Tttracer.exe

Used by Windows 1809 and newer to Debug Time Travel

Dump

Dump process by PID

TTTracer.exe -dumpFull -attach {PID}

Dumps process using tttracer.exe. Requires administrator privileges — MITRE: T1003 — Privileges: Administrator

Execute

Spawn process using other binary

tttracer.exe {PATH_ABSOLUTE:.exe}

Execute specified executable from tttracer.exe. Requires administrator privileges. — MITRE: T1127 — Privileges: Administrator