ThreatCheck scans a local file or downloaded URL content with Microsoft Defender or an AMSI provider, then reports the end offset and bytes associated with a detection. It supports detection analysis; payload generation or modification is outside the tool's documented behavior.
C#
RESTRICTED_ACCESS_BLUR_MARKER