UAC-0226 GIFTEDCROOK Delayed Self-Deletion via cmd.exe Timeout

Ethan Andrews@eandrews

•updated Jun 29, 2026•1•0•1

Detects the GIFTEDCROOK malware performing post-execution cleanup using cmd.exe. The malware utilizes a command-line chain consisting of 'timeout' and 'del' to remove staged payloads from C:\ProgramData and persistence shortcuts (.lnk files) from the user's Startup folder after a delay.