Mike Streetz (O_P)
05/07/2026, 1:58 PMJames Rankin
05/07/2026, 2:23 PMJon Bucud
05/07/2026, 2:57 PMJon Bucud
05/07/2026, 3:28 PMstrings -n 5 -u .\msedge.dmp |
Select-String -Pattern "knownpw" -Context 10,10
sheeeeesh, i get the "requires admin to do a dmp"...but it's not like there's a shortage of priv escalation exploits out thereMike Streetz (O_P)
05/07/2026, 3:55 PMJon Bucud
05/07/2026, 3:59 PMJon Bucud
05/07/2026, 5:28 PMJon Bucud
05/07/2026, 5:31 PMPS C:\Users\xJBucud\appdata\Local\Temp> Get-CimInstance Win32_Process -Filter "Name = 'msedge.exe'" |
>> ForEach-Object {
>> $owner = $_ | Invoke-CimMethod -MethodName GetOwner
>> [PSCustomObject]@{
>> ProcessId = $_.ProcessId
>> Name = $_.Name
>> User = "$($owner.Domain)\$($owner.User)"
>> }
>> }
ProcessId Name User
--------- ---- ----
7376 msedge.exe LC\jbucud
13104 msedge.exe LC\jbucud
5604 msedge.exe \
12256 msedge.exe LC\jbucud
PS C:\Users\xJBucud\appdata\Local\Temp> whoami
lc\xjbucud
PS C:\Users\xJBucud\appdata\Local\Temp> .\strings64.exe -n 5 -u .\msedge.dmp | Select-String -Pattern "knownpassword" -context 10,10Jon Bucud
05/07/2026, 5:31 PMMike Streetz (O_P)
05/07/2026, 5:35 PMJon Bucud
05/07/2026, 5:41 PMJon Bucud
05/07/2026, 5:54 PMJames Rankin
05/07/2026, 5:55 PMJon Bucud
05/07/2026, 5:56 PMMike Streetz (O_P)
05/07/2026, 9:15 PMJames Rankin
05/07/2026, 9:16 PMJon Bucud
05/07/2026, 9:29 PMJon Bucud
05/07/2026, 9:37 PMJames Rankin
05/07/2026, 9:41 PMJon Bucud
05/07/2026, 9:44 PMJames Rankin
05/08/2026, 7:46 AMMike Streetz (O_P)
05/08/2026, 5:24 PMMike Streetz (O_P)
05/08/2026, 5:24 PMMike Streetz (O_P)
05/08/2026, 5:26 PM