MemProcFS-plugins icon indicating copy to clipboard operation
MemProcFS-plugins copied to clipboard

pypykatz failed! Win 10 Latest Version 10.0.19042.928

Open DFIROPS opened this issue 4 years ago • 0 comments

===== BASIC INFO. SUBMIT THIS IF THERE IS AN ISSUE ===== CPU arch: X64 OS: None BuildNumber: 19041 MajorVersion: 6 MSV timestamp: 181380219

Traceback (most recent call last): File "C:\Python39\Lib\site-packages\pypykatz\pypykatz.py", line 261, in get_lsa lsa_dec = LsaDecryptor.choose(self.reader, lsa_dec_template, self.sysinfo) File "C:\Python39\Lib\site-packages\pypykatz\lsadecryptor\lsa_decryptor.py", line 20, in choose return LsaDecryptor_NT6(reader, decryptor_template, sysinfo) File "C:\Python39\Lib\site-packages\pypykatz\lsadecryptor\lsa_decryptor_nt6.py", line 22, in init self.acquire_crypto_material() File "C:\Python39\Lib\site-packages\pypykatz\lsadecryptor\lsa_decryptor_nt6.py", line 26, in acquire_crypto_material sigpos = self.find_signature() File "C:\Python39\Lib\site-packages\pypykatz\lsadecryptor\lsa_decryptor_nt6.py", line 44, in find_signature fl = self.reader.find_in_module('lsasrv.dll', self.decryptor_template.key_pattern.signature, find_first = True) TypeError: find_in_module() got an unexpected keyword argument 'find_first'

During handling of the above exception, another exception occurred:

Traceback (most recent call last): File "C:\Forensic Program Files\MemProcFS\plugins\pym_pypykatz\pym_pypykatz.py", line 107, in process_lsass mimi.start() File "C:\Python39\Lib\site-packages\pypykatz\pypykatz.py", line 350, in start self.lsa_decryptor = self.get_lsa() File "C:\Python39\Lib\site-packages\pypykatz\pypykatz.py", line 267, in get_lsa raise Exception('All detection methods failed.') Exception: All detection methods failed.

DFIROPS avatar May 11 '21 00:05 DFIROPS