AndrewSpecial AndrewSpecial, dumping lsass' memory stealthily and bypassing "Cylance" since 2019. How to compile: cl *.cpp /DUNICODE How to use: Run AndrewSpecial as Admin ??? Profit. Look for andrew.dmp! Throw that in mimikatz!