.NET process monitor that hooks CLR at the native layer, dumps reflective assemblies from memory, and checks AMSI/ETW integrity vs on disk binaries.
detection clr etw malware-analysis phantom crypter amsi blue-team-tool reflective-loading jlaive scrubcrypt pe-dump windows-security-research
-
Updated
Jul 7, 2026 - C++