this is weird- no .exe mapped- that section it looks like it was meant to be contains just....idunno wtf that data is?pic.twitter.com/LENX2qmiVD
Show this thread
Allright process lemming demming had a fatal flaw - the running image name would become something appended :AltStream. Making it very obvious there is tampering going on. Now I managed to: have mimikatz running- its filename is c:\root\write.exe - that file is org write.exepic.twitter.com/7of9qdQPRG
-
-
Thanks. Twitter will use this to make your timeline better. UndoUndo
-
-
-
just scanned with defender- it do not at all see that mimikatz is running at the same time.pic.twitter.com/LN3ZQCWHXA
Show this threadThanks. Twitter will use this to make your timeline better. UndoUndo
-
-
-
interesting your work always intrigues me
Thanks. Twitter will use this to make your timeline better. UndoUndo
-
Loading seems to be taking a while.
Twitter may be over capacity or experiencing a momentary hiccup. Try again or visit Twitter Status for more information.