m.zip
- SHA256 d86e5d2701b548dfbe0419bcffb2ae82c6ccdeb6dc9612050273c543a6f5215a
Overview
overview
10Static
static
10mimikatz-m...rv.sys
windows10-2004-x64
10mimikatz-m...rv.sys
windows11-ltsc_2024-x64
10mimikatz-m...tz.exe
windows10-2004-x64
3mimikatz-m...tz.exe
windows11-ltsc_2024-x64
3mimikatz-m...ib.dll
windows10-2004-x64
3mimikatz-m...ib.dll
windows11-ltsc_2024-x64
3mimikatz-m...ve.exe
windows10-2004-x64
3mimikatz-m...ve.exe
windows11-ltsc_2024-x64
3mimikatz-m.../rules
ubuntu-18.04-amd64
1mimikatz-m.../rules
debian-9-armhf
1mimikatz-m.../rules
debian-9-mips
1mimikatz-m.../rules
debian-9-mipsel
1mimikatz-m...rv.sys
windows10-2004-x64
10mimikatz-m...rv.sys
windows11-ltsc_2024-x64
10mimikatz-m...tz.exe
windows10-2004-x64
1mimikatz-m...tz.exe
windows11-ltsc_2024-x64
1mimikatz-m...ib.dll
windows10-2004-x64
1mimikatz-m...ib.dll
windows11-ltsc_2024-x64
1Behavioral task
behavioral1
Sample
mimikatz-master/Win32/mimidrv.sys
Resource
win10v2004-20260911-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
mimikatz-master/Win32/mimidrv.sys
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
3 signatures
150 seconds
Behavioral task
behavioral3
Sample
mimikatz-master/Win32/mimikatz.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral4
Sample
mimikatz-master/Win32/mimikatz.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
1 signatures
150 seconds
Behavioral task
behavioral5
Sample
mimikatz-master/Win32/mimilib.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral6
Sample
mimikatz-master/Win32/mimilib.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
3 signatures
150 seconds
Behavioral task
behavioral7
Sample
mimikatz-master/Win32/mimilove.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral8
Sample
mimikatz-master/Win32/mimilove.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
1 signatures
150 seconds
Behavioral task
behavioral9
Sample
mimikatz-master/debian/rules
Resource
ubuntu1804-amd64-20261019-en
ubuntu-18.04-amd64
0 signatures
150 seconds
Behavioral task
behavioral10
Sample
mimikatz-master/debian/rules
Resource
debian9-armhf-20260513-en
debian-9-armhf
0 signatures
150 seconds
Behavioral task
behavioral11
Sample
mimikatz-master/debian/rules
Resource
debian9-mipsbe-20260513-en
debian-9-mips
0 signatures
150 seconds
Behavioral task
behavioral12
Sample
mimikatz-master/debian/rules
Resource
debian9-mipsel-20260513-en
debian-9-mipsel
0 signatures
150 seconds
Behavioral task
behavioral13
Sample
mimikatz-master/x64/mimidrv.sys
Resource
win10v2004-20260911-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral14
Sample
mimikatz-master/x64/mimidrv.sys
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
3 signatures
150 seconds
Behavioral task
behavioral15
Sample
mimikatz-master/x64/mimikatz.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral16
Sample
mimikatz-master/x64/mimikatz.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral17
Sample
mimikatz-master/x64/mimilib.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral18
Sample
mimikatz-master/x64/mimilib.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
General
- Target m.zip
- Size 1.1MB
- Sample261022-asggbaha22
- SHA256 d86e5d2701b548dfbe0419bcffb2ae82c6ccdeb6dc9612050273c543a6f5215a
- MD5 85061fb539f0e118805729c0d9efa99e
- SHA1 478bab67c2525e1b195622e718d1d07fd0d46774
- SHA512 89eeed1be038f1d4cda6af76096e732944ab47d6275818ab4558c3be9080fadc01369adb0d8405eecdebd62519de486a8fd349b0dcc4c1afb5d3f4fdbb09a1ea
- SSDEEP 24576:qwvlkGmFoHjZkvEp/DEyTo+dmH5Q3JR2RZV1GMZH9epNdWR:tviGmateEBBoYmZyR8ZDf9eBWR
- TLSH T1AF45330C6E80C190C4E5E977AB66871C0CF8E29C51364D0F7ED5D4FEAAEBECA691119C
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
Malware Config
Signatures
- Family: Mimikatz
mimikatz is an open source tool to dump credentials on Windows.
- Detects Mimilove part of Mimikatz 1 IoCs
resource yara_rule static1/unpack001/mimikatz-master/Win32/mimilove.exe mimilove - mimikatz is an open source tool to dump credentials on Windows 6 IoCs
resource yara_rule static1/unpack001/mimikatz-master/Win32/mimidrv.sys mimikatz static1/unpack001/mimikatz-master/Win32/mimikatz.exe mimikatz static1/unpack001/mimikatz-master/Win32/mimilib.dll mimikatz static1/unpack001/mimikatz-master/x64/mimidrv.sys mimikatz static1/unpack001/mimikatz-master/x64/mimikatz.exe mimikatz static1/unpack001/mimikatz-master/x64/mimilib.dll mimikatz - Revoked Certificate in Chain 2 IoCs
One or more certificates in the signing chain have been revoked, indicating potential compromise.
resource unpack001/mimikatz-master/Win32/mimidrv.sys unpack001/mimikatz-master/x64/mimidrv.sys - Untrusted Codesign Signers 2 IoCs
Codesigned file was signed by an untrusted entity.
resource unpack001/mimikatz-master/Win32/mimidrv.sys unpack001/mimikatz-master/x64/mimidrv.sys
File Explorer
-
m.zip.zip 1.1MB
-
mimikatz-master/README.md4KB
-
mimikatz-master/Win32/mimidrv.sys.sys 28KB
-
mimikatz-master/Win32/mimikatz.exe.exe 971KB
-
mimikatz-master/Win32/mimilib.dll.dll 40KB
-
mimikatz-master/Win32/mimilove.exe.exe 35KB
-
mimikatz-master/debian/changelog3KB
-
mimikatz-master/debian/compat2B
-
mimikatz-master/debian/control563B
-
mimikatz-master/debian/copyright2KB
-
mimikatz-master/debian/dirs19B
-
mimikatz-master/debian/docs10B
-
mimikatz-master/debian/mimikatz.install89B
-
mimikatz-master/debian/rules.sh 442B
-
mimikatz-master/debian/source/format12B
-
mimikatz-master/debian/watch218B
-
mimikatz-master/kiwi_passwords.yar2KB
-
mimikatz-master/mimicom.idl2KB
-
mimikatz-master/x64/mimidrv.sys.sys 35KB
-
mimikatz-master/x64/mimikatz.exe.exe 1.2MB
-
mimikatz-master/x64/mimilib.dll.dll 45KB
mimikatz-master/README.md
- SHA256 56e362b25b365ab16793f15c29f5f05ac6a38a4bfc3d2b38b3a1fcc060b12deb
- MD5 cd6c6858d2e48df55978e2006f39b171
- SHA1 0f80cc21e84f607c4d27216f322c589a22d329c0
- SHA512 3bde9b7d3f9b0a149856294219515df6246acd912e0ad4b2106bc59e98f27fa0609b63fc6b0f9d824875b320351e6066f514cacb9483b16f82dec37e558b9022
- SSDEEP 96:cIS1JUU5tiDWOKXZfZ5cm003GI7UmIQ7KaJwB6amIzN1QrY5R:cIS1KUniDW1pfZtKi2hNSY5R
- TLSH T147A1C66E079172258B6382A6B3B2F384E3E1B589A6CE1D5CF5AC40216355327E27F583
- MD5 SHA1 SHA512 SSDEEP TLSH
mimikatz-master/Win32/mimidrv.sys
- IMPHASH 25862203800205f80fd8b3a6634ea1c6
- SHA256 a0931e16cf7b18d15579e36e0a69edad1717b07527b5407f2c105a2f554224b2
- MD5 49518f7375a5f995ebe9423d8f19cfe4
- SHA1 46c9a474a1a62c25a05bc7661b75a80b471616e6
- SHA512 63236cc2b517552ea4e5c8211b2cba5c36f50d40a01c97488f8234a28bc212cdb83e95d1e829b591ff1cb4d4f3bd79a79a0e32aca7cb73077f80fb6d14a55e7f
- SSDEEP 384:ji91BwAaJmCH6wseck/+5f2AWyzJJ5cF/7fZ+B8YluynVYEH5C+vdUb+se:jiHyA4sLMyNJ5+zfZ+B8YluyVHZC5ise
- TLSH T152D2E8117BEA8461E4B51DF46AECD201167FF9A15F76E6CF3144838E29A1BC0AE34723
- MD5 SHA1 SHA512 SSDEEP TLSH
-
mimikatz is an open source tool to dump credentials on Windows
-
Revoked Certificate in Chain
One or more certificates in the signing chain have been revoked, indicating potential compromise.
-
Untrusted Codesign Signers
Codesigned file was signed by an untrusted entity.
