1 files changed, 12 insertions, 0 deletions
diff --git a/Exfiltration/mimikatz-1.0/driver/notify_process.h b/Exfiltration/mimikatz-1.0/driver/notify_process.h
new file mode 100644
index 0000000..27cbe3a
--- /dev/null
+++ b/Exfiltration/mimikatz-1.0/driver/notify_process.h
@@ -0,0 +1,12 @@
+#pragma once
+#include "notify.h"
+
+#define MAX_NT6_PspCreateProcessNotifyRoutine	64
+#define MAX_NT5_PspCreateProcessNotifyRoutine	8
+
+ULONG * PspCreateProcessNotifyRoutineCount;
+ULONG * PspCreateProcessNotifyRoutineExCount;
+PVOID * PspCreateProcessNotifyRoutine;
+
+NTSTATUS getPspCreateProcessNotifyRoutine();
+NTSTATUS kListNotifyProcesses(LPWSTR pszDest, size_t cbDest, LPWSTR *ppszDestEnd, size_t *pcbRemaining);