demo-critical-exfil · Activity

Session

`demo-critical-exfil`

claude-code on staging-ci-01 · 20s · first 2026-04-22 20:14:21 · last 2026-04-22 20:14:41

Notes 0

No notes yet. Leave the first one so the next reviewer inherits the context.

4 processes · 0 opens · 1 writes · 0 renames · 0 deletes · 1 DNS · 0 TCP · 2 UDP

Executables (4)

`C:\Users\bill\AppData\Roaming\Claude\claude-code\2.1.111\claude.exe`	1
`C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe`	1
`C:\Windows\System32\cmd.exe`	1
`C:\Windows\System32\sc.exe`	1

File opens (0)

none

Writes (1)

C:\Users\ci\AppData\Local\Temp\svc-updater.exe 1

Dir opens (2)

`C:\Users\ci\.aws\credentials`	1
`C:\Users\ci\.ssh\id_rsa`	1

Renames (0)

none

Deletes (0)

none

DNS queries (1)

pastebin.com 1

TCP targets (0)

none

UDP targets (2)

`185.220.101.42:4444`	1
`45.137.21.9:53413`	1