Process Doppelgänging

loader.exe -f payload.exe

Executes a payload by creating a transactional section (TxF) over a legitimate file: the process starts from the modified image in memory, without touching disk.

Use it when the AV scans binaries on-access and you want to run a PE that doesn't exist on disk. Process Doppelgänging uses Transactional NTFS: you open a transaction over a legitimate file (notepad.exe), create a section with the modified version, and launch the process from that section. The original file remains intact.

TxF is deprecated since Windows 10 and disabled on many systems: if the API fails, the loader breaks. Modern EDRs detect the pattern of a process created from a transactional section. On Windows 11, it's increasingly hard to find a volume with TxF active.