CmdID

CmdID / Files

mimidrv.sys

mimidrv for Windows (mimikatz) file version info

Driver on Windows LOLDrivers malicious 2 Sigma rules name it

A known malicious driver

from LOLDrivers
T1068Exploitation for Privilege Escalation
Its entryhttps://www.loldrivers.io/drivers/87752fb8-e9f6-4235-91e2-c4343677d817/

147 known samples

Show the 147 samples’ SHA-256 hashes

2.2.0.0 · its entry

07beac65e28ee124f1da354293a3d6ad7250ed1ce29b8342acfd22252548a5af

2.2.0.0 · its entry

082a79311da64b6adc3655e79aa090a9262acaac3b917a363b9571f520a17f6a

2.2.0.0 · its entry

083f821d90e607ed93221e71d4742673e74f573d0755a96ad17d1403f65a2254

2.2.0.0 · its entry

0f98492c92e35042b09032e3d9aedc357e4df94fc840217fa1091046f9248a06

2.2.0.0 · its entry

10ad50fcb360dcab8539ea322aaf2270565dc835b7535790937348523d723d6b

2.2.0.0 · its entry

12b0000698b79ea3c8178b9e87801cc34bad096a151a8779559519deafd4e3f0

2.2.0.0 · its entry

19dfacea1b9f19c0379f89b2424ceb028f2ce59b0db991ba83ae460027584987

2.2.0.0 · its entry

1a5c08d40a5e73b9fe63ea5761eaec8f41d916ca3da2acbc4e6e799b06af5524

2.2.0.0 · its entry

1d23ab46ad547e7eef409b40756aae9246fbdf545d13946f770643f19c715e80

2.2.0.0 · its entry

200f98655d1f46d2599c2c8605ebb7e335fee3883a32135ca1a81e09819bc64a

2.2.0.0 · its entry

2456a7921fa8ab7b9779e5665e6b42fccc019feb9e49a9a28a33ec0a4bb323c4

2.2.0.0 · its entry

26ef7b27d1afb685e0c136205a92d29b1091e3dcf6b7b39a4ec03fbbdb57cb55

2.2.0.0 · its entry

31b66a57fae0cc28a6a236d72a35c8b6244f997e700f9464f9cbf800dbf8bee6

2.2.0.0 · its entry

3ca5d47d076e99c312578ef6499e1fa7b9db88551cfc0f138da11105aca7c5e1

2.2.0.0 · its entry

406b844f4b5c82caf26056c67f9815ad8ecf1e6e5b07d446b456e5ff4a1476f9

2.2.0.0 · its entry

4136f1eb11cc463a858393ea733d5f1c220a3187537626f7f5d63eccf7c5a03f

2.2.0.0 · its entry

41ad660820c41fc8b1860b13dc1fea8bc8cb2faceb36ed3e29d40d28079d2b1f

2.2.0.0 · its entry

492113a223d6a3fc110059fe46a180d82bb8e002ef2cd76cbf0c1d1eb8243263

2.2.0.0 · its entry

4b97d63ebdeda6941bb8cef5e94741c6cca75237ca830561f2262034805f0919

2.2.0.0 · its entry

4bd4715d2a7af627da11513e32fab925c872babebdb7ff5675a75815fbf95021

2.2.0.0 · its entry

4c89c907b7525b39409af1ad11cc7d2400263601edafc41c935715ef5bd145de

2.2.0.0 · its entry

4d42678df3917c37f44a1506307f1677b9a689efcf350b1acce7e6f64b514905

2.2.0.0 · its entry

569fe70bedd0df8585689b0e88ad8bd0544fdf88b9dbfc2076f4bdbcf89c28aa

2.2.0.0 · its entry

704c6ffe786bc83a73fbdcd2edd50f47c3b5053da7da6aa4c10324d389a31db4

2.2.0.0 · its entry

793b78e70b3ae3bb400c5a8bc4d2d89183f1d7fc70954aed43df7287248b6875

2.2.0.0 · its entry

7b846b0a717665e4d9fb313f25d1f6a5b782e495387aea45cf87ad3c049ac0db

2.2.0.0 · its entry

80e4c83cfa9d675a6746ab846fa5da76d79e87a9297e94e595a2d781e02673b3

2.2.0.0 · its entry