PE Signature issue
Digest
b6:a2:ef:75:f8:8b:d7:55:2b:e4:35:8e:cb:72:eb:78:56:50:3c:b1
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Benjamin Delpy,C=FR
Chains
Oct 15, 2026
CN=Benjamin Delpy,C=FR
Subject
CN=Benjamin Delpy,C=FR
Serial Number
11:21:69:41:7a:1c:3e:f4:6a:30:1f:99:38:5f:50:68:0f:a0
Issuer
CN=GlobalSign CodeSigning CA - G2,O=GlobalSign nv-sa,C=BE
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Revoked
Revocation Date
Jun 28, 2011
Timespan
Jun 28, 2011 - Jun 28, 2014
Subject
CN=GlobalSign CodeSigning CA - G2,O=GlobalSign nv-sa,C=BE
Serial Number
75:1e:3e:e9:c5:dc:2f:3e:8f:04:e5:9d:ee:5e:d4:09
Issuer
CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning, ExtKeyUsageOCSPSigning
Revocation Status
Not revoked
Timespan
Apr 13, 2011 - Apr 13, 2026
Subject
CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE
Serial Number
61:0b:7f:6b:00:00:00:00:00:19
Issuer
CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Revocation Status
Not revoked
Timespan
May 23, 2006 - May 23, 2016
Minor OS version
1
Major OS version
6
Entry point
32830
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_NATIVE
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
c:\security\mimikatz\mimidrv\objfre_wnet_x86\i386\mimidrv.pdb
ntoskrnl.exe
NtBuildNumber
IofCompleteRequest
KeBugCheck
IoCreateSymbolicLink
IoCreateDevice
PsInitialSystemProcess
ObfDereferenceObject
PsLookupProcessByProcessId
PsGetProcessImageFileName
PsGetProcessId
ZwClose
ZwSetInformationProcess
ZwDuplicateToken
ObOpenObjectByPointer
PsProcessType
RtlInitUnicodeString
PsReferencePrimaryToken
IoGetCurrentProcess
RtlCompareMemory
ZwOpenProcessTokenEx
ExFreePoolWithTag
ExAllocatePoolWithTag
IoFreeMdl
MmUnlockPages
MmProbeAndLockPages
IoAllocateMdl
memcpy
KeServiceDescriptorTable
IoEnumerateRegisteredFiltersList
KeTickCount
MmGetSystemRoutineAddress
IoDeleteSymbolicLink
IoDeleteDevice
memset
PsDereferencePrimaryToken
_vsnwprintf
PsGetVersion
ExAllocatePoolWithQuotaTag
ZwQuerySystemInformation
RtlUnwind
KeBugCheckEx
fltmgr.sys
FltGetFilterInformation
FltEnumerateInstances
FltGetVolumeFromInstance
FltObjectDereference
FltEnumerateFilters
Name
.text
Size
9KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
4KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
5KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
PAGE
Size
1024B
Virtual Size
614B
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
INIT
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
.reloc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=4, id=149, productName=VS2008 SP1 build 30729, version=30729,
count=1, id=109, productName=VS2005 build 50727, version=50727,
count=48, id=1, productName=Unmarked objects,
count=5, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=1, id=95, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=11, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=1, id=148, productName=VS2008 SP1 [9.0] build 30729, version=30729,
count=1, id=145, productName=VS2008 SP1 build 30729, version=30729,
mimikatz-master/Win32/mimikatz.exe
- IMPHASH f1f5d7c44930a687e54a18242f91deb2
- SHA256 2e8092205a2ded4b07e9d10d0ec02eba0ffcf1d370cab88c5221a749915f678a
- MD5 46f366e3ee36c05ab5a7a319319f7c72
- SHA1 040fbf1325d51358606b710bc3bd774c04bdb308
- SHA512 03e67c8f76a589ad43866396f46af12267e3c9ab2ca0a155f9df0406b4bd77b706e12757222d7c95bfa4b91d6ef073150edb87d11496617a2004e9dc953904e1
- SSDEEP 24576:ZUawjJv4xFV1To1GPC31fILaq/K34UQCxWw:daOxnOB3aLbK3R5Qw
- TLSH T11B254A5177E64425F5B22AB06EF2A611CE77B9E21831D14F129C464F1FB3A809E3A733
- MD5 SHA1 SHA512 SSDEEP TLSH
-
mimikatz is an open source tool to dump credentials on Windows
Digest
07:3a:87:de:eb:aa:de:db:92:66:09:65:65:c0:d4:9c:cd:d0:66:e6:a8:11:48:a5:a6:b8:e3:c8:73:fb:7b:73
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Open Source Developer\, Benjamin Delpy,O=Open Source Developer,L=Montreuil,C=FR,1.2.840.113549.1.9.1=#0c1762656e6a616d696e4067656e74696c6b6977692e636f6d
Chains
Feb 29, 2020
CN=Open Source Developer\, Benjamin Delpy,O=Open Source Developer,L=Montreuil,C=FR,1.2.840.113549.1.9.1=#0c1762656e6a616d696e4067656e74696c6b6977692e636f6d
CN=Certum Code Signing CA SHA2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL
CN=Certum Trusted Network CA,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL
Digest
26:41:1a:37:35:40:db:2e:24:4e:1d:eb:2e:2a:55:bb:ad:76:0b:b4
Digest Algorithm
sha1
PE Digests Matches
Trusted
Signing Certificate
CN=Open Source Developer\, Benjamin Delpy,O=Open Source Developer,L=Montreuil,C=FR,1.2.840.113549.1.9.1=#0c1762656e6a616d696e4067656e74696c6b6977692e636f6d
Chains
Feb 29, 2020
CN=Open Source Developer\, Benjamin Delpy,O=Open Source Developer,L=Montreuil,C=FR,1.2.840.113549.1.9.1=#0c1762656e6a616d696e4067656e74696c6b6977692e636f6d
CN=Certum Code Signing CA SHA2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL
CN=Certum Trusted Network CA,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL
Subject
CN=Certum Code Signing CA SHA2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL
Serial Number
6b:32:6a:0f:03:28:d3:7a:1d:53:0b:fd:23:bd:48:e2
Issuer
CN=Certum Trusted Network CA,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Oct 29, 2015 - Jun 9, 2027
Subject
CN=Open Source Developer\, Benjamin Delpy,O=Open Source Developer,L=Montreuil,C=FR,1.2.840.113549.1.9.1=#0c1762656e6a616d696e4067656e74696c6b6977692e636f6d
Serial Number
10:a9:2b:2a:c8:aa:84:76:b6:c7:23:2e:c0:a9:e6:fa
Issuer
CN=Certum Code Signing CA SHA2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Dec 5, 2019 - Dec 4, 2020
Subject
CN=Certum EV TSA SHA2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL
Serial Number
fe:67:e4:f1:5a:24:e3:c6:0d:54:7c:a0:20:c2:76:70
Issuer
CN=Certum Trusted Network CA,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Mar 8, 2016 - May 30, 2027
Minor OS version
0
Major OS version
5
Entry point
582210
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
advapi32
CryptSetHashParam
CryptGetHashParam
CryptExportKey
CryptAcquireContextW
CryptSetKeyParam
CryptGetKeyParam
CryptReleaseContext
CryptDuplicateKey
CryptAcquireContextA
CryptGetProvParam
CryptImportKey
SystemFunction007
CryptEncrypt
CryptCreateHash
CryptGenKey
CryptDestroyKey
CryptDecrypt
CryptDestroyHash
CryptHashData
CopySid
GetLengthSid
LsaQueryInformationPolicy
LsaOpenPolicy
LsaClose
CreateWellKnownSid
CreateProcessWithLogonW
CreateProcessAsUserW
RegQueryValueExW
RegQueryInfoKeyW
RegEnumValueW
RegOpenKeyExW
RegEnumKeyExW
RegCloseKey
RegSetValueExW
SystemFunction032
ConvertSidToStringSidW
CreateServiceW
CloseServiceHandle
DeleteService
OpenSCManagerW
SetServiceObjectSecurity
OpenServiceW
BuildSecurityDescriptorW
QueryServiceObjectSecurity
StartServiceW
AllocateAndInitializeSid
QueryServiceStatusEx
FreeSid
ControlService
IsTextUnicode
OpenProcessToken
GetTokenInformation
LookupAccountNameW
LookupAccountSidW
DuplicateTokenEx
CheckTokenMembership
CryptSetProvParam
CryptEnumProvidersW
ConvertStringSidToSidW
LsaFreeMemory
GetSidSubAuthority
GetSidSubAuthorityCount
IsValidSid
SetThreadToken
CryptEnumProviderTypesW
SystemFunction006
CryptGetUserKey
OpenEventLogW
GetNumberOfEventLogRecords
ClearEventLogW
SystemFunction001
CryptDeriveKey
SystemFunction005
LsaQueryTrustedDomainInfoByName
CryptSignHashW
LsaOpenSecret
LsaQuerySecret
SystemFunction013
LsaRetrievePrivateData
LsaEnumerateTrustedDomainsEx
LookupPrivilegeValueW
StartServiceCtrlDispatcherW
SetServiceStatus
RegisterServiceCtrlHandlerW
LookupPrivilegeNameW
OpenThreadToken
CredFree
CredEnumerateW
SystemFunction025
ConvertStringSecurityDescriptorToSecurityDescriptorW
SystemFunction024
CredIsMarshaledCredentialW
CredUnmarshalCredentialW
A_SHAFinal
A_SHAInit
A_SHAUpdate
cabinet
ord11
ord14
ord10
ord13
crypt32
CertFindCertificateInStore
CertEnumSystemStore
CertEnumCertificatesInStore
CertAddCertificateContextToStore
CryptDecodeObjectEx
CertAddEncodedCertificateToStore
CertOpenStore
CertFreeCertificateContext
CertCloseStore
CertSetCertificateContextProperty
PFXExportCertStoreEx
CryptUnprotectData
CryptBinaryToStringW
CryptBinaryToStringA
CryptStringToBinaryW
CryptExportPublicKeyInfo
