Home

Awesome

AndrewSpecial

AndrewSpecial, dumping lsass' memory stealthily and bypassing "Cylance" since 2019.

How to compile:

cl *.cpp /DUNICODE

How to use:

  1. Run AndrewSpecial as Admin
  2. ???
  3. Profit. Look for andrew.dmp! Throw that in mimikatz!