mimikatz_trunk 2.7z
- SHA256 1f2338d7b628374139d373af383a1bdec1a16b43ced015849c6be4e4d90cc2c3
Overview
overview
10Static
static
10Win32/mimidrv.sys
windows7-x64
10Win32/mimidrv.sys
windows10-2004-x64
10Win32/mimikatz.exe
windows7-x64
1Win32/mimikatz.exe
windows10-2004-x64
1Win32/mimilib.dll
windows7-x64
3Win32/mimilib.dll
windows10-2004-x64
3Win32/mimilove.exe
windows7-x64
1Win32/mimilove.exe
windows10-2004-x64
1Win32/mimispool.dll
windows7-x64
1Win32/mimispool.dll
windows10-2004-x64
1x64/mimidrv.sys
windows7-x64
10x64/mimidrv.sys
windows10-2004-x64
10x64/mimikatz.exe
windows7-x64
1x64/mimikatz.exe
windows10-2004-x64
1x64/mimilib.dll
windows7-x64
1x64/mimilib.dll
windows10-2004-x64
1x64/mimispool.dll
windows7-x64
1x64/mimispool.dll
windows10-2004-x64
1Behavioral task
behavioral1
Sample
Win32/mimidrv.sys
Resource
win7-20240221-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
Win32/mimidrv.sys
Resource
win10v2004-20240419-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral3
Sample
Win32/mimikatz.exe
Resource
win7-20240215-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral4
Sample
Win32/mimikatz.exe
Resource
win10v2004-20240426-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral5
Sample
Win32/mimilib.dll
Resource
win7-20240221-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral6
Sample
Win32/mimilib.dll
Resource
win10v2004-20240226-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral7
Sample
Win32/mimilove.exe
Resource
win7-20231129-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral8
Sample
Win32/mimilove.exe
Resource
win10v2004-20240419-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral9
Sample
Win32/mimispool.dll
Resource
win7-20240419-en
windows7-x64
1 signatures
150 seconds
Behavioral task
behavioral10
Sample
Win32/mimispool.dll
Resource
win10v2004-20240419-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral11
Sample
x64/mimidrv.sys
Resource
win7-20240221-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral12
Sample
x64/mimidrv.sys
Resource
win10v2004-20240419-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral13
Sample
x64/mimikatz.exe
Resource
win7-20240221-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral14
Sample
x64/mimikatz.exe
Resource
win10v2004-20240419-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral15
Sample
x64/mimilib.dll
Resource
win7-20231129-en
windows7-x64
1 signatures
150 seconds
Behavioral task
behavioral16
Sample
x64/mimilib.dll
Resource
win10v2004-20240426-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral17
Sample
x64/mimispool.dll
Resource
win7-20240215-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral18
Sample
x64/mimispool.dll
Resource
win10v2004-20240419-en
windows10-2004-x64
0 signatures
150 seconds
General
- Target mimikatz_trunk 2.7z
- Size 879KB
- Sample240430-fbwgsscf26
- SHA256 1f2338d7b628374139d373af383a1bdec1a16b43ced015849c6be4e4d90cc2c3
- MD5 9b161e8fe171550ff1116c11e62b734f
- SHA1 1890075e36c792d99aecb57424cffbdbcbe6215f
- SHA512 e877464194c5af4a92682a4b323173a7f9940e96e7abf847dc18d63ec54d01f14d6c43f7cad44e9cae3b2a6ec0d4ab8cc9798047e839a9b1c6fb2358e309558c
- SSDEEP 24576:VVS8/iDSEVeuUaR1XMuzs65mOwhkVahwu5Opo:V88/i+EVpUaR18ot6ye5Opo
- MD5 SHA1 SHA512 SSDEEP
Score
10/10
Malware Config
Signatures
- Mimikatz family
- mimikatz is an open source tool to dump credentials on Windows 6 IoCs
resource yara_rule static1/unpack001/Win32/mimidrv.sys mimikatz static1/unpack001/Win32/mimikatz.exe mimikatz static1/unpack001/Win32/mimilib.dll mimikatz static1/unpack001/x64/mimidrv.sys mimikatz static1/unpack001/x64/mimikatz.exe mimikatz static1/unpack001/x64/mimilib.dll mimikatz - Unsigned PE 7 IoCs
Checks for missing Authenticode signature.
resource unpack001/Win32/mimikatz.exe unpack001/Win32/mimilib.dll unpack001/Win32/mimilove.exe unpack001/Win32/mimispool.dll unpack001/x64/mimikatz.exe unpack001/x64/mimilib.dll unpack001/x64/mimispool.dll
File Explorer
-
mimikatz_trunk 2.7z.7z 879KB
-
README.md5KB
-
Win32/mimidrv.sys.sys 29KB
-
Win32/mimikatz.exe.exe 1.0MB
-
Win32/mimilib.dll.dll 31KB
-
Win32/mimilove.exe.exe 24KB
-
Win32/mimispool.dll.dll 10KB
-
kiwi_passwords.yar2KB
-
mimicom.idl2KB
-
x64/mimidrv.sys.sys 36KB
-
x64/mimikatz.exe.exe 1.3MB
-
x64/mimilib.dll.dll 36KB
-
x64/mimispool.dll.dll 10KB
README.md
- SHA256 c905322e2b68c1fdc30cef2be3d94ea12a9df3ec08faba25c1a16f58892bc68d
- MD5 389833fb7cb7ceb525e914f0f36f2d40
- SHA1 11a9a9ec39caa5200e5bb3e2db867eb63c081ff7
- SHA512 8b5a9bdbabcc5e2d753f4c3f0555b9c684724919dafd7f52d07a22089eaf982f17e05736cfa0c30983778fd9ead94b6023ce3b27cc90de1d224478799f4bf425
- SSDEEP 96:cIS1JUx5tiDWlKXZfZ5cm003GI7UmIQ7KaJwB6amIxrN1QrY5R:cIS1KxniDWcpfZtKi2PNSY5R
- MD5 SHA1 SHA512 SSDEEP
Win32/mimidrv.sys
- IMPHASH 25862203800205f80fd8b3a6634ea1c6
- SHA256 4ff7578df7293e50c9bdd48657a6ba0c60e1f6d06a2dd334f605af34fe6f75a5
- MD5 0818699d065afcb1f397d578d3708dc2
- SHA1 df107aa0214b914c645967eddff6fdda88152eba
- SHA512 f6f89627a1be33788d576acebf16d36fbfa1b6f89d8cb9191771146231ccb5d77af11aa70640813e473872c83171cc4606f490d16d1bce322926046a5bc80cdd
- SSDEEP 768:Bk0ByYHIVcmG9yJao/fZ+B8zlu7TVHZC5is5c:BZyYGG92LHMB8zl8TJwism
- MD5 SHA1 SHA512 SSDEEP
-
mimikatz is an open source tool to dump credentials on Windows
PE Signature issue
Digest
dc:8a:cb:ab:b1:b0:e6:23:7a:ba:7f:42:cf:c5:23:ba:62:ef:0a:a6
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Benjamin Delpy,C=FR
Chains
Apr 26, 2024
Subject
CN=Benjamin Delpy,C=FR
Serial Number
11:21:69:41:7a:1c:3e:f4:6a:30:1f:99:38:5f:50:68:0f:a0
Issuer
CN=GlobalSign CodeSigning CA - G2,O=GlobalSign nv-sa,C=BE
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jun 28, 2011 - Jun 28, 2014
Subject
CN=GlobalSign CodeSigning CA - G2,O=GlobalSign nv-sa,C=BE
Serial Number
75:1e:3e:e9:c5:dc:2f:3e:8f:04:e5:9d:ee:5e:d4:09
Issuer
CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning, ExtKeyUsageOCSPSigning
Timespan
Apr 13, 2011 - Apr 13, 2026
Subject
CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE
Serial Number
61:0b:7f:6b:00:00:00:00:00:19
Issuer
CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
May 23, 2006 - May 23, 2016
Minor OS version
1
Major OS version