CryptFindOIDInfo
CryptAcquireCertificatePrivateKey
CertNameToStrW
CryptStringToBinaryA
CertGetCertificateContextProperty
CryptSignAndEncodeCertificate
CryptEncodeObject
CryptProtectData
CryptQueryObject
CertGetNameStringW
cryptdll
MD5Init
MD5Update
MD5Final
CDLocateCSystem
CDGenerateRandomBits
CDLocateCheckSum
dnsapi
DnsFree
DnsQuery_A
fltlib
FilterFindFirst
FilterFindNext
netapi32
NetServerGetInfo
NetStatisticsGet
NetShareEnum
DsEnumerateDomainTrustsW
DsGetDcNameW
NetApiBufferFree
NetRemoteTOD
NetSessionEnum
NetWkstaUserEnum
I_NetServerAuthenticate2
I_NetServerTrustPasswordsGet
I_NetServerReqChallenge
ole32
CoInitializeEx
CoUninitialize
CoCreateInstance
oleaut32
VariantInit
SysFreeString
SysAllocString
rpcrt4
RpcMgmtEpEltInqNextW
RpcMgmtEpEltInqBegin
I_RpcGetCurrentCallHandle
NdrClientCall2
RpcMgmtEpEltInqDone
RpcBindingFromStringBindingW
RpcStringBindingComposeW
MesEncodeIncrementalHandleCreate
RpcBindingSetAuthInfoExW
RpcBindingInqAuthClientW
RpcBindingSetOption
RpcImpersonateClient
RpcBindingFree
RpcStringFreeW
RpcRevertToSelf
MesDecodeIncrementalHandleCreate
MesHandleFree
MesIncrementalHandleReset
NdrMesTypeDecode2
NdrMesTypeAlignSize2
NdrMesTypeFree2
NdrMesTypeEncode2
RpcServerUnregisterIfEx
I_RpcBindingInqSecurityContext
RpcServerInqBindings
RpcServerListen
RpcMgmtWaitServerListen
RpcEpRegisterW
RpcMgmtStopServerListening
RpcBindingToStringBindingW
RpcServerRegisterIf2
RpcServerRegisterAuthInfoW
RpcBindingVectorFree
UuidToStringW
RpcServerUseProtseqEpW
RpcEpUnregister
NdrServerCall2
RpcEpResolveBinding
UuidCreate
shlwapi
PathIsDirectoryW
PathCanonicalizeW
PathCombineW
PathFindFileNameW
PathIsRelativeW
samlib
SamEnumerateGroupsInDomain
SamiChangePasswordUser
SamSetInformationUser
SamGetGroupsForUser
SamConnect
SamGetMembersInGroup
SamRidToSid
SamGetMembersInAlias
SamEnumerateAliasesInDomain
SamGetAliasMembership
SamOpenGroup
SamQueryInformationUser
SamCloseHandle
SamEnumerateDomainsInSamServer
SamFreeMemory
SamEnumerateUsersInDomain
SamOpenUser
SamLookupDomainInSamServer
SamLookupNamesInDomain
SamLookupIdsInDomain
SamOpenDomain
SamOpenAlias
secur32
QueryContextAttributesW
FreeContextBuffer
LsaConnectUntrusted
LsaLookupAuthenticationPackage
LsaFreeReturnBuffer
DeleteSecurityContext
LsaCallAuthenticationPackage
FreeCredentialsHandle
EnumerateSecurityPackagesW
AcquireCredentialsHandleW
InitializeSecurityContextW
LsaDeregisterLogonProcess
shell32
CommandLineToArgvW
user32
IsCharAlphaNumericW
GetKeyboardLayout
DispatchMessageW
DefWindowProcW
SetClipboardViewer
SendMessageW
GetClipboardSequenceNumber
OpenClipboard
CreateWindowExW
ChangeClipboardChain
GetClipboardData
RegisterClassExW
TranslateMessage
EnumClipboardFormats
PostMessageW
UnregisterClassW
GetMessageW
CloseClipboard
DestroyWindow
userenv
CreateEnvironmentBlock
DestroyEnvironmentBlock
version
GetFileVersionInfoSizeW
VerQueryValueW
GetFileVersionInfoW
hid
HidD_GetFeature
HidD_GetPreparsedData
HidD_GetHidGuid
HidD_GetAttributes
HidD_FreePreparsedData
HidP_GetCaps
HidD_SetFeature
setupapi
SetupDiGetDeviceInterfaceDetailW
SetupDiEnumDeviceInterfaces
SetupDiGetClassDevsW
SetupDiDestroyDeviceInfoList
winscard
SCardControl
SCardTransmit
SCardDisconnect
SCardGetAttrib
SCardEstablishContext
SCardFreeMemory
SCardListReadersW
SCardReleaseContext
SCardGetCardTypeProviderNameW
SCardListCardsW
SCardConnectW
winsta
WinStationCloseServer
WinStationOpenServerW
WinStationFreeMemory
WinStationConnectW
WinStationQueryInformationW
WinStationEnumerateW
wldap32
ord203
ord140
ord122
ord14
ord157
ord88
ord133
ord27
ord147
ord167
ord127
ord96
ord304
ord309
ord54
ord142
ord77
ord13
ord208
ord145
ord36
ord79
ord41
ord73
ord310
ord139
ord97
ord223
ord12
ord113
ord301
ord224
ord26
ord69
msasn1
ASN1_CreateModule
ASN1BERDotVal2Eoid
ASN1_CloseEncoder
ASN1_CreateDecoder
ASN1_FreeEncoded
ASN1_CloseModule
ASN1_CreateEncoder
ASN1_CloseDecoder
ntdll
RtlUnicodeStringToAnsiString
RtlFreeAnsiString
RtlDowncaseUnicodeString
RtlFreeUnicodeString
RtlInitUnicodeString
RtlEqualUnicodeString
NtQueryObject
RtlCompressBuffer
RtlGetCompressionWorkSpaceSize
NtQuerySystemInformation
RtlGetCurrentPeb
NtQueryInformationProcess
RtlCreateUserThread
RtlGUIDFromString
RtlStringFromGUID
NtCompareTokens
RtlGetNtVersionNumbers
RtlEqualString
RtlUpcaseUnicodeString
RtlAppendUnicodeStringToString
RtlAnsiStringToUnicodeString
RtlFreeOemString
RtlUpcaseUnicodeStringToOemString
NtResumeProcess
RtlAdjustPrivilege
NtSuspendProcess
NtTerminateProcess
NtQuerySystemEnvironmentValueEx
NtSetSystemEnvironmentValueEx
NtEnumerateSystemEnvironmentValuesEx
RtlIpv4AddressToStringW
RtlIpv6AddressToStringW
kernel32
GetFileSize
HeapReAlloc
GetFullPathNameA
GetFullPathNameW
GetTimeFormatW
WideCharToMultiByte
GetSystemTimeAsFileTime
SystemTimeToFileTime
GetDateFormatW
InterlockedExchange
SetFilePointerEx
GetProcessId
PurgeComm
ClearCommError
CreateRemoteThread
WaitForSingleObject
SetLastError
CreateProcessW
SetConsoleOutputCP
GetConsoleOutputCP
CreateFileMappingW
UnmapViewOfFile
MapViewOfFile
WriteProcessMemory
VirtualProtect
VirtualAllocEx
VirtualProtectEx
VirtualAlloc
ReadProcessMemory
VirtualFreeEx
VirtualQueryEx
VirtualFree
VirtualQuery
GetComputerNameExW
DeviceIoControl
DuplicateHandle
OpenProcess
GetCurrentProcess
ExpandEnvironmentStringsW
FindNextFileW
FindClose
GetCurrentDirectoryW
GetFileSizeEx
FlushFileBuffers
GetFileAttributesW
FindFirstFileW
lstrlenW
DeleteFileA
GetTempPathA
GetFileInformationByHandle
FileTimeToLocalFileTime
GetCurrentDirectoryA
GetTempFileNameA
SetFilePointer
CreateFileA
FileTimeToDosDateTime
CreateThread
CreateMutexW
CloseHandle
LocalAlloc
GetLastError
CreateFileW
ReadFile
Sleep
TerminateThread
WriteFile
FileTimeToSystemTime
SetEndOfFile
FreeLibrary
HeapAlloc
QueryPerformanceCounter
HeapFree
InterlockedCompareExchange
UnlockFile
FlushViewOfFile
LockFile
WaitForSingleObjectEx
OutputDebugStringW
GetTickCount
UnlockFileEx
GetProcessHeap
FormatMessageA
LoadLibraryW
HeapCompact
FormatMessageW
GetVersionExW
HeapDestroy
GetFileAttributesA
HeapCreate
HeapValidate
MultiByteToWideChar
GetTempPathW
GetProcAddress
HeapSize
LockFileEx
GetDiskFreeSpaceW
LoadLibraryA
CreateFileMappingA
GetDiskFreeSpaceA
GetSystemInfo
GetFileAttributesExW
OutputDebugStringA
GetVersionExA
DeleteFileW
GetCurrentProcessId
GetSystemTime
AreFileApisANSI
ExitProcess
RaiseException
SetConsoleCtrlHandler
SetConsoleTitleW
lstrlenA
GlobalSize
GetModuleHandleW
SetHandleInformation
CreatePipe
InitializeCriticalSection
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
SetEvent
CreateEventW
GetCurrentThreadId
GetModuleHandleA
GetVersion
SetUnhandledExceptionFilter
UnhandledExceptionFilter
TerminateProcess
LocalFree
RtlUnwind
GetSystemDirectoryW
SetConsoleCursorPosition
GetTimeZoneInformation
GetStdHandle
FillConsoleOutputCharacterW
GetComputerNameW
ProcessIdToSessionId
GetCurrentThread
SetCurrentDirectoryW
IsWow64Process
GetConsoleScreenBufferInfo
msvcrt
calloc
__set_app_type
isdigit
_read
_lseeki64
mbtowc
__mb_cur_max
isleadbyte
isxdigit
localeconv
_snprintf
_itoa
wctomb
ferror
iswctype
wcstombs
_write
_isatty
ungetc
?terminate@@YAXXZ
_controlfp
__badioinfo
__pioinfo
__p__fmode
isspace
_wcsicmp
__p__commode
__setusermatherr
_amsg_exit
_initterm
_errno
free
_wcsdup
_vsnprintf
strrchr
_except_handler3
vfwprintf
_vscwprintf
fflush
_wfopen
wprintf
_fileno
_iob
vwprintf
_setmode
fclose
_stricmp
wcsrchr
wcschr
strtoul
_wcsnicmp
wcsstr
_vscprintf
memmove
strncmp
malloc
_msize
strcspn
realloc
fgetws
wcstoul
wcstol
towupper
_wpgmptr
strstr
strchr
_wcstoui64
wcsncmp
getchar
memset
memcpy
__wgetmainargs
_cexit
_exit
_XcptFilter
exit
Name
.text
Size
590KB
Virtual Size
589KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
309KB
Virtual Size
309KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
14KB
Virtual Size
16KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
16KB
Virtual Size
15KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
30KB
Virtual Size
29KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=16, id=149, productName=VS2008 SP1 build 30729, version=30729,
count=14, id=132, productName=VS2008 SP1 build 30729, version=30729,
