Sigtrace AI.Trace · Forensic session report

Session `dev-laptop-bill-medium-359736192`

Agent claude-code on host dev-laptop-bill · 1m15s

Session ID: dev-laptop-bill-medium-359736192
Agent: claude-code
Host: dev-laptop-bill
First seen: 2026-04-22 11:59:32Z
Last seen: 2026-04-22 12:00:47Z
Duration: 1m15s
Events captured: 29
Posted at: 2026-04-22 22:14:22Z
Report generated: 2026-04-23 10:21:50Z
Report ID: 9806a52a24458209
Schema version: 1
Live dashboard: https://demo.sigtrace.ai/ui/sessions/dev-laptop-bill-medium-359736192

Verdict Medium 4 sensitive paths 2 network targets

Sensitive path hits · 4

Path	Reason	Op	Pid	When
`C:\Users\bill\.netrc`	netrc	open	3012	`2026-04-22T12:00:47.414646275Z`
`C:\Users\bill\.netrc`	netrc	open	3012	`2026-04-22T12:00:47.414646275Z`
`C:\work\myapp\.env`	dotenv	open	4802	`2026-04-22T12:00:43.414646275Z`
`C:\work\myapp\.env`	dotenv	open	4802	`2026-04-22T12:00:43.414646275Z`

No suspicious host queries.

No suspicious command lines.

No registry persistence writes.

No flagged image loads.

Image	Count
`C:\Users\bill\AppData\Roaming\Claude\claude-code\2.1.111\claude.exe`	1

Path	Count
`C:\work\webapp\src\lib\api.ts`	5
`C:\work\webapp\src\App.tsx`	3
`C:\work\webapp\vite.config.ts`	3
`C:\Users\bill\.netrc`	2
`C:\work\myapp\.env`	2
`C:\work\webapp\package.json`	2
`C:\work\webapp\src\components\Dashboard.tsx`	2

Path	Count
`C:\work\webapp\src\lib\api.ts`	1

No renames or deletes.

Target	Count
`104.16.132.229:443`	1
`192.229.211.108:443`	1