MineralXBeta.zip
- SHA256 dfa31982273761cdc1e39d0a5efc52b0be3ecf94c5c15a6ad5adff6d20c2b77c
Behavioral task
behavioral1
Sample
MineralXBeta/MineralX.exe
Resource
win7-20240508-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral2
Sample
MineralXBeta/MineralX.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral3
Sample
MineralXBeta/MineralX.exe
Resource
win7-20240611-en
windows7-x64
1 signatures
150 seconds
Behavioral task
behavioral4
Sample
MineralXBeta/MineralX.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
2 signatures
150 seconds
General
- Target MineralXBeta.zip
- Size 2.0MB
- Sample240615-yshalssgrb
- SHA256 dfa31982273761cdc1e39d0a5efc52b0be3ecf94c5c15a6ad5adff6d20c2b77c
- MD5 67f64bbed8bfa57de22321b5c96e5c51
- SHA1 c50eb9daa1dbedb9a38ff6083099af511bd3bbee
- SHA512 847b338f0053ae3ad10d92508977ee0ce1d56578eac9cf4d8ec290e9b01b6a1152ef06e02ae727f549809ed995a4fbd8deb99d8fb4afe5d90e13e05b9f196ef2
- SSDEEP 49152:jwTcvkUOGOV79Cj20Hy96OUZ9+UvGfnmIDcOaZ7VJ3PKwNf:jwRUOFCC4sUZ9dv2fDcOgPR
- MD5 SHA1 SHA512 SSDEEP
Score
10/10
Malware Config
Signatures
- AgentTesla payload 1 IoCs
resource yara_rule static1/unpack001/MineralXBeta/Guna.UI2.dll family_agenttesla - Agenttesla family
- Unsigned PE 5 IoCs
Checks for missing Authenticode signature.
resource unpack001/MineralXBeta/AnonymeAPI.dll unpack001/MineralXBeta/FastColoredTextBox.dll unpack001/MineralXBeta/MineralX.dll unpack001/MineralXBeta/MineralX.exe unpack001/MineralXBeta/Solara/SolaraBootstrapper.exe
File Explorer
-
MineralXBeta.zip.zip 2.0MB
-
MineralXBeta/AnonymeAPI.dll.dll 5KB
-
MineralXBeta/FastColoredTextBox.dll.dll 302KB
-
MineralXBeta/Guna.UI2.dll.dll 2.1MB
-
MineralXBeta/Microsoft.Web.WebView2.Core.dll.dll 557KB
-
MineralXBeta/Microsoft.Web.WebView2.WinForms.dll.dll 37KB
-
MineralXBeta/Microsoft.Web.WebView2.Wpf.dll.dll 50KB
-
MineralXBeta/MineralX.deps.json4KB
-
MineralXBeta/MineralX.dll.exe 290KB
-
MineralXBeta/MineralX.exe.exe 140KB
-
MineralXBeta/MineralX.pdb17KB
-
MineralXBeta/MineralX.runtimeconfig.json386B
-
MineralXBeta/Solara.lnk.lnk 1KB
-
MineralXBeta/Solara/SolaraBootstrapper.exe.exe 13KB
-
MineralXBeta/Solara/autoexec/newinjector.txt102B
-
MineralXBeta/Solara/scripts/qsdfsdfsdfsdfsdfsdfdsfsdf.txt573B
-
MineralXBeta/Solara/workspace/.tests/appendfile.txt7B
-
MineralXBeta/Solara/workspace/.tests/getcustomasset.txt7B
-
MineralXBeta/Solara/workspace/.tests/isfile.txt7B
-
MineralXBeta/Solara/workspace/.tests/listfiles/test_1.txt7B
-
MineralXBeta/Solara/workspace/.tests/listfiles/test_2.txt7B
-
MineralXBeta/Solara/workspace/.tests/loadfile.txt1B
-
MineralXBeta/Solara/workspace/.tests/readfile.txt7B
-
MineralXBeta/Solara/workspace/.tests/writefile7B
-
MineralXBeta/Solara/workspace/.tests/writefile.txt7B
-
MineralXBeta/Solara/workspace/ClipfipScripts/options.json79B
-
MineralXBeta/Solara/workspace/IY_FE.iy539B
-
MineralXBeta/Solara/workspace/SimpleSpy/Settings.json111B
-
MineralXBeta/Solara/workspace/dex/deps_version.dat40B
-
MineralXBeta/Solara/workspace/dex/rbx_api.dat3.9MB
-
MineralXBeta/Solara/workspace/inject.txt94B
-
MineralXBeta/System.Management.dll.dll 71KB
-
MineralXBeta/runtimes/win-arm64/native/WebView2Loader.dll137KB
-
MineralXBeta/runtimes/win-x64/native/WebView2Loader.dll.dll 161KB
-
MineralXBeta/runtimes/win-x86/native/WebView2Loader.dll.dll 113KB
-
MineralXBeta/runtimes/win/lib/net8.0/System.Management.dll.dll 304KB
MineralXBeta/AnonymeAPI.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 fa67ff8d8fd7553975444d7aca6893a4b42b0dc9d25626862c4e9f6dee4dce76
- MD5 50dbc4f076ec0feec5648db3e09c85eb
- SHA1 466c6c60be0d2a1a0a24832b5a8f1d90392eea66
- SHA512 701762af3caddf7b12a8e7db54e48307f69e2d1cb61e8de0412a18745af26b0cd8290316c9fa4c7f549cb420127911fe050d9d50d532fbf078ae89d04451936f
- SSDEEP 96:Nl6dOdVdeGgCe0JphEv9fXXG9TtVI3gsil7D0jDu:P6dOdVdvgC7pofqVI3gsM7wji