count=2, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=67, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=2, id=156, productName=VS2010 SP1 build 40219, version=40219,
count=4, id=203, productName=VS2012 UPD4 build 61030, version=61030,
count=2, id=203, productName=VS2012 UPD2 build 60315, version=60315,
count=2, id=95, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=2, id=132, productName=VS2008 build 21022, version=21022,
count=47, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=626, id=1, productName=Unmarked objects,
count=1, id=126, version=50727,
count=99, id=137, version=30729,
count=1, id=148, productName=VS2008 SP1 [9.0] build 30729, version=30729,
count=1, id=145, productName=VS2008 SP1 build 30729, version=30729,
mimikatz-master/Win32/mimilib.dll
- IMPHASH f9c08077ec0126532e2897217c9bcfbe
- SHA256 2b202a389838e59a7e19bcb8f1280cf339de49d23b37c2ff2028da9924d8ed0d
- MD5 b89fd300420f7f8aa506177cc230a824
- SHA1 03e89ebc0375803e8a2a758bed0ce0c325012e70
- SHA512 5f650c2bba97f04f3ba994eb01f74d3492bcf25d6230c6e576edf8f3cbacb304a28a437a0d3a9dbc51239818c64fc187f171d2afa0a2f068080661398389a2c6
- SSDEEP 768:bhUZHYTw3R3Zeu1b5Oib7ts3sdYemVejdl0SN4FHEhG4FQtEh3:8nikb55b7+8d1IejdlDCHE0CKEh
- TLSH T1F41329425B144CF1FF860A38B4DF2E33AE7E95E089A0049BB56F418A1F563617B3934B
- MD5 SHA1 SHA512 SSDEEP TLSH
-
mimikatz is an open source tool to dump credentials on Windows
Digest
4a:e0:b7:e2:a4:5a:59:bb:7a:33:03:e7:c5:be:02:2d:10:db:2b:8b:f3:f3:da:5f:51:f9:f3:58:7c:94:c1:b1
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Open Source Developer\, Benjamin Delpy,O=Open Source Developer,L=Montreuil,C=FR,1.2.840.113549.1.9.1=#0c1762656e6a616d696e4067656e74696c6b6977692e636f6d
Chains
Feb 29, 2020
CN=Open Source Developer\, Benjamin Delpy,O=Open Source Developer,L=Montreuil,C=FR,1.2.840.113549.1.9.1=#0c1762656e6a616d696e4067656e74696c6b6977692e636f6d
CN=Certum Code Signing CA SHA2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL
CN=Certum Trusted Network CA,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL
Digest
69:80:5f:47:62:c9:e4:64:c0:bd:1c:a9:45:58:5e:87:93:d6:e3:2a
Digest Algorithm
sha1
PE Digests Matches
Trusted
Signing Certificate
CN=Open Source Developer\, Benjamin Delpy,O=Open Source Developer,L=Montreuil,C=FR,1.2.840.113549.1.9.1=#0c1762656e6a616d696e4067656e74696c6b6977692e636f6d
Chains
Feb 29, 2020
CN=Open Source Developer\, Benjamin Delpy,O=Open Source Developer,L=Montreuil,C=FR,1.2.840.113549.1.9.1=#0c1762656e6a616d696e4067656e74696c6b6977692e636f6d
CN=Certum Code Signing CA SHA2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL
CN=Certum Trusted Network CA,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL
Subject
CN=Certum Code Signing CA SHA2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL
Serial Number
6b:32:6a:0f:03:28:d3:7a:1d:53:0b:fd:23:bd:48:e2
Issuer
CN=Certum Trusted Network CA,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Oct 29, 2015 - Jun 9, 2027
Subject
CN=Open Source Developer\, Benjamin Delpy,O=Open Source Developer,L=Montreuil,C=FR,1.2.840.113549.1.9.1=#0c1762656e6a616d696e4067656e74696c6b6977692e636f6d
Serial Number
10:a9:2b:2a:c8:aa:84:76:b6:c7:23:2e:c0:a9:e6:fa
Issuer
CN=Certum Code Signing CA SHA2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Dec 5, 2019 - Dec 4, 2020
Subject
CN=Certum EV TSA SHA2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL
Serial Number
fe:67:e4:f1:5a:24:e3:c6:0d:54:7c:a0:20:c2:76:70
Issuer
CN=Certum Trusted Network CA,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Mar 8, 2016 - May 30, 2027
Minor OS version
0
Major OS version
5
Entry point
17019
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
advapi32
CreateRestrictedToken
CreateProcessAsUserW
ConvertSidToStringSidA
IsTextUnicode
OpenProcessToken
ntdll
RtlStringFromGUID
RtlEqualString
RtlFreeUnicodeString
rpcrt4
MesDecodeIncrementalHandleCreate
MesIncrementalHandleReset
NdrMesTypeDecode2
NdrMesTypeFree2
MesHandleFree
kernel32
GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
GetTickCount
SetUnhandledExceptionFilter
UnhandledExceptionFilter
TerminateProcess
InterlockedCompareExchange
Sleep
GetCurrentProcess
CloseHandle
FreeLibrary
LoadLibraryW
lstrlenW
GetProcAddress
LocalAlloc
LocalFree
GetTimeFormatA
GetDateFormatA
FileTimeToSystemTime
FileTimeToLocalFileTime
RaiseException
InterlockedExchange
GetLastError
LoadLibraryA
RtlUnwind
QueryPerformanceCounter
msvcrt
_wfopen
fclose
_stricmp
fflush
memset
memcpy
_XcptFilter
malloc
free
_initterm
_amsg_exit
vfwprintf
_except_handler3
DhcpNewPktHook
DhcpServerCalloutEntry
DnsPluginCleanup
DnsPluginInitialize
DnsPluginQuery
ExtensionApiVersion
InitializeChangeNotify
Msv1_0SubAuthenticationFilter
Msv1_0SubAuthenticationRoutine
PasswordChangeNotify
SpLsaModeInitialize
WinDbgExtensionDllInit
coffee
mimikatz
startW
Name
.text
Size
14KB
Virtual Size
13KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
9KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
1KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
2KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=7, id=149, productName=VS2008 SP1 build 30729, version=30729,
count=13, id=132, productName=VS2008 SP1 build 30729, version=30729,
count=2, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=59, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=2, id=156, productName=VS2010 SP1 build 40219, version=40219,
count=2, id=132, productName=VS2008 build 21022, version=21022,
count=7, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=106, id=1, productName=Unmarked objects,
count=1, id=126, version=50727,
count=13, id=137, version=30729,
count=1, id=146, productName=VS2008 SP1 build 30729, version=30729,
count=1, id=148, productName=VS2008 SP1 [9.0] build 30729, version=30729,
count=1, id=145, productName=VS2008 SP1 build 30729, version=30729,
mimikatz-master/Win32/mimilove.exe
- IMPHASH 4e1492696c43305d97c6c6a4e8958cdf
- SHA256 eac47b3ba3c4a035d4fb8abe0b5531d7f23f1d803b0c784f25cdf68c27520c77
- MD5 5b25c78e900658105bc64f0a31b10656
- SHA1 2ca81716cf60d5debae0ad9a82c8566ab53f19a4
- SHA512 ba6bd33c39523b5ebf20b3a5f2f37544b5a5637c64cc132bb1c162a8682288c1a9c105baf7fe2e581ca22070def5a1a33ad68e8f28c26067abf1a4d021c82eb9
- SSDEEP 768:dZuH7PLxh8+AJtxF0jBuD24aYNNW9gFqF6VGCxBl/qkFSuEh8FxzEh6:juHxsreYa9dnCxBlnSuEg5EY
- TLSH T192F209626AF94561F2A20E30FAE96507CE7779C14D30004F512C85C75BA3B54AFABB2F
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Detects Mimilove part of Mimikatz
Digest
30:51:35:1d:da:35:19:26:3a:23:a4:02:ab:17:3e:5c:6f:2b:aa:e0:52:a0:34:21:27:80:11:41:ad:f2:a2:19
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Open Source Developer\, Benjamin Delpy,O=Open Source Developer,L=Montreuil,C=FR,1.2.840.113549.1.9.1=#0c1762656e6a616d696e4067656e74696c6b6977692e636f6d
Chains
Feb 29, 2020
CN=Open Source Developer\, Benjamin Delpy,O=Open Source Developer,L=Montreuil,C=FR,1.2.840.113549.1.9.1=#0c1762656e6a616d696e4067656e74696c6b6977692e636f6d
CN=Certum Code Signing CA SHA2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL
CN=Certum Trusted Network CA,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL
Digest
cc:c0:79:2e:a8:9e:ef:95:38:48:8b:9c:6e:75:1c:e8:23:28:1e:d6
Digest Algorithm
sha1
PE Digests Matches
Trusted
Signing Certificate
CN=Open Source Developer\, Benjamin Delpy,O=Open Source Developer,L=Montreuil,C=FR,1.2.840.113549.1.9.1=#0c1762656e6a616d696e4067656e74696c6b6977692e636f6d
Chains
Feb 29, 2020
CN=Open Source Developer\, Benjamin Delpy,O=Open Source Developer,L=Montreuil,C=FR,1.2.840.113549.1.9.1=#0c1762656e6a616d696e4067656e74696c6b6977692e636f6d
CN=Certum Code Signing CA SHA2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL
CN=Certum Trusted Network CA,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL
Subject
CN=Certum Code Signing CA SHA2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL
Serial Number
6b:32:6a:0f:03:28:d3:7a:1d:53:0b:fd:23:bd:48:e2
Issuer
CN=Certum Trusted Network CA,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Oct 29, 2015 - Jun 9, 2027
Subject
