Scans a given process. Recognizes and dumps a variety of potentially malicious implants (replaced/injected PEs, shellcodes, hooks, in-memory patches).

A fully static Roblox Client Decryptor

VMProtect payload extractor with IAT reconstruction. Monitors section unpacking, dumps PE with fixed headers, reconstructs imports via module export enumeration, and scans heap for IOCs. Supports EXE and DLL targets (x86/x64).

Generic Themida/WinLicense payload extractor. Launches protected PE as suspended process, detects section decryption, dumps unpacked binary with fixed headers, and scans process memory for IOCs. Supports EXE and DLL targets (x86/x64).