sekurlsa::pth performs Pass-the-Hash, Pass-the-Key and Over-Pass-the-Hash. Upon successful authentication, a program is run (n.b. defaulted to cme.exe). It has the following command line arguments:/user : the username to impersonate. It must be noted that Administrator is not the only name for this well-known account./domain : the fully qualified domain name. If Active Directory domain services are not in use or in case of local user/admin, a computer or a server name, workgroup can be used./rc4 or /ntlm : the RC4 key / NT hash (derived of the user's password)./aes128 : the AES128 key derived from the user's password and the realm of the domain./aes256 : the AES256 key derived from the user's password and the realm of the domain./run : the command line to run (defaulted to cmd.exe)./luid : locally unique identifier. According to Microsoft, the locally unique identifier (LUID) is a 64-bit value guaranteed to be unique only on the system on which it was generated. The uniqueness of an LUID is guaranteed only until the system is restarted./impersonate : It performs user token impersonation. It must be noted that a new process is not spawned but the token is injected on the process running Mimikatz.privilege::debug or by executing Mimikatz as the NT-AUTHORITY\SYSTEM account). This doesn't apply to Pass-The-Ticket which uses an official API.hacklab\optimus user is a low privileged user in the HACKLAB.LOCAL active directory domain: