This tool extracts code from memory (potential code injections, kernel modules, and loaded libraries), and scan the results using ClamAV. Furthemore, it looks for strings indicating suspicious PowerShell activityor macro code.