process-explorer
A Windows memory forensics tool that records a process's memory map over time, replays it, and scores each region for signs of code injection
