Pinned

1. FilelessRemotePE Public

   Loading Fileless Remote PE from URI to memory with argument passing and ETW patching and NTDLL unhooking and No New Thread technique

   C++ 423 95

2. DumpThatLSASS Public

   Dumping LSASS by Unhooking MiniDumpWriteDump by getting a fresh DbgHelp.dll copy from the disk , plus functions and strings obfuscation , it contains Anti-sandbox , if you run it under unperformant…

   C++ 224 37

3. ExecRemoteAssembly Public

   Execute Remote Assembly with args passing and with AMSI and ETW patching

   C++ 135 15

4. githubC2 Public

   Abusing Github API to host our C2 traffic, usefull for bypassing blocking firewall rules if github is in the target white list , and in case you don't have C2 infrastructure , now you have a free one

   C++ 78 14

5. MasqueradingPEB Public

   Maquerade any legitimate Windows binary by changing some fields in the PEB structure

   C++ 53 10

6. ScreenShot Public

   a C2 feature , ScreenShot capture , the file output is a png on the current directory named "screen.png"

   C++ 42 9