staging-ci-01-critical-59535636 · Overview

Session

`staging-ci-01-critical-59535636`

claude-code on staging-ci-01 · 1m28s · first 2026-04-20 23:44:16 · last 2026-04-20 23:45:44

Notes 0

No notes yet. Leave the first one so the next reviewer inherits the context.

Processes 2

File opens 4

DNS / TCP / UDP 4 / 3 / 1

Sensitive hits 2

Event timeline · 23:44:16 → 23:45:44 · peak 5 events/bin

Sensitive path hits · 2 matches

Path	Reason	Op	Process	When
`C:\Users\bill\.kube\config`	kube config	open	pid 8158	`2026-04-20T23:45:40.591538552Z`
`C:\Users\bill\.kube\config`	kube config	open	pid 8158	`2026-04-20T23:45:40.591538552Z`

Suspicious host queries · 1 match

Host	Reason
`anonfiles.com`	anonymous file drop

Registry persistence · 2 hits

Key	Value	Op	Reason	Process	When
`\REGISTRY\USER\S-1-5-21-1000\Software\Microsoft\Windows\CurrentVersion\Run`	`Updater`	set	run key	pid 9099	`2026-04-20T23:45:44.591538552Z`
`\REGISTRY\USER\S-1-5-21-1000\Software\Microsoft\Windows\CurrentVersion\Run`	`Updater`	set	run key	pid 9099	`2026-04-20T23:45:44.591538552Z`

Posted 2026-04-22 22:14:21Z