# cs-analyze-processdump.py
# Analyze Cobalt Strike beacon process dumps for sleep mask encoding
# Docs: https://docs.remnux.org/discover-the-tools/examine+static+properties/deobfuscation

% cobalt-strike, sleep-mask, memory

# Basic usage
cs-analyze-processdump.py <process_dump>