Two of these three ssh.exe -R sessions are benign. The telemetry that separates them, and the one case it can't.