TinyRCT PerfWatson2.exe Self-Deletion via choice.exe Timed Delay

Ibrahim Saud@tektrix

•updated Jun 27, 2026•0•0•0

Detects a suspicious command line pattern where the Windows command shell (cmd.exe) is utilized to trigger a time-delayed deletion of the process image PerfWatson2.exe. This behavior is indicative of an attempt to remove indicators of compromise or cleanup malicious artifacts after execution.