mimikatz - Copy.exe - mimikatz.exe - mimikatz for Windows

info
MZ
PE
resources
imports
foremost
version info
hexdump
disasm
log
discuss
donate

filename	mimikatz - Copy.exe
size	787456 (0xc0400)
md5	1822a5736066fc2dec91a26ad7cd7c27

type	PE32 executable (console) Intel 80386, for MS Windows
mimetype	application/x-dosexec

clamav	OK
virustotal	→ scan with virustotal.com

histogram

MZ Header

signature	MZ
bytes_in_last_block	0x90
blocks_in_file	3
num_relocs	0
header_paragraphs	4
min_extra_paragraphs	0
max_extra_paragraphs	0xffff
ss	0
sp	0xb8
checksum	0
ip	0
cs	0
reloc_table_offset	0x40
overlay_number	0
reserved0	0
oem_id	0
oem_info	0
reserved2	0
reserved3	0
reserved4	0
reserved5	0
reserved6	0
lfanew	0x128

Rich Header

lib id	version	times used
241	40116	10
243	40116	150
242	40116	25
259	24123	23
260	24123	21
156	40219	2
203	61030	4
203	60315	2
131	30729	2
261	24123	31
93	4035	8
147	30729	33
1	0	492
264	24210	78
255	24210	1
151	0	1
258	24210	1

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

Signature	PE
Machine	0x14c
NumberOfSections	6
TimeDateStamp	0x59759016
PointerToSymbolTable	0
NumberOfSymbols	0
SizeOfOptionalHeader	0xe0
Characteristics	0x102
Magic	0x10b
LinkerVersion	14.0
SizeOfCode	0x79200
SizeOfInitializedData	0x48200
SizeOfUninitializedData	0
AddressOfEntryPoint	0x58b1b
BaseOfCode	0x1000
BaseOfData	0x7b000
ImageBase	0x400000
SectionAlignment	0x1000
FileAlignment	0x200
OperatingSystemVersion	5.1
ImageVersion	0.0
SubsystemVersion	5.1
Reserved1	0
SizeOfImage	0xc6000
SizeOfHeaders	0x400
CheckSum	0
Subsystem	3
DllCharacteristics	0x8140
SizeOfStackReserve	0x100000
SizeOfStackCommit	0x1000
SizeOfHeapReserve	0x100000
SizeOfHeapCommit	0x1000
LoaderFlags	0
NumberOfRvaAndSizes	0x10

Packer / Compiler

MS Visual C++ v8.0

Sections

name	va	vsize	raw size	flags
.text	0x1000	0x79144	0x79200	R-X CODE
.rdata	0x7b000	0x39ae8	0x39c00	R-- IDATA
.data	0xb5000	0x402c	0x2e00	RW- IDATA
.gfids	0xba000	0xb0	0x200	R-- IDATA
.rsrc	0xbb000	0x4260	0x4400	R-- IDATA
.reloc	0xc0000	0x5c4c	0x5e00	R-- IDATA DISCARDABLE

Data Directory

type	va	size
EXPORT	0	0
IMPORT	0xb1c7c	0x1f4
RESOURCE	0xbb000	0x4260
EXCEPTION	0	0
SECURITY	0	0
BASERELOC	0xc0000	0x5c4c
DEBUG	0xb0fe0	0x1c
ARCHITECTURE	0	0
GLOBALPTR	0	0
TLS	0	0
LOAD_CONFIG	0x7b870	0x40
Bound_IAT	0	0
IAT	0x7b000	0x78c
Delay_IAT	0xb19d4	0x60
CLR_Header	0	0

show previews

type	name	size
ICON	#1	9640
ICON	#2	4264
ICON	#3	1128
GROUP_ICON	#100	48
VERSION	#1	960
MANIFEST	#1	548

