C2Looper shell output capture to c2_out.txt in temp dir

Duo Tech@duotech

•updated Aug 18, 2026•2•0•7

Detects C2Looper's remote interactive shell and ShellExecuteW run-and-self-delete command execution, correlated with the c2_out.txt output-capture artifact.