6
Entry point
32830
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_NATIVE
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
c:\security\mimikatz\mimidrv\objfre_wnet_x86\i386\mimidrv.pdb
ntoskrnl.exe
NtBuildNumber
IofCompleteRequest
KeBugCheck
IoCreateSymbolicLink
IoCreateDevice
PsInitialSystemProcess
ObfDereferenceObject
PsLookupProcessByProcessId
PsGetProcessImageFileName
PsGetProcessId
ZwClose
ZwSetInformationProcess
ZwDuplicateToken
ObOpenObjectByPointer
PsProcessType
RtlInitUnicodeString
PsReferencePrimaryToken
IoGetCurrentProcess
RtlCompareMemory
ZwOpenProcessTokenEx
ExFreePoolWithTag
ExAllocatePoolWithTag
IoFreeMdl
MmUnlockPages
MmProbeAndLockPages
IoAllocateMdl
memcpy
KeServiceDescriptorTable
IoEnumerateRegisteredFiltersList
KeTickCount
MmGetSystemRoutineAddress
IoDeleteSymbolicLink
IoDeleteDevice
memset
PsDereferencePrimaryToken
_vsnwprintf
PsGetVersion
ExAllocatePoolWithQuotaTag
ZwQuerySystemInformation
RtlUnwind
KeBugCheckEx
fltmgr.sys
FltGetFilterInformation
FltEnumerateInstances
FltGetVolumeFromInstance
FltObjectDereference
FltEnumerateFilters
Name
.text
Size
9KB
Virtual Size
9KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
5KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
PAGE
Size
1024B
Virtual Size
614B
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
INIT
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
.reloc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=4, id=149, productName=VS2008 SP1 build 30729, version=30729,
count=1, id=109, productName=VS2005 build 50727, version=50727,
count=48, id=1, productName=Unmarked objects,
count=5, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=1, id=95, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=11, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=1, id=148, productName=VS2008 SP1 [9.0] build 30729, version=30729,
count=1, id=145, productName=VS2008 SP1 build 30729, version=30729,
Win32/mimikatz.exe
- IMPHASH ff6abb25b3369620afef1dacd4a21f4c
- SHA256 94795fd89366e01bd6ce6471ff27c3782e2e16377a848426cf0b2e6baee9449b
- MD5 d3b17ddf0b98fd2441ed46b033043456
- SHA1 93ed68c7e5096d936115854954135d110648e739
- SHA512 cac2230361981323ea998c08f7d9afc9369c62a683a60421628adab1eb1e4ffbbc9c2239a8bf66cb662ad7d56e7284f9051bb548979b8c6862570ce45aa27120
- SSDEEP 24576:uiDjF7X3YoGq4tC1YJk+3nWBkDeq26iLutKcEY4:u05YjqakE3Aq2vu7E
- MD5 SHA1 SHA512 SSDEEP
-
mimikatz is an open source tool to dump credentials on Windows
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
5
Entry point
621122
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
advapi32
CryptSetHashParam
CryptGetHashParam
CryptExportKey
CryptAcquireContextW
CryptSetKeyParam
CryptGetKeyParam
CryptReleaseContext
CryptDuplicateKey
CryptAcquireContextA
CryptGetProvParam
CryptImportKey
SystemFunction007
CryptEncrypt
CryptCreateHash
CryptGenKey
CryptDestroyKey
CryptDecrypt
CryptDestroyHash
CryptHashData
CopySid
GetLengthSid
LsaQueryInformationPolicy
LsaOpenPolicy
LsaClose
CreateWellKnownSid
CreateProcessWithLogonW
CreateProcessAsUserW
RegQueryValueExW
RegQueryInfoKeyW
RegEnumValueW
RegOpenKeyExW
RegEnumKeyExW
RegCloseKey
RegSetValueExW
SystemFunction033
SystemFunction032
ConvertSidToStringSidW
CreateServiceW
CloseServiceHandle
DeleteService
OpenSCManagerW
SetServiceObjectSecurity
OpenServiceW
BuildSecurityDescriptorW
QueryServiceObjectSecurity
StartServiceW
AllocateAndInitializeSid
QueryServiceStatusEx
FreeSid
ControlService
IsTextUnicode
OpenProcessToken
GetTokenInformation
LookupAccountNameW
LookupAccountSidW
DuplicateTokenEx
CheckTokenMembership
CryptSetProvParam
CryptEnumProvidersW
ConvertStringSidToSidW
LsaFreeMemory
GetSidSubAuthority
GetSidSubAuthorityCount
IsValidSid
SetThreadToken
CryptEnumProviderTypesW
SystemFunction006
CryptGetUserKey
OpenEventLogW
GetNumberOfEventLogRecords
ClearEventLogW
SystemFunction001
CryptDeriveKey
SystemFunction005
LsaQueryTrustedDomainInfoByName
CryptSignHashW
LsaSetSecret
SystemFunction023
LsaOpenSecret
LsaQuerySecret
LsaRetrievePrivateData
LsaEnumerateTrustedDomainsEx
LookupPrivilegeValueW
StartServiceCtrlDispatcherW
SetServiceStatus
RegisterServiceCtrlHandlerW
LookupPrivilegeNameW
OpenThreadToken
EqualSid
CredFree
CredEnumerateW
SystemFunction026
ConvertStringSecurityDescriptorToSecurityDescriptorW
SystemFunction027
SystemFunction041
CredIsMarshaledCredentialW
CredUnmarshalCredentialW
A_SHAFinal
A_SHAInit
A_SHAUpdate
cabinet
ord11
ord14
ord10
ord13
crypt32
CryptSignAndEncodeCertificate
CertEnumSystemStore
CertEnumCertificatesInStore
CertAddCertificateContextToStore
CryptDecodeObjectEx
CryptStringToBinaryA
CertAddEncodedCertificateToStore
CertOpenStore
CertFreeCertificateContext
CertCloseStore
CryptStringToBinaryW
CertSetCertificateContextProperty
PFXExportCertStoreEx
CryptUnprotectData
CryptBinaryToStringW
CryptBinaryToStringA
CryptExportPublicKeyInfo
CryptFindOIDInfo
CryptAcquireCertificatePrivateKey
CertNameToStrW
CertFindCertificateInStore
CertGetCertificateContextProperty
CertGetNameStringW
CryptEncodeObject
CryptProtectData
CryptQueryObject
cryptdll
MD5Update
MD5Final
CDLocateCSystem
MD5Init
CDLocateCheckSum
CDGenerateRandomBits
dnsapi
DnsFree
DnsQuery_A
fltlib
FilterFindFirst
FilterFindNext
mpr
WNetCancelConnection2W
WNetAddConnection2W
netapi32
NetStatisticsGet
DsGetDcNameW
NetApiBufferFree
NetRemoteTOD
NetSessionEnum
NetServerGetInfo
DsEnumerateDomainTrustsW
NetShareEnum
NetWkstaUserEnum
I_NetServerAuthenticate2
I_NetServerTrustPasswordsGet
I_NetServerReqChallenge
odbc32
ord75
ord9
ord43
ord24
ord31
ord111
ord141
ord13
ole32
CoTaskMemFree
CoSetProxyBlanket
CoInitializeEx
CoUninitialize
CoCreateInstance
oleaut32
SysAllocString
VariantInit
SysFreeString
VariantClear
rpcrt4
RpcBindingFree
RpcBindingFromStringBindingW
RpcStringBindingComposeW
MesEncodeIncrementalHandleCreate
RpcBindingSetAuthInfoExW
RpcBindingInqAuthClientW
RpcBindingSetOption
RpcImpersonateClient
RpcStringFreeW
RpcRevertToSelf
MesDecodeIncrementalHandleCreate
MesHandleFree
MesIncrementalHandleReset
NdrMesTypeDecode2
NdrMesTypeAlignSize2
NdrMesTypeFree2
NdrMesTypeEncode2
RpcServerUnregisterIfEx
I_RpcBindingInqSecurityContext
RpcServerInqBindings