module_name	hint	ord	function_name
ADVAPI32.dll	203		CryptReleaseContext
ADVAPI32.dll	192		CryptGenKey
ADVAPI32.dll	198		CryptGetProvParam
ADVAPI32.dll	196		CryptGetHashParam
ADVAPI32.dll	202		CryptImportKey
ADVAPI32.dll	205		CryptSetKeyParam
ADVAPI32.dll	182		CryptDestroyHash
ADVAPI32.dll	204		CryptSetHashParam
ADVAPI32.dll	200		CryptHashData
ADVAPI32.dll	179		CryptCreateHash
ADVAPI32.dll	191		CryptExportKey
ADVAPI32.dll	180		CryptDecrypt
ADVAPI32.dll	724		SystemFunction007
ADVAPI32.dll	185		CryptDuplicateKey
ADVAPI32.dll	186		CryptEncrypt
ADVAPI32.dll	177		CryptAcquireContextW
ADVAPI32.dll	197		CryptGetKeyParam
ADVAPI32.dll	176		CryptAcquireContextA
ADVAPI32.dll	183		CryptDestroyKey
ADVAPI32.dll	310		GetLengthSid
ADVAPI32.dll	118		CopySid
ADVAPI32.dll	413		LsaClose
ADVAPI32.dll	445		LsaOpenPolicy
ADVAPI32.dll	453		LsaQueryInformationPolicy
ADVAPI32.dll	131		CreateWellKnownSid
ADVAPI32.dll	124		CreateProcessAsUserW
ADVAPI32.dll	125		CreateProcessWithLogonW
ADVAPI32.dll	622		RegQueryValueExW
ADVAPI32.dll	594		RegEnumValueW
ADVAPI32.dll	609		RegOpenKeyExW
ADVAPI32.dll	638		RegSetValueExW
ADVAPI32.dll	591		RegEnumKeyExW
ADVAPI32.dll	616		RegQueryInfoKeyW
ADVAPI32.dll	560		RegCloseKey
ADVAPI32.dll	749		SystemFunction032
ADVAPI32.dll	551		QueryServiceObjectSecurity
ADVAPI32.dll	553		QueryServiceStatusEx
ADVAPI32.dll	67		BuildSecurityDescriptorW
ADVAPI32.dll	507		OpenServiceW
ADVAPI32.dll	713		StartServiceW
ADVAPI32.dll	288		FreeSid
ADVAPI32.dll	92		ControlService
ADVAPI32.dll	703		SetServiceObjectSecurity
ADVAPI32.dll	218		DeleteService
ADVAPI32.dll	32		AllocateAndInitializeSid
ADVAPI32.dll	505		OpenSCManagerW
ADVAPI32.dll	87		CloseServiceHandle
ADVAPI32.dll	129		CreateServiceW
ADVAPI32.dll	108		ConvertSidToStringSidW
ADVAPI32.dll	384		IsTextUnicode
ADVAPI32.dll	346		GetTokenInformation
ADVAPI32.dll	399		LookupAccountNameW
ADVAPI32.dll	401		LookupAccountSidW
ADVAPI32.dll	223		DuplicateTokenEx
ADVAPI32.dll	81		CheckTokenMembership
ADVAPI32.dll	503		OpenProcessToken
ADVAPI32.dll	116		ConvertStringSidToSidW
ADVAPI32.dll	427		LsaFreeMemory
ADVAPI32.dll	723		SystemFunction006
ADVAPI32.dll	188		CryptEnumProviderTypesW
ADVAPI32.dll	190		CryptEnumProvidersW
ADVAPI32.dll	206		CryptSetProvParam
ADVAPI32.dll	199		CryptGetUserKey
ADVAPI32.dll	502		OpenEventLogW
ADVAPI32.dll	83		ClearEventLogW
ADVAPI32.dll	323		GetNumberOfEventLogRecords
ADVAPI32.dll	742		SystemFunction025
ADVAPI32.dll	460		LsaRetrievePrivateData
ADVAPI32.dll	447		LsaOpenSecret
ADVAPI32.dll	457		LsaQueryTrustedDomainInfoByName
ADVAPI32.dll	454		LsaQuerySecret
ADVAPI32.dll	718		SystemFunction001
ADVAPI32.dll	722		SystemFunction005
ADVAPI32.dll	343		GetSidSubAuthority
ADVAPI32.dll	730		SystemFunction013
ADVAPI32.dll	344		GetSidSubAuthorityCount
ADVAPI32.dll	426		LsaEnumerateTrustedDomainsEx
