gistfile1.txt

Function ParseMimiLsass
		{
			$UnameRegex = '^*[Username]{8}'
			$DomainRegex = '^*[Domain]{6}'
			$PassRegex = '^*[Password]{8}[ ][:]'
			$Domains = select-string -Path $LootDirectory\Mimikatz-LSASS-OUT-64.txt -Pattern $DomainRegex  | Select-Object Line
			$Usernames = select-string -Path $LootDirectory\Mimikatz-LSASS-OUT-64.txt -Pattern $UnameRegex  | Select-Object Line
			$Passwords = select-string -Path $LootDirectory\Mimikatz-LSASS-OUT-64.txt -Pattern $PassRegex  | Select-Object Line
			$Domains32 = select-string -Path $LootDirectory\Mimikatz-LSASS-OUT-32.txt -Pattern $DomainRegex  | Select-Object Line
			$Usernames32 = select-string -Path $LootDirectory\Mimikatz-LSASS-OUT-32.txt -Pattern $UnameRegex  | Select-Object Line
			$Passwords32 = select-string -Path $LootDirectory\Mimikatz-LSASS-OUT-32.txt -Pattern $PassRegex  | Select-Object Line
			$Success = @()
			[int]$i = "0"
			foreach ($Username in $Usernames)
			{
				
				[string]$Dom = $Domains[$i]
				[string]$User = $Username
				[string]$Pass = $Passwords[$i]
				
				
				
				$i = $i + 1
									$Passw = $Pass.Split(":")[1..3]
									$Passwo = $Passw -Join("") -Replace "}",""
									$Doma = $Dom.Split(":")[1] -Replace "}",""
									$Usern = $User.Split(":")[1] -Replace "}",""
									if($Passwo -eq "")
									{
										$Passwo = "(null)"
									}
									if($Doma -eq "")
									{
										$Doma = "(null)"
									}
									elseif ($Doma -match "Basic command")
									{
											$Doma = "(null)"
									}
									if ($Usern -notcontains "`$")
									{
										$SuccessLogin = [ordered]@{
														Architecture = "64 Bit"
														Domain = $Doma
														UserName = $Usern
														Password = $Passwo
													}
										$SuccessLoginObj = [pscustomobject]$SuccessLogin
										$Success += $SuccessLoginObj
									}
				}
			[int]$i = "0"
			foreach ($Username in $Usernames32)
			{
				
				[string]$Dom = $Domains32[$i]
				[string]$User = $Username32
				[string]$Pass = $Passwords32[$i]
				
				
				
				$i = $i + 1
									$Passw = $Pass.Split(":")[1..3]
									$Passwo = $Passw -Join("") -Replace "}",""
									$Doma = $Dom.Split(":")[1] -Replace "}",""
									$Usern = $User.Split(":")[1] -Replace "}",""
									if($Passwo -eq "")
									{
										$Passwo = "(null)"
									}
									if($Doma -eq "")
									{
										$Doma = "(null)"
									}
									elseif ($Doma -match "Basic command")
									{
											$Doma = "(null)"
									}
									if ($Usern -notcontains "`$")
									{
										$SuccessLogin = [ordered]@{
														Architecture = "64 Bit"
														Domain = $Doma
														UserName = $Usern
														Password = $Passwo
													}
										$SuccessLoginObj = [pscustomobject]$SuccessLogin
										$Success += $SuccessLoginObj
									}
				}
		return $Success
	}