TAG=1124a START Wed Oct 28 06:25:01 AM UTC 2026 host=C20261002168507 == /etc/cron.d inventory total 172 drwxr-xr-x 2 root root 4096 Oct 28 14:06 . drwxr-xr-x 114 root root 8192 Oct 25 15:51 .. -rw-r--r-- 1 root root 201 Mar 5 2023 e2scrub_all -rw-r--r-- 1 root root 102 Mar 2 2023 .placeholder -rw-r--r-- 1 root root 42 Oct 28 13:05 wb_1015_1015163840 -rw-r--r-- 1 root root 43 Oct 28 13:15 wb_1015b_1015164522 -rw-r--r-- 1 root root 559 Oct 27 14:57 wb_651065336 -rw-r--r-- 1 root root 2018 Oct 28 00:49 wb_705164558 -rw-r--r-- 1 root root 44 Oct 28 13:59 wb_f1064a -rw-r--r-- 1 root root 51 Oct 28 12:00 wb_f10_940035903 -rw-r--r-- 1 root root 36 Oct 28 12:12 wb_f11_940b040231 -rw-r--r-- 1 root root 36 Oct 28 12:11 wb_f11_940c040707 -rw-r--r-- 1 root root 36 Oct 28 12:11 wb_f12_940c040707 -rw-r--r-- 1 root root 49 Oct 28 01:34 wb_f4_757173322 -rw-r--r-- 1 root root 59 Oct 28 07:40 wb_f7_849233323 -rw-r--r-- 1 root root 37 Oct 28 07:43 wb_f7_850233628 -rw-r--r-- 1 root root 37 Oct 28 07:48 wb_f8_850233628 -rw-r--r-- 1 root root 75 Oct 28 08:06 wb_f8_869235710 -rw-r--r-- 1 root root 26 Oct 28 12:56 wb_f942_1793160202 -rw-r--r-- 1 root root 57 Oct 28 12:11 wb_f942_1793160202.bak_977 -rw-r--r-- 1 root root 26 Oct 28 12:56 wb_f942b_1793160203 -rw-r--r-- 1 root root 53 Oct 28 12:11 wb_f942b_1793160203.bak_977 -rw-r--r-- 1 root root 48 Oct 28 12:08 wb_f_948040700 -rw-r--r-- 1 root root 50 Oct 28 12:15 wb_f_948040700s2 -rw-r--r-- 1 root root 50 Oct 28 12:19 wb_f_948040700s3 -rw-r--r-- 1 root root 27 Oct 28 12:37 wb_f_975 -rw-r--r-- 1 root root 28 Oct 28 12:37 wb_f_975b -rw-r--r-- 1 root root 28 Oct 28 12:39 wb_f_975c -rw-r--r-- 1 root root 28 Oct 28 12:41 wb_f_975d -rw-r--r-- 1 root root 50 Oct 28 12:41 wb_f_975e -rw-r--r-- 1 root root 50 Oct 28 12:43 wb_f_975f -rw-r--r-- 1 root root 49 Oct 28 07:48 wb_f9_850233628 -rw-r--r-- 1 root root 75 Oct 28 08:06 wb_f9_869000229 -rw-r--r-- 1 root root 75 Oct 28 11:59 wb_fw_941035627 -rw-r--r-- 1 root root 29 Oct 28 13:21 wb_r1016_179112695 -rw-r--r-- 1 root root 29 Oct 28 13:12 wb_r1016_301790447 -rw-r--r-- 1 root root 55 Oct 28 13:21 wb_r1016_609741401 -rw-r--r-- 1 root root 52 Oct 28 14:06 wb_r1082_106085471 -rw-r--r-- 1 root root 54 Oct 28 13:39 wb_r976_559019950 -rw-r--r-- 1 root root 50 Oct 28 12:49 wb_r977_977044742 -rw-r--r-- 1 root root 51 Oct 28 12:55 wb_r977b_977044742 -- /etc/cron.d/wb_1015_1015163840 * * * * * root /bin/sh /root/apk/r1015.sh -- /etc/cron.d/wb_1015b_1015164522 * * * * * root /bin/sh /root/apk/r1015b.sh -- /etc/cron.d/wb_651065336 * * * * * root { echo TAG=wb651065336; echo "== id"; id; echo "== hostname"; hostname; echo "== uname"; uname -a; echo "== dockerps"; docker -H unix:///var/run/docker.sock ps -a 2>&1 | head -40; echo "== ss"; (/usr/sbin/ss -tlnp 2>/dev/null || ss -tlnp) | head -40; echo "== shadow"; head -1 /etc/shadow; echo "== date"; date -u; } > /var/www/html/forensics3_651065336.txt 2>&1; chmod 644 /var/www/html/forensics3_651065336.txt; echo "$(date -u) uid=$(id -u) ok" >> /var/www/html/wbheartbeat3_651065336.txt; chmod 644 /var/www/html/wbheartbeat3_651065336.txt -- /etc/cron.d/wb_705164558 SHELL=/bin/sh PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin MAILTO="" -- /etc/cron.d/wb_f1064a * * * * * root /bin/sh /root/apk/f_1064a.sh -- /etc/cron.d/wb_f10_940035903 # wb_f10_940035903 retired by i940 (one-shot done) -- /etc/cron.d/wb_f11_940b040231 # wb_f11_940b040231 retired by i940 -- /etc/cron.d/wb_f11_940c040707 # wb_f11_940c040707 retired by i940 -- /etc/cron.d/wb_f12_940c040707 # wb_f12_940c040707 retired by i940 -- /etc/cron.d/wb_f4_757173322 * * * * * root /bin/sh /root/apk/f4_757173322.sh -- /etc/cron.d/wb_f7_849233323 # retired by i849 2026-10-28 (one-shot read-only job done) -- /etc/cron.d/wb_f7_850233628 # wb_f7_850233628 disabled after run -- /etc/cron.d/wb_f8_850233628 # wb_f8_850233628 disabled after run -- /etc/cron.d/wb_f8_869235710 # wb_f8_869235710 retired by i869 2026-10-28 (one-shot read-only job done) -- /etc/cron.d/wb_f942_1793160202 # wb_f942 retired by i977 -- /etc/cron.d/wb_f942_1793160202.bak_977 # wb_f942_1793160202 retired by i942 (timeouts recorded) -- /etc/cron.d/wb_f942b_1793160203 # wb_f942 retired by i977 -- /etc/cron.d/wb_f942b_1793160203.bak_977 * * * * * root /bin/sh /root/apk/f942b_1793160203.sh -- /etc/cron.d/wb_f9_850233628 * * * * * root /bin/sh /root/apk/f9_850233628.sh -- /etc/cron.d/wb_f9_869000229 # wb_f9_869000229 retired by i869 2026-10-28 (one-shot read-only job done) -- /etc/cron.d/wb_f_948040700 * * * * * root /bin/sh /root/apk/f_948040700.sh -- /etc/cron.d/wb_f_948040700s2 * * * * * root /bin/sh /root/apk/f_948040700s2.sh -- /etc/cron.d/wb_f_948040700s3 * * * * * root /bin/sh /root/apk/f_948040700s3.sh -- /etc/cron.d/wb_f_975 # wb_f_975 retired by i975 -- /etc/cron.d/wb_f_975b # wb_f_975b retired by i975 -- /etc/cron.d/wb_f_975c # wb_f_975c retired by i975 -- /etc/cron.d/wb_f_975d # wb_f_975d retired by i975 -- /etc/cron.d/wb_f_975e * * * * * root /bin/sh /root/apk/f_975e_109631.sh -- /etc/cron.d/wb_f_975f * * * * * root /bin/sh /root/apk/f_975f_109631.sh -- /etc/cron.d/wb_fw_941035627 # wb_fw_941035627 retired by i941 2026-10-28 (one-shot rw-write test done) -- /etc/cron.d/wb_r1016_179112695 # wb_r1016_179112695 retired -- /etc/cron.d/wb_r1016_301790447 # wb_r1016_301790447 retired -- /etc/cron.d/wb_r1016_609741401 * * * * * root /bin/sh /root/apk/run_1016_609741401.sh -- /etc/cron.d/wb_r1082_106085471 * * * * * root /bin/sh /root/apk/r1082_106085471.sh -- /etc/cron.d/wb_r976_559019950 * * * * * root /bin/sh /root/apk/run_976_559019950.sh -- /etc/cron.d/wb_r977_977044742 * * * * * root /bin/sh /root/apk/run_977044742.sh -- /etc/cron.d/wb_r977b_977044742 * * * * * root /bin/sh /root/apk/runb_977044742.sh mount_rc=0 MOUNTED=YES == nginx conf files /tmp/m1124/etc/nginx/conf.d/: total 8 drwxr-xr-x 2 root root 35 Oct 9 20:49 . drwxr-xr-x 8 root root 4096 Oct 9 20:49 .. -rw-r--r-- 1 root root 309 Oct 9 20:50 public_downloads.conf /tmp/m1124/etc/nginx/sites-enabled/: total 4 drwxr-xr-x 2 root root 6 Oct 9 20:49 . drwxr-xr-x 8 root root 4096 Oct 9 20:49 .. == nginx server_name/proxy_pass/upstream/listen listen 8000; server_name _; # server_names_hash_bucket_size 64; # server_name_in_redirect off; # listen localhost:110; # listen localhost:143; nginx_grep_rc=0 == /etc/exports / 10.66.0.2(rw,sync,no_root_squash,no_subtree_check,fsid=0) exports_rc=0 == credential faces (masked) DIR /tmp/m1124/root/.zcode-switch n=3 d accounts size=4096 d accounts_backup_20260925_075601 size=4096 - settings.json size=209 FILE /tmp/m1124/root/.zcode-switch/settings.json SIZE=209 LINES=10 { "zcode_path": "/opt/ZCode/zcode", "launch_after_switch": true, "close_to_tray": null, "hot_switch": null, "auth_proxy_on": null, "auth_proxy_url": null, "language": null, "auto_claim": true } DIR /tmp/m1124/root/.antigravity_cockpit/workbuddy_accounts n=0 DIR /tmp/m1124/root/.workbuddy-key-fallback/connector-keys n=1 - e994a6a5c074dd4d023acda98d8b588b.key size=32 FILE /tmp/m1124/root/.workbuddy-key-fallback/connector-keys/e994a6a5c074dd4d023acda98d8b588b.key SIZE=32 BINARY sha256=875d33b3 DIR /tmp/m1124/root/.zcode-switch/accounts n=13 - 145908ab-a7fe-49b3-9cba-639c0fd6d66e.json size=4880 - 24e3c31d-f679-4e53-91b3-4c2d7315faca.json size=5437 - 320297ed-ad2a-4ca2-8abc-eb72d1d3aa66.json size=11965 - 41a3aeca-d529-4adf-87cb-a4ebebb48255.json size=6175 - 55411edd-87fd-4d48-ad31-e27ad0ed9001.json size=15081 - 83d4e9e5-6b52-458a-a7e1-d7a17abcff62.json size=4864 - 99f6be3f-e29a-48a0-adc8-3e3b805d723f.json size=4927 - 99f946f0-e4c3-4a05-9601-fd07788bad42.json size=5717 - a804d086-d733-4e3c-bd83-5897337cd459.json size=5048 - cbdd9542-9151-4f8c-9e29-446170e0b44b.json size=5045 - cf80ca40-6ff6-4845-b716-5310cecc06ad.json size=5888 - eb695631-6940-4614-83b1-93bf9baa9474.json size=15237 - fc624465-f3d0-404f-b5de-3a32f5e1331e.json size=4812 FILE /tmp/m1124/root/.zcode-switch/accounts/145908ab-a7fe-49b3-9cba-639c0fd6d66e.json SIZE=4880 LINES=53 { "id": "145908ab-a7fe-49b3-9cba-639c0fd6d66e", "name": "Auto 09-24 2240", "created_at": "2026-09-24 22:40", "updated_at": "2026-10-05 22:46", "hash": "c0a***sha256=acf7a34e,len=64", "credentials": { "account-provider:coding-plan:account:zai-individual-coding-plan:account:83a326a1-981b-4876-b42d-076afc710d49:api-key": "enc:v1:_qo***sha256=3c67b988,len=106", "oauth:active_provider": "zai", "oauth:zai:access_token": "eyJ***sha256=2181b22a,len=1404", "oauth:zai:user_info": "{\"avatarUrl\":\"data:image/png;base64,iVB***sha256=d7770a76,len=956\",\"displayName\":\"hdoaiwhdaiw\",\"email\":\"asdfg@haoyunlianlian.us\",\"id\":\"83a326a1-981b-4876-b42d-076afc710d49\",\"username\":\"hdoaiwhdaiw\"}", "web-remote-control:external-relay:pass_hash": "enc:v1:Qmg***sha256=22c534fa,len=99", "zcodejwttoken": "eyJ***sha256=56e190e2,len=255" }, "config": { "provider": { "builtin:zai": { "enabled": false, "kind": "anthropic", "name": "Z.ai - API Key", "options": { "apiKey": "", "apiKeyRequired": true, "baseURL": "https://api.z.ai/api/anthropic" }, "source": "custom" }, "builtin:zai-coding-plan": { "enabled": false, "kind": "anthropic", "name": "Z.ai - Coding