PELoader

Unreleased C++ Windows utility that decrypts and executes PE payloads inside its own process using seven in-process loading methods: LoadLibrary and NtMapViewOfSection module stomping, Transacted Hollowing, Ghostly Hollowing, Herpaderply Hollowing, mapped-section protection changes, and private executable memory. Its README reports product-specific test detections; it does not establish a general EDR bypass.