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
11258
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
C:\Users\Dell\Desktop\AnonymeAPI\AnonymeAPI\obj\Debug\AnonymeAPI.pdb
mscoree
_CorDllMain
Name
.text
Size
3KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
904B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
MineralXBeta/FastColoredTextBox.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 5017f2a1475b362c4f20fe70a2dbdbd7f584110e3e9e77567534cd3cb37a8dff
- MD5 5304e194ef0cc5f11d3ea02a69b87b48
- SHA1 b47c6dadc2ebf340f60ecd0232f9348aee4d0b66
- SHA512 1a7f3d64f3ec5b616e13a417fd7375310b5f55922c05c97555a32d373935190e5832c78196865eeeefc5e1b5173cd4701d8074917b6b4ce25c10e7ebf7fc4d26
- SSDEEP 6144:TWnt+7aWtr4/5YaWnmoQyMfdA+i7vHUWNsqmLDkvheNk4MSH:TWnt+7aWi/8m5/dAh7HUk5eNaS
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
314550
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
C:\REPO\Private\FastColoredTextBox\FastColoredTextBox\obj\Release\net6.0-windows\FastColoredTextBox.pdb
mscoree
_CorDllMain
Name
.text
Size
299KB
Virtual Size
299KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
MineralXBeta/Guna.UI2.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 3ac70532408b89159bfe235d4ed228faa03ae3fbd63ec6a82d895f287a3b0579
- MD5 b429ae86c5be521bc8ca3b164cec3acb
- SHA1 387560073ff5a1f2191abc6f75fc34532bbb6dd2
- SHA512 eae65de53da50708983ed8ebf9e1e3dd5f9aea95a354d272e199bb59517f62bfe35f0df7a37d81ab0423d0d6d29304fa70284c731bd54023e446b2c19bacafb1
- SSDEEP 24576:DgWuftU4WrNOA6sM6kXxMfNmnjk/c5NrH0UUoo2QkJXVSItH5ppoO0KzJ6nFwHQL:DA+NOpXm1mnj0cP+DkhMAiawnFV
- MD5 SHA1 SHA512 SSDEEP
-
AgentTesla payload
PE Signature issue
Digest
5e:00:a7:1b:7e:46:57:12:de:98:da:e3:8d:91:ea:26:6d:ef:71:ee
Digest Algorithm
sha1
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Sobatdata Software
Chains
Nov 25, 2023
Subject
CN=Sobatdata Software
Serial Number
7a:98:1b:7d:3e:b4:86:bb:45:84:c4:3c:c9:a8:3f:db
Issuer
CN=Sobatdata Root CA
Timespan
Oct 23, 2019 - Oct 22, 2025
Subject
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Aug 1, 2022 - Nov 9, 2031
Subject
CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US
Serial Number
07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Issuer
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Mar 23, 2022 - Mar 22, 2037
Subject
CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US
Serial Number
05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Issuer
CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jul 14, 2023 - Oct 13, 2034
Minor OS version
0
Major OS version
4
Entry point
2226574
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
mscoree
_CorDllMain
Name
.text
Size
2.1MB
Virtual Size
2.1MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
MineralXBeta/Microsoft.Web.WebView2.Core.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 a1e096c6842b9f443679f47e321379d15e1f93c77fd0b6d32b9eb0e93e25ac89
- MD5 2ab84dc690059b2bd34d2f00561d6af4
- SHA1 49b665b40a5ae995edfec80caf7e409c9795e9dd
- SHA512 80d1c0fbe937655f1e78549c4bdaaa7d8aa55a74945c16f3663fe270c0a715eb7f89dc66490a0164f33444aece768a41e894bdcaa50ce2f88a6dab77b9809afa
- SSDEEP 12288:vClswUBor3lJrpQ322zy+uFKcDoRFNCMmeA+imQ269pRFZNIEJdIEY0lxEIPrEIf:vSjqA
- MD5 SHA1 SHA512 SSDEEP
Digest
54:d7:5f:3a:d9:aa:8d:e0:4f:8a:f5:b0:6d:04:ae:fc:b0:90:c8:c1:e1:3c:04:6d:fa:3c:72:92:9f:7c:a8:82
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Jun 12, 2024
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:03:a5:41:11:e8:f0:7f:be:0b:75:00:00:00:00:03:a5
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Oct 19, 2023 - Oct 16, 2024
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 8, 2011 - Jul 8, 2026
Minor OS version
0
Major OS version
4
Entry point
566574
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