CN=Open Source Developer\, Benjamin Delpy,O=Open Source Developer,L=Montreuil,C=FR,1.2.840.113549.1.9.1=#0c1762656e6a616d696e4067656e74696c6b6977692e636f6d
Serial Number
10:a9:2b:2a:c8:aa:84:76:b6:c7:23:2e:c0:a9:e6:fa
Issuer
CN=Certum Code Signing CA SHA2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Dec 5, 2019 - Dec 4, 2020
Subject
CN=Certum EV TSA SHA2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL
Serial Number
fe:67:e4:f1:5a:24:e3:c6:0d:54:7c:a0:20:c2:76:70
Issuer
CN=Certum Trusted Network CA,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Mar 8, 2016 - May 30, 2027
Minor OS version
0
Major OS version
5
Entry point
12594
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB paths
advapi32
IsTextUnicode
ConvertSidToStringSidW
user32
IsCharAlphaNumericW
ntdll
RtlEqualUnicodeString
NtQueryInformationProcess
RtlInitUnicodeString
NtQuerySystemInformation
RtlEqualString
RtlRunDecodeUnicodeString
kernel32
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
GetModuleHandleA
SetUnhandledExceptionFilter
UnhandledExceptionFilter
TerminateProcess
InterlockedCompareExchange
Sleep
InterlockedExchange
RtlUnwind
GetCurrentProcessId
GetLastError
LocalAlloc
DeviceIoControl
CloseHandle
LocalFree
SetFilePointer
WriteFile
ReadProcessMemory
ReadFile
WriteProcessMemory
UnmapViewOfFile
GetCurrentProcess
GetDateFormatW
GetSystemTimeAsFileTime
GetTimeFormatW
FileTimeToSystemTime
FileTimeToLocalFileTime
OpenProcess
GetVersionExW
msvcrt
vfwprintf
fflush
_iob
wcsrchr
memset
memcpy
__wgetmainargs
_cexit
_exit
_XcptFilter
exit
_initterm
_amsg_exit
__setusermatherr
__p__commode
__p__fmode
__set_app_type
?terminate@@YAXXZ
_controlfp
vwprintf
Name
.text
Size
10KB
Virtual Size
9KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
9KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
1024B
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=6, id=149, productName=VS2008 SP1 build 30729, version=30729,
count=14, id=132, productName=VS2008 SP1 build 30729, version=30729,
count=2, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=67, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=2, id=156, productName=VS2010 SP1 build 40219, version=40219,
count=7, id=93, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=140, id=1, productName=Unmarked objects,
count=1, id=126, version=50727,
count=7, id=137, version=30729,
count=1, id=148, productName=VS2008 SP1 [9.0] build 30729, version=30729,
count=1, id=145, productName=VS2008 SP1 build 30729, version=30729,
mimikatz-master/debian/changelog
- SHA256 d1f604f4ab24ea68a73ed2b2194a938c88accbf9c83af2f426d92d27b9d414b6
- MD5 b2924815b7f616d376255c5cc4e4a969
- SHA1 88562f4ead0947af82fed36d38fd59fdd2200329
- SHA512 6188e41db35f0cad15597bfb0bb9ab7831c7c918cea93f6fad9c05aeebcd0cca65a24dfcbfaa4a28ba85e5b416381abc77ac65c226502fa5d2b95b59d9eb1de5
- TLSH T1A351AC004D4450B0DE97FEF7A6D83E11C96A2BFEDE94A4A60BCB5C41E7062E0FB15D02
- MD5 SHA1 SHA512 TLSH
mimikatz-master/debian/compat
- SHA256 2e6d31a5983a91251bfae5aefa1c0a19d8ba3cf601d0e8a706b4cfa9661a6b8a
- MD5 7c5aba41f53293b712fd86d08ed5b36e
- SHA1 b6abd567fa79cbe0196d093a067271361dc6ca8b
- SHA512 67403e2e061fea6d54770f26bb22883c4586cbf3b37898d8b8e1b41f56a123b62a2f85bbfa891c6bebc1a0c9d0c5849acd5d79af364938ff80725dfbc69037c4
- MD5 SHA1 SHA512
mimikatz-master/debian/control
- SHA256 1bed3d6de5332fd8c203d0b51cefbd327be3ab2de1a82d7d8da385bac452ac57
- MD5 da73837a13f2db52e3a5b00871737ea5
- SHA1 d3e29a541a43f3b4c3da8afe74ac340b74fa4767
- SHA512 299a548ea70fa3b90c402b5c9ba98018fa96de199507942311aef633e89788540efb8f9001a912b8181a7c95d47bb39a0de23e5349ca3ee675b124fea80514db
- TLSH T15CF08B0C58E822697706E83B2764532339F8334970C70935B7F15359B8D65F7140B1AF
- MD5 SHA1 SHA512 TLSH
mimikatz-master/debian/copyright
- SHA256 42f2064455eeeb5e6f4f31072f9595727aa6b58898f32415d8a49dcc124834b3
- MD5 86b5db18150570215857435500194632
- SHA1 2912b0fa3fc6fcf82c376df641cbf856bc968eb8
- SHA512 dc290144d5ca0eb9095c38d11b712b5e615d0cd0d488501aaa52c2932c6b288ff07ab175ed151925d596aef6f216f1195ac77dbb7bb94467d495ccff589f4b4b
- TLSH T16641635E9740833352D515C66A0EE1CFFB16603731BD4414346D431EAF1BB7A06FA2EA
- MD5 SHA1 SHA512 TLSH
mimikatz-master/debian/dirs
- SHA256 af15bb63f4a5343ce280d4aec375c0eb593c9740267c48f7c34da28ea6d534b2
- MD5 b5fe6359b29a35be2e07f690ddc900e2
- SHA1 b3768d6294adfa8000bdbfb8ff544b290b74477b
- SHA512 c503dbfc2a9da7d690f4ae10f42ce6ce86374912a9ed9f8750e62a90094a5162d6b4838904c8e33386cb78d4ad398f37b4a0fb15a41604b4fe7d436a78261153
- MD5 SHA1 SHA512
mimikatz-master/debian/docs
- SHA256 d0919d5bb7576d4b1a495856f1e561985d1063a8e22c74dfb90a5267c165331d
- MD5 ac036608c5c402f92926505d0f0ab0e4
- SHA1 9b9853025e82ad275c67117e2b3cd217ce3e439c
- SHA512 4ba1b8191e70c7c78e5d1b5a7058ee052c015bfda06dc489c258ad2ef535f6991e5d1413134cf1aeb1ca268f639feced42d5d4b9175d5d432ed6aab7fb1b47fd
- MD5 SHA1 SHA512
mimikatz-master/debian/mimikatz.install
- SHA256 2135bc3d34d6fb7ab786e94caa58e8f8965a7ac8ccb0557cabcc57000f13d084
- MD5 b512d3bf8ba6bd36cda73309f50d2033
- SHA1 10f1ebfb1ac03f5c55a71a2e57d90dc1b1411aca
- SHA512 2d48aa9e2277d12d10553b714157946cafdd42034a9701a9eceb7834bcc637b9667310941e73e68ca52213db2b83e1b0ad9cb889720980f148651845cd59997c
- TLSH T132B00132731684FB9E00D5333B12675417A2FAF9A446EA68F6D0820717D284F125B043
- MD5 SHA1 SHA512 TLSH
mimikatz-master/debian/rules
- SHA256 d8813af656e3d3bd27fab484708606fe5edde9bd232c2e3b571adf4a9f0b6348
- MD5 378029c42062c66f603a92d0ecd0db32
- SHA1 050a2023e376897e88ba58f9e8ac068a39a8e6f6
- SHA512 95ec9553bf9eec4ae074af021028c46ea0e715bfb090e827ab7a7e08f414fee6f15ad6eaee5938baa256eeb97bbf05b5f0caf7ef06815b771fa13efef7179fd1
- TLSH T1DCF05C4B57E6D6811C82B342969166AF2BE0913C097C8BF1B4AC444527095714691DAE
- MD5 SHA1 SHA512 TLSH
mimikatz-master/debian/source/format
- SHA256 1be7080d72e6b566df3e236ce2c55efdfbbb8fa1c972d825e5b672ff8773be1a
- MD5 d3a10140af54ec7371d3b9b084b07c14
- SHA1 1064dc0ce263680c076a1005f35ec906a5cf5a32
- SHA512 5d4a87949e0d8de1537662bebfcd707b1012c3a5c9bdcde8dbec8013c9c0ce0b3de5b16569a7bde33904772106c5a887ace648a742177cbbcac64e7f9c49d137
- MD5 SHA1 SHA512
mimikatz-master/debian/watch
- SHA256 8f74f22608b0f21871352de72dcf43df2b89d4787dab12f153bbd6f371a09fd9
- MD5 a1bf8dca579f7d169b060a752dd07732
- SHA1 2b94359974a527e627ef4a1aa3a9edbc0d76ca6a
- SHA512 08d5cf2670939c12a1cf13048a6b78a8314cddd84bef87ecc5754f6465a0981ba6076620d9077e4d26fefdd778b58b29b41feb1313c7daa33e7ac4cf9cf9a02d
- TLSH T119D0A74D310011706999B7718708FA08F3D4B79D841DEC5452A00722DD910372593105
- MD5 SHA1 SHA512 TLSH
mimikatz-master/kiwi_passwords.yar
- SHA256 966a58176b30c9bd5d4abfee0690e454129296e5522bbcf5f3c9db7fc84e279e
- MD5 79985d36b7a860473aa19a0b82b4747e
- SHA1 d6057993d9d57b9783718e924724fbf9b7b0b741
- SHA512 a73119ccd9a561905393cef284e292a380b376ee3a15453ecbea52e70dc2b73548aa6664939962514631553e1fb38fc0fee91c80b7312577c27806c2ca87129c
- TLSH T10C51023C2D41D249E063719D8FB135C879912303B5EE49C2B0DEE738E01BA7166BE455
- MD5 SHA1 SHA512 TLSH
mimikatz-master/mimicom.idl
- SHA256 51d45e6c5df6b43b17afc863794f34000d32fb37cd7c3664efc5bd99039ac3df
- MD5 ca47e27329203c266372d04475db2c57
- SHA1 4f7e3cb56c1a0d66ea979ff0ae644a6fe3feb0d8
- SHA512 6e3a697ac27db3184284c4537cccea6a7204ef7a23327f8eb58eaa9bdbe774c2ed7ddfd0070a5d6eba034195d10b82f7cfc8167a54a230e12e55e6c0ddbaa4e9
- TLSH T1315175970088917B6D3350C5933BD2D2DA6B8F07577C86D750E4E6A50C06BB9D3389B3
- MD5 SHA1 SHA512 TLSH
mimikatz-master/x64/mimidrv.sys
- IMPHASH a63c276e82b09fa57509d7958aa9d208
- SHA256 f9b01406864ab081aa77eef4ad15cb2dd2f830d1ef54f52622a59ff1aeb05ba5
- MD5 c8541a9cef64589593e999968a0385b9
- SHA1 fe18c58fbd0a83d67920e037d522c176704d2ca3
- SHA512 faf69095bf6ce18724163fcaaed851dc39949dcd21d4432c4d1734ccfbbe86c3e2bc17fd8c7c9b31b7e62f73e8a183852a358fe07f18570ce3281e2fe7b92bee
- SSDEEP 768:Si4mpA/ZBEAKaCTC/dBm8ipSfJvl1qlCGB8YluQYVHZC5islW:umaEAKEYaJlQlHB8YlhYJwisg
- TLSH T125F2F953A7E95458F1B749B9C9FDC116EBB2BC256B3297CF1200824E0F62BC09E34765
- MD5 SHA1 SHA512 SSDEEP TLSH
-
mimikatz is an open source tool to dump credentials on Windows
-
Revoked Certificate in Chain
One or more certificates in the signing chain have been revoked, indicating potential compromise.