85b9d7344bf847349b5d58ebe4d44fd63679a36164505271593ef1076aa163b2

2.2.0.0 · its entry

8b32fc8b15363915605c127ccbf5cbe71778f8dfbf821a25455496e969a01434

2.2.0.0 · its entry

93aa3066ae831cdf81505e1bc5035227dc0e8f06ebbbb777832a17920c6a02fe

2.2.0.0 · its entry

94c71954ac0b1fd9fa2bd5c506a16302100ba75d9f84f39ee9b333546c714601

2.2.0.0 · its entry

95e5b5500e63c31c6561161a82f7f9373f99b5b1f54b018c4866df4f2a879167

2.2.0.0 · its entry

9a42fa1870472c38a56c0a70f62e57a3cdc0f5bc142f3a400d897b85d65800ac

2.2.0.0 · its entry

9e56e96df36237e65b3d7dbc490afdc826215158f6278cd579c576c4b455b392

2.2.0.0 · its entry

a0931e16cf7b18d15579e36e0a69edad1717b07527b5407f2c105a2f554224b2

2.2.0.0 · its entry

a1e6b431534258954db07039117b3159e889c6b9e757329bbd4126383c60c778

2.2.0.0 · its entry

a7a665a695ec3c0f862a0d762ad55aff6ce6014359647e7c7f7e3c4dc3be81b7

2.2.0.0 · its entry

aaf04d89fd15bc61265e545f8e1da80e20f59f90058ed343c62ee24358e3af9e

2.2.0.0 · its entry

ac5fb90e88d8870cd5569e661bea98cf6b001d83ab7c65a5196ea3743146939a

2.2.0.0 · its entry

b0a27ac1a8173413de13860d2b2e34cb6bc4d1149f94b62d319042e11d8b004c

2.2.0.0 · its entry

b0b80a11802b4a8ca69c818a03e76e7ef57c2e293de456439401e8e6073f8719

2.2.0.0 · its entry

bc49cb96f3136c3e552bf29f808883abb9e651040415484c1736261b52756908

2.2.0.0 · its entry

c42c1e5c3c04163bf61c3b86b04a5ec7d302af7e254990cef359ac80474299da

2.2.0.0 · its entry

c4f041de66ec8cc5ab4a03bbc46f99e073157a4e915a9ab4069162de834ffc5c

2.2.0.0 · its entry

cf9451c9ccc5509b9912965f79c2b95eb89d805b2a186d7521d3a262cf5a7a37

2.2.0.0 · its entry

d032001eab6cad4fbef19aab418650ded00152143bd14507e17d62748297c23f

2.2.0.0 · its entry

d37996abc8efb29f1ccbb4335ce9ba9158bec86cc4775f0177112e87e4e3be5c

2.2.0.0 · its entry

d43520128871c83b904f3136542ea46644ac81a62d51ae9d3c3a3f32405aad96

2.2.0.0 · its entry

e8ec06b1fa780f577ff0e8c713e0fd9688a48e0329c8188320f9eb62dfc0667f

2.2.0.0 · its entry

e99580e25f419b5ad90669e0c274cf63d30efa08065d064a863e655bdf77fb59

2.2.0.0 · its entry

ee525b90053bb30908b5d7bf4c5e9b8b9d6b7b5c9091a26fa25d30d3ad8ef5d0

2.2.0.0 · its entry

ee7b8eb150df2788bb9d5fe468327899d9f60d6731c379fd75143730a83b1c55

2.2.0.0 · its entry

efa56907b9d0ec4430a5d581f490b6b9052b1e979da4dab6a110ab92e17d4576

2.2.0.0 · its entry

f03f0fb3a26bb83e8f8fa426744cf06f2e6e29f5220663b1d64265952b8de1a1

2.2.0.0 · its entry

f6157e033a12520c73dcedf8e49cd42d103e5874c34d6527bb9de25a5d26e5ad

2.2.0.0 · its entry

f9b01406864ab081aa77eef4ad15cb2dd2f830d1ef54f52622a59ff1aeb05ba5

2.1.1.0 · its entry

008fa89822b7a1f91e5843169083202ea580f7b06eb6d5cae091ba844d035f25

2.1.1.0 · its entry

02ebf848fa618eba27065db366b15ee6629d98f551d20612ac38b9f655f37715

2.1.1.0 · its entry

21617210249d2a35016e8ca6bd7a1edda25a12702a2294d56010ee8148637f5a

