PaperCut pc-app.exe Java loader chunked .bin staging and self-cleanup
Detects anomalous file activity associated with the PaperCut application (pc-app.exe), characterized by the creation of numbered binary chunks (.bin) followed by the creation of a status log file (pcxboot_l.txt) and the subsequent deletion of the binary chunks. This behavior is indicative of an in-memory Java payload loader pattern used to evade detection.
Microsoft Sentinel (KQL)
