etw patch in memory detector — free browser tool | fatcousin

drop ntdll / clr region scan · detect etw patching bytes in ntdll!EtwEventWrite · runs locally

input

drop ntdll/clr dump · apihooks · memory scan export

or click

Select file

ret/xor eax patches · jmp hooks at EtwEventWrite · CLR ETW blind · Volatility apihooks text

limits

heuristic screener · parses artifacts locally · not definitive proof of ETW tampering

status

>ready