Mimikatz
Named by 2 kept items in this workspace.
Search every workspace for Mimikatz. It matches the name as written, so it can find other things that share it.
The items that name it 2
Credential dumping tool/malware whose kernel driver (mimidrv.sys) was used and then deleted by the threat actor to dump credentials from memory
All threat actors in this workspace.