Windows position-independent-code tool that clones an existing handle to LSASS from another process and writes an obfuscated LSASS memory dump. The upstream project says the executable can live entirely in its text segment, does not allocate additional executable memory, uses a modified ReactOS MiniDumpWriteDumpA implementation, and uses RecycledGate to bypass userland hooks.
C
RESTRICTED_ACCESS_BLUR_MARKER