ADVAPI32.dll	407		LookupPrivilegeValueW
ADVAPI32.dll	712		StartServiceCtrlDispatcherW
ADVAPI32.dll	648		RegisterServiceCtrlHandlerW
ADVAPI32.dll	704		SetServiceStatus
ADVAPI32.dll	390		IsValidSid
ADVAPI32.dll	508		OpenThreadToken
ADVAPI32.dll	705		SetThreadToken
ADVAPI32.dll	405		LookupPrivilegeNameW
ADVAPI32.dll	140		CredFree
ADVAPI32.dll	137		CredEnumerateW
CRYPT32.dll	8		CertAddEncodedCertificateToStore
CRYPT32.dll	64		CertFreeCertificateContext
CRYPT32.dll	18		CertCloseStore
CRYPT32.dll	278		PFXExportCertStoreEx
CRYPT32.dll	106		CertSetCertificateContextProperty
CRYPT32.dll	87		CertOpenStore
CRYPT32.dll	219		CryptUnprotectData
CRYPT32.dll	125		CryptBinaryToStringW
CRYPT32.dll	217		CryptStringToBinaryW
CRYPT32.dll	189		CryptProtectData
CRYPT32.dll	122		CryptAcquireCertificatePrivateKey
CRYPT32.dll	142		CryptExportPublicKeyInfo
CRYPT32.dll	47		CertEnumSystemStore
CRYPT32.dll	4		CertAddCertificateContextToStore
CRYPT32.dll	210		CryptSignAndEncodeCertificate
CRYPT32.dll	44		CertEnumCertificatesInStore
CRYPT32.dll	84		CertNameToStrW
CRYPT32.dll	134		CryptEncodeObject
CRYPT32.dll	53		CertFindCertificateInStore
CRYPT32.dll	75		CertGetNameStringW
CRYPT32.dll	70		CertGetCertificateContextProperty
cryptdll.dll	4		CDGenerateRandomBits
cryptdll.dll	11		MD5Final
cryptdll.dll	13		MD5Update
cryptdll.dll	12		MD5Init
cryptdll.dll	6		CDLocateCheckSum
cryptdll.dll	5		CDLocateCSystem
NETAPI32.dll	188		NetRemoteTOD
NETAPI32.dll	16		DsGetDcNameW
NETAPI32.dll	101		NetApiBufferFree
NETAPI32.dll	269		NetWkstaUserEnum
NETAPI32.dll	239		NetShareEnum
NETAPI32.dll	243		NetStatisticsGet
NETAPI32.dll	231		NetSessionEnum
NETAPI32.dll	220		NetServerGetInfo
ole32.dll	63		CoInitializeEx
ole32.dll	108		CoUninitialize
ole32.dll	16		CoCreateInstance
OLEAUT32.dll		2
OLEAUT32.dll		6
OLEAUT32.dll		8
RPCRT4.dll	382		RpcEpRegisterW
RPCRT4.dll	355		RpcBindingInqAuthClientW
RPCRT4.dll	369		RpcBindingSetOption
RPCRT4.dll	351		RpcBindingFromStringBindingW
RPCRT4.dll	494		RpcStringBindingComposeW
RPCRT4.dll	366		RpcBindingSetAuthInfoExW
RPCRT4.dll	498		RpcStringFreeW
RPCRT4.dll	125		MesHandleFree
RPCRT4.dll	399		RpcImpersonateClient
RPCRT4.dll	432		RpcRevertToSelf
RPCRT4.dll	124		MesEncodeIncrementalHandleCreate
RPCRT4.dll	121		MesDecodeIncrementalHandleCreate
RPCRT4.dll	349		RpcBindingFree
RPCRT4.dll	126		MesIncrementalHandleReset
RPCRT4.dll	243		NdrMesTypeEncode2
RPCRT4.dll	241		NdrMesTypeDecode2
RPCRT4.dll	244		NdrMesTypeFree2
RPCRT4.dll	239		NdrMesTypeAlignSize2
RPCRT4.dll	32		I_RpcBindingInqSecurityContext
RPCRT4.dll	149		NdrClientCall2
RPCRT4.dll	283		NdrServerCall2
RPCRT4.dll	507		UuidCreate
RPCRT4.dll	373		RpcBindingVectorFree
RPCRT4.dll	401		RpcMgmtEpEltInqBegin
RPCRT4.dll	402		RpcMgmtEpEltInqDone
RPCRT4.dll	461		RpcServerUseProtseqEpW
RPCRT4.dll	451		RpcServerUnregisterIfEx