-
Untrusted Codesign Signers
Codesigned file was signed by an untrusted entity.
PE Signature issue
Digest
9a:b8:ec:77:be:80:2f:f1:ce:a9:c1:29:33:8b:29:1a:48:c5:0c:bb
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Benjamin Delpy,C=FR
Chains
Oct 15, 2026
CN=Benjamin Delpy,C=FR
Subject
CN=Benjamin Delpy,C=FR
Serial Number
11:21:69:41:7a:1c:3e:f4:6a:30:1f:99:38:5f:50:68:0f:a0
Issuer
CN=GlobalSign CodeSigning CA - G2,O=GlobalSign nv-sa,C=BE
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Revoked
Revocation Date
Jun 28, 2011
Timespan
Jun 28, 2011 - Jun 28, 2014
Subject
CN=GlobalSign CodeSigning CA - G2,O=GlobalSign nv-sa,C=BE
Serial Number
75:1e:3e:e9:c5:dc:2f:3e:8f:04:e5:9d:ee:5e:d4:09
Issuer
CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning, ExtKeyUsageOCSPSigning
Revocation Status
Not revoked
Timespan
Apr 13, 2011 - Apr 13, 2026
Subject
CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE
Serial Number
61:0b:7f:6b:00:00:00:00:00:19
Issuer
CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Revocation Status
Not revoked
Timespan
May 23, 2006 - May 23, 2016
Minor OS version
1
Major OS version
6
Entry point
45156
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_NATIVE
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
c:\security\mimikatz\mimidrv\objfre_wnet_amd64\amd64\mimidrv.pdb
ntoskrnl.exe
KeBugCheck
IofCompleteRequest
IoCreateSymbolicLink
IoCreateDevice
PsProcessType
PsGetProcessImageFileName
PsLookupProcessByProcessId
PsReferencePrimaryToken
ZwOpenProcessTokenEx
IoGetCurrentProcess
ZwSetInformationProcess
ZwClose
ZwDuplicateToken
PsInitialSystemProcess
_vsnwprintf
ObfDereferenceObject
ObOpenObjectByPointer
PsGetProcessId
PsDereferencePrimaryToken
ExAllocatePoolWithTag
ExFreePoolWithTag
IoFreeMdl
MmProbeAndLockPages
MmUnlockPages
IoAllocateMdl
ZwUnloadKey
IoEnumerateRegisteredFiltersList
KeBugCheckEx
MmGetSystemRoutineAddress
IoDeleteDevice
RtlInitUnicodeString
NtBuildNumber
RtlCompareMemory
IoDeleteSymbolicLink
PsGetVersion
ExAllocatePoolWithQuotaTag
ZwQuerySystemInformation
RtlUnwindEx
fltmgr.sys
FltGetFilterInformation
FltEnumerateInstances
FltEnumerateFilters
FltObjectDereference
FltGetVolumeFromInstance
Name
.text
Size
13KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
5KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
6KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
512B
Virtual Size
432B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
PAGE
Size
1024B
Virtual Size
651B
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
INIT
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
.reloc
Size
1024B
Virtual Size
588B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=1, id=128, version=50727,
count=45, id=1, productName=Unmarked objects,
count=5, id=123, productName=Windows Server 2003 SP1 DDK (for AMD64) build 40310, version=40310,
count=2, id=125, productName=Windows Server 2003 SP1 DDK (for AMD64) build 40310, version=40310,
count=5, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=3, id=149, productName=VS2008 SP1 build 30729, version=30729,
count=1, id=109, productName=Windows Server 2003 SP1 DDK (for AMD64) build 40310, version=40310,
count=7, id=137, version=30729,
count=1, id=148, productName=VS2008 SP1 [9.0] build 30729, version=30729,
count=1, id=145, productName=VS2008 SP1 build 30729, version=30729,
mimikatz-master/x64/mimikatz.exe
- IMPHASH 1355327f6ca3430b3ddbe6e0acda71ea
- SHA256 92804faaab2175dc501d73e814663058c78c0a042675a8937266357bcfb96c50
- MD5 e930b05efe23891d19bc354a4209be3e
- SHA1 d1f7832035c3e8a73cc78afd28cfd7f4cece6d20
- SHA512 a7a59176ca275d5d5ea6547108907bbe8ddbf3489308b3d6efe571b685de7e6263d36d6580abe9587a7f77adc22d3b7b164ad42845b6c110b794eaba7ab47ec6
- SSDEEP 24576:zLrEjqXg4NiXcmHVjIhlIyEeQ37uV3Ugmf4Yl0Q0V7FCR:zLZo1jFyjFJhmf4YlHWk
- TLSH T142452941A7E940A8F1B79AB49EF19117DBB378D61934C30F02A48B5B1F73F619D29322
- MD5 SHA1 SHA512 SSDEEP TLSH
-
mimikatz is an open source tool to dump credentials on Windows
Digest
71:c1:40:fa:4c:5c:fe:12:62:34:82:3c:fb:4a:ad:51:e6:ce:1b:6a:cf:77:d5:6e:f7:a9:98:ef:68:47:f3:f0
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Open Source Developer\, Benjamin Delpy,O=Open Source Developer,L=Montreuil,C=FR,1.2.840.113549.1.9.1=#0c1762656e6a616d696e4067656e74696c6b6977692e636f6d
Chains
Feb 29, 2020
CN=Open Source Developer\, Benjamin Delpy,O=Open Source Developer,L=Montreuil,C=FR,1.2.840.113549.1.9.1=#0c1762656e6a616d696e4067656e74696c6b6977692e636f6d
CN=Certum Code Signing CA SHA2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL
CN=Certum Trusted Network CA,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL
Digest
2e:a0:f6:10:c7:a6:cc:b0:ae:92:c2:cb:a0:01:ff:09:a5:13:55:ed
Digest Algorithm
sha1
PE Digests Matches
Trusted
Signing Certificate
CN=Open Source Developer\, Benjamin Delpy,O=Open Source Developer,L=Montreuil,C=FR,1.2.840.113549.1.9.1=#0c1762656e6a616d696e4067656e74696c6b6977692e636f6d
Chains
Feb 29, 2020
CN=Open Source Developer\, Benjamin Delpy,O=Open Source Developer,L=Montreuil,C=FR,1.2.840.113549.1.9.1=#0c1762656e6a616d696e4067656e74696c6b6977692e636f6d
CN=Certum Code Signing CA SHA2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL
CN=Certum Trusted Network CA,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL
Subject
CN=Certum Code Signing CA SHA2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL
Serial Number
6b:32:6a:0f:03:28:d3:7a:1d:53:0b:fd:23:bd:48:e2
Issuer
CN=Certum Trusted Network CA,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Oct 29, 2015 - Jun 9, 2027
Subject
CN=Open Source Developer\, Benjamin Delpy,O=Open Source Developer,L=Montreuil,C=FR,1.2.840.113549.1.9.1=#0c1762656e6a616d696e4067656e74696c6b6977692e636f6d
Serial Number
10:a9:2b:2a:c8:aa:84:76:b6:c7:23:2e:c0:a9:e6:fa
Issuer
CN=Certum Code Signing CA SHA2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Dec 5, 2019 - Dec 4, 2020
Subject
CN=Certum EV TSA SHA2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL
Serial Number
fe:67:e4:f1:5a:24:e3:c6:0d:54:7c:a0:20:c2:76:70
Issuer
CN=Certum Trusted Network CA,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Mar 8, 2016 - May 30, 2027
Minor OS version
2
Major OS version
5
Entry point
773388
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
advapi32
CryptSetHashParam
CryptGetHashParam
CryptExportKey
CryptAcquireContextW
CryptSetKeyParam
CryptGetKeyParam
CryptReleaseContext
CryptDuplicateKey
CryptAcquireContextA
CryptGetProvParam
CryptImportKey
SystemFunction007
CryptEncrypt
CryptCreateHash
CryptGenKey
CryptDestroyKey
CryptDecrypt
CryptDestroyHash
CryptHashData
CopySid
GetLengthSid
LsaQueryInformationPolicy
LsaOpenPolicy
LsaClose
CreateWellKnownSid
CreateProcessWithLogonW
CreateProcessAsUserW
RegQueryValueExW
RegQueryInfoKeyW
RegEnumValueW
RegOpenKeyExW
RegEnumKeyExW
RegCloseKey
RegSetValueExW
SystemFunction032
ConvertSidToStringSidW
CreateServiceW
CloseServiceHandle
DeleteService
OpenSCManagerW
SetServiceObjectSecurity
OpenServiceW
BuildSecurityDescriptorW
QueryServiceObjectSecurity
StartServiceW
AllocateAndInitializeSid
QueryServiceStatusEx
FreeSid
ControlService
IsTextUnicode
OpenProcessToken
GetTokenInformation
LookupAccountNameW
LookupAccountSidW
DuplicateTokenEx
CheckTokenMembership
CryptSetProvParam
CryptEnumProvidersW
ConvertStringSidToSidW
LsaFreeMemory
GetSidSubAuthority
GetSidSubAuthorityCount
IsValidSid
SetThreadToken
CryptEnumProviderTypesW
SystemFunction006
CryptGetUserKey
OpenEventLogW
GetNumberOfEventLogRecords
ClearEventLogW
SystemFunction001
CryptDeriveKey
SystemFunction005
LsaQueryTrustedDomainInfoByName
CryptSignHashW
