service (mimikatzsvc)/*\path to mimikatz binary mimikatz driver (mimidrv)/*\mimidrv.sys *.kirbi - wce WCESERVICE/*\service image file like GUID wce_ccache, wce_krbtkts, wceaux.dll WCEServicePipe samex - SAM.out, NTDS.out, SYSTEM.out - PWDumpX PWDumpX Service / *\DumpSvc.exe DumpExt.dll, DumpSvc.exe, *- PwHashes.txt - cachedump - - \cachedumppipe lsadump - - \lsadump* pwdump6 service name like GUID lsremora.dll, lsremora64.dll, test.pwd - fgdump fgexec/*\fgexec.exe Cachedump/*\cachedump.exe Cachedump/*\cachedump64.exe service name like GUID/*\servpw.exe service name like GUID/*\servpw64.exe fgexec.exe, pwdump.exe, pstgdump.exe, lsremora.dll, lsremora64.dll, cachedump.exe, cachedump64.exe, servpw64.exe, servpw.exe, test.pwd, *.pwdump, *.fgdump-log -