RPCRT4.dll	371		RpcBindingToStringBindingW
RPCRT4.dll	446		RpcServerRegisterIf2
RPCRT4.dll	404		RpcMgmtEpEltInqNextW
RPCRT4.dll	383		RpcEpResolveBinding
RPCRT4.dll	442		RpcServerListen
RPCRT4.dll	444		RpcServerRegisterAuthInfoW
RPCRT4.dll	384		RpcEpUnregister
RPCRT4.dll	436		RpcServerInqBindings
RPCRT4.dll	418		RpcMgmtStopServerListening
SHLWAPI.dll	58		PathCombineW
SHLWAPI.dll	56		PathCanonicalizeW
SHLWAPI.dll	101		PathIsRelativeW
SHLWAPI.dll	91		PathIsDirectoryW
SHLWAPI.dll	73		PathFindFileNameW
SAMLIB.dll	28		SamLookupIdsInDomain
SAMLIB.dll	18		SamEnumerateGroupsInDomain
SAMLIB.dll	26		SamGetMembersInGroup
SAMLIB.dll	30		SamOpenAlias
SAMLIB.dll	24		SamGetGroupsForUser
SAMLIB.dll	25		SamGetMembersInAlias
SAMLIB.dll	19		SamEnumerateUsersInDomain
SAMLIB.dll	29		SamLookupNamesInDomain
SAMLIB.dll	31		SamOpenDomain
SAMLIB.dll	17		SamEnumerateDomainsInSamServer
SAMLIB.dll	33		SamOpenUser
SAMLIB.dll	56		SamiChangePasswordUser
SAMLIB.dll	21		SamGetAliasMembership
SAMLIB.dll	7		SamConnect
SAMLIB.dll	6		SamCloseHandle
SAMLIB.dll	27		SamLookupDomainInSamServer
SAMLIB.dll	20		SamFreeMemory
SAMLIB.dll	38		SamQueryInformationUser
SAMLIB.dll	48		SamSetInformationUser
SAMLIB.dll	32		SamOpenGroup
SAMLIB.dll	16		SamEnumerateAliasesInDomain
SAMLIB.dll	44		SamRidToSid
Secur32.dll	52		QueryContextAttributesW
Secur32.dll	39		LsaConnectUntrusted
Secur32.dll	40		LsaDeregisterLogonProcess
Secur32.dll	45		LsaLookupAuthenticationPackage
Secur32.dll	42		LsaFreeReturnBuffer
Secur32.dll	24		FreeContextBuffer
Secur32.dll	38		LsaCallAuthenticationPackage
SHELL32.dll	6		CommandLineToArgvW
USER32.dll	318		GetKeyboardLayout
USER32.dll	451		IsCharAlphaNumericW
USERENV.dll	4		DestroyEnvironmentBlock
USERENV.dll			CreateEnvironmentBlock
VERSION.dll	6		GetFileVersionInfoW
VERSION.dll	14		VerQueryValueW
VERSION.dll	5		GetFileVersionInfoSizeW
HID.DLL	2		HidD_GetAttributes
HID.DLL	21		HidP_GetCaps
HID.DLL	12		HidD_GetPreparsedData
HID.DLL	1		HidD_FreePreparsedData
HID.DLL	5		HidD_GetHidGuid
SETUPAPI.dll	366		SetupDiGetDeviceInterfaceDetailW
SETUPAPI.dll	342		SetupDiGetClassDevsW
SETUPAPI.dll	323		SetupDiEnumDeviceInterfaces
SETUPAPI.dll	319		SetupDiDestroyDeviceInfoList
WinSCard.dll	8		SCardConnectW
WinSCard.dll	19		SCardFreeMemory
WinSCard.dll	20		SCardGetAttrib
WinSCard.dll	10		SCardDisconnect
WinSCard.dll	12		SCardEstablishContext
WinSCard.dll	51		SCardReleaseContext
WinSCard.dll	36		SCardListCardsW
WinSCard.dll	22		SCardGetCardTypeProviderNameW
WinSCard.dll	42		SCardListReadersW
WINSTA.dll	26		WinStationConnectW
WINSTA.dll	35		WinStationFreeMemory
WINSTA.dll	23		WinStationCloseServer
WINSTA.dll	51		WinStationQueryInformationW
WINSTA.dll	49		WinStationOpenServerW
WINSTA.dll	31		WinStationEnumerateW
WLDAP32.dll		73
WLDAP32.dll		145
WLDAP32.dll		77
WLDAP32.dll		142
WLDAP32.dll		41
WLDAP32.dll		147
WLDAP32.dll		79