RpcServerListen
RpcMgmtWaitServerListen
RpcEpRegisterW
RpcMgmtStopServerListening
RpcBindingToStringBindingW
RpcServerRegisterIf2
RpcServerRegisterAuthInfoW
RpcBindingVectorFree
UuidToStringW
RpcServerUseProtseqEpW
RpcEpUnregister
NdrServerCall2
NdrClientCall2
UuidCreate
RpcEpResolveBinding
RpcBindingSetObject
RpcBindingSetAuthInfoW
RpcMgmtEpEltInqDone
RpcMgmtEpEltInqNextW
RpcMgmtEpEltInqBegin
I_RpcGetCurrentCallHandle
shlwapi
UrlUnescapeW
PathIsDirectoryW
PathFindFileNameW
PathIsRelativeW
PathCombineW
PathCanonicalizeW
samlib
SamEnumerateAliasesInDomain
SamQueryInformationUser
SamCloseHandle
SamEnumerateDomainsInSamServer
SamFreeMemory
SamEnumerateUsersInDomain
SamOpenUser
SamLookupDomainInSamServer
SamLookupNamesInDomain
SamLookupIdsInDomain
SamOpenDomain
SamConnect
SamSetInformationUser
SamiChangePasswordUser
SamEnumerateGroupsInDomain
SamGetGroupsForUser
SamGetMembersInGroup
SamGetMembersInAlias
SamRidToSid
SamGetAliasMembership
SamOpenGroup
SamOpenAlias
secur32
FreeContextBuffer
LsaLookupAuthenticationPackage
LsaFreeReturnBuffer
LsaDeregisterLogonProcess
QueryContextAttributesW
InitializeSecurityContextW
AcquireCredentialsHandleW
EnumerateSecurityPackagesW
FreeCredentialsHandle
DeleteSecurityContext
LsaCallAuthenticationPackage
LsaConnectUntrusted
shell32
CommandLineToArgvW
user32
SetClipboardViewer
DefWindowProcW
GetClipboardSequenceNumber
OpenClipboard
CreateWindowExW
ChangeClipboardChain
RegisterClassExW
TranslateMessage
EnumClipboardFormats
PostMessageW
DispatchMessageW
GetKeyboardLayout
IsCharAlphaNumericW
SendMessageW
UnregisterClassW
GetMessageW
DestroyWindow
CloseClipboard
GetClipboardData
userenv
DestroyEnvironmentBlock
CreateEnvironmentBlock
version
VerQueryValueW
GetFileVersionInfoSizeW
GetFileVersionInfoW
hid
HidD_GetFeature
HidD_GetPreparsedData
HidD_GetHidGuid
HidP_GetCaps
HidD_SetFeature
HidD_FreePreparsedData
HidD_GetAttributes
setupapi
SetupDiGetDeviceInterfaceDetailW
SetupDiEnumDeviceInterfaces
SetupDiGetClassDevsW
SetupDiDestroyDeviceInfoList
winscard
SCardControl
SCardTransmit
SCardDisconnect
SCardGetAttrib
SCardEstablishContext
SCardFreeMemory
SCardListReadersW
SCardReleaseContext
SCardGetCardTypeProviderNameW
SCardListCardsW
SCardConnectW
winsta
WinStationCloseServer
WinStationOpenServerW
WinStationFreeMemory
WinStationConnectW
WinStationQueryInformationW
WinStationEnumerateW
wldap32
ord145
ord36
ord208
ord41
ord73
ord310
ord13
ord77
ord142
ord54
ord309
ord79
ord304
ord301
ord127
ord26
ord167
ord147
ord27
ord88
ord157
ord14
ord122
ord140
ord203
ord69
ord139
ord97
ord223
ord12
ord113
ord224
ord96
ord133
msasn1
ASN1_CreateEncoder
ASN1BERDotVal2Eoid
ASN1_CloseEncoder
ASN1_CreateDecoder
ASN1_FreeEncoded
ASN1_CloseModule
ASN1_CloseDecoder
ASN1_CreateModule
ntdll
RtlIpv6AddressToStringW
RtlUnicodeStringToAnsiString
RtlFreeAnsiString
RtlDowncaseUnicodeString
RtlFreeUnicodeString
RtlInitUnicodeString
RtlEqualUnicodeString
NtQueryObject
RtlCompressBuffer
RtlGetCompressionWorkSpaceSize
NtQuerySystemInformation
RtlGetCurrentPeb
NtQueryInformationProcess
RtlCreateUserThread
RtlGUIDFromString
RtlStringFromGUID
NtCompareTokens
RtlGetNtVersionNumbers
RtlEqualString
RtlUpcaseUnicodeString
RtlAppendUnicodeStringToString
RtlAnsiStringToUnicodeString
RtlFreeOemString
RtlUpcaseUnicodeStringToOemString
NtQueryDirectoryObject
NtResumeProcess
NtOpenDirectoryObject
RtlAdjustPrivilege
NtSuspendProcess
NtTerminateProcess
NtQuerySystemEnvironmentValueEx
NtSetSystemEnvironmentValueEx
NtEnumerateSystemEnvironmentValuesEx
RtlIpv4AddressToStringW
kernel32
SystemTimeToFileTime
lstrlenA
GetDateFormatW
GetSystemTimeAsFileTime
ClearCommError
CreateRemoteThread
WaitForSingleObject
CreateProcessW
SetConsoleOutputCP
GetConsoleOutputCP
CreateFileMappingW
UnmapViewOfFile
MapViewOfFile
WriteProcessMemory
VirtualProtect
InterlockedExchange
SetFilePointerEx
GetProcessId
GetComputerNameW
ProcessIdToSessionId
VirtualAllocEx
VirtualProtectEx
VirtualAlloc
SetLastError
ReadProcessMemory
VirtualFreeEx
VirtualQueryEx
VirtualFree
VirtualQuery
GetComputerNameExW
DeviceIoControl
DuplicateHandle
OpenProcess
GetCurrentProcess
ExpandEnvironmentStringsW
FindNextFileW
FindClose
GetCurrentDirectoryW
GetFileSizeEx
FlushFileBuffers
GetFileAttributesW
FindFirstFileW
lstrlenW
GetProcAddress
LoadLibraryW
GetModuleHandleW
FreeLibrary
DeleteFileA
GetTempPathA
GetFileInformationByHandle
FileTimeToLocalFileTime
GetCurrentDirectoryA
GetTempFileNameA
SetFilePointer
CreateFileA
FileTimeToDosDateTime
CreateThread
LocalFree
CloseHandle
LocalAlloc
GetLastError
CreateFileW
ReadFile
Sleep
TerminateThread
WriteFile
FileTimeToSystemTime
GetTimeFormatW
GetFullPathNameW
GetFullPathNameA
HeapReAlloc
GetFileSize
CreateMutexW
HeapCompact
SetEndOfFile
HeapAlloc
QueryPerformanceCounter
HeapFree
InterlockedCompareExchange
UnlockFile
FlushViewOfFile
LockFile
WaitForSingleObjectEx
OutputDebugStringW
GetTickCount
UnlockFileEx
GetProcessHeap
FormatMessageA
FormatMessageW
GetVersionExW
WideCharToMultiByte
HeapDestroy
GetFileAttributesA
HeapCreate
HeapValidate
MultiByteToWideChar
GetTempPathW
HeapSize
LockFileEx
GetDiskFreeSpaceW
LoadLibraryA
CreateFileMappingA
GetDiskFreeSpaceA
GetSystemInfo
GetFileAttributesExW
OutputDebugStringA
GetVersionExA
DeleteFileW
GetCurrentProcessId
GetSystemTime
AreFileApisANSI
ExitProcess
ExitThread
RaiseException
SetConsoleCtrlHandler
SetConsoleTitleW
SetFileAttributesW
GlobalSize
SetHandleInformation
CreatePipe
InitializeCriticalSection
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
SetEvent
CreateEventW
GetSystemDirectoryW
SetConsoleCursorPosition
GetTimeZoneInformation
GetStdHandle
FillConsoleOutputCharacterW
GetConsoleScreenBufferInfo
IsWow64Process
SetCurrentDirectoryW
GetCurrentThread
RtlUnwind
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetVersion
GetModuleHandleA
GetCurrentThreadId
PurgeComm
msvcrt
calloc
__set_app_type
_lseeki64
wctomb
__setusermatherr
isspace
mbtowc
__mb_cur_max
_itoa
isleadbyte
isxdigit
localeconv
_snprintf
__p__fmode
ferror
iswctype
wcstombs
?terminate@@YAXXZ
_write
_isatty
ungetc
_controlfp
__badioinfo
__pioinfo
__p__commode
_read
isdigit
strrchr
_amsg_exit
_initterm
exit
_XcptFilter
_exit
_cexit
_errno
free
_wcsdup
