# Windows Process Dump

Down Windows Sysinternals Suite from Microsoft:

{% embed url="<https://docs.microsoft.com/en-us/sysinternals/downloads/sysinternals-suite>" %}

&#x20;upload procdump64.exe onto the target windows box

&#x20;

may need to accept the EULA agreement first

**.\procdump64.exe  -accepteula**

&#x20;Dump a process

**.\procdump64.exe -ma \<pid>**

&#x20;

This will produce a binary dump file, which you can run the strings command on and grep for passwords