WLDAP32.dll		36
WLDAP32.dll		27
WLDAP32.dll		13
WLDAP32.dll		310
WLDAP32.dll		54
WLDAP32.dll		301
WLDAP32.dll		304
WLDAP32.dll		309
WLDAP32.dll		167
WLDAP32.dll		208
WLDAP32.dll		26
WLDAP32.dll		133
WLDAP32.dll		127
advapi32.dll			A_SHAFinal
advapi32.dll	2		A_SHAUpdate
advapi32.dll	1		A_SHAInit
msasn1.dll	3		ASN1_CloseDecoder
msasn1.dll	8		ASN1_CreateModule
msasn1.dll	6		ASN1_CreateDecoder
msasn1.dll	4		ASN1_CloseEncoder
msasn1.dll			ASN1BERDotVal2Eoid
msasn1.dll	9		ASN1_FreeEncoded
msasn1.dll	7		ASN1_CreateEncoder
msasn1.dll	5		ASN1_CloseModule
ntdll.dll	32		RtlIpv6AddressToStringW
ntdll.dll	31		RtlIpv4AddressToStringW
ntdll.dll	1		NtEnumerateSystemEnvironmentValuesEx
ntdll.dll	5		NtQuerySystemEnvironmentValueEx
ntdll.dll	9		NtSetSystemEnvironmentValueEx
ntdll.dll	11		NtSuspendProcess
ntdll.dll	12		NtTerminateProcess
ntdll.dll	20		RtlEqualString
ntdll.dll	7		NtResumeProcess
ntdll.dll	23		RtlFreeOemString
ntdll.dll	14		RtlAnsiStringToUnicodeString
ntdll.dll	38		RtlUpcaseUnicodeString
ntdll.dll	15		RtlAppendUnicodeStringToString
ntdll.dll	28		RtlGetNtVersionNumbers
ntdll.dll			NtCompareTokens
ntdll.dll	35		RtlStringFromGUID
ntdll.dll	13		RtlAdjustPrivilege
ntdll.dll	21		RtlEqualUnicodeString
ntdll.dll	19		RtlDowncaseUnicodeString
ntdll.dll	24		RtlFreeUnicodeString
ntdll.dll	25		RtlGUIDFromString
ntdll.dll	17		RtlCreateUserThread
ntdll.dll	27		RtlGetCurrentPeb
ntdll.dll	2		NtQueryInformationProcess
ntdll.dll	6		NtQuerySystemInformation
ntdll.dll	16		RtlCompressBuffer
ntdll.dll	26		RtlGetCompressionWorkSpaceSize
ntdll.dll	3		NtQueryObject
ntdll.dll	36		RtlUnicodeStringToAnsiString
ntdll.dll	22		RtlFreeAnsiString
ntdll.dll	39		RtlUpcaseUnicodeStringToOemString
ntdll.dll	30		RtlInitUnicodeString
netapi32.dll			I_NetServerAuthenticate2
netapi32.dll	1		I_NetServerReqChallenge
netapi32.dll	2		I_NetServerTrustPasswordsGet
KERNEL32.dll	353		FreeEnvironmentStringsW
KERNEL32.dll	474		GetEnvironmentStringsW
KERNEL32.dll	370		GetCPInfo
KERNEL32.dll	567		GetOEMCP
KERNEL32.dll	778		IsValidCodePage
KERNEL32.dll	308		FindFirstFileExW
KERNEL32.dll	617		GetStringTypeW
KERNEL32.dll	1159		SetStdHandle
KERNEL32.dll	428		GetConsoleMode
KERNEL32.dll	410		GetConsoleCP
KERNEL32.dll	813		LCMapStringW
KERNEL32.dll	100		CompareStringW
KERNEL32.dll	499		GetFileType
KERNEL32.dll	360		GetACP
KERNEL32.dll	535		GetModuleHandleExW
KERNEL32.dll	532		GetModuleFileNameW
KERNEL32.dll	391		GetCommandLineW
KERNEL32.dll	390		GetCommandLineA
KERNEL32.dll	830		LoadLibraryExW
KERNEL32.dll	1222		TlsFree
KERNEL32.dll	1224		TlsSetValue
KERNEL32.dll	1223		TlsGetValue
KERNEL32.dll	1221		TlsAlloc
KERNEL32.dll	739		InitializeCriticalSectionAndSpinCount
KERNEL32.dll	1048		RtlUnwind
KERNEL32.dll	1216		TerminateProcess
KERNEL32.dll	772		IsProcessorFeaturePresent
KERNEL32.dll	611		GetStartupInfoW