_vsnprintf
_except_handler3
_wcsicmp
vfwprintf
_vscwprintf
fflush
_wfopen
wprintf
_fileno
_iob
vwprintf
_setmode
fclose
_stricmp
wcsrchr
wcschr
wcsstr
strtoul
_wcsnicmp
_vscprintf
memmove
strncmp
malloc
_msize
strcspn
realloc
fgetws
wcstoul
strchr
wcstol
wcsncmp
_wcstoui64
towupper
_wpgmptr
strstr
_strcmpi
strtol
getchar
memset
memcpy
__wgetmainargs
Name
.text
Size
628KB
Virtual Size
627KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
366KB
Virtual Size
365KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
14KB
Virtual Size
16KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
16KB
Virtual Size
15KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
33KB
Virtual Size
33KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=16, id=149, productName=VS2008 SP1 build 30729, version=30729,
count=14, id=132, productName=VS2008 SP1 build 30729, version=30729,
count=2, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=67, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=6, id=203, productName=VS2012 UPD4 build 61030, version=61030,
count=2, id=203, productName=VS2012 UPD2 build 60315, version=60315,
count=3, id=95, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=2, id=132, productName=VS2008 build 21022, version=21022,
count=51, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=659, id=1, productName=Unmarked objects,
count=1, id=126, version=50727,
count=114, id=137, version=30729,
count=1, id=148, productName=VS2008 SP1 [9.0] build 30729, version=30729,
count=1, id=145, productName=VS2008 SP1 build 30729, version=30729,
Win32/mimilib.dll
- IMPHASH 721f5090ab31a091c5b9778028cc974c
- SHA256 e60c210687e79347d06f9a144ee84417ba9ac4c1f303720f2fe4509734d670d6
- MD5 46e598798bdde4c72e796edcf2317b52
- SHA1 e00efa11ab8464e665f2a1d526e94cca5c71d9fa
- SHA512 c384fe4cd20dc97b53a26593d30b6c5d8d3665f957019b555bad956cc4e238b50216f47af7fa4ad9bd03d30d323b811aa0e32dcea2e25a9df6855a65dcea9a9d
- SSDEEP 384:ZPqreMGv6SqMDjuPRjL9sapJcos+uOiZESsQDygQ2Unn7PAss3sWqWyXO4hMnAl3:lrEdpJLFiq3GO7bs3sdEFyQejil0Tn
- MD5 SHA1 SHA512 SSDEEP
-
mimikatz is an open source tool to dump credentials on Windows
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
5
Entry point
18187
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
advapi32
CreateRestrictedToken
CreateProcessAsUserW
ConvertSidToStringSidA
IsTextUnicode
OpenProcessToken
ntdll
RtlFreeUnicodeString
RtlStringFromGUID
RtlEqualString
rpcrt4
MesDecodeIncrementalHandleCreate
MesIncrementalHandleReset
NdrMesTypeDecode2
NdrMesTypeFree2
MesHandleFree
ole32
CoCreateInstance
kernel32
GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
GetTickCount
UnhandledExceptionFilter
TerminateProcess
InterlockedCompareExchange
Sleep
RtlUnwind
QueryPerformanceCounter
GetCurrentProcess
CloseHandle
FreeLibrary
LoadLibraryW
lstrlenW
GetProcAddress
InterlockedIncrement
InterlockedDecrement
GetLastError
VirtualProtect
LocalAlloc
LocalFree
GetTimeFormatA
GetDateFormatA
FileTimeToSystemTime
FileTimeToLocalFileTime
RaiseException
InterlockedExchange
LoadLibraryA
SetUnhandledExceptionFilter
msvcrt
fclose
free
malloc
_stricmp
vfwprintf
fflush
memset
memcpy
_XcptFilter
_initterm
_amsg_exit
_wfopen
_except_handler3
DhcpNewPktHook
DhcpServerCalloutEntry
DllCanUnloadNow
DllGetClassObject
DnsPluginCleanup
DnsPluginInitialize
DnsPluginQuery
ExtensionApiVersion
InitializeChangeNotify
Msv1_0SubAuthenticationFilter
Msv1_0SubAuthenticationRoutine
NPGetCaps
NPLogonNotify
PasswordChangeNotify
SpLsaModeInitialize
WinDbgExtensionDllInit
coffee
mimikatz
startW
Name
.text
Size
15KB
Virtual Size
14KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
9KB
Virtual Size
9KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
1KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=7, id=149, productName=VS2008 SP1 build 30729, version=30729,
count=13, id=132, productName=VS2008 SP1 build 30729, version=30729,
count=2, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=59, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=1, id=95, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=2, id=203, productName=VS2012 UPD4 build 61030, version=61030,
count=2, id=132, productName=VS2008 build 21022, version=21022,
count=9, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=110, id=1, productName=Unmarked objects,
count=1, id=126, version=50727,
count=15, id=137, version=30729,
count=1, id=146, productName=VS2008 SP1 build 30729, version=30729,
count=1, id=148, productName=VS2008 SP1 [9.0] build 30729, version=30729,
count=1, id=145, productName=VS2008 SP1 build 30729, version=30729,
Win32/mimilove.exe
- IMPHASH 4e1492696c43305d97c6c6a4e8958cdf
- SHA256 cc585d962904351ce1d92195b0fc79034dc3b13144f7c7ff24cd9f768b25e9ef
- MD5 c67f3497c310c01018f599b3eebae99e
- SHA1 d73e52e55b1ad65015886b3a01b1cc27c87e9952
- SHA512 1205b5a9a9d2f3fabcce7e53e70e4efce08b21469ae64120beaee67a828d12eeeecddc623b453105ed15990fcc7bbce53175eca6545007f9d68c0aee66e55bc0
- SSDEEP 768:LK73LxCEQskxjvDoR8a4Tj9gwF6VLCx2l/:LK5uGRl4f9dqCx2l
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
5
Entry point
12594
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
advapi32
IsTextUnicode
ConvertSidToStringSidW
user32
IsCharAlphaNumericW
ntdll
RtlEqualUnicodeString
NtQueryInformationProcess
RtlInitUnicodeString
NtQuerySystemInformation
RtlEqualString
RtlRunDecodeUnicodeString
kernel32
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
GetModuleHandleA
SetUnhandledExceptionFilter
UnhandledExceptionFilter
TerminateProcess
InterlockedCompareExchange
Sleep
InterlockedExchange
RtlUnwind
GetCurrentProcessId
GetLastError
LocalAlloc
DeviceIoControl
CloseHandle
LocalFree
SetFilePointer
WriteFile
ReadProcessMemory
ReadFile
WriteProcessMemory
UnmapViewOfFile
GetCurrentProcess
GetDateFormatW
GetSystemTimeAsFileTime
GetTimeFormatW
FileTimeToSystemTime
FileTimeToLocalFileTime
OpenProcess
GetVersionExW
msvcrt
vfwprintf
fflush
_iob
wcsrchr
memset
memcpy
__wgetmainargs
_cexit
_exit
_XcptFilter
exit
_initterm
_amsg_exit
__setusermatherr
__p__commode
__p__fmode
__set_app_type
?terminate@@YAXXZ
_controlfp
vwprintf
Name
.text
Size
10KB
Virtual Size
9KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
9KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
1024B
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=6, id=149, productName=VS2008 SP1 build 30729, version=30729,
count=14, id=132, productName=VS2008 SP1 build 30729, version=30729,
count=2, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=67, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=2, id=203, productName=VS2012 UPD4 build 61030, version=61030,
count=7, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=141, id=1, productName=Unmarked objects,
count=1, id=126, version=50727,
count=7, id=137, version=30729,
count=1, id=148, productName=VS2008 SP1 [9.0] build 30729, version=30729,
count=1, id=145, productName=VS2008 SP1 build 30729, version=30729,
Win32/mimispool.dll
- IMPHASH 3d9268f54e37cd480a12f0595aa6b437
- SHA256 05842de51ede327c0f55df963f6de4e32ab88f43a73b9e0e1d827bc70199eff0
- MD5 dab7a18b02399053ba3ff1e568789fce
- SHA1 ceee090c9ee8279d6410d8d450d55acb81d34766
- SHA512 6dd0ade4112d7ed44c090f81614ed2f1d84cfcb25a45b08d22b3fa74e4e3f9b99f719f8bca9c1f03d13757f38eac072bb4d55e229c478524bf348f76fc3e36dd
- SSDEEP 192:I191rqbIcL9uD3nhKlWUEHRl1RtnIDKwIb/DtC0uolZC7:RRgDXhKAUQlftO6tC0uols
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
5
Entry point
6411
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
advapi32
CreateProcessAsUserW
SetTokenInformation
DuplicateTokenEx
OpenProcessToken
userenv
CreateEnvironmentBlock
DestroyEnvironmentBlock
winsta
WinStationEnumerateW
WinStationFreeMemory
kernel32
GetCurrentProcessId
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
SetUnhandledExceptionFilter
GetCurrentProcess
SetLastError
CloseHandle
UnhandledExceptionFilter
TerminateProcess
InterlockedCompareExchange
Sleep
InterlockedExchange
RtlUnwind
GetSystemTimeAsFileTime
msvcrt
memset
_XcptFilter
malloc
free
_initterm
_amsg_exit
DrvDisableDriver
DrvEnableDriver
DrvQueryDriverInfo
DrvResetConfigCache
GenerateCopyFilePaths
SpoolerCopyFileEvent
Name
.text
Size
3KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
1024B
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
1024B
Virtual Size
968B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=6, id=149, productName=VS2008 SP1 build 30729, version=30729,
count=13, id=132, productName=VS2008 SP1 build 30729, version=30729,
count=2, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=59, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=9, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=75, id=1, productName=Unmarked objects,
count=1, id=126, version=50727,
count=1, id=137, version=30729,
count=1, id=146, productName=VS2008 SP1 build 30729, version=30729,
count=1, id=148, productName=VS2008 SP1 [9.0] build 30729, version=30729,
count=1, id=145, productName=VS2008 SP1 build 30729, version=30729,
kiwi_passwords.yar
- SHA256 25b0c720edf459b98346692d52c094abc92bae6b9e1309b7ab6f11057d605e21
- MD5 21cb5b54ab42c19f66a10e839f789d64
- SHA1 36cb221fad2de8af5abe28702c189d20afe5d141
- SHA512 042cb7c42588c7cf013061db95e68b035e51ec5d14701fc9e12a19e661de0e05564985650598c95c830c449553a5177b256fe9fc813447e2e6d506bad3748ff8
- MD5 SHA1 SHA512
mimicom.idl
- SHA256 51d45e6c5df6b43b17afc863794f34000d32fb37cd7c3664efc5bd99039ac3df
- MD5 ca47e27329203c266372d04475db2c57
- SHA1 4f7e3cb56c1a0d66ea979ff0ae644a6fe3feb0d8
- SHA512 6e3a697ac27db3184284c4537cccea6a7204ef7a23327f8eb58eaa9bdbe774c2ed7ddfd0070a5d6eba034195d10b82f7cfc8167a54a230e12e55e6c0ddbaa4e9
- MD5 SHA1 SHA512
x64/mimidrv.sys
- IMPHASH a63c276e82b09fa57509d7958aa9d208
- SHA256 d30f51bfd62695df96ba94cde14a7fae466b29ef45252c6ad19d57b4a87ff44e
- MD5 3e528207ca374123f63789195a4aedde
- SHA1 2616372f708a6fb9665cd28206f4c7de6458f5c5
- SHA512 73f83b881e0e329493f6b2ac299ea0b9d9d1b04dc8a4705f78ae3f82b1a3e012db9202079f7e7dff5ad4431d3a8e7e2fb42d3f0963d66ab9a6aa0bf2cfa02c41
- SSDEEP 768:6PVvAF3Sz0Kp4TC/ndBK8ipSPnA+vl1qlCGB8zlu0RVHZC5isg:mVvPz0K3EyDlQlHB8zl9RJwisg
- MD5 SHA1 SHA512 SSDEEP
-
mimikatz is an open source tool to dump credentials on Windows
PE Signature issue
Digest
97:9e:0f:a7:4f:a1:13:27:40:f5:87:14:d1:0c:c8:89:f0:e9:75:10
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Benjamin Delpy,C=FR
Chains
Apr 26, 2024
Subject
CN=Benjamin Delpy,C=FR
Serial Number
11:21:69:41:7a:1c:3e:f4:6a:30:1f:99:38:5f:50:68:0f:a0
Issuer
CN=GlobalSign CodeSigning CA - G2,O=GlobalSign nv-sa,C=BE
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Jun 28, 2011 - Jun 28, 2014
Subject
CN=GlobalSign CodeSigning CA - G2,O=GlobalSign nv-sa,C=BE
Serial Number
75:1e:3e:e9:c5:dc:2f:3e:8f:04:e5:9d:ee:5e:d4:09
Issuer
CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning, ExtKeyUsageOCSPSigning
Timespan
Apr 13, 2011 - Apr 13, 2026
Subject
CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE
Serial Number
61:0b:7f:6b:00:00:00:00:00:19
Issuer
CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
May 23, 2006 - May 23, 2016
Minor OS version
1
Major OS version
6
Entry point
45156
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_NATIVE
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
c:\security\mimikatz\mimidrv\objfre_wnet_amd64\amd64\mimidrv.pdb
ntoskrnl.exe
KeBugCheck
IofCompleteRequest
IoCreateSymbolicLink
IoCreateDevice
PsProcessType
PsGetProcessImageFileName
PsLookupProcessByProcessId
PsReferencePrimaryToken
ZwOpenProcessTokenEx
IoGetCurrentProcess
ZwSetInformationProcess
ZwClose
ZwDuplicateToken
PsInitialSystemProcess
_vsnwprintf
ObfDereferenceObject
ObOpenObjectByPointer
PsGetProcessId
PsDereferencePrimaryToken
ExAllocatePoolWithTag
ExFreePoolWithTag
IoFreeMdl
MmProbeAndLockPages
MmUnlockPages
IoAllocateMdl
ZwUnloadKey
IoEnumerateRegisteredFiltersList
KeBugCheckEx
MmGetSystemRoutineAddress
IoDeleteDevice
RtlInitUnicodeString
NtBuildNumber
RtlCompareMemory
IoDeleteSymbolicLink
PsGetVersion
ExAllocatePoolWithQuotaTag
ZwQuerySystemInformation
RtlUnwindEx
fltmgr.sys
FltGetFilterInformation
FltEnumerateInstances
FltEnumerateFilters
FltObjectDereference
FltGetVolumeFromInstance
Name
.text
Size
13KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
5KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
7KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
512B
Virtual Size
432B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
PAGE
Size
1024B
Virtual Size
651B
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
INIT
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
.reloc
Size
1024B
Virtual Size
648B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=1, id=128, version=50727,
count=45, id=1, productName=Unmarked objects,
count=5, id=123, productName=Windows Server 2003 SP1 DDK (for AMD64) build 40310, version=40310,
count=2, id=125, productName=Windows Server 2003 SP1 DDK (for AMD64) build 40310, version=40310,
count=5, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=3, id=149, productName=VS2008 SP1 build 30729, version=30729,
count=1, id=109, productName=Windows Server 2003 SP1 DDK (for AMD64) build 40310, version=40310,
count=7, id=137, version=30729,
count=1, id=148, productName=VS2008 SP1 [9.0] build 30729, version=30729,
count=1, id=145, productName=VS2008 SP1 build 30729, version=30729,
x64/mimikatz.exe
- IMPHASH 55ee500bb4bdfc49f27a98ae456d8edf
- SHA256 61c0810a23580cf492a6ba4f7654566108331e7a4134c968c2d6a05261b2d8a1
- MD5 29efd64dd3c7fe1e2b022b7ad73a1ba5
- SHA1 e3b6ea8c46fa831cec6f235a5cf48b38a4ae8d69
- SHA512 f00b1ab035aa574c70f6b95b63f676fa75ff8f379f92e85ad5872c358a6bb1ed5417fdd226d421307a48653577ca42aba28103b3b2d7a5c572192d6e5f07e8b3
- SSDEEP 24576:0CgjBAeu8iuUHGzkuBhzy2F+yVICFPC27rIlve3NuacODvsG:0CI7XBE2IuF64rIlmdii
- MD5 SHA1 SHA512 SSDEEP
-
mimikatz is an open source tool to dump credentials on Windows
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
2
Major OS version
5
Entry point
825576
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
advapi32
CryptSetHashParam
CryptGetHashParam
CryptExportKey
CryptAcquireContextW
CryptSetKeyParam
CryptGetKeyParam
CryptReleaseContext
CryptDuplicateKey
CryptAcquireContextA
CryptGetProvParam
CryptImportKey
SystemFunction007
CryptEncrypt
CryptCreateHash
CryptGenKey
CryptDestroyKey
CryptDecrypt
CryptDestroyHash
CryptHashData
CopySid
GetLengthSid
LsaQueryInformationPolicy
LsaOpenPolicy
LsaClose
CreateWellKnownSid
CreateProcessWithLogonW
CreateProcessAsUserW
RegQueryValueExW
RegQueryInfoKeyW
RegEnumValueW
RegOpenKeyExW
RegEnumKeyExW
RegCloseKey
RegSetValueExW
SystemFunction033
SystemFunction032
ConvertSidToStringSidW
CreateServiceW
CloseServiceHandle
DeleteService
OpenSCManagerW
SetServiceObjectSecurity
OpenServiceW
BuildSecurityDescriptorW
QueryServiceObjectSecurity
StartServiceW
AllocateAndInitializeSid
QueryServiceStatusEx
FreeSid
ControlService
IsTextUnicode
OpenProcessToken
GetTokenInformation
LookupAccountNameW
LookupAccountSidW
DuplicateTokenEx
CheckTokenMembership
CryptSetProvParam
CryptEnumProvidersW
ConvertStringSidToSidW
LsaFreeMemory
GetSidSubAuthority
GetSidSubAuthorityCount
IsValidSid
SetThreadToken
CryptEnumProviderTypesW
SystemFunction006
CryptGetUserKey
OpenEventLogW
GetNumberOfEventLogRecords
ClearEventLogW
SystemFunction001
CryptDeriveKey
SystemFunction005
LsaQueryTrustedDomainInfoByName
CryptSignHashW
LsaSetSecret
SystemFunction023
LsaOpenSecret
LsaQuerySecret
LsaRetrievePrivateData
LsaEnumerateTrustedDomainsEx
LookupPrivilegeValueW
StartServiceCtrlDispatcherW
SetServiceStatus
RegisterServiceCtrlHandlerW
LookupPrivilegeNameW
OpenThreadToken
EqualSid
CredFree
CredEnumerateW
SystemFunction026
ConvertStringSecurityDescriptorToSecurityDescriptorW
SystemFunction027
SystemFunction041
CredIsMarshaledCredentialW
CredUnmarshalCredentialW
A_SHAFinal
A_SHAInit
A_SHAUpdate
cabinet
ord11
ord14
ord10
ord13
crypt32
CryptSignAndEncodeCertificate
CertEnumSystemStore
CertEnumCertificatesInStore
CertAddCertificateContextToStore
CryptDecodeObjectEx
CryptStringToBinaryA
CertAddEncodedCertificateToStore
CertOpenStore
CertFreeCertificateContext
CertCloseStore
CryptStringToBinaryW
CertSetCertificateContextProperty
PFXExportCertStoreEx
CryptUnprotectData
CryptBinaryToStringW
CryptBinaryToStringA
CryptExportPublicKeyInfo
CryptFindOIDInfo
CryptAcquireCertificatePrivateKey
CertNameToStrW
CertFindCertificateInStore
CertGetCertificateContextProperty
CertGetNameStringW
CryptEncodeObject
CryptProtectData
CryptQueryObject
cryptdll
MD5Init
MD5Final
CDLocateCSystem
CDGenerateRandomBits
CDLocateCheckSum
MD5Update
dnsapi
DnsFree
DnsQuery_A
fltlib
FilterFindFirst
FilterFindNext
mpr
WNetCancelConnection2W
WNetAddConnection2W
netapi32
NetStatisticsGet
DsGetDcNameW
NetApiBufferFree
NetRemoteTOD
NetSessionEnum
NetServerGetInfo
DsEnumerateDomainTrustsW
NetShareEnum
NetWkstaUserEnum
I_NetServerAuthenticate2
I_NetServerTrustPasswordsGet
I_NetServerReqChallenge
odbc32
ord75
ord9
ord43
ord24
ord31
ord111
ord141
ord13
ole32
CoInitializeEx
CoSetProxyBlanket
CoTaskMemFree
CoUninitialize
CoCreateInstance
oleaut32
SysAllocString
VariantInit
SysFreeString
VariantClear
rpcrt4
RpcBindingFree
RpcBindingFromStringBindingW
RpcStringBindingComposeW
MesEncodeIncrementalHandleCreate
RpcBindingSetAuthInfoExW
RpcBindingInqAuthClientW
RpcBindingSetOption
RpcImpersonateClient
RpcStringFreeW
RpcRevertToSelf
MesDecodeIncrementalHandleCreate
MesHandleFree
MesIncrementalHandleReset
NdrMesTypeDecode2
NdrMesTypeAlignSize2
NdrMesTypeFree2
NdrMesTypeEncode2
RpcServerUnregisterIfEx
I_RpcBindingInqSecurityContext
RpcServerInqBindings
RpcServerListen
RpcMgmtWaitServerListen
RpcEpRegisterW
RpcMgmtStopServerListening
RpcBindingToStringBindingW
RpcServerRegisterIf2
RpcServerRegisterAuthInfoW
RpcBindingVectorFree
UuidToStringW
RpcServerUseProtseqEpW
RpcEpUnregister
NdrServerCall2
NdrClientCall2
UuidCreate
RpcEpResolveBinding
RpcBindingSetObject
RpcBindingSetAuthInfoW
RpcMgmtEpEltInqDone
RpcMgmtEpEltInqNextW
RpcMgmtEpEltInqBegin
I_RpcGetCurrentCallHandle
shlwapi
UrlUnescapeW
PathIsDirectoryW
PathFindFileNameW
PathIsRelativeW
PathCombineW
PathCanonicalizeW
samlib
SamEnumerateAliasesInDomain
SamQueryInformationUser
SamCloseHandle
SamEnumerateDomainsInSamServer
SamFreeMemory
SamEnumerateUsersInDomain
SamOpenUser
SamLookupDomainInSamServer
SamLookupNamesInDomain
SamLookupIdsInDomain
SamOpenDomain
SamConnect
SamSetInformationUser
SamiChangePasswordUser
SamEnumerateGroupsInDomain
SamGetGroupsForUser
SamGetMembersInGroup
SamGetMembersInAlias