Plan", "options": { "apiKey": "", "apiKeyRequired": true, "baseURL": "https://api.z.ai/api/anthropic" }, "source": "custom" }, "builtin:zai-start-plan": { "enabled": true, "kind": "anthropic", "name": "Z.ai - Coding Plan", "options": { "apiKey": "eyJ***sha256=56e190e2,len=255", "baseURL": "https://z***sha256=0da6facf,len=40" }, "source": "custom" } } }, "virtual_device_mid": "c0fd0d24-c7d2-41a6-aedb-7138845dccd7", "virtual_arms_uid": "uid_ojitw5zttcs713fi" } FILE /tmp/m1124/root/.zcode-switch/accounts/24e3c31d-f679-4e53-91b3-4c2d7315faca.json SIZE=5437 LINES=53 { "id": "24e3c31d-f679-4e53-91b3-4c2d7315faca", "name": "zz", "created_at": "2026-09-25 07:27", "updated_at": "2026-09-25 07:30", "hash": "56b***sha256=38d55179,len=64", "credentials": { "account-provider:coding-plan:account:zai-individual-coding-plan:account:7741025d-6f41-4ac8-a271-5a43f43d7bde:api-key": "enc:v1:kKa***sha256=e1935328,len=106", "oauth:active_provider": "zai", "oauth:zai:access_token": "eyJ***sha256=c4b331e8,len=1402", "oauth:zai:user_info": "{\"avatarUrl\":\"data:image/png;base64,iVB***sha256=e7a00550,len=1556\",\"displayName\":\"zz\",\"email\":\"zzz@290015.xyz\",\"id\":\"7741025d-6f41-4ac8-a271-5a43f43d7bde\",\"username\":\"zz\"}", "web-remote-control:external-relay:pass_hash": "enc:v1:dy4***sha256=37ccd0fd,len=99", "zcodejwttoken": "eyJ***sha256=a5dad2d0,len=255" }, "config": { "provider": { "builtin:zai": { "enabled": false, "kind": "anthropic", "name": "Z.ai - API Key", "options": { "apiKey": "", "apiKeyRequired": true, "baseURL": "https://api.z.ai/api/anthropic" }, "source": "custom" }, "builtin:zai-coding-plan": { "enabled": false, "kind": "anthropic", "name": "Z.ai - Coding Plan", "options": { "apiKey": "", "apiKeyRequired": true, "baseURL": "https://api.z.ai/api/anthropic" }, "source": "custom" }, "builtin:zai-start-plan": { "enabled": true, "kind": "anthropic", "name": "Z.ai - Coding Plan", "options": { "apiKey": "eyJ***sha256=a5dad2d0,len=255", "baseURL": "https://z***sha256=0da6facf,len=40" }, "source": "custom" } } }, "virtual_device_mid": "c977249b-d04a-4f13-8a33-c9a7a8d49680", "virtual_arms_uid": "uid_5m0sa962txen43ef" } FILE /tmp/m1124/root/.zcode-switch/accounts/320297ed-ad2a-4ca2-8abc-eb72d1d3aa66.json SIZE=11965 LINES=54 { "id": "320297ed-ad2a-4ca2-8abc-eb72d1d3aa66", "name": "dsa@haoyunlianlian.us", "created_at": "2026-09-11 22:06", "updated_at": "2026-10-08 07:04", "hash": "a26***sha256=85f00f2a,len=64", "credentials": { "account-provider:coding-plan:account:zai-individual-coding-plan:account:5caf39f1-8694-4213-8c0c-2be9cf2bd05b:api-key": "enc:v1:iRS***sha256=16c809aa,len=106", "oauth:active_provider": "zai", "oauth:zai:access_token": "enc:v1:J9P***sha256=12067d23,len=1912", "oauth:zai:refresh_token": "enc:v1:MRs***sha256=d3537d84,len=1912", "oauth:zai:user_info": "enc:v1:sP3***sha256=cc02df41,len=5616", "web-remote-control:external-relay:pass_hash": "enc:v1:Qmg***sha256=22c534fa,len=99", "zcodejwttoken": "enc:v1:SQA***sha256=b847f52b,len=380" }, "config": { "provider": { "builtin:zai": { "enabled": false, "kind": "anthropic", "name": "Z.ai - API Key", "options": { "apiKey": "", "apiKeyRequired": true, "baseURL": "https://api.z.ai/api/anthropic" }, "source": "custom" }, "builtin:zai-coding-plan": { "enabled": false, "kind": "anthropic", "name": "Z.ai - Coding Plan", "options": { "apiKey": "", "apiKeyRequired": true, "baseURL": "https://api.z.ai/api/anthropic" }, "source": "custom" }, "builtin:zai-start-plan": { "enabled": true, "kind": "anthropic", "name": "Z.ai - Coding Plan", "options": { "apiKey": "eyJ***sha256=56e190e2,len=255", "baseURL": "https://z***sha256=0da6facf,len=40" }, "source": "custom" } } }, "virtual_device_mid": "b3371dc6-1f72-473b-a866-fd4e3bcc3281", "virtual_arms_uid": "uid_24xxaj41lh48bn88" } FILE /tmp/m1124/root/.zcode-switch/accounts/41a3aeca-d529-4adf-87cb-a4ebebb48255.json SIZE=6175 LINES=53 { "id": "41a3aeca-d529-4adf-87cb-a4ebebb48255", "name": "Auto 10-01 0937", "created_at": "2026-10-01 09:37", "updated_at": "2026-10-01 09:37", "hash": "6ae***sha256=1147b978,len=64", "credentials": { "account-provider:coding-plan:account:zai-individual-coding-plan:account:83a326a1-981b-4876-b42d-076afc710d49:api-key": "fallback:v1:NTm***sha256=3a997500,len=191", "oauth:active_provider": "fallback:v1:u3X***sha256=bce5ddd5,len=44", "oauth:zai:access_token": "fallback:v1:nIq***sha256=d546b895,len=1912", "oauth:zai:user_info": "fallback:v1:RKz***sha256=235df23b,len=1540", "web-remote-control:external-relay:pass_hash": "fallback:v1:l0b***sha256=0b5c5ca8,len=182", "zcodejwttoken": "fallback:v1:oop***sha256=be37b465,len=380" }, "config": { "provider": { "builtin:zai": { "enabled": false, "kind": "anthropic", "name": "Z.ai - API Key", "options": { "apiKey": "", "apiKeyRequired": true, "baseURL": "https://api.z.ai/api/anthropic" }, "source": "custom" }, "builtin:zai-coding-plan": { "enabled": false, "kind": "anthropic", "name": "Z.ai - Coding Plan", "options": { "apiKey": "", "apiKeyRequired": true, "baseURL": "https://api.z.ai/api/anthropic" }, "source": "custom" }, "builtin:zai-start-plan": { "enabled": true, "kind": "anthropic", "name": "Z.ai - Coding Plan", "options": { "apiKey": "eyJ***sha256=e53b088e,len=255", "baseURL": "https://z***sha256=0da6facf,len=40" }, "source": "custom" } } }, "virtual_device_mid": "a3d9ad65-a47e-4075-af63-cb45f965d80f", "virtual_arms_uid": "uid_1uaj9l53ex7fl6db" } FILE /tmp/m1124/root/.zcode-switch/accounts/55411edd-87fd-4d48-ad31-e27ad0ed9001.json SIZE=15081 LINES=378 { "id": "55411edd-87fd-4d48-ad31-e27ad0ed9001", "name": "asd@290015.xyz", "created_at": "2026-09-11 22:06", "updated_at": "2026-10-08 07:04", "hash": "1b0***sha256=0d904465,len=64", "credentials": { "account-provider:coding-plan:account:zai-individual-coding-plan:account:ccf5d958-38bd-4cac-b2b0-61b53faeea51:api-key": "enc:v1:1hn***sha256=3d089a0f,len=106", "oauth:active_provider": "enc:v1:3OA***sha256=d8385bde,len=44", "oauth:zai:access_token": "enc:v1:NOv***sha256=29265879,len=1912", "oauth:zai:user_info": "enc:v1:1f_***sha256=2062318b,len=2671", "web-remote-control:external-relay:pass_hash": "enc:v1:Qmg***sha256=22c534fa,len=99", "zcodejwttoken": "enc:v1:kZG***sha256=295c0b21,len=380" }, "config": { "provider": { "builtin:bigmodel": { "enabled": false, "kind": "anthropic", "models": { "GLM-5.3": { "limit": { "context": 