2.1.1.0 · its entry

2ce4f8089b02017cbe86a5f25d6bc69dd8b6f5060c918a64a4123a5f3be1e878

2.1.1.0 · its entry

40556dd9b79b755cc0b48d3d024ceb15bd2c0e04960062ab2a85cd7d4d1b724a

2.1.1.0 · its entry

443c0ba980d4db9213b654a45248fd855855c1cc81d18812cae9d16729ff9a85

2.1.1.0 · its entry

60ee78a2b070c830fabb54c6bde0d095dff8fad7f72aa719758b3c41c72c2aa9

2.1.1.0 · its entry

6964a5d85639baee288555797992861232e75817f93028b50b8c6d34aa38b05b

2.1.1.0 · its entry

7662187c236003308a7951c2f49c0768636c492f8935292d02f69e59b01d236d

2.1.1.0 · its entry

773b4a1efb9932dd5116c93d06681990759343dfe13c0858d09245bc610d5894

2.1.1.0 · its entry

8206ce9c42582ac980ff5d64f8e3e310bc2baa42d1a206dd831c6ab397fbd8fe

2.1.1.0 · its entry

82ac05fefaa8c7ee622d11d1a378f1d255b647ab2f3200fd323cc374818a83f2

2.1.1.0 · its entry

8b30b2dc36d5e8f1ffc7281352923773fb821cdf66eb6516f82c697a524b599b

2.1.1.0 · its entry

a85d3fd59bb492a290552e5124bfe3f9e26a3086d69d42ccc44737b5a66673ec

2.1.1.0 · its entry

aafa642ca3d906138150059eeddb6f6b4fe9ad90c6174386cfe13a13e8be47d9

2.1.1.0 · its entry

b2486f9359c94d7473ad8331b87a9c17ca9ba6e4109fd26ce92dff01969eaa09

2.1.1.0 · its entry

beef40f1b4ce0ff2ee5c264955e6b2a0de6fe4089307510378adc83fad77228b

2.1.1.0 · its entry

c7cd14c71bcac5420872c3d825ff6d4be6a86f3d6a8a584f1a756541efff858e

2.1.1.0 · its entry

d41e39215c2c1286e4cd3b1dc0948adefb161f22bc3a78756a027d41614ee4ff

2.1.1.0 · its entry

d7aa8abdda8a68b8418e86bef50c19ef2f34bc66e7b139e43c2a99ab48c933be

2.1.1.0 · its entry

e858de280bd72d7538386a73e579580a6d5edba87b66b3671dc180229368be19

2.1.1.0 · its entry

e8743094f002239a8a9d6d7852c7852e0bb63cd411b007bd8c194bcba159ef15

2.1.1.0 · its entry

ec96b15ce218f97ec1d8f07f13b052d274c4c8438f31daf246ccfaaee5e1bebd

2.1.1.0 · its entry

fefc070a5f6a9c0415e1c6f44512a33e8d163024174b30a61423d00d1e8f9bf2

2.1.0.0 · its entry

0740359baef32cbb0b14a9d1bd3499ea2e770ff9b1c85898cfac8fd9aca4fa39

2.1.0.0 · its entry

0aab2deae90717a8876d46d257401d265cf90a5db4c57706e4003c19eee33550

2.1.0.0 · its entry

0f7bfa10075bf5c193345866333d415509433dbfe5a7d45664b88d72216ff7c3

2.1.0.0 · its entry

14b89298134696f2fd1b1df0961d36fa6354721ea92498a349dc421e79447925

2.1.0.0 · its entry

15cf366f7b3ee526db7ce2b5253ffebcbfaa4f33a82b459237c049f854a97c0c

2.1.0.0 · its entry

1ef7afea0cf2ef246ade6606ef8b7195de9cd7a3cd7570bff90ba1e2422276f6

2.1.0.0 · its entry

26bea3b3ab2001d91202f289b7e41499d810474607db7a0893ceab74f5532f47

2.1.0.0 · its entry

29348ebe12d872c5f40e316a0043f7e5babe583374487345a79bad0ba93fbdfe

2.1.0.0 · its entry

2da2b883e48e929f5365480d487590957d9e6582cc6da2c0b42699ba85e54fe2

2.1.0.0 · its entry

36c65aeb255c06898ffe32e301030e0b74c8bca6fe7be593584b8fdaacd4e475

2.1.0.0 · its entry