LsaOpenSecret
LsaQuerySecret
SystemFunction013
LsaRetrievePrivateData
LsaEnumerateTrustedDomainsEx
LookupPrivilegeValueW
StartServiceCtrlDispatcherW
SetServiceStatus
RegisterServiceCtrlHandlerW
LookupPrivilegeNameW
OpenThreadToken
CredFree
CredEnumerateW
SystemFunction025
ConvertStringSecurityDescriptorToSecurityDescriptorW
SystemFunction024
CredIsMarshaledCredentialW
CredUnmarshalCredentialW
A_SHAFinal
A_SHAInit
A_SHAUpdate
cabinet
ord11
ord14
ord10
ord13
crypt32
CertFindCertificateInStore
CertEnumSystemStore
CertEnumCertificatesInStore
CertAddCertificateContextToStore
CryptDecodeObjectEx
CertAddEncodedCertificateToStore
CertOpenStore
CertFreeCertificateContext
CertCloseStore
CertSetCertificateContextProperty
PFXExportCertStoreEx
CryptUnprotectData
CryptBinaryToStringW
CryptBinaryToStringA
CryptStringToBinaryW
CryptExportPublicKeyInfo
CryptFindOIDInfo
CryptAcquireCertificatePrivateKey
CertNameToStrW
CryptStringToBinaryA
CertGetCertificateContextProperty
CryptSignAndEncodeCertificate
CryptEncodeObject
CryptProtectData
CryptQueryObject
CertGetNameStringW
cryptdll
MD5Init
MD5Update
MD5Final
CDLocateCSystem
CDGenerateRandomBits
CDLocateCheckSum
dnsapi
DnsFree
DnsQuery_A
fltlib
FilterFindFirst
FilterFindNext
netapi32
NetServerGetInfo
NetStatisticsGet
NetShareEnum
DsEnumerateDomainTrustsW
DsGetDcNameW
NetApiBufferFree
NetRemoteTOD
NetSessionEnum
NetWkstaUserEnum
I_NetServerAuthenticate2
I_NetServerTrustPasswordsGet
I_NetServerReqChallenge
ole32
CoInitializeEx
CoUninitialize
CoCreateInstance
oleaut32
VariantInit
SysFreeString
SysAllocString
rpcrt4
RpcMgmtEpEltInqNextW
RpcMgmtEpEltInqBegin
I_RpcGetCurrentCallHandle
NdrClientCall2
RpcMgmtEpEltInqDone
RpcBindingFromStringBindingW
RpcStringBindingComposeW
MesEncodeIncrementalHandleCreate
RpcBindingSetAuthInfoExW
RpcBindingInqAuthClientW
RpcBindingSetOption
RpcImpersonateClient
RpcBindingFree
RpcStringFreeW
RpcRevertToSelf
MesDecodeIncrementalHandleCreate
MesHandleFree
MesIncrementalHandleReset
NdrMesTypeDecode2
NdrMesTypeAlignSize2
NdrMesTypeFree2
NdrMesTypeEncode2
RpcServerUnregisterIfEx
I_RpcBindingInqSecurityContext
RpcServerInqBindings
RpcServerListen
RpcMgmtWaitServerListen
RpcEpRegisterW
RpcMgmtStopServerListening
RpcBindingToStringBindingW
RpcServerRegisterIf2
RpcServerRegisterAuthInfoW
RpcBindingVectorFree
UuidToStringW
RpcServerUseProtseqEpW
RpcEpUnregister
NdrServerCall2
RpcEpResolveBinding
UuidCreate
shlwapi
PathIsDirectoryW
PathCanonicalizeW
PathCombineW
PathFindFileNameW
PathIsRelativeW
samlib
SamEnumerateGroupsInDomain
SamiChangePasswordUser
SamSetInformationUser
SamGetGroupsForUser
SamConnect
SamGetMembersInGroup
SamRidToSid
SamGetMembersInAlias
SamEnumerateAliasesInDomain
SamGetAliasMembership
SamOpenGroup
SamQueryInformationUser
SamCloseHandle
SamEnumerateDomainsInSamServer
SamFreeMemory
SamEnumerateUsersInDomain
SamOpenUser
SamLookupDomainInSamServer
SamLookupNamesInDomain
SamLookupIdsInDomain
SamOpenDomain
SamOpenAlias
secur32
QueryContextAttributesW
FreeContextBuffer
LsaConnectUntrusted
LsaLookupAuthenticationPackage
LsaDeregisterLogonProcess
DeleteSecurityContext
LsaCallAuthenticationPackage
FreeCredentialsHandle
EnumerateSecurityPackagesW
AcquireCredentialsHandleW
InitializeSecurityContextW
LsaFreeReturnBuffer
shell32
CommandLineToArgvW
user32
IsCharAlphaNumericW
GetKeyboardLayout
DispatchMessageW
DefWindowProcW
SetClipboardViewer
SendMessageW
GetClipboardSequenceNumber
OpenClipboard
CreateWindowExW
ChangeClipboardChain
GetClipboardData
RegisterClassExW
TranslateMessage
EnumClipboardFormats
PostMessageW
UnregisterClassW
GetMessageW
CloseClipboard
DestroyWindow
userenv
CreateEnvironmentBlock
DestroyEnvironmentBlock
version
VerQueryValueW
GetFileVersionInfoSizeW
GetFileVersionInfoW
hid
HidD_GetFeature
HidD_GetPreparsedData
HidD_GetHidGuid
HidD_GetAttributes
HidD_FreePreparsedData
HidP_GetCaps
HidD_SetFeature
setupapi
SetupDiGetDeviceInterfaceDetailW
SetupDiEnumDeviceInterfaces
SetupDiGetClassDevsW
SetupDiDestroyDeviceInfoList
winscard
SCardControl
SCardTransmit
SCardDisconnect
SCardGetAttrib
SCardEstablishContext
SCardFreeMemory
SCardListReadersW
SCardReleaseContext
SCardGetCardTypeProviderNameW
SCardListCardsW
SCardConnectW
winsta
WinStationCloseServer
WinStationOpenServerW
WinStationFreeMemory
WinStationConnectW
WinStationQueryInformationW
WinStationEnumerateW
wldap32
ord122
ord14
ord88
ord157
ord133
ord27
ord147
ord167
ord26
ord127
ord224
ord113
ord309
ord54
ord142
ord77
ord13
ord208
ord145
ord36
ord79
ord41
ord73
ord310
ord203
ord69
ord139
ord97
ord223
ord304
ord12
ord96
ord301
ord140
msasn1
ASN1_CreateModule
ASN1BERDotVal2Eoid
ASN1_CloseEncoder
ASN1_CreateDecoder
ASN1_FreeEncoded
ASN1_CloseModule
ASN1_CreateEncoder
ASN1_CloseDecoder
ntdll
RtlFreeAnsiString
RtlDowncaseUnicodeString
RtlFreeUnicodeString
RtlInitUnicodeString
RtlEqualUnicodeString
NtQueryObject
RtlCompressBuffer
RtlGetCompressionWorkSpaceSize
NtQuerySystemInformation
RtlGetCurrentPeb
NtQueryInformationProcess
RtlUnicodeStringToAnsiString
RtlGUIDFromString
RtlStringFromGUID
NtCompareTokens
RtlGetNtVersionNumbers
RtlEqualString
RtlUpcaseUnicodeString
RtlAppendUnicodeStringToString
RtlAnsiStringToUnicodeString
RtlFreeOemString
RtlUpcaseUnicodeStringToOemString
NtResumeProcess
RtlAdjustPrivilege
NtSuspendProcess
NtTerminateProcess
NtQuerySystemEnvironmentValueEx
RtlCreateUserThread
NtSetSystemEnvironmentValueEx
NtEnumerateSystemEnvironmentValuesEx
RtlIpv4AddressToStringW
RtlIpv6AddressToStringW
kernel32
GetFullPathNameA
GetFullPathNameW
GetTimeFormatW
WideCharToMultiByte
GetSystemTimeAsFileTime
SystemTimeToFileTime
GetDateFormatW
PurgeComm
ClearCommError
RtlVirtualUnwind
SetFilePointerEx
GetProcessId
CreateRemoteThread
WaitForSingleObject
SetLastError
CreateProcessW
SetConsoleOutputCP
GetConsoleOutputCP
CreateFileMappingW
UnmapViewOfFile
MapViewOfFile
WriteProcessMemory
VirtualAllocEx
VirtualProtectEx
VirtualAlloc
ReadProcessMemory
VirtualFreeEx
VirtualQueryEx
VirtualFree
VirtualQuery
GetComputerNameExW
DeviceIoControl
DuplicateHandle
OpenProcess
GetCurrentProcess
ExpandEnvironmentStringsW
FindNextFileW
FindClose
GetCurrentDirectoryW
GetFileSizeEx
FlushFileBuffers
GetFileAttributesW
FindFirstFileW
lstrlenW
DeleteFileA
GetTempPathA
GetFileInformationByHandle
FileTimeToLocalFileTime
GetCurrentDirectoryA
GetTempFileNameA
SetFilePointer
CreateFileA
FileTimeToDosDateTime
CreateThread
LocalFree
CloseHandle
LocalAlloc
HeapReAlloc
CreateFileW
ReadFile
TerminateThread
WriteFile
FileTimeToSystemTime
Sleep
VirtualProtect
CreateMutexW
HeapCompact
SetEndOfFile
FreeLibrary
HeapAlloc
QueryPerformanceCounter
HeapFree
UnlockFile
FlushViewOfFile
LockFile
WaitForSingleObjectEx
OutputDebugStringW
GetTickCount
UnlockFileEx
GetProcessHeap
FormatMessageA
LoadLibraryW
GetFileSize
FormatMessageW
GetVersionExW
HeapDestroy
GetFileAttributesA
HeapCreate
HeapValidate
MultiByteToWideChar
GetTempPathW
GetProcAddress
HeapSize
LockFileEx
GetDiskFreeSpaceW
LoadLibraryA
CreateFileMappingA
GetDiskFreeSpaceA
GetSystemInfo
GetFileAttributesExW
OutputDebugStringA
GetVersionExA
DeleteFileW
GetCurrentProcessId
GetSystemTime
AreFileApisANSI
ExitProcess
RaiseException
SetConsoleCtrlHandler
SetConsoleTitleW
lstrlenA
GlobalSize
GetModuleHandleW
SetHandleInformation
CreatePipe
InitializeCriticalSection
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
SetEvent
CreateEventW
GetSystemDirectoryW
GetCurrentThreadId
SetUnhandledExceptionFilter
UnhandledExceptionFilter
TerminateProcess
RtlCaptureContext
GetLastError
RtlLookupFunctionEntry
SetConsoleCursorPosition
GetTimeZoneInformation
GetStdHandle
FillConsoleOutputCharacterW
GetConsoleScreenBufferInfo