1000000, "output": 128000 }, "modalities": { "input": [ "text" ], "output": [ "text" ] }, "reasoning": { "defaultVariant": "max", "enabled": true, "variants": [ "low", "max", "high" ] }, "zcode": { "modified": false, "priority": 99 } }, "GLM-5.3-Flash": { "limit": { "context": 1000000, "output": 128000 }, "modalities": { "input": [ "text", "image", "video" ], "output": [ "text" ] }, "reasoning": { "defaultVariant": "max", "enabled": true, "variants": [ "low", "max", "high" ] }, "zcode": { "modified": false, "priority": 100 } } }, "name": "Bigmodel - API Key", "options": { "apiKey": "", "baseURL": "https://open.bigmodel.cn/api/anthropic" }, "source": "custom", "systemDisabledReason": "oauth_provider_inactive" }, "builtin:bigmodel-coding-plan": { "enabled": false, "kind": "anthropic", "models": { "GLM-5.3": { "limit": { "context": 1000000, "output": 128000 }, "modalities": { "input": [ "text" ], "output": [ "text" ] }, "reasoning": { "defaultVariant": "max", "enabled": true, "variants": [ "low", "max", "high" ] }, "zcode": { "modified": false, "priority": 99 } }, "GLM-5.3-Flash": { "limit": { "context": 1000000, "output": 128000 }, "modalities": { "input": [ "text", "image", "video" ], "output": [ "text" ] }, "reasoning": { "defaultVariant": "max", "enabled": true, "variants": [ "low", "max", "high" ] }, "zcode": { "modified": false, "priority": 100 } } }, "name": "BigModel - Coding Plan", "options": { "apiKey": "", "baseURL": "https://open.bigmodel.cn/api/anthropic" }, "source": "custom", "systemDisabledReason": "oauth_provider_inactive" }, "builtin:bigmodel-start-plan": { "enabled": false, "kind": "anthropic", "models": {}, "name": "BigModel- Coding Plan", "options": { "apiKey": "", "baseURL": "https://z***sha256=0da6facf,len=40" }, "source": "custom", "systemDisabledReason": "oauth_provider_inactive" }, "builtin:zai": { "kind": "anthropic", "models": { "GLM-5.3": { "limit": { "context": 1000000, "output": 128000 }, "modalities": { "input": [ "text" ], "output": [ "text" ] }, "reasoning": { "defaultVariant": "max", "enabled": true, "variants": [ "low", "max", "high" ] }, "zcode": { "modified": false, "priority": 99 } }, "GLM-5.3-Flash": { "limit": { "context": 1000000, "output": 128000 }, "modalities": { "input": [ "text", "image", "video" ], "output": [ "text" ] }, "reasoning": { "defaultVariant": "max", "enabled": true, "variants": [ "low", "max", "high" ] }, "zcode": { "modified": false, "priority": 100 } } }, "name": "Z.ai - API Key", "options": { "apiKey": "", "apiKeyRequired": true, "baseURL": "https://api.z.ai/api/anthropic" }, "source": "custom" }, "builtin:zai-coding-plan": { "enabled": false, "kind": "anthropic", "models": { "GLM-5.3": { "limit": { "context": 1000000, "output": 128000 }, "modalities": { "input": [ "text" ], "output": [ "text" py_rc=0 umount done RDONE Wed Oct 28 06:25:02 AM UTC 2026