3b2cd65a4fbdd784a6466e5196bc614c17d1dbaed3fd991d242e3be3e9249da6

2.1.0.0 · its entry

469713c76c7a887826611b8c7180209a8bb6250f91d0f1eb84ac4d450ef15870

2.1.0.0 · its entry

4999541c47abd4a7f2a002c180ae8d31c19804ce538b85870b8db53d3652862b

2.1.0.0 · its entry

4af8192870afe18c77381dfaf8478f8914fa32906812bb53073da284a49ae4c7

2.1.0.0 · its entry

4bca0a401b364a5cc1581a184116c5bafa224e13782df13272bc1b748173d1be

2.1.0.0 · its entry

51805bb537befaac8ce28f2221624cb4d9cefdc0260bc1afd5e0bc97bf1f9f93

2.1.0.0 · its entry

5295080de37d4838e15dec4e3682545033d479d3d9ac28d74747c086559fb968

2.1.0.0 · its entry

52f3905bbd97dcd2dbd22890e5e8413b9487088f1ee2fa828030a6a45b3975fd

2.1.0.0 · its entry

618b15970671700188f4102e5d0638184e2723e8f57f7e917fa49792daebdadb

2.1.0.0 · its entry

62036cdf3663097534adf3252b921eed06b73c2562655eae36b126c7d3d83266

2.1.0.0 · its entry

62764ddc2dce74f2620cd2efd97a2950f50c8ac5a1f2c1af00dc5912d52f6920

2.1.0.0 · its entry

64d4370843a07e25d4ceb68816015efcaeca9429bb5bb692a88e615b48c7da96

2.1.0.0 · its entry

673bbc7fa4154f7d99af333014e888599c27ead02710f7bc7199184b30b38653

2.1.0.0 · its entry

69866557566c59772f203c11f5fba30271448e231b65806a66e48f41e3804d7f

2.1.0.0 · its entry

6d68d8a71a11458ddf0cbb73c0f145bee46ef29ce03ad7ece6bd6aa9d31db9b7

2.1.0.0 · its entry

818787057fc60ac8b957aa37d750aa4bace8e6a07d3d28b070022ee6dcd603ab

2.1.0.0 · its entry

822982c568b6f44b610f8dc4ab5d94795c33ae08a6a608050941264975c1ecdb

2.1.0.0 · its entry

82b7fa34ad07dbf9afa63b2f6ed37973a1b4fe35dee90b3cf5c788c15c9f08f7

2.1.0.0 · its entry

8684aec77b4c3cafc1a6594de7e95695fa698625d4206a6c4b201875f76a5b38

2.1.0.0 · its entry

897f2bbe81fc3b1ae488114b93f3eb0133a85678d061c7a6f718507971f33736

2.1.0.0 · its entry

9dc7beb60a0a6e7238fc8589b6c2665331be1e807b4d2b3ddd1c258dbbd3e2f7

2.1.0.0 · its entry

a32dc2218fb1f538fba33701dfd9ca34267fda3181e82eb58b971ae8b78f0852

2.1.0.0 · its entry

a42f4ae69b8755a957256b57eb3d319678eab81705f0ffea0d649ace7321108f

2.1.0.0 · its entry

a78c9871da09fab21aec9b88a4e880f81ecb1ed0fa941f31cc2f041067e8e972

2.1.0.0 · its entry

af4f42197f5ce2d11993434725c81ecb6f54025110dedf56be8ffc0e775d9895

2.1.0.0 · its entry

b34e2d9f3d4ef59cf7af18e17133a6a06509373e69e33c8eecb2e30501d0d9e4

2.1.0.0 · its entry

b8c71e1844e987cd6f9c2baf28d9520d4ccdd8593ce7051bb1b3c9bf1d97076a

2.1.0.0 · its entry

bcb774b6f6ff504d2db58096601bc5cb419c169bfbeaa3af852417e87d9b2aa0

2.1.0.0 · its entry

c4c9c84b211899ceb0d18a839afa497537a7c7c01ab481965a09788a9e16590c

2.1.0.0 · its entry

c4fb31e3f24e40742a1b9855a2d67048fe64b26d8d2dbcec77d2d5deeded2bcc

2.1.0.0 · its entry

c7bccc6f38403def4690e00a0b31eda05973d82be8953a3379e331658c51b231

2.1.0.0 · its entry

c8ae217860f793fce3ad0239d7b357dba562824dd7177c9d723ca4d4a7f99a12

