Detects the execution of a renamed "NirCmd.exe" binary based on the PE metadata fields.
Already have an account? Log in
