Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6401	May 16, 2024, 9:03 a.m.	May 16, 2024, 9:12 a.m.

Size	1.7MB
Type	ASCII text, with very long lines, with no line terminators
MD5	`929da23097367077c3678dea19303133`
SHA256	`c0610aac18112d627458c1a3a061358788a4d93b0e5dc24dc1260999d81b805a`
CRC32	`99E721B4`
ssdeep	`12288:jzNjk1Cg5GqK8IdjKtPDnk76Nv3YeB040NTxYGQzpOT1IGMjLcMkLaCEa8U9YXlS:jze117nqS3zBuTmRi1wQmEbCsr`
Yara	hide_executable_file - Hide executable file

powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy unrestricted -File C:\Users\test22\AppData\Local\Temp\mimikats.ps1
2588

Name	Response	Post-Analysis Lookup
No hosts contacted.

IP Address	Status	Action
No hosts contacted.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Command line console output was observed (10 events)

Time & API	Arguments	Status	Return
WriteConsoleW May 16, 2024, 9:03 a.m.	buffer: Invoke-Command : PE platform doesn't match the architecture of the process it i console_handle: 0x00000023	1	1
WriteConsoleW May 16, 2024, 9:03 a.m.	buffer: s being loaded in (32/64bit) console_handle: 0x0000002f	1	1
WriteConsoleW May 16, 2024, 9:03 a.m.	buffer: At C:\Users\test22\AppData\Local\Temp\mimikats.ps1:2881 char:23 console_handle: 0x0000003b	1	1
WriteConsoleW May 16, 2024, 9:03 a.m.	buffer: + Invoke-Command <<<< -ScriptBlock $RemoteScriptBlock -ArgumentList @( console_handle: 0x00000047	1	1
WriteConsoleW May 16, 2024, 9:03 a.m.	buffer: $PEBytes, $FuncReturnType, $ProcId, $ProcName,$ForceASLR) console_handle: 0x00000053	1	1
WriteConsoleW May 16, 2024, 9:03 a.m.	buffer: + CategoryInfo : OperationStopped: (PE platform doe...d in (32/64 console_handle: 0x0000005f	1	1
WriteConsoleW May 16, 2024, 9:03 a.m.	buffer: bit):String) [Invoke-Command], RuntimeException console_handle: 0x0000006b	1	1
WriteConsoleW May 16, 2024, 9:03 a.m.	buffer: + FullyQualifiedErrorId : PE platform doesn't match the architecture of th console_handle: 0x00000077	1	1
WriteConsoleW May 16, 2024, 9:03 a.m.	buffer: e process it is being loaded in (32/64bit),Microsoft.PowerShell.Commands.I console_handle: 0x00000083	1	1
WriteConsoleW May 16, 2024, 9:03 a.m.	buffer: nvokeCommandCommand console_handle: 0x0000008f	1	1

Uses Windows APIs to generate a cryptographic key (8 events)

Time & API	Arguments	Status	Return
CryptExportKey May 16, 2024, 9:03 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x06e840a0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 16, 2024, 9:03 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x06e840a0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 16, 2024, 9:03 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x06e840a0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 16, 2024, 9:03 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x06e840a0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 16, 2024, 9:03 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x06e840a0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 16, 2024, 9:03 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x06e840a0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 16, 2024, 9:03 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x06e840a0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey May 16, 2024, 9:03 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x06e840a0 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx May 16, 2024, 9:03 a.m.		1	1	0

Allocates read-write-execute memory (usually to unpack itself) (50 out of 67 events)