KERNEL32.dll	1189		SetUnhandledExceptionFilter
KERNEL32.dll	1235		UnhandledExceptionFilter
KERNEL32.dll	768		IsDebuggerPresent
KERNEL32.dll	743		InitializeSListHead
KERNEL32.dll	453		GetCurrentThreadId
KERNEL32.dll	829		LoadLibraryExA
KERNEL32.dll	588		GetProcessId
KERNEL32.dll	921		ProcessIdToSessionId
KERNEL32.dll	452		GetCurrentThread
KERNEL32.dll	782		IsWow64Process
KERNEL32.dll	1073		SetConsoleCursorPosition
KERNEL32.dll	1101		SetCurrentDirectoryW
KERNEL32.dll	296		FillConsoleOutputCharacterW
KERNEL32.dll	664		GetTimeZoneInformation
KERNEL32.dll	398		GetComputerNameExW
KERNEL32.dll	612		GetStdHandle
KERNEL32.dll	434		GetConsoleScreenBufferInfo
KERNEL32.dll	1113		SetEvent
KERNEL32.dll	133		CreateEventW
KERNEL32.dll	161		CreatePipe
KERNEL32.dll	1136		SetHandleInformation
KERNEL32.dll	536		GetModuleHandleW
KERNEL32.dll	354		FreeLibrary
KERNEL32.dll	581		GetProcAddress
KERNEL32.dll	831		LoadLibraryW
KERNEL32.dll	1357		lstrlenA
KERNEL32.dll	1096		SetConsoleTitleW
KERNEL32.dll	281		ExitProcess
KERNEL32.dll	945		RaiseException
KERNEL32.dll	1069		SetConsoleCtrlHandler
KERNEL32.dll	659		GetTickCount
KERNEL32.dll	935		QueryPerformanceCounter
KERNEL32.dll	349		FormatMessageA
KERNEL32.dll	631		GetSystemTime
KERNEL32.dll	633		GetSystemTimeAsFileTime
KERNEL32.dll	1213		SystemTimeToFileTime
KERNEL32.dll	586		GetProcessHeap
KERNEL32.dll	449		GetCurrentProcessId
KERNEL32.dll	209		DeleteCriticalSection
KERNEL32.dll	496		GetFileSize
KERNEL32.dll	851		LockFileEx
KERNEL32.dll	137		CreateFileMappingA
KERNEL32.dll	1236		UnlockFile
KERNEL32.dll	718		HeapDestroy
KERNEL32.dll	716		HeapCompact
KERNEL32.dll	715		HeapAlloc
KERNEL32.dll	627		GetSystemInfo
KERNEL32.dll	722		HeapReAlloc
KERNEL32.dll	214		DeleteFileW
KERNEL32.dll	211		DeleteFileA
KERNEL32.dll	675		GetVersionExA
KERNEL32.dll	1274		WaitForSingleObjectEx
KERNEL32.dll	136		CreateFileA
KERNEL32.dll	346		FlushViewOfFile
KERNEL32.dll	906		OutputDebugStringW
KERNEL32.dll	487		GetFileAttributesExW
KERNEL32.dll	485		GetFileAttributesA
KERNEL32.dll	460		GetDiskFreeSpaceA
KERNEL32.dll	350		FormatMessageW
KERNEL32.dll	644		GetTempPathA
KERNEL32.dll	871		MultiByteToWideChar
KERNEL32.dll	724		HeapSize
KERNEL32.dll	727		HeapValidate
KERNEL32.dll	676		GetVersionExW
KERNEL32.dll	158		CreateMutexW
KERNEL32.dll	645		GetTempPathW
KERNEL32.dll	1237		UnlockFileEx
KERNEL32.dll	1110		SetEnvironmentVariableA
KERNEL32.dll	1111		SetEnvironmentVariableW
KERNEL32.dll	1316		WriteConsoleW
KERNEL32.dll	958		ReadConsoleW
KERNEL32.dll	1127		SetFilePointerEx
KERNEL32.dll	1107		SetEndOfFile
KERNEL32.dll	504		GetFullPathNameA
KERNEL32.dll	738		InitializeCriticalSection
KERNEL32.dll	825		LeaveCriticalSection
KERNEL32.dll	850		LockFile
KERNEL32.dll	905		OutputDebugStringA
KERNEL32.dll	463		GetDiskFreeSpaceW
KERNEL32.dll	745		InterlockedCompareExchange