SamRidToSid
SamGetAliasMembership
SamOpenGroup
SamOpenAlias
secur32
FreeContextBuffer
LsaLookupAuthenticationPackage
LsaFreeReturnBuffer
LsaDeregisterLogonProcess
QueryContextAttributesW
InitializeSecurityContextW
AcquireCredentialsHandleW
EnumerateSecurityPackagesW
FreeCredentialsHandle
DeleteSecurityContext
LsaCallAuthenticationPackage
LsaConnectUntrusted
shell32
CommandLineToArgvW
user32
SetClipboardViewer
DefWindowProcW
GetClipboardSequenceNumber
OpenClipboard
CreateWindowExW
GetClipboardData
RegisterClassExW
TranslateMessage
EnumClipboardFormats
PostMessageW
DispatchMessageW
GetKeyboardLayout
IsCharAlphaNumericW
SendMessageW
UnregisterClassW
DestroyWindow
CloseClipboard
GetMessageW
ChangeClipboardChain
userenv
DestroyEnvironmentBlock
CreateEnvironmentBlock
version
VerQueryValueW
GetFileVersionInfoSizeW
GetFileVersionInfoW
hid
HidD_GetFeature
HidD_GetPreparsedData
HidD_GetHidGuid
HidD_GetAttributes
HidD_SetFeature
HidP_GetCaps
HidD_FreePreparsedData
setupapi
SetupDiGetDeviceInterfaceDetailW
SetupDiEnumDeviceInterfaces
SetupDiGetClassDevsW
SetupDiDestroyDeviceInfoList
winscard
SCardReleaseContext
SCardListCardsW
SCardGetCardTypeProviderNameW
SCardListReadersW
SCardFreeMemory
SCardEstablishContext
SCardControl
SCardConnectW
SCardTransmit
SCardDisconnect
SCardGetAttrib
winsta
WinStationCloseServer
WinStationOpenServerW
WinStationFreeMemory
WinStationConnectW
WinStationQueryInformationW
WinStationEnumerateW
wldap32
ord36
ord79
ord145
ord73
ord310
ord208
ord13
ord77
ord142
ord54
ord41
ord309
ord304
ord301
ord127
ord26
ord167
ord147
ord133
ord157
ord88
ord14
ord122
ord140
ord203
ord69
ord139
ord97
ord223
ord12
ord113
ord224
ord96
ord27
msasn1
ASN1_CreateModule
ASN1_CloseEncoder
ASN1_CreateDecoder
ASN1_FreeEncoded
ASN1_CloseModule
ASN1_CreateEncoder
ASN1_CloseDecoder
ASN1BERDotVal2Eoid
ntdll
strtol
_strcmpi
strstr
towupper
_wcstoui64
wcsncmp
wcstol
strchr
strcspn
strncmp
memmove
_wcsnicmp
strtoul
wcsstr
wcschr
wcsrchr
_stricmp
_vscwprintf
_wcsicmp
strrchr
_vsnprintf
log
memcmp
RtlUnicodeStringToAnsiString
RtlFreeAnsiString
RtlDowncaseUnicodeString
RtlFreeUnicodeString
RtlInitUnicodeString
RtlEqualUnicodeString
NtQueryObject
RtlCompressBuffer
RtlGetCompressionWorkSpaceSize
NtQuerySystemInformation
RtlGetCurrentPeb
NtQueryInformationProcess
RtlCreateUserThread
RtlGUIDFromString
RtlStringFromGUID
NtCompareTokens
RtlGetNtVersionNumbers
RtlEqualString
RtlUpcaseUnicodeString
RtlAppendUnicodeStringToString
RtlAnsiStringToUnicodeString
RtlFreeOemString
RtlUpcaseUnicodeStringToOemString
NtQueryDirectoryObject
NtResumeProcess
NtOpenDirectoryObject
RtlAdjustPrivilege
NtSuspendProcess
NtTerminateProcess
NtQuerySystemEnvironmentValueEx
NtSetSystemEnvironmentValueEx
NtEnumerateSystemEnvironmentValuesEx
RtlIpv4AddressToStringW
RtlIpv6AddressToStringW
wcstoul
__chkstk
kernel32
lstrlenA
GetDateFormatW
SystemTimeToFileTime
ClearCommError
CreateRemoteThread
WaitForSingleObject
CreateProcessW
SetConsoleOutputCP
GetConsoleOutputCP
CreateFileMappingW
UnmapViewOfFile
MapViewOfFile
WriteProcessMemory
VirtualAllocEx
VirtualProtectEx
RtlVirtualUnwind
SetFilePointerEx
GetProcessId
GetComputerNameW
IsWow64Process
VirtualAlloc
SetLastError
ReadProcessMemory
VirtualFreeEx
VirtualQueryEx
VirtualFree
VirtualQuery
GetComputerNameExW
DeviceIoControl
DuplicateHandle
OpenProcess
GetCurrentProcess
ExpandEnvironmentStringsW
FindNextFileW
FindClose
GetCurrentDirectoryW
GetFileSizeEx
FlushFileBuffers
GetFileAttributesW
FindFirstFileW
lstrlenW
GetProcAddress
LoadLibraryW
GetModuleHandleW
FreeLibrary
DeleteFileA
GetTempPathA
GetFileInformationByHandle
FileTimeToLocalFileTime
GetCurrentDirectoryA
GetTempFileNameA
SetFilePointer
CreateFileA
FileTimeToDosDateTime
CreateThread
LocalFree
CloseHandle
LocalAlloc
GetLastError
CreateFileW
ReadFile
TerminateThread
WriteFile
FileTimeToSystemTime
Sleep
VirtualProtect
WideCharToMultiByte
GetTimeFormatW
GetFullPathNameW
GetFullPathNameA
HeapReAlloc
GetFileSize
CreateMutexW
HeapCompact
SetEndOfFile
HeapAlloc
QueryPerformanceCounter
HeapFree
UnlockFile
FlushViewOfFile
LockFile
WaitForSingleObjectEx
OutputDebugStringW
GetTickCount
UnlockFileEx
GetProcessHeap
FormatMessageA
FormatMessageW
GetVersionExW
HeapDestroy
GetSystemTimeAsFileTime
GetFileAttributesA
HeapCreate
HeapValidate
MultiByteToWideChar
GetTempPathW
HeapSize
LockFileEx
GetDiskFreeSpaceW
LoadLibraryA
CreateFileMappingA
GetDiskFreeSpaceA
GetSystemInfo
GetFileAttributesExW
OutputDebugStringA
GetVersionExA
DeleteFileW
GetCurrentProcessId
GetSystemTime
AreFileApisANSI
ExitProcess
ExitThread
RaiseException
SetConsoleCtrlHandler
SetConsoleTitleW
SetFileAttributesW
GlobalSize
SetHandleInformation
CreatePipe
InitializeCriticalSection
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
SetEvent
CreateEventW
GetSystemDirectoryW
SetConsoleCursorPosition
GetTimeZoneInformation
GetStdHandle
FillConsoleOutputCharacterW
GetConsoleScreenBufferInfo
SetCurrentDirectoryW
GetCurrentThread
ProcessIdToSessionId
RtlLookupFunctionEntry
RtlCaptureContext
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentThreadId
PurgeComm
msvcrt
calloc
isdigit
_fmode
_commode
__setusermatherr
isspace
mbtowc
__mb_cur_max
isleadbyte
isxdigit
localeconv
_snprintf
__set_app_type
_itoa
wctomb
ferror
iswctype
wcstombs
?terminate@@YAXXZ
__badioinfo
__pioinfo
_read
_lseeki64
_write
_isatty
ungetc
_amsg_exit
_initterm
fclose
_setmode
vwprintf
exit
_cexit
_exit
_XcptFilter
__wgetmainargs
__C_specific_handler
memset
memcpy
_iob
getchar
_wpgmptr
fgetws
realloc
_msize
malloc
_vscprintf
_errno
free
_wcsdup
vfwprintf
fflush
_wfopen
wprintf
_fileno
Name
.text
Size
830KB
Virtual Size
829KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
414KB
Virtual Size
413KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
26KB
Virtual Size
30KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
26KB
Virtual Size
26KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
16KB
Virtual Size
15KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
9KB
Virtual Size
9KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=1, id=149, productName=VS2008 SP1 build 30729, version=30729,
