{
  "name": "miniDump",
  "display_name": "miniDump",
  "kind": "module",
  "description": "Dump LSASS to an XORed generated TeamServer artifact, or decrypt an XORed dump locally.",
  "command_template": "miniDump {action} {artifact_name:q?}",
  "target": "beacon",
  "requires_session": true,
  "platforms": ["windows"],
  "archs": ["x86", "x64", "arm64"],
  "args": [
    {
      "name": "action",
      "type": "enum",
      "required": true,
      "description": "MiniDump action.",
      "values": ["dump", "decrypt"]
    },
    {
      "name": "artifact_name",
      "type": "path",
      "required": false,
      "description": "Optional generated artifact filename hint for dump, or input XORed dump path for decrypt."
    }
  ],
  "examples": [
    "miniDump dump",
    "miniDump dump lsass.xored",
    "miniDump decrypt /tmp/lsass.xored"
  ],
  "source": "manifest"
}