2.1.0.0 · its entry

d50cb5f4b28c6c26f17b9d44211e515c3c0cc2c0c4bf24cd8f9ed073238053ad

2.1.0.0 · its entry

ddf427ce55b36db522f638ba38e34cd7b96a04cb3c47849b91e7554bfd09a69a

2.1.0.0 · its entry

e4b2c0aa28aac5e197312a061b05363e2e0387338b28b23272b5b6659d29b1d8

2.1.0.0 · its entry

f3ec3f22639d45b3c865bb1ed7622db32e04e1dbc456298be02bf1f3875c3aac

2.0.0.0 · its entry

06ddf49ac8e06e6b83fccba1141c90ea01b65b7db592c54ffe8aa6d30a75c0b8

2.0.0.0 · its entry

07759750fbb93c77b5c3957c642a9498fcff3946a5c69317db8d6be24098a4a0

2.0.0.0 · its entry

087270d57f1626f29ba9c25750ca19838a869b73a1f71af50bdf37d6ff776212

2.0.0.0 · its entry

0d676baac43d9e2d05b577d5e0c516fba250391ab0cb11232a4b17fd97a51e35

2.0.0.0 · its entry

0f58e09651d48d2b1bcec7b9f7bb85a2d1a7b65f7a51db281fe0c4f058a48597

2.0.0.0 · its entry

28f5aa194a384680a08c0467e94a8fc40f8b0f3f2ac5deb42e0f51a80d27b553

2.0.0.0 · its entry

2fd43a749b5040ebfafd7cdbd088e27ef44341d121f313515ebde460bf3aaa21

2.0.0.0 · its entry

30e083cd7616b1b969a92fd18cf03097735596cce7fcf3254b2ca344e526acc2

2.0.0.0 · its entry

4dc24fd07f8fb854e685bc540359c59f177de5b91231cc44d6231e33c9e932b1

2.0.0.0 · its entry

627e13da6a45006fff4711b14754f9ccfac9a5854d275da798a22f3a68dd1eaa

2.0.0.0 · its entry

7824931e55249a501074a258b4f65cd66157ee35672ba17d1c0209f5b0384a28

2.0.0.0 · its entry

94ba4bcbdb55d6faf9f33642d0072109510f5c57e8c963d1a3eb4f9111f30112

2.0.0.0 · its entry

a74e8f94d2c140646a8bb12e3e322c49a97bd1b8a2e4327863d3623f43d65c66

2.0.0.0 · its entry

a906251667a103a484a6888dca3e9c8c81f513b8f037b98dfc11440802b0d640

2.0.0.0 · its entry

b169a5f643524d59330fafe6e3e328e2179fc5116ee6fae5d39581467d53ac03

2.0.0.0 · its entry

baf7fbc4743a81eb5e4511023692b2dfdc32ba670ba3e4ed8c09db7a19bd82d3

2.0.0.0 · its entry

bcca03ce1dd040e67eb71a7be0b75576316f0b6587b2058786fda8b6f0a5adfd

2.0.0.0 · its entry

dfc80e0d468a2c115a902aa332a97e3d279b1fc3d32083e8cf9a4aadf3f54ad1

2.0.0.0 · its entry

eab9b5b7e5fab1c2d7d44cd28f13ae8bb083d9362d2b930d43354a3dfd38e05a

its entry

2faf95a3405578d0e613c8d88d534aa7233da0a6217ce8475890140ab8fb33c8

its entry

af7ca247bf229950fb48674b21712761ac650d33f13a4dca44f61c59f4c9ac46

From LOLDrivers (Apache 2.0). A driver is known by its hash: a sample under another name is the same driver. In Ceplin, "<sha256>".whatis() says which sample a hash is.

Is it the real mimidrv.sys?

file version info and known copies
Productmimidrv (mimikatz), gentilkiwi (Benjamin DELPY)
Descriptionmimidrv for Windows (mimikatz)

From the file’s version info, as recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look.

What detects it

Sigma

Sigma names mimidrv.sys in 2 rules, for every kind of event; none is a process creation rule CmdID evaluates, so none is listed.