GetComputerNameW
ProcessIdToSessionId
GetCurrentThread
SetCurrentDirectoryW
msvcrt
isspace
isdigit
calloc
mbtowc
_lseeki64
_write
isleadbyte
isxdigit
localeconv
_snprintf
_itoa
wctomb
ferror
iswctype
wcstombs
_isatty
ungetc
?terminate@@YAXXZ
__badioinfo
__pioinfo
_read
log
__mb_cur_max
vwprintf
__set_app_type
_fmode
_commode
_errno
free
_wcsdup
_vsnprintf
strrchr
_wcsicmp
vfwprintf
_vscwprintf
fflush
_wfopen
wprintf
_fileno
_iob
memcmp
_setmode
fclose
_stricmp
wcsrchr
wcschr
strtoul
_wcsnicmp
wcsstr
_vscprintf
memmove
strncmp
malloc
_msize
strcspn
realloc
fgetws
wcstoul
wcstol
towupper
_wpgmptr
strstr
strchr
_wcstoui64
wcsncmp
getchar
memcpy
memset
__C_specific_handler
__wgetmainargs
_XcptFilter
_exit
_cexit
exit
_initterm
_amsg_exit
__setusermatherr
Name
.text
Size
779KB
Virtual Size
778KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
354KB
Virtual Size
353KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
25KB
Virtual Size
28KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
25KB
Virtual Size
24KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
16KB
Virtual Size
15KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
9KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=2, id=149, productName=VS2008 SP1 build 30729, version=30729,
count=63, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=16, id=132, productName=VS2008 SP1 build 30729, version=30729,
count=2, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=2, id=156, productName=VS2010 SP1 build 40219, version=40219,
count=4, id=203, productName=VS2012 UPD4 build 61030, version=61030,
count=2, id=203, productName=VS2012 UPD2 build 60315, version=60315,
count=2, id=109, productName=Windows Server 2003 SP1 DDK (for AMD64) build 40310, version=40310,
count=2, id=132, productName=VS2008 build 21022, version=21022,
count=47, id=123, productName=Windows Server 2003 SP1 DDK (for AMD64) build 40310, version=40310,
count=634, id=1, productName=Unmarked objects,
count=1, id=126, version=50727,
count=99, id=137, version=30729,
count=1, id=148, productName=VS2008 SP1 [9.0] build 30729, version=30729,
count=1, id=145, productName=VS2008 SP1 build 30729, version=30729,
mimikatz-master/x64/mimilib.dll
- IMPHASH d65ad3d169907c04f78241dc4d64978e
- SHA256 7ffce7f6d7262f214d78e6b7fd8d07119835cba4b04ce334260665d7c8fb369a
- MD5 eb05429d25fc57b476428cdb0a134b2f
- SHA1 1c6913248131b5784b923eff1e76a443f738affc
- SHA512 199cbef36efe00121dbc1e5126ee556a72090c5134f157aa48a89d5ab2b0a15116cb059a7387e5d29dd6a4cab2b584494baf32c9b388118107ab9fa53743bb3f
- SSDEEP 768:VWZZrWUCE5KuhECg1kQPbTk/Zm8b4snsFYzltrf0zlejdl0mHFBEhLF3YEhV7K:gP1vgKob4/Zm8bxsFmGlejdl5lBE/IE+
- TLSH T13A235D5B8A6418A0EE92C639E2FB5A57DE71B4805A61064F317CC5CA2F733713F2C70A
- MD5 SHA1 SHA512 SSDEEP TLSH
-
mimikatz is an open source tool to dump credentials on Windows
Digest
07:d2:ce:5d:2a:e0:50:f5:3e:a0:07:5e:43:2e:38:e4:aa:37:c1:61:a8:54:e6:bf:0d:13:f7:96:01:f2:7f:d5
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Open Source Developer\, Benjamin Delpy,O=Open Source Developer,L=Montreuil,C=FR,1.2.840.113549.1.9.1=#0c1762656e6a616d696e4067656e74696c6b6977692e636f6d
Chains
Feb 29, 2020
CN=Open Source Developer\, Benjamin Delpy,O=Open Source Developer,L=Montreuil,C=FR,1.2.840.113549.1.9.1=#0c1762656e6a616d696e4067656e74696c6b6977692e636f6d
CN=Certum Code Signing CA SHA2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL
CN=Certum Trusted Network CA,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL
Digest
7c:9e:a3:8f:e3:93:97:40:99:d7:93:46:7b:95:7d:10:57:1e:53:b1
Digest Algorithm
sha1
PE Digests Matches
Trusted
Signing Certificate
CN=Open Source Developer\, Benjamin Delpy,O=Open Source Developer,L=Montreuil,C=FR,1.2.840.113549.1.9.1=#0c1762656e6a616d696e4067656e74696c6b6977692e636f6d
Chains
Feb 29, 2020
CN=Open Source Developer\, Benjamin Delpy,O=Open Source Developer,L=Montreuil,C=FR,1.2.840.113549.1.9.1=#0c1762656e6a616d696e4067656e74696c6b6977692e636f6d
CN=Certum Code Signing CA SHA2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL
CN=Certum Trusted Network CA,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL
Subject
CN=Certum Code Signing CA SHA2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL
Serial Number
6b:32:6a:0f:03:28:d3:7a:1d:53:0b:fd:23:bd:48:e2
Issuer
CN=Certum Trusted Network CA,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL
Key Usages
KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Oct 29, 2015 - Jun 9, 2027
Subject
CN=Open Source Developer\, Benjamin Delpy,O=Open Source Developer,L=Montreuil,C=FR,1.2.840.113549.1.9.1=#0c1762656e6a616d696e4067656e74696c6b6977692e636f6d
Serial Number
10:a9:2b:2a:c8:aa:84:76:b6:c7:23:2e:c0:a9:e6:fa
Issuer
CN=Certum Code Signing CA SHA2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Revocation Status
Not revoked
Timespan
Dec 5, 2019 - Dec 4, 2020
Subject
CN=Certum EV TSA SHA2,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL
Serial Number
fe:67:e4:f1:5a:24:e3:c6:0d:54:7c:a0:20:c2:76:70
Issuer
CN=Certum Trusted Network CA,OU=Certum Certification Authority,O=Unizeto Technologies S.A.,C=PL
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Mar 8, 2016 - May 30, 2027
Minor OS version
2
Major OS version
5
Entry point
20072
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
advapi32
CreateRestrictedToken
CreateProcessAsUserW
ConvertSidToStringSidA
IsTextUnicode
OpenProcessToken
ntdll
RtlStringFromGUID
RtlEqualString
RtlFreeUnicodeString
rpcrt4
MesDecodeIncrementalHandleCreate
MesIncrementalHandleReset
NdrMesTypeDecode2
NdrMesTypeFree2
MesHandleFree
kernel32
GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
GetTickCount
SetUnhandledExceptionFilter
UnhandledExceptionFilter
TerminateProcess
RtlCaptureContext
RtlLookupFunctionEntry
Sleep
GetCurrentProcess
CloseHandle
FreeLibrary
LoadLibraryW
lstrlenW
GetProcAddress
LocalAlloc
LocalFree
GetTimeFormatA
GetDateFormatA
FileTimeToSystemTime
FileTimeToLocalFileTime
RaiseException
GetLastError
LoadLibraryA
RtlVirtualUnwind
QueryPerformanceCounter
msvcrt
_wfopen
fclose
_stricmp
vfwprintf
fflush
memcpy
memset
_XcptFilter
malloc
_initterm
free
_amsg_exit
__C_specific_handler
memcmp
DhcpNewPktHook
DhcpServerCalloutEntry
DnsPluginCleanup
DnsPluginInitialize
DnsPluginQuery
ExtensionApiVersion
InitializeChangeNotify
Msv1_0SubAuthenticationFilter
Msv1_0SubAuthenticationRoutine
PasswordChangeNotify
SpLsaModeInitialize
WinDbgExtensionDllInit
coffee
mimikatz
startW
Name
.text
Size
17KB
Virtual Size
17KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
11KB
Virtual Size
10KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
2KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
1024B
Virtual Size
816B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
286B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=1, id=149, productName=VS2008 SP1 build 30729, version=30729,
count=56, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=15, id=132, productName=VS2008 SP1 build 30729, version=30729,
count=2, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=2, id=156, productName=VS2010 SP1 build 40219, version=40219,
count=2, id=132, productName=VS2008 build 21022, version=21022,
count=7, id=123, productName=Windows Server 2003 SP1 DDK (for AMD64) build 40310, version=40310,
count=117, id=1, productName=Unmarked objects,
count=1, id=126, version=50727,
count=13, id=137, version=30729,
count=1, id=146, productName=VS2008 SP1 build 30729, version=30729,
count=1, id=148, productName=VS2008 SP1 [9.0] build 30729, version=30729,
count=1, id=145, productName=VS2008 SP1 build 30729, version=30729,