LSASS dump + HTTPS exfiltration, all in-memory.
How It works
- Takes a snapshot of
lsass.exeand then create aMiniDumpof it. - Obfuscates the
"lsass.exe"string with XOR in source-code to avoid flagging. - In-memory compression of MiniDump then uploads it to remote webserver via HTTPS.