> For the complete documentation index, see [llms.txt](https://hackerlab.gitbook.io/wiki.hackerlab.cz/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://hackerlab.gitbook.io/wiki.hackerlab.cz/infra-pentesting/dump-file-analysis.md).

# Dump File Analysis

List printable characters or words longer than 7 characters

## LSAS

On linux use pypykatz to analyse LSAS.DMP file

{% embed url="<https://github.com/skelsec/pypykatz>" %}

### Pypykatz install

```
git clone https://github.com/skelsec/pypykatz.git
python3 setup.py install
```

### Pypykatz LSAS analysis

```
 pypykatz lsa minidump lsass.DMP
```

## Strings and Regex

```
strings ./LogonUI.DMP | egrep -x '.{7,}'
```

```
strings ./explorer.DMP | egrep -x '.{10,}' | egrep -v "\.lnk|\.cpp|\.dll|xxxx|\.pdb|Font|ENTITY|PADDING|DOS mode|\?\?\?\?"
```