_LOAD=false\nPOWERSHELL1_HAS_KEYFILE=false\nPOWERSHELL1_HAS_PROXYCMD=false\nPOWERSHELL1_HAS_N=false\nREC|POWERSHELL_PROC|IDX=2|PID=11376|SESSION=1\nPOWERSHELL2_CMD_AVAILABLE=true\nPOWERSHELL2_HAS_AGENT=false\nPOWERSHELL2_HAS_NOAGENT=false\nPOWERSHELL2_HAS_BATCH=false\nPOWERSHELL2_HAS_LOAD=false\nPOWERSHELL2_HAS_KEYFILE=false\nPOWERSHELL2_HAS_PROXYCMD=false\nPOWERSHELL2_HAS_N=false\nREC|POWERSHELL_PROC|IDX=3|PID=13292|SESSION=1\nPOWERSHELL3_CMD_AVAILABLE=true\nPOWERSHELL3_HAS_AGENT=false\nPOWERSHELL3_HAS_NOAGENT=false\nPOWERSHELL3_HAS_BATCH=false\nPOWERSHELL3_HAS_LOAD=false\nPOWERSHELL3_HAS_KEYFILE=false\nPOWERSHELL3_HAS_PROXYCMD=false\nPOWERSHELL3_HAS_N=false\nREC|POWERSHELL_PROC|IDX=4|PID=15780|SESSION=1\nPOWERSHELL4_CMD_AVAILABLE=true\nPOWERSHELL4_HAS_AGENT=false\nPOWERSHELL4_HAS_NOAGENT=false\nPOWERSHELL4_HAS_BATCH=false\nPOWERSHELL4_HAS_LOAD=false\nPOWERSHELL4_HAS_KEYFILE=false\nPOWERSHELL4_HAS_PROXYCMD=false\nPOWERSHELL4_HAS_N=false\nPOWERSHELL_PROCESS_COUNT=4\nREC|LOCAL_REF_FILE|KIND=PLINK_EXE|IDX=1|BASENAME=plink.exe|EXT=.exe|SHA256=30e75ef832c684b8f1e45667af29a91390b5508cf43dab69247d9713e13d8430\nREC|LOCAL_REF_SHAPE|KIND=PLINK_EXE|IDX=1|HAS_64020=false|HAS_64022=false|HAS_PLINK=true|HAS_R=true|HAS_L=true|HAS_D=true|HAS_PAGEANT=true|HAS_START_PROCESS=false|HAS_GET_NETTCP=false\nREC|LOCAL_REF_FILE|KIND=STARTUP_TARGET|IDX=1|BASENAME=Cloud.exe|EXT=.exe|SHA256=757715535c30d107a50ebb6b0e297872ab09bca5e44da44fb9046ba43ff946af\nREC|LOCAL_REF_SHAPE|KIND=STARTUP_TARGET|IDX=1|HAS_64020=false|HAS_64022=false|HAS_PLINK=false|HAS_R=true|HAS_L=false|HAS_D=true|HAS_PAGEANT=false|HAS_START_PROCESS=false|HAS_GET_NETTCP=false\nREC|LOCAL_REF_FILE|KIND=STARTUP_TARGET|IDX=3|BASENAME=FSCapture.exe|EXT=.exe|SHA256=1a111d3ef9b3c4432c0436b76e5e8939c6dbddbee7bdf630a25f06cc0b50f972\nREC|LOCAL_REF_SHAPE|KIND=STARTUP_TARGET|IDX=3|HAS_64020=false|HAS_64022=false|HAS_PLINK=false|HAS_R=true|HAS_L=true|HAS_D=true|HAS_PAGEANT=false|HAS_START_PROCESS=false|HAS_GET_NETTCP=false\nREC|LOCAL_REF_FILE|KIND=STARTUP_TARGET|IDX=4|BASENAME=powershell.exe|EXT=.exe|SHA256=9785001b0dcf755eddb8af294a373c0b87b2498660f724e76c4d53f9c217c7a3\nREC|LOCAL_REF_SHAPE|KIND=STARTUP_TARGET|IDX=4|HAS_64020=false|HAS_64022=false|HAS_PLINK=false|HAS_R=true|HAS_L=false|HAS_D=true|HAS_PAGEANT=false|HAS_START_PROCESS=false|HAS_GET_NETTCP=false\nREC|LOCAL_REF_FILE|KIND=STARTUP_ARG|IDX=4|BASENAME=ProxyStackStartup.ps1|EXT=.ps1|SHA256=e9552fc158a236d0b50dd6e4059390a9565678aea1ea46d75320929837671433\nREC|LOCAL_REF_SHAPE|KIND=STARTUP_ARG|IDX=4|HAS_64020=false|HAS_64022=false|HAS_PLINK=false|HAS_R=true|HAS_L=true|HAS_D=true|HAS_PAGEANT=false|HAS_START_PROCESS=true|HAS_GET_NETTCP=true\nREC|LOCAL_REF_FILE|KIND=STARTUP_TARGET|IDX=5|BASENAME=pageant.exe|EXT=.exe|SHA256=6457208e5391df615552f629e615dca2b80c87c63ee65fa245fd1369ce5c9e81\nREC|LOCAL_REF_SHAPE|KIND=STARTUP_TARGET|IDX=5|HAS_64020=false|HAS_64022=false|HAS_PLINK=false|HAS_R=true|HAS_L=true|HAS_D=true|HAS_PAGEANT=true|HAS_START_PROCESS=false|HAS_GET_NETTCP=false\nREC|LOCAL_REF_FILE|KIND=STARTUP_TARGET|IDX=7|BASENAME=punto.exe|EXT=.exe|SHA256=708bf79f69b9c6decf26458f73f54088ab268dd038b1e338fb083f0f255b18df\nREC|LOCAL_REF_SHAPE|KIND=STARTUP_TARGET|IDX=7|HAS_64020=false|HAS_64022=false|HAS_PLINK=false|HAS_R=true|HAS_L=true|HAS_D=true|HAS_PAGEANT=false|HAS_START_PROCESS=false|HAS_GET_NETTCP=false\nREC|LOCAL_REF_FILE|KIND=STARTUP_TARGET|IDX=8|BASENAME=powershell.exe|EXT=.exe|SHA256=9785001b0dcf755eddb8af294a373c0b87b2498660f724e76c4d53f9c217c7a3\nREC|LOCAL_REF_SHAPE|KIND=STARTUP_TARGET|IDX=8|HAS_64020=false|HAS_64022=false|HAS_PLINK=false|HAS_R=true|HAS_L=false|HAS_D=true|HAS_PAGEANT=false|HAS_START_PROCESS=false|HAS_GET_NETTCP=false\nREC|LOCAL_REF_FILE|KIND=STARTUP_ARG|IDX=8|BASENAME=watchdog.ps1|EXT=.ps1|SHA256=7738599c1d229c105f1073f04b420063bd776f3444b3f6fcf7d09bd320cce0e3\nREC|LOCAL_REF_SHAPE|KIND=STARTUP_ARG|IDX=8|HAS_64020=true|HAS_64022=false|HAS_PLINK=true|HAS_R=true|HAS_L=true|HAS_D=false|HAS_PAGEANT=false|HAS_START_PROCESS=false|HAS_GET_NETTCP=true\nREC|LOCAL_REF_FILE|KIND=STARTUP_TARGET|IDX=9|BASENAME=powershell.exe|EXT=.exe|SHA256=9785001b0dcf755eddb8af294a373c0b87b2498660f724e76c4d53f9c217c7a3\nREC|LOCAL_REF_SHAPE|KIND=STARTUP_TARGET|IDX=9|HAS_64020=false|HAS_64022=false|HAS_PLINK=false|HAS_R=true|HAS_L=false|HAS_D=true|HAS_PAGEANT=false|HAS_START_PROCESS=false|HAS_GET_NETTCP=false\nREC|LOCAL_REF_FILE|KIND=STARTUP_ARG|IDX=9|BASENAME=bridge.ps1|EXT=.ps1|SHA256=d6ed793d7cfd3ec4894ff766f1c20a5de80cf3be6615a27ae4dc0f836da4cf0e\nREC|LOCAL_REF_SHAPE|KIND=STARTUP_ARG|IDX=9|HAS_64020=true|HAS_64022=false|HAS_PLINK=false|HAS_R=false|HAS_L=true|HAS_D=false|HAS_PAGEANT=false|HAS_START_PROCESS=false|HAS_GET_NETTCP=false\nREC|LOCAL_REF_FILE|KIND=STARTUP_TARGET|IDX=10|BASENAME=powershell.exe|EXT=.exe|SHA256=9785001b0dcf755eddb8af294a373c0b87b2498660f724e76c4d53f9c217c7a3\nREC|LOCAL_REF_SHAPE|KIND=STARTUP_TARGET|IDX=10|HAS_64020=false|HAS_64022=false|HAS_PLINK=false|HAS_R=true|HAS_L=false|HAS_D=true|HAS_PAGEANT=false|HAS_START_PROCESS=false|HAS_GET_NETTCP=false\nREC|LOCAL_REF_FILE|KIND=STARTUP_ARG|IDX=10|BASENAME=bridge.ps1|EXT=.ps1|SHA256=d6ed793d7cfd3ec4894ff766f1c20a5de80cf3be6615a27ae4dc0f836da4cf0e\nREC|LOCAL_REF_SHAPE|KIND=STARTUP_ARG|IDX=10|HAS_64020=true|HAS_64022=false|HAS_PLINK=false|HAS_R=false|HAS_L=true|HAS_D=false|HAS_PAGEANT=false|HAS_START_PROCESS=false|HAS_GET_NETTCP=false\nPVE64020_LISTENER_COUNT=0\nPVE64020_SSHD_OWNER_COUNT=0\nCLUSTER_QUORATE=true\nNETBIRD_LAZY=false\nNETBIRD_MANAGEMENT=true\nNETBIRD_SIGNAL=true\nNETBIRD_CONNECTED=5\nDECISION=PASS_WINDOWS_DACHA_MISSING_REVERSE_PLINK_RCA\nNEXT_GATE=RESTORE_EXACT_REVERSE_PLINK\nTASK_RESULT=WINDOWS_DACHA_MISSING_REVERSE_PLINK_RCA\nCHANGES_MADE=false\nROLLBACK_STARTED=false\nROLLBACK_RESTORED=null\nMUTATION_OUTCOME=NO_MUTATION\nHOMELAB_RESULT_CONTRACT={\"version\":1,\"command_id\":\"SUPPORT-261007-WINDOWS-DACHA-MISSING-REVERSE-PLINK-RCA-99753R1\",\"status\":\"OK\",\"changes_made\":false,\"rollback_started\":false,\"rollback_restored\":null}\n" +} diff --git a/runtime/history/SUPPORT-261007-WINDOWS-DACHA-MISSING-REVERSE-PLINK-RCA-99753R1.txt b/runtime/history/SUPPORT-261007-WINDOWS-DACHA-MISSING-REVERSE-PLINK-RCA-99753R1.txt new file mode 100644 index 00000000..12e18d18 --- /dev/null +++ b/runtime/history/SUPPORT-261007-WINDOWS-DACHA-MISSING-REVERSE-PLINK-RCA-99753R1.txt @@ -0,0 +1,200 @@ +CHAT_OUTPUT_BEGIN +COMMAND_ID=SUPPORT-261007-WINDOWS-DACHA-MISSING-REVERSE-PLINK-RCA-99753R1 +STATUS=OK +RC=0 +HOST=pve01 +MODE=read-only +COMPONENT=windows-dacha-missing-reverse-plink-rca +REFERENCE_REGISTER_CHECK=OK +REFERENCE_SHA256=5a3d8e5154c41cb582a4e0aca68090be1f0138918bf82131a948df326f9d8d66 +ERROR_REGISTER_CHECK=OK +ERROR_REGISTER_SHA256=3b09a553ec0f527ed3afeed4753f52a74ee3036045bbfb3c685e9f8af4ba7ba0 +COMMAND_SHA256=d289d7bc43289666a4ccfe7fc59455bd687b7f7c352661d10fe80b0e98985c4a +DUPLICATE_FAILED_COMMAND_BLOCKED=false +EXECUTION_STARTED=true +CHANGE_DECLARED=false +RESULT_CONTRACT_VALID=true +RESULT_CONTRACT_STATUS=NOT_APPLICABLE +RESULT_CONTRACT_ERROR=NONE +COMMAND_RC=0 +CHANGES_MADE=false +ROLLBACK_STARTED=false +ROLLBACK_RESTORED=null +MUTATION_OUTCOME=NO_MUTATION +SANITIZED=yes +SECRETS_INCLUDED=no +PRIVATE_ADDRESSES_INCLUDED=no +RAW_EVIDENCE_SHA256=6018d2046ced7926ff69efd1924f09f46e9f3502f93d25f53709946add9baa9b +SANITIZED_OUTPUT_SHA256=6018d2046ced7926ff69efd1924f09f46e9f3502f93d25f53709946add9baa9b +OUTPUT_BEGIN +WINDOWS_DACHA_MISSING_REVERSE_PLINK_RCA=V1 +MODE=read-only +NO_MUTATION=true +WINDOWS_LOCAL_INSPECT_RC=0 +WINDOWS_EVIDENCE_PRESENT=true +REC|PLINK_PROC|IDX=1|PID=14608|SESSION=1 +PLINK1_OWNER_QUERY_RC=0 +PLINK1_PAGEANT_SAME_OWNER_SESSION_COUNT=1 +PLINK1_CMD_AVAILABLE=true +PLINK1_HAS_AGENT=true +PLINK1_HAS_NOAGENT=false +PLINK1_HAS_BATCH=true +PLINK1_HAS_LOAD=false +PLINK1_HAS_KEYFILE=false +PLINK1_HAS_PROXYCMD=false +PLINK1_HAS_N=true +PLINK_PROCESS_COUNT=1 +STARTUP_FOLDER_PRESENT=true +REC|STARTUP_ALL|IDX=1|EXT=lnk|TARGET_BASENAME=cloud.exe|ARG_LENGTH=10|HAS_64020=false|HAS_64022=false|HAS_PLINK=false|HAS_PAGEANT=false|HAS_POWERSHELL=false +STARTUP1_ARGS_CMD_AVAILABLE=true +STARTUP1_ARGS_HAS_AGENT=false +STARTUP1_ARGS_HAS_NOAGENT=false +STARTUP1_ARGS_HAS_BATCH=false +STARTUP1_ARGS_HAS_LOAD=false +STARTUP1_ARGS_HAS_KEYFILE=false +STARTUP1_ARGS_HAS_PROXYCMD=false +STARTUP1_ARGS_HAS_N=false +REC|STARTUP_ALL|IDX=2|EXT=ini +REC|STARTUP_ALL|IDX=3|EXT=lnk|TARGET_BASENAME=fscapture.exe|ARG_LENGTH=7|HAS_64020=false|HAS_64022=false|HAS_PLINK=false|HAS_PAGEANT=false|HAS_POWERSHELL=false +STARTUP3_ARGS_CMD_AVAILABLE=true +STARTUP3_ARGS_HAS_AGENT=false +STARTUP3_ARGS_HAS_NOAGENT=false +STARTUP3_ARGS_HAS_BATCH=false +STARTUP3_ARGS_HAS_LOAD=false +STARTUP3_ARGS_HAS_KEYFILE=false +STARTUP3_ARGS_HAS_PROXYCMD=false +STARTUP3_ARGS_HAS_N=false +REC|STARTUP_ALL|IDX=4|EXT=lnk|TARGET_BASENAME=powershell.exe|ARG_LENGTH=120|HAS_64020=false|HAS_64022=false|HAS_PLINK=false|HAS_PAGEANT=false|HAS_POWERSHELL=true +STARTUP4_ARGS_CMD_AVAILABLE=true +STARTUP4_ARGS_HAS_AGENT=false +STARTUP4_ARGS_HAS_NOAGENT=false +STARTUP4_ARGS_HAS_BATCH=false +STARTUP4_ARGS_HAS_LOAD=false +STARTUP4_ARGS_HAS_KEYFILE=false +STARTUP4_ARGS_HAS_PROXYCMD=false +STARTUP4_ARGS_HAS_N=false +REC|STARTUP_ARG_REF|IDX=4|BASENAME=proxystackstartup.ps1|EXT=ps1 +REC|STARTUP_ALL|IDX=5|EXT=lnk|TARGET_BASENAME=pageant.exe|ARG_LENGTH=61|HAS_64020=false|HAS_64022=false|HAS_PLINK=false|HAS_PAGEANT=true|HAS_POWERSHELL=false +STARTUP5_ARGS_CMD_AVAILABLE=true +STARTUP5_ARGS_HAS_AGENT=false +STARTUP5_ARGS_HAS_NOAGENT=false +STARTUP5_ARGS_HAS_BATCH=false +STARTUP5_ARGS_HAS_LOAD=false +STARTUP5_ARGS_HAS_KEYFILE=false +STARTUP5_ARGS_HAS_PROXYCMD=false +STARTUP5_ARGS_HAS_N=false +REC|STARTUP_ALL|IDX=6|EXT=backup +REC|STARTUP_ALL|IDX=7|EXT=lnk|TARGET_BASENAME=punto.exe|ARG_LENGTH=0|HAS_64020=false|HAS_64022=false|HAS_PLINK=false|HAS_PAGEANT=false|HAS_POWERSHELL=false +STARTUP7_ARGS_CMD_AVAILABLE=false +REC|STARTUP_ALL|IDX=8|EXT=lnk|TARGET_BASENAME=powershell.exe|ARG_LENGTH=131|HAS_64020=false|HAS_64022=false|HAS_PLINK=false|HAS_PAGEANT=false|HAS_POWERSHELL=true +STARTUP8_ARGS_CMD_AVAILABLE=true +STARTUP8_ARGS_HAS_AGENT=false +STARTUP8_ARGS_HAS_NOAGENT=false +STARTUP8_ARGS_HAS_BATCH=false +STARTUP8_ARGS_HAS_LOAD=false +STARTUP8_ARGS_HAS_KEYFILE=false +STARTUP8_ARGS_HAS_PROXYCMD=false +STARTUP8_ARGS_HAS_N=false +REC|STARTUP_ARG_REF|IDX=8|BASENAME=watchdog.ps1|EXT=ps1 +REC|STARTUP_ALL|IDX=9|EXT=lnk|TARGET_BASENAME=powershell.exe|ARG_LENGTH=171|HAS_64020=true|HAS_64022=true|HAS_PLINK=false|HAS_PAGEANT=false|HAS_POWERSHELL=true +STARTUP9_ARGS_CMD_AVAILABLE=true +STARTUP9_ARGS_HAS_AGENT=false +STARTUP9_ARGS_HAS_NOAGENT=false +STARTUP9_ARGS_HAS_BATCH=false +STARTUP9_ARGS_HAS_LOAD=false +STARTUP9_ARGS_HAS_KEYFILE=false +STARTUP9_ARGS_HAS_PROXYCMD=false +STARTUP9_ARGS_HAS_N=false +REC|STARTUP_ARG_REF|IDX=9|BASENAME=bridge.ps1|EXT=ps1 +REC|STARTUP_ALL|IDX=10|EXT=lnk|TARGET_BASENAME=powershell.exe|ARG_LENGTH=171|HAS_64020=true|HAS_64022=true|HAS_PLINK=false|HAS_PAGEANT=false|HAS_POWERSHELL=true +STARTUP10_ARGS_CMD_AVAILABLE=true +STARTUP10_ARGS_HAS_AGENT=false +STARTUP10_ARGS_HAS_NOAGENT=false +STARTUP10_ARGS_HAS_BATCH=false +STARTUP10_ARGS_HAS_LOAD=false +STARTUP10_ARGS_HAS_KEYFILE=false +STARTUP10_ARGS_HAS_PROXYCMD=false +STARTUP10_ARGS_HAS_N=false +REC|STARTUP_ARG_REF|IDX=10|BASENAME=bridge.ps1|EXT=ps1 +STARTUP_TOTAL_FILE_COUNT=10 +REC|POWERSHELL_PROC|IDX=1|PID=11432|SESSION=1 +POWERSHELL1_CMD_AVAILABLE=true +POWERSHELL1_HAS_AGENT=false +POWERSHELL1_HAS_NOAGENT=false +POWERSHELL1_HAS_BATCH=false +POWERSHELL1_HAS_LOAD=false +POWERSHELL1_HAS_KEYFILE=false +POWERSHELL1_HAS_PROXYCMD=false +POWERSHELL1_HAS_N=false +REC|POWERSHELL_PROC|IDX=2|PID=11376|SESSION=1 +POWERSHELL2_CMD_AVAILABLE=true +POWERSHELL2_HAS_AGENT=false +POWERSHELL2_HAS_NOAGENT=false +POWERSHELL2_HAS_BATCH=false +POWERSHELL2_HAS_LOAD=false +POWERSHELL2_HAS_KEYFILE=false +POWERSHELL2_HAS_PROXYCMD=false +POWERSHELL2_HAS_N=false +REC|POWERSHELL_PROC|IDX=3|PID=13292|SESSION=1 +POWERSHELL3_CMD_AVAILABLE=true +POWERSHELL3_HAS_AGENT=false +POWERSHELL3_HAS_NOAGENT=false +POWERSHELL3_HAS_BATCH=false +POWERSHELL3_HAS_LOAD=false +POWERSHELL3_HAS_KEYFILE=false +POWERSHELL3_HAS_PROXYCMD=false +POWERSHELL3_HAS_N=false +REC|POWERSHELL_PROC|IDX=4|PID=15780|SESSION=1 +POWERSHELL4_CMD_AVAILABLE=true +POWERSHELL4_HAS_AGENT=false +POWERSHELL4_HAS_NOAGENT=false +POWERSHELL4_HAS_BATCH=false +POWERSHELL4_HAS_LOAD=false +POWERSHELL4_HAS_KEYFILE=false +POWERSHELL4_HAS_PROXYCMD=false +POWERSHELL4_HAS_N=false +POWERSHELL_PROCESS_COUNT=4 +REC|LOCAL_REF_FILE|KIND=PLINK_EXE|IDX=1|BASENAME=plink.exe|EXT=.exe|SHA256=30e75ef832c684b8f1e45667af29a91390b5508cf43dab69247d9713e13d8430 +REC|LOCAL_REF_SHAPE|KIND=PLINK_EXE|IDX=1|HAS_64020=false|HAS_64022=false|HAS_PLINK=true|HAS_R=true|HAS_L=true|HAS_D=true|HAS_PAGEANT=true|HAS_START_PROCESS=false|HAS_GET_NETTCP=false +REC|LOCAL_REF_FILE|KIND=STARTUP_TARGET|IDX=1|BASENAME=Cloud.exe|EXT=.exe|SHA256=757715535c30d107a50ebb6b0e297872ab09bca5e44da44fb9046ba43ff946af +REC|LOCAL_REF_SHAPE|KIND=STARTUP_TARGET|IDX=1|HAS_64020=false|HAS_64022=false|HAS_PLINK=false|HAS_R=true|HAS_L=false|HAS_D=true|HAS_PAGEANT=false|HAS_START_PROCESS=false|HAS_GET_NETTCP=false +REC|LOCAL_REF_FILE|KIND=STARTUP_TARGET|IDX=3|BASENAME=FSCapture.exe|EXT=.exe|SHA256=1a111d3ef9b3c4432c0436b76e5e8939c6dbddbee7bdf630a25f06cc0b50f972 +REC|LOCAL_REF_SHAPE|KIND=STARTUP_TARGET|IDX=3|HAS_64020=false|HAS_64022=false|HAS_PLINK=false|HAS_R=true|HAS_L=true|HAS_D=true|HAS_PAGEANT=false|HAS_START_PROCESS=false|HAS_GET_NETTCP=false +REC|LOCAL_REF_FILE|KIND=STARTUP_TARGET|IDX=4|BASENAME=powershell.exe|EXT=.exe|SHA256=9785001b0dcf755eddb8af294a373c0b87b2498660f724e76c4d53f9c217c7a3 +REC|LOCAL_REF_SHAPE|KIND=STARTUP_TARGET|IDX=4|HAS_64020=false|HAS_64022=false|HAS_PLINK=false|HAS_R=true|HAS_L=false|HAS_D=true|HAS_PAGEANT=false|HAS_START_PROCESS=false|HAS_GET_NETTCP=false +REC|LOCAL_REF_FILE|KIND=STARTUP_ARG|IDX=4|BASENAME=ProxyStackStartup.ps1|EXT=.ps1|SHA256=e9552fc158a236d0b50dd6e4059390a9565678aea1ea46d75320929837671433 +REC|LOCAL_REF_SHAPE|KIND=STARTUP_ARG|IDX=4|HAS_64020=false|HAS_64022=false|HAS_PLINK=false|HAS_R=true|HAS_L=true|HAS_D=true|HAS_PAGEANT=false|HAS_START_PROCESS=true|HAS_GET_NETTCP=true +REC|LOCAL_REF_FILE|KIND=STARTUP_TARGET|IDX=5|BASENAME=pageant.exe|EXT=.exe|SHA256=6457208e5391df615552f629e615dca2b80c87c63ee65fa245fd1369ce5c9e81 +REC|LOCAL_REF_SHAPE|KIND=STARTUP_TARGET|IDX=5|HAS_64020=false|HAS_64022=false|HAS_PLINK=false|HAS_R=true|HAS_L=true|HAS_D=true|HAS_PAGEANT=true|HAS_START_PROCESS=false|HAS_GET_NETTCP=false +REC|LOCAL_REF_FILE|KIND=STARTUP_TARGET|IDX=7|BASENAME=punto.exe|EXT=.exe|SHA256=708bf79f69b9c6decf26458f73f54088ab268dd038b1e338fb083f0f255b18df +REC|LOCAL_REF_SHAPE|KIND=STARTUP_TARGET|IDX=7|HAS_64020=false|HAS_64022=false|HAS_PLINK=false|HAS_R=true|HAS_L=true|HAS_D=true|HAS_PAGEANT=false|HAS_START_PROCESS=false|HAS_GET_NETTCP=false +REC|LOCAL_REF_FILE|KIND=STARTUP_TARGET|IDX=8|BASENAME=powershell.exe|EXT=.exe|SHA256=9785001b0dcf755eddb8af294a373c0b87b2498660f724e76c4d53f9c217c7a3 +REC|LOCAL_REF_SHAPE|KIND=STARTUP_TARGET|IDX=8|HAS_64020=false|HAS_64022=false|HAS_PLINK=false|HAS_R=true|HAS_L=false|HAS_D=true|HAS_PAGEANT=false|HAS_START_PROCESS=false|HAS_GET_NETTCP=false +REC|LOCAL_REF_FILE|KIND=STARTUP_ARG|IDX=8|BASENAME=watchdog.ps1|EXT=.ps1|SHA256=7738599c1d229c105f1073f04b420063bd776f3444b3f6fcf7d09bd320cce0e3 +REC|LOCAL_REF_SHAPE|KIND=STARTUP_ARG|IDX=8|HAS_64020=true|HAS_64022=false|HAS_PLINK=true|HAS_R=true|HAS_L=true|HAS_D=false|HAS_PAGEANT=false|HAS_START_PROCESS=false|HAS_GET_NETTCP=true +REC|LOCAL_REF_FILE|KIND=STARTUP_TARGET|IDX=9|BASENAME=powershell.exe|EXT=.exe|SHA256=9785001b0dcf755eddb8af294a373c0b87b2498660f724e76c4d53f9c217c7a3 +REC|LOCAL_REF_SHAPE|KIND=STARTUP_TARGET|IDX=9|HAS_64020=false|HAS_64022=false|HAS_PLINK=false|HAS_R=true|HAS_L=false|HAS_D=true|HAS_PAGEANT=false|HAS_START_PROCESS=false|HAS_GET_NETTCP=false +REC|LOCAL_REF_FILE|KIND=STARTUP_ARG|IDX=9|BASENAME=bridge.ps1|EXT=.ps1|SHA256=d6ed793d7cfd3ec4894ff766f1c20a5de80cf3be6615a27ae4dc0f836da4cf0e +REC|LOCAL_REF_SHAPE|KIND=STARTUP_ARG|IDX=9|HAS_64020=true|HAS_64022=false|HAS_PLINK=false|HAS_R=false|HAS_L=true|HAS_D=false|HAS_PAGEANT=false|HAS_START_PROCESS=false|HAS_GET_NETTCP=false +REC|LOCAL_REF_FILE|KIND=STARTUP_TARGET|IDX=10|BASENAME=powershell.exe|EXT=.exe|SHA256=9785001b0dcf755eddb8af294a373c0b87b2498660f724e76c4d53f9c217c7a3 +REC|LOCAL_REF_SHAPE|KIND=STARTUP_TARGET|IDX=10|HAS_64020=false|HAS_64022=false|HAS_PLINK=false|HAS_R=true|HAS_L=false|HAS_D=true|HAS_PAGEANT=false|HAS_START_PROCESS=false|HAS_GET_NETTCP=false +REC|LOCAL_REF_FILE|KIND=STARTUP_ARG|IDX=10|BASENAME=bridge.ps1|EXT=.ps1|SHA256=d6ed793d7cfd3ec4894ff766f1c20a5de80cf3be6615a27ae4dc0f836da4cf0e +REC|LOCAL_REF_SHAPE|KIND=STARTUP_ARG|IDX=10|HAS_64020=true|HAS_64022=false|HAS_PLINK=false|HAS_R=false|HAS_L=true|HAS_D=false|HAS_PAGEANT=false|HAS_START_PROCESS=false|HAS_GET_NETTCP=false +PVE64020_LISTENER_COUNT=0 +PVE64020_SSHD_OWNER_COUNT=0 +CLUSTER_QUORATE=true +NETBIRD_LAZY=false +NETBIRD_MANAGEMENT=true +NETBIRD_SIGNAL=true +NETBIRD_CONNECTED=5 +DECISION=PASS_WINDOWS_DACHA_MISSING_REVERSE_PLINK_RCA +NEXT_GATE=RESTORE_EXACT_REVERSE_PLINK +TASK_RESULT=WINDOWS_DACHA_MISSING_REVERSE_PLINK_RCA +CHANGES_MADE=false +ROLLBACK_STARTED=false +ROLLBACK_RESTORED=null +MUTATION_OUTCOME=NO_MUTATION +HOMELAB_RESULT_CONTRACT={"version":1,"command_id":"SUPPORT-261007-WINDOWS-DACHA-MISSING-REVERSE-PLINK-RCA-99753R1","status":"OK","changes_made":false,"rollback_started":false,"rollback_restored":null} + +OUTPUT_END +CHAT_OUTPUT_END diff --git a/runtime/latest.json b/runtime/latest.json index 4d390995..4f867823 100644 --- a/runtime/latest.json +++ b/runtime/latest.json @@ -1,19 +1,19 @@ { "schema_version": 1, "channel": "homelab-runtime", - "command_id": "SUPPORT-261007-WINDOWS-DACHA-STARTUP-SCRIPT-RCA-99752R1", + "command_id": "SUPPORT-261007-WINDOWS-DACHA-MISSING-REVERSE-PLINK-RCA-99753R1", "status": "OK", "rc": 0, "host": "pve01", "mode": "read-only", - "component": "windows-dacha-startup-script-rca", - "started_at_utc": "2026-10-07T03:57:47Z", - "finished_at_utc": "2026-10-07T03:57:48Z", + "component": "windows-dacha-missing-reverse-plink-rca", + "started_at_utc": "2026-10-07T04:00:19Z", + "finished_at_utc": "2026-10-07T04:00:19Z", "reference_register_checked": true, "reference_sha256": "5a3d8e5154c41cb582a4e0aca68090be1f0138918bf82131a948df326f9d8d66", "error_register_checked": true, "error_register_sha256": "3b09a553ec0f527ed3afeed4753f52a74ee3036045bbfb3c685e9f8af4ba7ba0", - "command_sha256": "d536d6b94315af4ae2824880fd7bd0d7b5d36e9dcf87b6546373e82a08687967", + "command_sha256": "d289d7bc43289666a4ccfe7fc59455bd687b7f7c352661d10fe80b0e98985c4a", "duplicate_failed_command_blocked": false, "block_reason": null, "execution_started": true, @@ -30,9 +30,9 @@ "secrets_included": false, "private_addresses_included": false, "raw_evidence_retained_locally": true, - "raw_evidence_sha256": "7e65c67d27f9681cb78b2341a92b23fd67fdb3eb77028a92a5e320345837fc9c", - "sanitized_output_sha256": "7e65c67d27f9681cb78b2341a92b23fd67fdb3eb77028a92a5e320345837fc9c", + "raw_evidence_sha256": "6018d2046ced7926ff69efd1924f09f46e9f3502f93d25f53709946add9baa9b", + "sanitized_output_sha256": "6018d2046ced7926ff69efd1924f09f46e9f3502f93d25f53709946add9baa9b", "output_truncated_in_json": false, "full_sanitized_output_url": "https://git.gram1.ru/.well-known/homelab-runtime/latest.txt", - "output": "WINDOWS_DACHA_STARTUP_SCRIPT_RCA=V1\nMODE=read-only\nNO_MUTATION=true\nWINDOWS_LOCAL_INSPECT_RC=0\nWINDOWS_EVIDENCE_PRESENT=true\nSTARTUP_FOLDER_PRESENT=true\nREC|SHORTCUT|IDX=1|TARGET_BASENAME=powershell.exe|ARG_LENGTH=171|HAS_FILE_SWITCH=true|HAS_COMMAND_SWITCH=false|HAS_ENCODED_COMMAND=false|HAS_NOPROFILE=true|HAS_WINDOWSTYLE=true|HAS_EXECUTIONPOLICY=true\nSTARTUP1_ARGS_HAS_64020=true\nSTARTUP1_ARGS_HAS_64022=true\nSTARTUP1_ARGS_HAS_PLINK=false\nSTARTUP1_ARGS_HAS_PAGEANT=false\nSTARTUP1_ARGS_HAS_SSH=false\nSTARTUP1_ARGS_HAS_START_PROCESS=false\nSTARTUP1_ARGS_HAS_STOP_PROCESS=false\nSTARTUP1_ARGS_HAS_GET_PROCESS=false\nSTARTUP1_ARGS_HAS_GET_NETTCP=false\nSTARTUP1_ARGS_HAS_NETSTAT=false\nSTARTUP1_ARGS_HAS_TEST_PATH=false\nSTARTUP1_ARGS_HAS_LOCK_TOKEN=false\nSTARTUP1_ARGS_HAS_PID_TOKEN=false\nSTARTUP1_ARGS_HAS_WATCHDOG=false\nSTARTUP1_ARGS_HAS_WHILE=false\nSTARTUP1_ARGS_HAS_START_SLEEP=false\nSTARTUP1_ARGS_HAS_EXIT=false\nSTARTUP1_ARGS_HAS_TCPCLIENT=false\nSTARTUP1_ARGS_HAS_TCPLISTENER=false\nSTARTUP1_ARGS_HAS_PROXY=false\nSTARTUP1_ARGS_HAS_TELEGRAM=false\nSTARTUP1_ARGS_HAS_IOBIT=false\nSTARTUP1_ARGS_HAS_CURL=false\nSTARTUP1_ARGS_HAS_INVOKE_WEBREQUEST=false\nSTARTUP1_PS1_CANDIDATE_COUNT=1\nSTARTUP1_PS1_RESOLVED=true\nREC|SCRIPT|IDX=1|BASENAME=bridge.ps1|SIZE=5696\nSTARTUP1_SCRIPT_HAS_64020=true\nSTARTUP1_SCRIPT_HAS_64022=false\nSTARTUP1_SCRIPT_HAS_PLINK=false\nSTARTUP1_SCRIPT_HAS_PAGEANT=false\nSTARTUP1_SCRIPT_HAS_SSH=false\nSTARTUP1_SCRIPT_HAS_START_PROCESS=false\nSTARTUP1_SCRIPT_HAS_STOP_PROCESS=false\nSTARTUP1_SCRIPT_HAS_GET_PROCESS=false\nSTARTUP1_SCRIPT_HAS_GET_NETTCP=false\nSTARTUP1_SCRIPT_HAS_NETSTAT=false\nSTARTUP1_SCRIPT_HAS_TEST_PATH=false\nSTARTUP1_SCRIPT_HAS_LOCK_TOKEN=false\nSTARTUP1_SCRIPT_HAS_PID_TOKEN=false\nSTARTUP1_SCRIPT_HAS_WATCHDOG=false\nSTARTUP1_SCRIPT_HAS_WHILE=true\nSTARTUP1_SCRIPT_HAS_START_SLEEP=false\nSTARTUP1_SCRIPT_HAS_EXIT=false\nSTARTUP1_SCRIPT_HAS_TCPCLIENT=true\nSTARTUP1_SCRIPT_HAS_TCPLISTENER=true\nSTARTUP1_SCRIPT_HAS_PROXY=true\nSTARTUP1_SCRIPT_HAS_TELEGRAM=false\nSTARTUP1_SCRIPT_HAS_IOBIT=false\nSTARTUP1_SCRIPT_HAS_CURL=false\nSTARTUP1_SCRIPT_HAS_INVOKE_WEBREQUEST=false\nREC|SCRIPT_LINE_SHAPE|IDX=1|LINE=1|HAS_64020=true|HAS_64022=false|HAS_PLINK=false|HAS_PAGEANT=false|HAS_START_PROCESS=false|HAS_STOP_PROCESS=false|HAS_GET_NETTCP=false|HAS_TEST_PATH=false|HAS_PID=false|HAS_LOCK=false|HAS_EXIT=false|HAS_R=false|HAS_L=false|HAS_D=false\nSTARTUP1_RELEVANT_LINE_COUNT=1\nREC|SHORTCUT|IDX=2|TARGET_BASENAME=powershell.exe|ARG_LENGTH=171|HAS_FILE_SWITCH=true|HAS_COMMAND_SWITCH=false|HAS_ENCODED_COMMAND=false|HAS_NOPROFILE=true|HAS_WINDOWSTYLE=true|HAS_EXECUTIONPOLICY=true\nSTARTUP2_ARGS_HAS_64020=true\nSTARTUP2_ARGS_HAS_64022=true\nSTARTUP2_ARGS_HAS_PLINK=false\nSTARTUP2_ARGS_HAS_PAGEANT=false\nSTARTUP2_ARGS_HAS_SSH=false\nSTARTUP2_ARGS_HAS_START_PROCESS=false\nSTARTUP2_ARGS_HAS_STOP_PROCESS=false\nSTARTUP2_ARGS_HAS_GET_PROCESS=false\nSTARTUP2_ARGS_HAS_GET_NETTCP=false\nSTARTUP2_ARGS_HAS_NETSTAT=false\nSTARTUP2_ARGS_HAS_TEST_PATH=false\nSTARTUP2_ARGS_HAS_LOCK_TOKEN=false\nSTARTUP2_ARGS_HAS_PID_TOKEN=false\nSTARTUP2_ARGS_HAS_WATCHDOG=false\nSTARTUP2_ARGS_HAS_WHILE=false\nSTARTUP2_ARGS_HAS_START_SLEEP=false\nSTARTUP2_ARGS_HAS_EXIT=false\nSTARTUP2_ARGS_HAS_TCPCLIENT=false\nSTARTUP2_ARGS_HAS_TCPLISTENER=false\nSTARTUP2_ARGS_HAS_PROXY=false\nSTARTUP2_ARGS_HAS_TELEGRAM=false\nSTARTUP2_ARGS_HAS_IOBIT=false\nSTARTUP2_ARGS_HAS_CURL=false\nSTARTUP2_ARGS_HAS_INVOKE_WEBREQUEST=false\nSTARTUP2_PS1_CANDIDATE_COUNT=1\nSTARTUP2_PS1_RESOLVED=true\nREC|SCRIPT|IDX=2|BASENAME=bridge.ps1|SIZE=5696\nSTARTUP2_SCRIPT_HAS_64020=true\nSTARTUP2_SCRIPT_HAS_64022=false\nSTARTUP2_SCRIPT_HAS_PLINK=false\nSTARTUP2_SCRIPT_HAS_PAGEANT=false\nSTARTUP2_SCRIPT_HAS_SSH=false\nSTARTUP2_SCRIPT_HAS_START_PROCESS=false\nSTARTUP2_SCRIPT_HAS_STOP_PROCESS=false\nSTARTUP2_SCRIPT_HAS_GET_PROCESS=false\nSTARTUP2_SCRIPT_HAS_GET_NETTCP=false\nSTARTUP2_SCRIPT_HAS_NETSTAT=false\nSTARTUP2_SCRIPT_HAS_TEST_PATH=false\nSTARTUP2_SCRIPT_HAS_LOCK_TOKEN=false\nSTARTUP2_SCRIPT_HAS_PID_TOKEN=false\nSTARTUP2_SCRIPT_HAS_WATCHDOG=false\nSTARTUP2_SCRIPT_HAS_WHILE=true\nSTARTUP2_SCRIPT_HAS_START_SLEEP=false\nSTARTUP2_SCRIPT_HAS_EXIT=false\nSTARTUP2_SCRIPT_HAS_TCPCLIENT=true\nSTARTUP2_SCRIPT_HAS_TCPLISTENER=true\nSTARTUP2_SCRIPT_HAS_PROXY=true\nSTARTUP2_SCRIPT_HAS_TELEGRAM=false\nSTARTUP2_SCRIPT_HAS_IOBIT=false\nSTARTUP2_SCRIPT_HAS_CURL=false\nSTARTUP2_SCRIPT_HAS_INVOKE_WEBREQUEST=false\nREC|SCRIPT_LINE_SHAPE|IDX=2|LINE=1|HAS_64020=true|HAS_64022=false|HAS_PLINK=false|HAS_PAGEANT=false|HAS_START_PROCESS=false|HAS_STOP_PROCESS=false|HAS_GET_NETTCP=false|HAS_TEST_PATH=false|HAS_PID=false|HAS_LOCK=false|HAS_EXIT=false|HAS_R=false|HAS_L=false|HAS_D=false\nSTARTUP2_RELEVANT_LINE_COUNT=1\nSTARTUP_EXACT_MATCH_COUNT=2\nREC|SCRIPT_HASH|IDX=1|BASENAME=bridge.ps1|SHA256=d6ed793d7cfd3ec4894ff766f1c20a5de80cf3be6615a27ae4dc0f836da4cf0e\nREC|SCRIPT_HASH|IDX=2|BASENAME=bridge.ps1|SHA256=d6ed793d7cfd3ec4894ff766f1c20a5de80cf3be6615a27ae4dc0f836da4cf0e\nCURRENT_PID64020_PRESENT=5964\nCURRENT_PID64022_PRESENT=15780\nREC|CURRENT_OWNER|PID=5964|IMAGE=plink.exe\nREC|CURRENT_OWNER|PID=15780|IMAGE=powershell.exe\nPVE64020_LISTENER_COUNT=0\nPVE64020_SSHD_OWNER_COUNT=0\nCLUSTER_QUORATE=true\nNETBIRD_LAZY=false\nNETBIRD_MANAGEMENT=true\nNETBIRD_SIGNAL=true\nNETBIRD_CONNECTED=5\nDECISION=PASS_WINDOWS_DACHA_STARTUP_SCRIPT_RCA\nNEXT_GATE=EXACT_LOCAL_WATCHDOG_REPAIR\nTASK_RESULT=WINDOWS_DACHA_STARTUP_SCRIPT_RCA\nCHANGES_MADE=false\nROLLBACK_STARTED=false\nROLLBACK_RESTORED=null\nMUTATION_OUTCOME=NO_MUTATION\nHOMELAB_RESULT_CONTRACT={\"version\":1,\"command_id\":\"SUPPORT-261007-WINDOWS-DACHA-STARTUP-SCRIPT-RCA-99752R1\",\"status\":\"OK\",\"changes_made\":false,\"rollback_started\":false,\"rollback_restored\":null}\n" + "output": "WINDOWS_DACHA_MISSING_REVERSE_PLINK_RCA=V1\nMODE=read-only\nNO_MUTATION=true\nWINDOWS_LOCAL_INSPECT_RC=0\nWINDOWS_EVIDENCE_PRESENT=true\nREC|PLINK_PROC|IDX=1|PID=14608|SESSION=1\nPLINK1_OWNER_QUERY_RC=0\nPLINK1_PAGEANT_SAME_OWNER_SESSION_COUNT=1\nPLINK1_CMD_AVAILABLE=true\nPLINK1_HAS_AGENT=true\nPLINK1_HAS_NOAGENT=false\nPLINK1_HAS_BATCH=true\nPLINK1_HAS_LOAD=false\nPLINK1_HAS_KEYFILE=false\nPLINK1_HAS_PROXYCMD=false\nPLINK1_HAS_N=true\nPLINK_PROCESS_COUNT=1\nSTARTUP_FOLDER_PRESENT=true\nREC|STARTUP_ALL|IDX=1|EXT=lnk|TARGET_BASENAME=cloud.exe|ARG_LENGTH=10|HAS_64020=false|HAS_64022=false|HAS_PLINK=false|HAS_PAGEANT=false|HAS_POWERSHELL=false\nSTARTUP1_ARGS_CMD_AVAILABLE=true\nSTARTUP1_ARGS_HAS_AGENT=false\nSTARTUP1_ARGS_HAS_NOAGENT=false\nSTARTUP1_ARGS_HAS_BATCH=false\nSTARTUP1_ARGS_HAS_LOAD=false\nSTARTUP1_ARGS_HAS_KEYFILE=false\nSTARTUP1_ARGS_HAS_PROXYCMD=false\nSTARTUP1_ARGS_HAS_N=false\nREC