KERNEL32.dll	507		GetFullPathNameW
KERNEL32.dll	238		EnterCriticalSection
KERNEL32.dll	719		HeapFree
KERNEL32.dll	717		HeapCreate
KERNEL32.dll	1230		TryEnterCriticalSection
KERNEL32.dll	21		AreFileApisANSI
KERNEL32.dll	456		GetDateFormatW
KERNEL32.dll	1297		WideCharToMultiByte
KERNEL32.dll	663		GetTimeFormatW
KERNEL32.dll	292		FileTimeToLocalFileTime
KERNEL32.dll	1358		lstrlenW
KERNEL32.dll	169		CreateRemoteThread
KERNEL32.dll	1273		WaitForSingleObject
KERNEL32.dll	202		DecodePointer
KERNEL32.dll	1139		SetLastError
KERNEL32.dll	168		CreateProcessW
KERNEL32.dll	1090		SetConsoleOutputCP
KERNEL32.dll	432		GetConsoleOutputCP
KERNEL32.dll	855		MapViewOfFile
KERNEL32.dll	140		CreateFileMappingW
KERNEL32.dll	1238		UnmapViewOfFile
KERNEL32.dll	1266		VirtualQueryEx
KERNEL32.dll	1265		VirtualQuery
KERNEL32.dll	1261		VirtualFreeEx
KERNEL32.dll	963		ReadProcessMemory
KERNEL32.dll	1258		VirtualAllocEx
KERNEL32.dll	1264		VirtualProtectEx
KERNEL32.dll	1126		SetFilePointer
KERNEL32.dll	1257		VirtualAlloc
KERNEL32.dll	1260		VirtualFree
KERNEL32.dll	1263		VirtualProtect
KERNEL32.dll	1326		WriteProcessMemory
KERNEL32.dll	221		DeviceIoControl
KERNEL32.dll	896		OpenProcess
KERNEL32.dll	232		DuplicateHandle
KERNEL32.dll	448		GetCurrentProcess
KERNEL32.dll	343		FlushFileBuffers
KERNEL32.dll	447		GetCurrentDirectoryW
KERNEL32.dll	490		GetFileAttributesW
KERNEL32.dll	302		FindClose
KERNEL32.dll	285		ExpandEnvironmentStringsW
KERNEL32.dll	325		FindNextFileW
KERNEL32.dll	497		GetFileSizeEx
KERNEL32.dll	313		FindFirstFileW
KERNEL32.dll	840		LocalFree
KERNEL32.dll	181		CreateThread
KERNEL32.dll	82		CloseHandle
KERNEL32.dll	1217		TerminateThread
KERNEL32.dll	514		GetLastError
KERNEL32.dll	1202		Sleep
KERNEL32.dll	143		CreateFileW
KERNEL32.dll	836		LocalAlloc
KERNEL32.dll	1317		WriteFile
KERNEL32.dll	960		ReadFile
KERNEL32.dll	293		FileTimeToSystemTime

StringTable 040904b0

ProductName	mimikatz
ProductVersion	2.1.1.0
CompanyName	gentilkiwi (Benjamin DELPY)
FileDescription	mimikatz for Windows
FileVersion	2.1.1.0
InternalName	mimikatz
LegalCopyright	Copyright (c) 2007 - 2017 gentilkiwi (Benjamin DELPY)
OriginalFilename	mimikatz.exe
PrivateBuild	Build with love for POC only
SpecialBuild	kiwi flavor !

VS_FIXEDFILEINFO

FileVersion	2.1.1.0
ProductVersion	2.1.1.0
StrucVersion	0x10000
FileFlagsMask	0x3f
FileFlags	0x2a
FileOS	0x40000
FileType	1
FileSubtype	0

show previews

offset	size	type	comment
0	787456	EXE	07/24/2017 06:13:42	#
15c1	15	HTM		#

offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable

Please donate some bucks to keep this site up and running:
Ko-fi
Yandex.Money
Thank you!

everything is OK

mimikatz - Copy.exe-

MZ Header

Rich Header

DOS stub

PE Header

Packer / Compiler

Sections

Data Directory

StringTable 040904b0

VS_FIXEDFILEINFO

mimikatz - Copy.exe
-