Time & API	Arguments	Status
NtAllocateVirtualMemory May 16, 2024, 9:03 a.m.	process_identifier: 2588 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x01fcb000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 16, 2024, 9:03 a.m.	process_identifier: 2588 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x01fdf000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 16, 2024, 9:03 a.m.	process_identifier: 2588 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x01f69000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 16, 2024, 9:03 a.m.	process_identifier: 2588 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02930000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 16, 2024, 9:03 a.m.	process_identifier: 2588 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02931000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 16, 2024, 9:03 a.m.	process_identifier: 2588 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02932000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 16, 2024, 9:03 a.m.	process_identifier: 2588 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02933000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 16, 2024, 9:03 a.m.	process_identifier: 2588 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02934000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 16, 2024, 9:03 a.m.	process_identifier: 2588 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02935000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 16, 2024, 9:03 a.m.	process_identifier: 2588 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02936000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 16, 2024, 9:03 a.m.	process_identifier: 2588 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x01f6d000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 16, 2024, 9:03 a.m.	process_identifier: 2588 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x054b6000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 16, 2024, 9:03 a.m.	process_identifier: 2588 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02937000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 16, 2024, 9:03 a.m.	process_identifier: 2588 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02938000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 16, 2024, 9:03 a.m.	process_identifier: 2588 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x054a1000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 16, 2024, 9:03 a.m.	process_identifier: 2588 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02939000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 16, 2024, 9:03 a.m.	process_identifier: 2588 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0293a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 16, 2024, 9:03 a.m.	process_identifier: 2588 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x01f6a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 16, 2024, 9:03 a.m.	process_identifier: 2588 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0293b000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 16, 2024, 9:03 a.m.	process_identifier: 2588 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0293c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 16, 2024, 9:03 a.m.	process_identifier: 2588 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0293d000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 16, 2024, 9:03 a.m.	process_identifier: 2588 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0293e000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 16, 2024, 9:03 a.m.	process_identifier: 2588 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0293f000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 16, 2024, 9:03 a.m.	process_identifier: 2588 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02970000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 16, 2024, 9:03 a.m.	process_identifier: 2588 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02971000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 16, 2024, 9:03 a.m.	process_identifier: 2588 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02972000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 16, 2024, 9:03 a.m.	process_identifier: 2588 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x01f6b000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 16, 2024, 9:03 a.m.	process_identifier: 2588 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02973000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 16, 2024, 9:03 a.m.	process_identifier: 2588 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02974000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 16, 2024, 9:03 a.m.	process_identifier: 2588 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02975000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 16, 2024, 9:03 a.m.	process_identifier: 2588 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02976000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 16, 2024, 9:03 a.m.	process_identifier: 2588 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02977000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 16, 2024, 9:03 a.m.	process_identifier: 2588 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02978000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 16, 2024, 9:03 a.m.	process_identifier: 2588 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02979000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 16, 2024, 9:03 a.m.	process_identifier: 2588 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0297a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 16, 2024, 9:03 a.m.	process_identifier: 2588 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x01f6e000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 16, 2024, 9:03 a.m.	process_identifier: 2588 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0297b000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 16, 2024, 9:03 a.m.	process_identifier: 2588 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0297c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 16, 2024, 9:03 a.m.	process_identifier: 2588 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0297d000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 16, 2024, 9:03 a.m.	process_identifier: 2588 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x057e0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 16, 2024, 9:03 a.m.	process_identifier: 2588 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0297e000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 16, 2024, 9:03 a.m.	process_identifier: 2588 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0297f000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 16, 2024, 9:03 a.m.	process_identifier: 2588 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05800000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 16, 2024, 9:03 a.m.	process_identifier: 2588 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05801000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 16, 2024, 9:03 a.m.	process_identifier: 2588 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05802000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 16, 2024, 9:03 a.m.	process_identifier: 2588 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05803000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 16, 2024, 9:03 a.m.	process_identifier: 2588 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05804000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 16, 2024, 9:03 a.m.	process_identifier: 2588 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05805000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 16, 2024, 9:03 a.m.	process_identifier: 2588 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x057e1000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory May 16, 2024, 9:03 a.m.	process_identifier: 2588 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05806000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1

A potential heapspray has been detected. 50 megabytes was sprayed onto the heap of the powershell.exe process (1 event)

count

805

name

heapspray

process

powershell.exe

total_mb

length

65536

protection

PAGE_READWRITE

File has been identified by 31 AntiVirus engines on VirusTotal as malicious (31 events)

Cynet	Malicious (score: 99)
Skyhigh	BehavesLike.PS.Dropper.tn
ALYac	Generic.Trojan.Mimikatz.Marte.!s!.A.CE947EEC
VIPRE	Generic.Trojan.Mimikatz.Marte.!s!.A.CE947EEC
Sangfor	Malware.Generic-PS.Save.aeebc366
Arcabit	Generic.Trojan.Mimikatz.Marte.!s!.A.CE947EEC
Symantec	Infostealer!im
ESET-NOD32	PowerShell/Agent.ASP
Avast	BV:AndroDrp-B [Drp]
ClamAV	Win.Trojan.PSempireInj-7013548-0
Kaspersky	HEUR:Trojan.Win32.Generic
BitDefender	Generic.Trojan.Mimikatz.Marte.!s!.A.CE947EEC
NANO-Antivirus	Trojan.Script.ExpKit.eydujq
MicroWorld-eScan	Generic.Trojan.Mimikatz.Marte.!s!.A.CE947EEC
Rising	Trojan.Injector/PS!1.ACC3 (CLASSIC)
Emsisoft	Generic.Trojan.Mimikatz.Marte.!s!.A.CE947EEC (B)
F-Secure	Trojan.TR/PShell.Agent.VPAP
FireEye	Generic.Trojan.Mimikatz.Marte.!s!.A.CE947EEC
Sophos	ATK/PowSploit-C
Ikarus	Trojan.PS.Agent
Jiangmin	Trojan.Generic.dmclj
Google	Detected
Avira	TR/PShell.Agent.VPAP
Kingsoft	Script.Ks.Malware.9344
Xcitium	TrojWare.Script.Injector.B@81qbmy
Microsoft	Trojan:PowerShell/Powersploit.J
ZoneAlarm	HEUR:Trojan.Win32.Generic
GData	PowerShell.Malware.Sabe.B@gen
Varist	PSH/Mimikatz.C
MAX	malware (ai score=87)
AVG	BV:AndroDrp-B [Drp]

mimikats.ps1

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All