|STARTUP_ALL|IDX=2|EXT=ini\nREC|STARTUP_ALL|IDX=3|EXT=lnk|TARGET_BASENAME=fscapture.exe|ARG_LENGTH=7|HAS_64020=false|HAS_64022=false|HAS_PLINK=false|HAS_PAGEANT=false|HAS_POWERSHELL=false\nSTARTUP3_ARGS_CMD_AVAILABLE=true\nSTARTUP3_ARGS_HAS_AGENT=false\nSTARTUP3_ARGS_HAS_NOAGENT=false\nSTARTUP3_ARGS_HAS_BATCH=false\nSTARTUP3_ARGS_HAS_LOAD=false\nSTARTUP3_ARGS_HAS_KEYFILE=false\nSTARTUP3_ARGS_HAS_PROXYCMD=false\nSTARTUP3_ARGS_HAS_N=false\nREC|STARTUP_ALL|IDX=4|EXT=lnk|TARGET_BASENAME=powershell.exe|ARG_LENGTH=120|HAS_64020=false|HAS_64022=false|HAS_PLINK=false|HAS_PAGEANT=false|HAS_POWERSHELL=true\nSTARTUP4_ARGS_CMD_AVAILABLE=true\nSTARTUP4_ARGS_HAS_AGENT=false\nSTARTUP4_ARGS_HAS_NOAGENT=false\nSTARTUP4_ARGS_HAS_BATCH=false\nSTARTUP4_ARGS_HAS_LOAD=false\nSTARTUP4_ARGS_HAS_KEYFILE=false\nSTARTUP4_ARGS_HAS_PROXYCMD=false\nSTARTUP4_ARGS_HAS_N=false\nREC|STARTUP_ARG_REF|IDX=4|BASENAME=proxystackstartup.ps1|EXT=ps1\nREC|STARTUP_ALL|IDX=5|EXT=lnk|TARGET_BASENAME=pageant.exe|ARG_LENGTH=61|HAS_64020=false|HAS_64022=false|HAS_PLINK=false|HAS_PAGEANT=true|HAS_POWERSHELL=false\nSTARTUP5_ARGS_CMD_AVAILABLE=true\nSTARTUP5_ARGS_HAS_AGENT=false\nSTARTUP5_ARGS_HAS_NOAGENT=false\nSTARTUP5_ARGS_HAS_BATCH=false\nSTARTUP5_ARGS_HAS_LOAD=false\nSTARTUP5_ARGS_HAS_KEYFILE=false\nSTARTUP5_ARGS_HAS_PROXYCMD=false\nSTARTUP5_ARGS_HAS_N=false\nREC|STARTUP_ALL|IDX=6|EXT=backup\nREC|STARTUP_ALL|IDX=7|EXT=lnk|TARGET_BASENAME=punto.exe|ARG_LENGTH=0|HAS_64020=false|HAS_64022=false|HAS_PLINK=false|HAS_PAGEANT=false|HAS_POWERSHELL=false\nSTARTUP7_ARGS_CMD_AVAILABLE=false\nREC|STARTUP_ALL|IDX=8|EXT=lnk|TARGET_BASENAME=powershell.exe|ARG_LENGTH=131|HAS_64020=false|HAS_64022=false|HAS_PLINK=false|HAS_PAGEANT=false|HAS_POWERSHELL=true\nSTARTUP8_ARGS_CMD_AVAILABLE=true\nSTARTUP8_ARGS_HAS_AGENT=false\nSTARTUP8_ARGS_HAS_NOAGENT=false\nSTARTUP8_ARGS_HAS_BATCH=false\nSTARTUP8_ARGS_HAS_LOAD=false\nSTARTUP8_ARGS_HAS_KEYFILE=false\nSTARTUP8_ARGS_HAS_PROXYCMD=false\nSTARTUP8_ARGS_HAS_N=false\nREC|STARTUP_ARG_REF|IDX=8|BASENAME=watchdog.ps1|EXT=ps1\nREC|STARTUP_ALL|IDX=9|EXT=lnk|TARGET_BASENAME=powershell.exe|ARG_LENGTH=171|HAS_64020=true|HAS_64022=true|HAS_PLINK=false|HAS_PAGEANT=false|HAS_POWERSHELL=true\nSTARTUP9_ARGS_CMD_AVAILABLE=true\nSTARTUP9_ARGS_HAS_AGENT=false\nSTARTUP9_ARGS_HAS_NOAGENT=false\nSTARTUP9_ARGS_HAS_BATCH=false\nSTARTUP9_ARGS_HAS_LOAD=false\nSTARTUP9_ARGS_HAS_KEYFILE=false\nSTARTUP9_ARGS_HAS_PROXYCMD=false\nSTARTUP9_ARGS_HAS_N=false\nREC|STARTUP_ARG_REF|IDX=9|BASENAME=bridge.ps1|EXT=ps1\nREC|STARTUP_ALL|IDX=10|EXT=lnk|TARGET_BASENAME=powershell.exe|ARG_LENGTH=171|HAS_64020=true|HAS_64022=true|HAS_PLINK=false|HAS_PAGEANT=false|HAS_POWERSHELL=true\nSTARTUP10_ARGS_CMD_AVAILABLE=true\nSTARTUP10_ARGS_HAS_AGENT=false\nSTARTUP10_ARGS_HAS_NOAGENT=false\nSTARTUP10_ARGS_HAS_BATCH=false\nSTARTUP10_ARGS_HAS_LOAD=false\nSTARTUP10_ARGS_HAS_KEYFILE=false\nSTARTUP10_ARGS_HAS_PROXYCMD=false\nSTARTUP10_ARGS_HAS_N=false\nREC|STARTUP_ARG_REF|IDX=10|BASENAME=bridge.ps1|EXT=ps1\nSTARTUP_TOTAL_FILE_COUNT=10\nREC|POWERSHELL_PROC|IDX=1|PID=11432|SESSION=1\nPOWERSHELL1_CMD_AVAILABLE=true\nPOWERSHELL1_HAS_AGENT=false\nPOWERSHELL1_HAS_NOAGENT=false\nPOWERSHELL1_HAS_BATCH=false\nPOWERSHELL1_HAS_LOAD=false\nPOWERSHELL1_HAS_KEYFILE=false\nPOWERSHELL1_HAS_PROXYCMD=false\nPOWERSHELL1_HAS_N=false\nREC|POWERSHELL_PROC|IDX=2|PID=11376|SESSION=1\nPOWERSHELL2_CMD_AVAILABLE=true\nPOWERSHELL2_HAS_AGENT=false\nPOWERSHELL2_HAS_NOAGENT=false\nPOWERSHELL2_HAS_BATCH=false\nPOWERSHELL2_HAS_LOAD=false\nPOWERSHELL2_HAS_KEYFILE=false\nPOWERSHELL2_HAS_PROXYCMD=false\nPOWERSHELL2_HAS_N=false\nREC|POWERSHELL_PROC|IDX=3|PID=13292|SESSION=1\nPOWERSHELL3_CMD_AVAILABLE=true\nPOWERSHELL3_HAS_AGENT=false\nPOWERSHELL3_HAS_NOAGENT=false\nPOWERSHELL3_HAS_BATCH=false\nPOWERSHELL3_HAS_LOAD=false\nPOWERSHELL3_HAS_KEYFILE=false\nPOWERSHELL3_HAS_PROXYCMD=false\nPOWERSHELL3_HAS_N=false\nREC|POWERSHELL_PROC|IDX=4|PID=15780|SESSION=1\nPOWERSHELL4_CMD_AVAILABLE=true\nPOWERSHELL4_HAS_AGENT=false\nPOWERSHELL4_HAS_NOAGENT=false\nPOWERSHELL4_HAS_BATCH=false\nPOWERSHELL4_HAS_LOAD=false\nPOWERSHELL4_HAS_KEYFILE=false\nPOWERSHELL4_HAS_PROXYCMD=false\nPOWERSHELL4_HAS_N=false\nPOWERSHELL_PROCESS_COUNT=4\nREC|LOCAL_REF_FILE|KIND=PLINK_EXE|IDX=1|BASENAME=plink.exe|EXT=.exe|SHA256=30e75ef832c684b8f1e45667af29a91390b5508cf43dab69247d9713e13d8430\nREC|LOCAL_REF_SHAPE|KIND=PLINK_EXE|IDX=1|HAS_64020=false|HAS_64022=false|HAS_PLINK=true|HAS_R=true|HAS_L=true|HAS_D=true|HAS_PAGEANT=true|HAS_START_PROCESS=false|HAS_GET_NETTCP=false\nREC|LOCAL_REF_FILE|KIND=STARTUP_TARGET|IDX=1|BASENAME=Cloud.exe|EXT=.exe|SHA256=757715535c30d107a50ebb6b0e297872ab09bca5e44da44fb9046ba43ff946af\nREC|LOCAL_REF_SHAPE|KIND=STARTUP_TARGET|IDX=1|HAS_64020=false|HAS_64022=false|HAS_PLINK=false|HAS_R=true|HAS_L=false|HAS_D=true|HAS_PAGEANT=false|HAS_START_PROCESS=false|HAS_GET_NETTCP=false\nREC|LOCAL_REF_FILE|KIND=STARTUP_TARGET|IDX=3|BASENAME=FSCapture.exe|EXT=.exe|SHA256=1a111d3ef9b3c4432c0436b76e5e8939c6dbddbee7bdf630a25f06cc0b50f972\nREC|LOCAL_REF_SHAPE|KIND=STARTUP_TARGET|IDX=3|HAS_64020=false|HAS_64022=false|HAS_PLINK=false|HAS_R=true|HAS_L=true|HAS_D=true|HAS_PAGEANT=false|HAS_START_PROCESS=false|HAS_GET_NETTCP=false\nREC|LOCAL_REF_FILE|KIND=STARTUP_TARGET|IDX=4|BASENAME=powershell.exe|EXT=.exe|SHA256=9785001b0dcf755eddb8af294a373c0b87b2498660f724e76c4d53f9c217c7a3\nREC|LOCAL_REF_SHAPE|KIND=STARTUP_TARGET|IDX=4|HAS_64020=false|HAS_64022=false|HAS_PLINK=false|HAS_R=true|HAS_L=false|HAS_D=true|HAS_PAGEANT=false|HAS_START_PROCESS=false|HAS_GET_NETTCP=false\nREC|LOCAL_REF_FILE|KIND=STARTUP_ARG|IDX=4|BASENAME=ProxyStackStartup.ps1|EXT=.ps1|SHA256=e9552fc158a236d0b50dd6e4059390a9565678aea1ea46d75320929837671433\nREC|LOCAL_REF_SHAPE|KIND=STARTUP_ARG|IDX=4|HAS_64020=false|HAS_64022=false|HAS_PLINK=false|HAS_R=true|HAS_L=true|HAS_D=true|HAS_PAGEANT=false|HAS_START_PROCESS=true|HAS_GET_NETTCP=true\nREC|LOCAL_REF_FILE|KIND=STARTUP_TARGET|IDX=5|BASENAME=pageant.exe|EXT=.exe|SHA256=6457208e5391df615552f629e615dca2b80c87c63ee65fa245fd1369ce5c9e81\nREC|LOCAL_REF_SHAPE|KIND=STARTUP_TARGET|IDX=5|HAS_64020=false|HAS_64022=false|HAS_PLINK=false|HAS_R=true|HAS_L=true|HAS_D=true|HAS_PAGEANT=true|HAS_START_PROCESS=false|HAS_GET_NETTCP=false\nREC|LOCAL_REF_FILE|KIND=STARTUP_TARGET|IDX=7|BASENAME=punto.exe|EXT=.exe|SHA256=708bf79f69b9c6decf26458f73f54088ab268dd038b1e338fb083f0f255b18df\nREC|LOCAL_REF_SHAPE|KIND=STARTUP_TARGET|IDX=7|HAS_64020=false|HAS_64022=false|HAS_PLINK=false|HAS_R=true|HAS_L=true|HAS_D=true|HAS_PAGEANT=false|HAS_START_PROCESS=false|HAS_GET_NETTCP=false\nREC|LOCAL_REF_FILE|KIND=STARTUP_TARGET|IDX=8|BASENAME=powershell.exe|EXT=.exe|SHA256=9785001b0dcf755eddb8af294a373c0b87b2498660f724e76c4d53f9c217c7a3\nREC|LOCAL_REF_SHAPE|KIND=STARTUP_TARGET|IDX=8|HAS_64020=false|HAS_64022=false|HAS_PLINK=false|HAS_R=true|HAS_L=false|HAS_D=true|HAS_PAGEANT=false|HAS_START_PROCESS=false|HAS_GET_NETTCP=false\nREC|LOCAL_REF_FILE|KIND=STARTUP_ARG|IDX=8|BASENAME=watchdog.ps1|EXT=.ps1|SHA256=7738599c1d229c105f1073f04b420063bd776f3444b3f6fcf7d09bd320cce0e3\nREC|LOCAL_REF_SHAPE|KIND=STARTUP_ARG|IDX=8|HAS_64020=true|HAS_64022=false|HAS_PLINK=true|HAS_R=true|HAS_L=true|HAS_D=false|HAS_PAGEANT=false|HAS_START_PROCESS=false|HAS_GET_NETTCP=true\nREC|LOCAL_REF_FILE|KIND=STARTUP_TARGET|IDX=9|BASENAME=powershell.exe|EXT=.exe|SHA256=9785001b0dcf755eddb8af294a373c0b87b2498660f724e76c4d53f9c217c7a3\nREC|LOCAL_REF_SHAPE|KIND=STARTUP_TARGET|IDX=9|HAS_64020=false|HAS_64022=false|HAS_PLINK=false|HAS_R=true|HAS_L=false|HAS_D=true|HAS_PAGEANT=false|HAS_START_PROCESS=false|HAS_GET_NETTCP=false\nREC|LOCAL_REF_FILE|KIND=STARTUP_ARG|IDX=9|BASENAME=bridge.ps1|EXT=.ps1|SHA256=d6ed793d7cfd3ec4894ff766f1c20a5de80cf3be6615a27ae4dc0f836da4cf0e\nREC|LOCAL_REF_SHAPE|KIND=STARTUP_ARG|IDX=9|HAS_64020=true|HAS_64022=false|HAS_PLINK=false|HAS_R=false|HAS_L=true|HAS_D=false|HAS_PAGEANT=false|HAS_START_PROCESS=false|HAS_GET_NETTCP=false\nREC|LOCAL_REF_FILE|KIND=STARTUP_TARGET|IDX=10|BASENAME=powershell.exe|EXT=.exe|SHA256=9785001b0dcf755eddb8af294a373c0b87b2498660f724e76c4d53f9c217c7a3\nREC|LOCAL_REF_SHAPE|KIND=STARTUP_TARGET|IDX=10|HAS_64020=false|HAS_64022=false|HAS_PLINK=false|HAS_R=true|HAS_L=false|HAS_D=true|HAS_PAGEANT=false|HAS_START_PROCESS=false|HAS_GET_NETTCP=false\nREC|LOCAL_REF_FILE|KIND=STARTUP_ARG|IDX=10|BASENAME=bridge.ps1|EXT=.ps1|SHA256=d6ed793d7cfd3ec4894ff766f1c20a5de80cf3be6615a27ae4dc0f836da4cf0e\nREC|LOCAL_REF_SHAPE|KIND=STARTUP_ARG|IDX=10|HAS_64020=true|HAS_64022=false|HAS_PLINK=false|HAS_R=false|HAS_L=true|HAS_D=false|HAS_PAGEANT=false|HAS_START_PROCESS=false|HAS_GET_NETTCP=false\nPVE64020_LISTENER_COUNT=0\nPVE64020_SSHD_OWNER_COUNT=0\nCLUSTER_QUORATE=true\nNETBIRD_LAZY=false\nNETBIRD_MANAGEMENT=true\nNETBIRD_SIGNAL=true\nNETBIRD_CONNECTED=5\nDECISION=PASS_WINDOWS_DACHA_MISSING_REVERSE_PLINK_RCA\nNEXT_GATE=RESTORE_EXACT_REVERSE_PLINK\nTASK_RESULT=WINDOWS_DACHA_MISSING_REVERSE_PLINK_RCA\nCHANGES_MADE=false\nROLLBACK_STARTED=false\nROLLBACK_RESTORED=null\nMUTATION_OUTCOME=NO_MUTATION\nHOMELAB_RESULT_CONTRACT={\"version\":1,\"command_id\":\"SUPPORT-261007-WINDOWS-DACHA-MISSING-REVERSE-PLINK-RCA-99753R1\",\"status\":\"OK\",\"changes_made\":false,\"rollback_started\":false,\"rollback_restored\":null}\n" } diff --git a/runtime/latest.txt b/runtime/latest.txt index 4718f78b..12e18d18 100644 --- a/runtime/latest.txt +++ b/runtime/latest.txt @@ -1,15 +1,15 @@ CHAT_OUTPUT_BEGIN -COMMAND_ID=SUPPORT-261007-WINDOWS-DACHA-STARTUP-SCRIPT-RCA-99752R1 +COMMAND_ID=SUPPORT-261007-WINDOWS-DACHA-MISSING-REVERSE-PLINK-RCA-99753R1 STATUS=OK RC=0 HOST=pve01 MODE=read-only -COMPONENT=windows-dacha-startup-script-rca +COMPONENT=windows-dacha-missing-reverse-plink-rca REFERENCE_REGISTER_CHECK=OK REFERENCE_SHA256=5a3d8e5154c41cb582a4e0aca68090be1f0138918bf82131a948df326f9d8d66 ERROR_REGISTER_CHECK=OK ERROR_REGISTER_SHA256=3b09a553ec0f527ed3afeed4753f52a74ee3036045bbfb3c685e9f8af4ba7ba0 -COMMAND_SHA256=d536d6b94315af4ae2824880fd7bd0d7b5d36e9dcf87b6546373e82a08687967 +COMMAND_SHA256=d289d7bc43289666a4ccfe7fc59455bd687b7f7c352661d10fe80b0e98985c4a DUPLICATE_FAILED_COMMAND_BLOCKED=false EXECUTION_STARTED=true CHANGE_DECLARED=false @@ -24,130 +24,162 @@ MUTATION_OUTCOME=NO_MUTATION SANITIZED=yes SECRETS_INCLUDED=no PRIVATE_ADDRESSES_INCLUDED=no -RAW_EVIDENCE_SHA256=7e65c67d27f9681cb78b2341a92b23fd67fdb3eb77028a92a5e320345837fc9c -SANITIZED_OUTPUT_SHA256=7e65c67d27f9681cb78b2341a92b23fd67fdb3eb77028a92a5e320345837fc9c +RAW_EVIDENCE_SHA256=6018d2046ced7926ff69efd1924f09f46e9f3502f93d25f53709946add9baa9b +SANITIZED_OUTPUT_SHA256=6018d2046ced7926ff69efd1924f09f46e9f3502f93d25f53709946add9baa9b OUTPUT_BEGIN -WINDOWS_DACHA_STARTUP_SCRIPT_RCA=V1 +WINDOWS_DACHA_MISSING_REVERSE_PLINK_RCA=V1 MODE=read-only NO_MUTATION=true WINDOWS_LOCAL_INSPECT_RC=0 WINDOWS_EVIDENCE_PRESENT=true +REC|PLINK_PROC|IDX=1|PID=14608|SESSION=1 +PLINK1_OWNER_QUERY_RC=0 +PLINK1_PAGEANT_SAME_OWNER_SESSION_COUNT=1 +PLINK1_CMD_AVAILABLE=true +PLINK1_HAS_AGENT=true +PLINK1_HAS_NOAGENT=false +PLINK1_HAS_BATCH=true +PLINK1_HAS_LOAD=false +PLINK1_HAS_KEYFILE=false +PLINK1_HAS_PROXYCMD=false +PLINK1_HAS_N=true +PLINK_PROCESS_COUNT=1 STARTUP_FOLDER_PRESENT=true -REC|SHORTCUT|IDX=1|TARGET_BASENAME=powershell.exe|ARG_LENGTH=171|HAS_FILE_SWITCH=true|HAS_COMMAND_SWITCH=false|HAS_ENCODED_COMMAND=false|HAS_NOPROFILE=true|HAS_WINDOWSTYLE=true|HAS_EXECUTIONPOLICY=true -STARTUP1_ARGS_HAS_64020=true -STARTUP1_ARGS_HAS_64022=true -STARTUP1_ARGS_HAS_PLINK=false -STARTUP1_ARGS_HAS_PAGEANT=false -STARTUP1_ARGS_HAS_SSH=false -STARTUP1_ARGS_HAS_START_PROCESS=false -STARTUP1_ARGS_HAS_STOP_PROCESS=false -STARTUP1_ARGS_HAS_GET_PROCESS=false -STARTUP1_ARGS_HAS_GET_NETTCP=false -STARTUP1_ARGS_HAS_NETSTAT=false -STARTUP1_ARGS_HAS_TEST_PATH=false -STARTUP1_ARGS_HAS_LOCK_TOKEN=false -STARTUP1_ARGS_HAS_PID_TOKEN=false -STARTUP1_ARGS_HAS_WATCHDOG=false -STARTUP1_ARGS_HAS_WHILE=false -STARTUP1_ARGS_HAS_START_SLEEP=false -STARTUP1_ARGS_HAS_EXIT=false -STARTUP1_ARGS_HAS_TCPCLIENT=false -STARTUP1_ARGS_HAS_TCPLISTENER=false -STARTUP1_ARGS_HAS_PROXY=false -STARTUP1_ARGS_HAS_TELEGRAM=false -STARTUP1_ARGS_HAS_IOBIT=false -STARTUP1_ARGS_HAS_CURL=false -STARTUP1_ARGS_HAS_INVOKE_WEBREQUEST=false -STARTUP1_PS1_CANDIDATE_COUNT=1 -STARTUP1_PS1_RESOLVED=true -REC|SCRIPT|IDX=1|BASENAME=bridge.ps1|SIZE=5696 -STARTUP1_SCRIPT_HAS_64020=true -STARTUP1_SCRIPT_HAS_64022=false -STARTUP1_SCRIPT_HAS_PLINK=false -STARTUP1_SCRIPT_HAS_PAGEANT=false -STARTUP1_SCRIPT_HAS_SSH=false -STARTUP1_SCRIPT_HAS_START_PROCESS=false -STARTUP1_SCRIPT_HAS_STOP_PROCESS=false -STARTUP1_SCRIPT_HAS_GET_PROCESS=false -STARTUP1_SCRIPT_HAS_GET_NETTCP=false -STARTUP1_SCRIPT_HAS_NETSTAT=false -STARTUP1_SCRIPT_HAS_TEST_PATH=false -STARTUP1_SCRIPT_HAS_LOCK_TOKEN=false -STARTUP1_SCRIPT_HAS_PID_TOKEN=false -STARTUP1_SCRIPT_HAS_WATCHDOG=false -STARTUP1_SCRIPT_HAS_WHILE=true -STARTUP1_SCRIPT_HAS_START_SLEEP=false -STARTUP1_SCRIPT_HAS_EXIT=false -STARTUP1_SCRIPT_HAS_TCPCLIENT=true -STARTUP1_SCRIPT_HAS_TCPLISTENER=true -STARTUP1_SCRIPT_HAS_PROXY=true -STARTUP1_SCRIPT_HAS_TELEGRAM=false -STARTUP1_SCRIPT_HAS_IOBIT=false -STARTUP1_SCRIPT_HAS_CURL=false -STARTUP1_SCRIPT_HAS_INVOKE_WEBREQUEST=false -REC|SCRIPT_LINE_SHAPE|IDX=1|LINE=1|HAS_64020=true|HAS_64022=false|HAS_PLINK=false|HAS_PAGEANT=false|HAS_START_PROCESS=false|HAS_STOP_PROCESS=false|HAS_GET_NETTCP=false|HAS_TEST_PATH=false|HAS_PID=false|HAS_LOCK=false|HAS_EXIT=false|HAS_R=false|HAS_L=false|HAS_D=false -STARTUP1_RELEVANT_LINE_COUNT=1 -REC|SHORTCUT|IDX=2|TARGET_BASENAME=powershell.exe|ARG_LENGTH=171|HAS_FILE_SWITCH=true|HAS_COMMAND_SWITCH=false|HAS_ENCODED_COMMAND=false|HAS_NOPROFILE=true|HAS_WINDOWSTYLE=true|HAS_EXECUTIONPOLICY=true -STARTUP2_ARGS_HAS_64020=true -STARTUP2_ARGS_HAS_64022=true -STARTUP2_ARGS_HAS_PLINK=false -STARTUP2_ARGS_HAS_PAGEANT=false -STARTUP2_ARGS_HAS_SSH=false -STARTUP2_ARGS_HAS_START_PROCESS=false -STARTUP2_ARGS_HAS_STOP_PROCESS=false -STARTUP2_ARGS_HAS_GET_PROCESS=false -STARTUP2_ARGS_HAS_GET_NETTCP=false -STARTUP2_ARGS_HAS_NETSTAT=false -STARTUP2_ARGS_HAS_TEST_PATH=false -STARTUP2_ARGS_HAS_LOCK_TOKEN=false -STARTUP2_ARGS_HAS_PID_TOKEN=false -STARTUP2_ARGS_HAS_WATCHDOG=false -STARTUP2_ARGS_HAS_WHILE=false -STARTUP2_ARGS_HAS_START_SLEEP=false -STARTUP2_ARGS_HAS_EXIT=false -STARTUP2_ARGS_HAS_TCPCLIENT=false -STARTUP2_ARGS_HAS_TCPLISTENER=false -STARTUP2_ARGS_HAS_PROXY=false -STARTUP2_ARGS_HAS_TELEGRAM=false -STARTUP2_ARGS_HAS_IOBIT=false -STARTUP2_ARGS_HAS_CURL=false -STARTUP2_ARGS_HAS_INVOKE_WEBREQUEST=false -STARTUP2_PS1_CANDIDATE_COUNT=1 -STARTUP2_PS1_RESOLVED=true -REC|SCRIPT|IDX=2|BASENAME=bridge.ps1|SIZE=5696 -STARTUP2_SCRIPT_HAS_64020=true -STARTUP2_SCRIPT_HAS_64022=false -STARTUP2_SCRIPT_HAS_PLINK=false -STARTUP2_SCRIPT_HAS_PAGEANT=false -STARTUP2_SCRIPT_HAS_SSH=false -STARTUP2_SCRIPT_HAS_START_PROCESS=false -STARTUP2_SCRIPT_HAS_STOP_PROCESS=false -STARTUP2_SCRIPT_HAS_GET_PROCESS=false -STARTUP2_SCRIPT_HAS_GET_NETTCP=false -STARTUP2_SCRIPT_HAS_NETSTAT=false -STARTUP2_SCRIPT_HAS_TEST_PATH=false -STARTUP2_SCRIPT_HAS_LOCK_TOKEN=false -STARTUP2_SCRIPT_HAS_PID_TOKEN=false -STARTUP2_SCRIPT_HAS_WATCHDOG=false -STARTUP2_SCRIPT_HAS_WHILE=true -STARTUP2_SCRIPT_HAS_START_SLEEP=false -STARTUP2_SCRIPT_HAS_EXIT=false -STARTUP2_SCRIPT_HAS_TCPCLIENT=true -STARTUP2_SCRIPT_HAS_TCPLISTENER=true -STARTUP2_SCRIPT_HAS_PROXY=true -STARTUP2_SCRIPT_HAS_TELEGRAM=false -STARTUP2_SCRIPT_HAS_IOBIT=false -STARTUP2_SCRIPT_HAS_CURL=false -STARTUP2_SCRIPT_HAS_INVOKE_WEBREQUEST=false -REC|SCRIPT_LINE_SHAPE|IDX=2|LINE=1|HAS_64020=true|HAS_64022=false|HAS_PLINK=false|HAS_PAGEANT=false|HAS_START_PROCESS=false|HAS_STOP_PROCESS=false|HAS_GET_NETTCP=false|HAS_TEST_PATH=false|HAS_PID=false|HAS_LOCK=false|HAS_EXIT=false|HAS_R=false|HAS_L=false|HAS_D=false -STARTUP2_RELEVANT_LINE_COUNT=1 -STARTUP_EXACT_MATCH_COUNT=2 -REC|SCRIPT_HASH|IDX=1|BASENAME=bridge.ps1|SHA256=d6ed793d7cfd3ec4894ff766f1c20a5de80cf3be6615a27ae4dc0f836da4cf0e -REC|SCRIPT_HASH|IDX=2|BASENAME=bridge.ps1|SHA256=d6ed793d7cfd3ec4894ff766f1c20a5de80cf3be6615a27ae4dc0f836da4cf0e -CURRENT_PID64020_PRESENT=5964 -CURRENT_PID64022_PRESENT=15780 -REC|CURRENT_OWNER|PID=5964|IMAGE=plink.exe -REC|CURRENT_OWNER|PID=15780|IMAGE=powershell.exe +REC|STARTUP_ALL|IDX=1|EXT=lnk|TARGET_BASENAME=cloud.exe|ARG_LENGTH=10|HAS_64020=false|HAS_64022=false|HAS_PLINK=false|HAS_PAGEANT=false|HAS_POWERSHELL=false +STARTUP1_ARGS_CMD_AVAILABLE=true +STARTUP1_ARGS_HAS_AGENT=false +STARTUP1_ARGS_HAS_NOAGENT=false +STARTUP1_ARGS_HAS_BATCH=false +STARTUP1_ARGS_HAS_LOAD=false +STARTUP1_ARGS_HAS_KEYFILE=false +STARTUP1_ARGS_HAS_PROXYCMD=false +STARTUP1_ARGS_HAS_N=false +REC|STARTUP_ALL|IDX=2|EXT=ini +REC|STARTUP_ALL|IDX=3|EXT=lnk|TARGET_BASENAME=fscapture.exe|ARG_LENGTH=7|HAS_64020=false|HAS_64022=false|HAS_PLINK=false|HAS_PAGEANT=false|HAS_POWERSHELL=false +STARTUP3_ARGS_CMD_AVAILABLE=true +STARTUP3_ARGS_HAS_AGENT=false +STARTUP3_ARGS_HAS_NOAGENT=false +STARTUP3_ARGS_HAS_BATCH=false +STARTUP3_ARGS_HAS_LOAD=false +STARTUP3_ARGS_HAS_KEYFILE=false +STARTUP3_ARGS_HAS_PROXYCMD=false +STARTUP3_ARGS_HAS_N=false +REC|STARTUP_ALL|IDX=4|EXT=lnk|TARGET_BASENAME=powershell.exe|ARG_LENGTH=120|HAS_64020=false|HAS_64022=false|HAS_PLINK=false|HAS_PAGEANT=false|HAS_POWERSHELL=true +STARTUP4_ARGS_CMD_AVAILABLE=true +STARTUP4_ARGS_HAS_AGENT=false +STARTUP4_ARGS_HAS_NOAGENT=false +STARTUP4_ARGS_HAS_BATCH=false +STARTUP4_ARGS_HAS_LOAD=false +STARTUP4_ARGS_HAS_KEYFILE=false +STARTUP4_ARGS_HAS_PROXYCMD=false +STARTUP4_ARGS_HAS_N=false +REC|STARTUP_ARG_REF|IDX=4|BASENAME=proxystackstartup.ps1|EXT=ps1 +REC|STARTUP_ALL|IDX=5|EXT=lnk|TARGET_BASENAME=pageant.exe|ARG_LENGTH=61|HAS_64020=false|HAS_64022=false|HAS_PLINK=false|HAS_PAGEANT=true|HAS_POWERSHELL=false +STARTUP5_ARGS_CMD_AVAILABLE=true +STARTUP5_ARGS_HAS_AGENT=false +STARTUP5_ARGS_HAS_NOAGENT=false +STARTUP5_ARGS_HAS_BATCH=false +STARTUP5_ARGS_HAS_LOAD=false +STARTUP5_ARGS_HAS_KEYFILE=false +STARTUP5_ARGS_HAS_PROXYCMD=false +STARTUP5_ARGS_HAS_N=false +REC|STARTUP_ALL|IDX=6|EXT=backup +REC|STARTUP_ALL|IDX=7|EXT=lnk|TARGET_BASENAME=punto.exe|ARG_LENGTH=0|HAS_64020=false|HAS_64022=false|HAS_PLINK=false|HAS_PAGEANT=false|HAS_POWERSHELL=false +STARTUP7_ARGS_CMD_AVAILABLE=false +REC|STARTUP_ALL|IDX=8|EXT=lnk|TARGET_BASENAME=powershell.exe|ARG_LENGTH=131|HAS_64020=false|HAS_64022=false|HAS_PLINK=false|HAS_PAGEANT=false|HAS_POWERSHELL=true +STARTUP8_ARGS_CMD_AVAILABLE=true +STARTUP8_ARGS_HAS_AGENT=false +STARTUP8_ARGS_HAS_NOAGENT=false +STARTUP8_ARGS_HAS_BATCH=false +STARTUP8_ARGS_HAS_LOAD=false +STARTUP8_ARGS_HAS_KEYFILE=false +STARTUP8_ARGS_HAS_PROXYCMD=false +STARTUP8_ARGS_HAS_N=false +REC|STARTUP_ARG_REF|IDX=8|BASENAME=watchdog.ps1|EXT=ps1 +REC|STARTUP_ALL|IDX=9|EXT=lnk|TARGET_BASENAME=powershell.exe|ARG_LENGTH=171|HAS_64020=true|HAS_64022=true|HAS_PLINK=false|HAS_PAGEANT=false|HAS_POWERSHELL=true +STARTUP9_ARGS_CMD_AVAILABLE=true +STARTUP9_ARGS_HAS_AGENT=false +STARTUP9_ARGS_HAS_NOAGENT=false +STARTUP9_ARGS_HAS_BATCH=false +STARTUP9_ARGS_HAS_LOAD=false +STARTUP9_ARGS_HAS_KEYFILE=false +STARTUP9_ARGS_HAS_PROXYCMD=false +STARTUP9_ARGS_HAS_N=false +REC|STARTUP_ARG_REF|IDX=9|BASENAME=bridge.ps1|EXT=ps1 +REC|STARTUP_ALL|IDX=10|EXT=lnk|TARGET_BASENAME=powershell.exe|ARG_LENGTH=171|HAS_64020=true|HAS_64022=true|HAS_PLINK=false|HAS_PAGEANT=false|HAS_POWERSHELL=true +STARTUP10_ARGS_CMD_AVAILABLE=true +STARTUP10_ARGS_HAS_AGENT=false +STARTUP10_ARGS_HAS_NOAGENT=false +STARTUP10_ARGS_HAS_BATCH=false +STARTUP10_ARGS_HAS_LOAD=false +STARTUP10_ARGS_HAS_KEYFILE=false +STARTUP10_ARGS_HAS_PROXYCMD=false +STARTUP10_ARGS_HAS_N=false +REC|STARTUP_ARG_REF|IDX=10|BASENAME=bridge.ps1|EXT=ps1 +STARTUP_TOTAL_FILE_COUNT=10 +REC|POWERSHELL_PROC|IDX=1|PID=11432|SESSION=1 +POWERSHELL1_CMD_AVAILABLE=true +POWERSHELL1_HAS_AGENT=false +POWERSHELL1_HAS_NOAGENT=false +POWERSHELL1_HAS_BATCH=false +POWERSHELL1_HAS_LOAD=false +POWERSHELL1_HAS_KEYFILE=false +POWERSHELL1_HAS_PROXYCMD=false +POWERSHELL1_HAS_N=false +REC|POWERSHELL_PROC|IDX=2|PID=11376|SESSION=1 +POWERSHELL2_CMD_AVAILABLE=true +POWERSHELL2_HAS_AGENT=false +POWERSHELL2_HAS_NOAGENT=false +POWERSHELL2_HAS_BATCH=false +POWERSHELL2_HAS_LOAD=false +POWERSHELL2_HAS_KEYFILE=false +POWERSHELL2_HAS_PROXYCMD=false +POWERSHELL2_HAS_N=false +REC|POWERSHELL_PROC|IDX=3|PID=13292|SESSION=1 +POWERSHELL3_CMD_AVAILABLE=true +POWERSHELL3_HAS_AGENT=false +POWERSHELL3_HAS_NOAGENT=false +POWERSHELL3_HAS_BATCH=false +POWERSHELL3_HAS_LOAD=false +POWERSHELL3_HAS_KEYFILE=false +POWERSHELL3_HAS_PROXYCMD=false +POWERSHELL3_HAS_N=false +REC|POWERSHELL_PROC|IDX=4|PID=15780|SESSION=1 +POWERSHELL4_CMD_AVAILABLE=true +POWERSHELL4_HAS_AGENT=false +POWERSHELL4_HAS_NOAGENT=false +POWERSHELL4_HAS_BATCH=false +POWERSHELL4_HAS_LOAD=false +POWERSHELL4_HAS_KEYFILE=false +POWERSHELL4_HAS_PROXYCMD=false +POWERSHELL4_HAS_N=false +POWERSHELL_PROCESS_COUNT=4 +REC|LOCAL_REF_FILE|KIND=PLINK_EXE|IDX=1|BASENAME=plink.exe|EXT=.exe|SHA256=30e75ef832c684b8f1e45667af29a91390b5508cf43dab69247d9713e13d8430 +REC|LOCAL_REF_SHAPE|KIND=PLINK_EXE|IDX=1|HAS_64020=false|HAS_64022=false|HAS_PLINK=true|HAS_R=true|HAS_L=true|HAS_D=true|HAS_PAGEANT=true|HAS_START_PROCESS=false|HAS_GET_NETTCP=false +REC|LOCAL_REF_FILE|KIND=STARTUP_TARGET|IDX=1|BASENAME=Cloud.exe|EXT=.exe|SHA256=757715535c30d107a50ebb6b0e297872ab09bca5e44da44fb9046ba43ff946af +REC|LOCAL_REF_SHAPE|KIND=STARTUP_TARGET|IDX=1|HAS_64020=false|HAS_64022=false|HAS_PLINK=false|HAS_R=true|HAS_L=false|HAS_D=true|HAS_PAGEANT=false|HAS_START_PROCESS=false|HAS_GET_NETTCP=false +REC|LOCAL_REF_FILE|KIND=STARTUP_TARGET|IDX=3|BASENAME=FSCapture.exe|EXT=.exe|SHA256=1a111d3ef9b3c4432c0436b76e5e8939c6dbddbee7bdf630a25f06cc0b50f972 +REC|LOCAL_REF_SHAPE|KIND=STARTUP_TARGET|IDX=3|HAS_64020=false|HAS_64022=false|HAS_PLINK=false|HAS_R=true|HAS_L=true|HAS_D=true|HAS_PAGEANT=false|HAS_START_PROCESS=false|HAS_GET_NETTCP=false +REC|LOCAL_REF_FILE|KIND=STARTUP_TARGET|IDX=4|BASENAME=powershell.exe|EXT=.exe|SHA256=9785001b0dcf755eddb8af294a373c0b87b2498660f724e76c4d53f9c217c7a3 +REC|LOCAL_REF_SHAPE|KIND=STARTUP_TARGET|IDX=4|HAS_64020=false|HAS_64022=false|HAS_PLINK=false|HAS_R=true|HAS_L=false|HAS_D=true|HAS_PAGEANT=false|HAS_START_PROCESS=false|HAS_GET_NETTCP=false +REC|LOCAL_REF_FILE|KIND=STARTUP_ARG|IDX=4|BASENAME=ProxyStackStartup.ps1|EXT=.ps1|SHA256=e9552fc158a236d0b50dd6e4059390a9565678aea1ea46d75320929837671433 +REC|LOCAL_REF_SHAPE|KIND=STARTUP_ARG|IDX=4|HAS_64020=false|HAS_64022=false|HAS_PLINK=false|HAS_R=true|HAS_L=true|HAS_D=true|HAS_PAGEANT=false|HAS_START_PROCESS=true|HAS_GET_NETTCP=true +REC|LOCAL_REF_FILE|KIND=STARTUP_TARGET|IDX=5|BASENAME=pageant.exe|EXT=.exe|SHA256=6457208e5391df615552f629e615dca2b80c87c63ee65fa245fd1369ce5c9e81 +REC|LOCAL_REF_SHAPE|KIND=STARTUP_TARGET|IDX=5|HAS_64020=false|HAS_64022=false|HAS_PLINK=false|HAS_R=true|HAS_L=true|HAS_D=true|HAS_PAGEANT=true|HAS_START_PROCESS=false|HAS_GET_NETTCP=false +REC|LOCAL_REF_FILE|KIND=STARTUP_TARGET|IDX=7|BASENAME=punto.exe|EXT=.exe|SHA256=708bf79f69b9c6decf26458f73f54088ab268dd038b1e338fb083f0f255b18df +REC|LOCAL_REF_SHAPE|KIND=STARTUP_TARGET|IDX=7|HAS_64020=false|HAS_64022=false|HAS_PLINK=false|HAS_R=true|HAS_L=true|HAS_D=true|HAS_PAGEANT=false|HAS_START_PROCESS=false|HAS_GET_NETTCP=false +REC|LOCAL_REF_FILE|KIND=STARTUP_TARGET|IDX=8|BASENAME=powershell.exe|EXT=.exe|SHA256=9785001b0dcf755eddb8af294a373c0b87b2498660f724e76c4d53f9c217c7a3 +REC|LOCAL_REF_SHAPE|KIND=STARTUP_TARGET|IDX=8|HAS_64020=false|HAS_64022=false|HAS_PLINK=false|HAS_R=true|HAS_L=false|HAS_D=true|HAS_PAGEANT=false|HAS_START_PROCESS=false|HAS_GET_NETTCP=false +REC|LOCAL_REF_FILE|KIND=STARTUP_ARG|IDX=8|BASENAME=watchdog.ps1|EXT=.ps1|SHA256=7738599c1d229c105f1073f04b420063bd776f3444b3f6fcf7d09bd320cce0e3 +REC|LOCAL_REF_SHAPE|KIND=STARTUP_ARG|IDX=8|HAS_64020=true|HAS_64022=false|HAS_PLINK=true|HAS_R=true|HAS_L=true|HAS_D=false|HAS_PAGEANT=false|HAS_START_PROCESS=false|HAS_GET_NETTCP=true +REC|LOCAL_REF_FILE|KIND=STARTUP_TARGET|IDX=9|BASENAME=powershell.exe|EXT=.exe|SHA256=9785001b0dcf755eddb8af294a373c0b87b2498660f724e76c4d53f9c217c7a3 +REC|LOCAL_REF_SHAPE|KIND=STARTUP_TARGET|IDX=9|HAS_64020=false|HAS_64022=false|HAS_PLINK=false|HAS_R=true|HAS_L=false|HAS_D=true|HAS_PAGEANT=false|HAS_START_PROCESS=false|HAS_GET_NETTCP=false +REC|LOCAL_REF_FILE|KIND=STARTUP_ARG|IDX=9|BASENAME=bridge.ps1|EXT=.ps1|SHA256=d6ed793d7cfd3ec4894ff766f1c20a5de80cf3be6615a27ae4dc0f836da4cf0e +REC|LOCAL_REF_SHAPE|KIND=STARTUP_ARG|IDX=9|HAS_64020=true|HAS_64022=false|HAS_PLINK=false|HAS_R=false|HAS_L=true|HAS_D=false|HAS_PAGEANT=false|HAS_START_PROCESS=false|HAS_GET_NETTCP=false +REC|LOCAL_REF_FILE|KIND=STARTUP_TARGET|IDX=10|BASENAME=powershell.exe|EXT=.exe|SHA256=9785001b0dcf755eddb8af294a373c0b87b2498660f724e76c4d53f9c217c7a3 +REC|LOCAL_REF_SHAPE|KIND=STARTUP_TARGET|IDX=10|HAS_64020=false|HAS_64022=false|HAS_PLINK=false|HAS_R=true|HAS_L=false|HAS_D=true|HAS_PAGEANT=false|HAS_START_PROCESS=false|HAS_GET_NETTCP=false +REC|LOCAL_REF_FILE|KIND=STARTUP_ARG|IDX=10|BASENAME=bridge.ps1|EXT=.ps1|SHA256=d6ed793d7cfd3ec4894ff766f1c20a5de80cf3be6615a27ae4dc0f836da4cf0e +REC|LOCAL_REF_SHAPE|KIND=STARTUP_ARG|IDX=10|HAS_64020=true|HAS_64022=false|HAS_PLINK=false|HAS_R=false|HAS_L=true|HAS_D=false|HAS_PAGEANT=false|HAS_START_PROCESS=false|HAS_GET_NETTCP=false PVE64020_LISTENER_COUNT=0 PVE64020_SSHD_OWNER_COUNT=0 CLUSTER_QUORATE=true @@ -155,14 +187,14 @@ NETBIRD_LAZY=false NETBIRD_MANAGEMENT=true NETBIRD_SIGNAL=true NETBIRD_CONNECTED=5 -DECISION=PASS_WINDOWS_DACHA_STARTUP_SCRIPT_RCA -NEXT_GATE=EXACT_LOCAL_WATCHDOG_REPAIR -TASK_RESULT=WINDOWS_DACHA_STARTUP_SCRIPT_RCA +DECISION=PASS_WINDOWS_DACHA_MISSING_REVERSE_PLINK_RCA +NEXT_GATE=RESTORE_EXACT_REVERSE_PLINK +TASK_RESULT=WINDOWS_DACHA_MISSING_REVERSE_PLINK_RCA CHANGES_MADE=false ROLLBACK_STARTED=false ROLLBACK_RESTORED=null MUTATION_OUTCOME=NO_MUTATION -HOMELAB_RESULT_CONTRACT={"version":1,"command_id":"SUPPORT-261007-WINDOWS-DACHA-STARTUP-SCRIPT-RCA-99752R1","status":"OK","changes_made":false,"rollback_started":false,"rollback_restored":null} +HOMELAB_RESULT_CONTRACT={"version":1,"command_id":"SUPPORT-261007-WINDOWS-DACHA-MISSING-REVERSE-PLINK-RCA-99753R1","status":"OK","changes_made":false,"rollback_started":false,"rollback_restored":null} OUTPUT_END CHAT_OUTPUT_END