count=62, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=16, id=132, productName=VS2008 SP1 build 30729, version=30729,
count=2, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=6, id=203, productName=VS2012 UPD4 build 61030, version=61030,
count=2, id=203, productName=VS2012 UPD2 build 60315, version=60315,
count=3, id=109, productName=Windows Server 2003 SP1 DDK (for AMD64) build 40310, version=40310,
count=2, id=132, productName=VS2008 build 21022, version=21022,
count=51, id=123, productName=Windows Server 2003 SP1 DDK (for AMD64) build 40310, version=40310,
count=670, id=1, productName=Unmarked objects,
count=1, id=126, version=50727,
count=114, id=137, version=30729,
count=1, id=148, productName=VS2008 SP1 [9.0] build 30729, version=30729,
count=1, id=145, productName=VS2008 SP1 build 30729, version=30729,
x64/mimilib.dll
- IMPHASH eaa79f1d9e8a00542b09cb462d0658ef
- SHA256 aef6ce3014add838cf676b57957d630cd2bb15b0c9193cf349bcffecddbc3623
- MD5 67651e9d2da634adedbe216948d5f752
- SHA1 0731bd320633a6d1ca7835e2bba2c5ee5429b293
- SHA512 88c7de54fd036a3052a49e52a8bb868e1cd67856b8ef1d0f2ad1151f663addf1d9435fb98f83a24cc16ffd832500061b64399c9fe82edcb83404f59daf7bfd47
- SSDEEP 768:CsdDjdgqUQv+EAZJimW8ahsNekFkTn5btsnsFfZ9kYeUveejil0g:vU+LuaaQkFkTn5b+sFhW7ejil
- MD5 SHA1 SHA512 SSDEEP
-
mimikatz is an open source tool to dump credentials on Windows
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
2
Major OS version
5
Entry point
21640
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
advapi32
CreateRestrictedToken
CreateProcessAsUserW
ConvertSidToStringSidA
IsTextUnicode
OpenProcessToken
ntdll
_stricmp
memcmp
RtlEqualString
RtlFreeUnicodeString
RtlStringFromGUID
rpcrt4
NdrMesTypeFree2
NdrMesTypeDecode2
MesIncrementalHandleReset
MesHandleFree
MesDecodeIncrementalHandleCreate
ole32
CoCreateInstance
kernel32
GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
GetTickCount
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
TerminateProcess
QueryPerformanceCounter
SetUnhandledExceptionFilter
VirtualProtect
Sleep
GetCurrentProcess
CloseHandle
FreeLibrary
LoadLibraryW
lstrlenW
GetProcAddress
GetLastError
LocalAlloc
LocalFree
GetTimeFormatA
GetDateFormatA
FileTimeToSystemTime
FileTimeToLocalFileTime
RaiseException
LoadLibraryA
UnhandledExceptionFilter
msvcrt
_wfopen
fclose
free
vfwprintf
fflush
memcpy
memset
__C_specific_handler
_XcptFilter
_initterm
_amsg_exit
malloc
DhcpNewPktHook
DhcpServerCalloutEntry
DllCanUnloadNow
DllGetClassObject
DnsPluginCleanup
DnsPluginInitialize
DnsPluginQuery
ExtensionApiVersion
InitializeChangeNotify
Msv1_0SubAuthenticationFilter
Msv1_0SubAuthenticationRoutine
NPGetCaps
NPLogonNotify
PasswordChangeNotify
SpLsaModeInitialize
WinDbgExtensionDllInit
coffee
mimikatz
startW
Name
.text
Size
19KB
Virtual Size
18KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
11KB
Virtual Size
11KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
2KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
1024B
Virtual Size
912B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
296B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=1, id=149, productName=VS2008 SP1 build 30729, version=30729,
count=55, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=15, id=132, productName=VS2008 SP1 build 30729, version=30729,
count=2, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=1, id=109, productName=Windows Server 2003 SP1 DDK (for AMD64) build 40310, version=40310,
count=2, id=203, productName=VS2012 UPD4 build 61030, version=61030,
count=2, id=132, productName=VS2008 build 21022, version=21022,
count=9, id=123, productName=Windows Server 2003 SP1 DDK (for AMD64) build 40310, version=40310,
count=119, id=1, productName=Unmarked objects,
count=1, id=126, version=50727,
count=15, id=137, version=30729,
count=1, id=146, productName=VS2008 SP1 build 30729, version=30729,
count=1, id=148, productName=VS2008 SP1 [9.0] build 30729, version=30729,
count=1, id=145, productName=VS2008 SP1 build 30729, version=30729,
x64/mimispool.dll
- IMPHASH c38ebbf4627ca2303746c77210e5a12e
- SHA256 66928c3316a12091995198710e0c537430dacefac1dbe78f12a331e1520142bd
- MD5 c6cc0def7d584f431d69126c1cc33a20
- SHA1 ea2646a646662909cd2bf5443e6b0030fb3cc6eb
- SHA512 17199e1be5d40744ae92d5d1b143645fcd0e413b92696fdaeb673785549bf20f4952a19887fe5c14cddbdfa435320a79044510d0de4e2c52fa26a1d2bfd83826
- SSDEEP 192:DGMoIQaZcsBTSWoH6DlI0zPQ4Ib/me0C0uolZC7:VJxgWFlVC50C0uols
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
2
Major OS version
5
Entry point
5864
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
advapi32
CreateProcessAsUserW
SetTokenInformation
DuplicateTokenEx
OpenProcessToken
userenv
DestroyEnvironmentBlock
CreateEnvironmentBlock
winsta
WinStationEnumerateW
WinStationFreeMemory
kernel32
GetCurrentProcessId
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
SetUnhandledExceptionFilter
UnhandledExceptionFilter
Sleep
GetCurrentProcess
SetLastError
CloseHandle
TerminateProcess
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
GetSystemTimeAsFileTime
msvcrt
memset
__C_specific_handler
_XcptFilter
malloc
free
_amsg_exit
_initterm
DrvDisableDriver
DrvEnableDriver
DrvQueryDriverInfo
DrvResetConfigCache
GenerateCopyFilePaths
SpoolerCopyFileEvent
Name
.text
Size
3KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
1024B
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
512B
Virtual Size
252B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
100B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=1, id=149, productName=VS2008 SP1 build 30729, version=30729,
count=55, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=15, id=132, productName=VS2008 SP1 build 30729, version=30729,
count=2, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=11, id=123, productName=Windows Server 2003 SP1 DDK (for AMD64) build 40310, version=40310,
count=87, id=1, productName=Unmarked objects,
count=1, id=126, version=50727,
count=1, id=137, version=30729,
count=1, id=146, productName=VS2008 SP1 build 30729, version=30729,
count=1, id=148, productName=VS2008 SP1 [9.0] build 30729, version=30729,
count=1, id=145, productName=VS2008 SP1 build 30729, version=30729,