D:\a\_work\1\s\third_party\edge_webview2\win\webview2_api_writer\dotNetAPIWrapper\Microsoft.Web.WebView2.Core\bin\ReleasePackage\Microsoft.Web.WebView2.Core.pdb
mscoree
_CorDllMain
Name
.text
Size
545KB
Virtual Size
545KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
1000B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
MineralXBeta/Microsoft.Web.WebView2.WinForms.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 50f28d5705da825b3fda973b5256f7c5ee33e0679973fbf1bccb5027c3e3311b
- MD5 f91b34b32c3af1516c12188fa9875350
- SHA1 885dba53919d1c4d9ed36bb38ad12c2d5c35a0b3
- SHA512 8dcff5bec01a4bb7428d9d57037e6c8b2e5e3f091e4d433e26bb9c82ac43c7b074d90636a34350455451d7a95300c9de5ba76aa8574f6823b488c0d0ddff8b80
- SSDEEP 768:LsjCEEHJ9l0EeFZ2sxIHTttZDgcEST3p4Jjrjh2jJ+SG2au8vxJKia5/Zi/ZGQKQ:qCEB15aTttZDgcEST3p4JjrjaJ+SG2a3
- MD5 SHA1 SHA512 SSDEEP
Digest
b4:fb:3b:14:11:7a:84:e6:8a:1f:16:df:de:3b:b1:4a:c0:c4:b7:41:93:c2:a3:f9:67:49:e1:1b:7d:8a:f3:14
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Jun 12, 2024
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:03:a5:41:11:e8:f0:7f:be:0b:75:00:00:00:00:03:a5
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Oct 19, 2023 - Oct 16, 2024
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 8, 2011 - Jul 8, 2026
Minor OS version
0
Major OS version
4
Entry point
33598
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
D:\a\_work\1\s\third_party\edge_webview2\win\winforms_control\Microsoft.Web.WebView2.WinForms\obj\Release Stable APIs\netcoreapp3.0\Microsoft.Web.WebView2.WinForms.pdb
mscoree
_CorDllMain
Name
.text
Size
25KB
Virtual Size
24KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
MineralXBeta/Microsoft.Web.WebView2.Wpf.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 744b0e990f9eb292abddbe021f38be86912386207e0fb352a6ec804b61d42d97
- MD5 ffb9d7f6546e00c3a97edcc0ed0091f2
- SHA1 cdf7aa51565725c9efe548ac7258da025a4d8b34
- SHA512 16c1c1a0477c7f7839514783b60cd4759e9ae01e11567820d11234337951cca819475e658026d97df3e6c7277cd575581887c0056cda8cfc8a83a448b375f3c6
- SSDEEP 1536:DpGhWMhWLF9/wKi8LDP/ryEH0GBy4JjrD1aah/UaOzk6hKKa5/Bi/IGCv0Z0T6Pf:saNi8LDP/b0GBy4JjrD1aah/UaOzk6h3
- MD5 SHA1 SHA512 SSDEEP
Digest
f5:ad:ff:d7:e2:15:cd:26:7a:dc:58:65:69:5e:c6:a7:a4:bd:0e:fc:d0:3a:ee:82:af:5c:1f:05:ff:8a:2d:7f
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Jun 12, 2024
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:03:a5:41:11:e8:f0:7f:be:0b:75:00:00:00:00:03:a5
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Oct 19, 2023 - Oct 16, 2024
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 8, 2011 - Jul 8, 2026
Minor OS version
0
Major OS version
4
Entry point
47478
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
D:\a\_work\1\s\third_party\edge_webview2\win\wpf_control\Microsoft.Web.WebView2.Wpf\obj\Release Stable APIs\netcoreapp3.0\Microsoft.Web.WebView2.Wpf.pdb
mscoree
_CorDllMain
Name
.text
Size
38KB
Virtual Size
38KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
984B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
MineralXBeta/MineralX.deps.json
- SHA256 0dd059604f7f9827fdea07ea3c2bb4333d88e34932b80b8d850b54e4337c0381
- MD5 d79756d873d5e90fbcb910d3a45b6b0e
- SHA1 165c981009ec86424ad6d7499317a94ab3634ecf
- SHA512 dc36203d25f996d3c3b593da276acdfe0344068d6736939bf4120a3e129bb2d1cd6b94172e135ae223048df3a81f04692d10a87e602809624e7484cb048e2d93
- SSDEEP 48:BC00qPOHW21EHn+6HrHz/KHp/KHv/K5YiOYldT6WEPpmWEmHr5BHISwRw+HDME8B:C/2FLOg6OurTS9oJjsOGqm5+fkz5SWZT
- MD5 SHA1 SHA512 SSDEEP
MineralXBeta/MineralX.dll
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 816d443c3024029b93d9ab9aaea66b7d6520ce6e53a65eb31f8dd7983a3fefa7
- MD5 f29ad89d86b63d2a03e09efef067196a
- SHA1 41ddfce82a60a8e73c89839d677c08db950d45d9
- SHA512 c358aad516595e377310050cee4bfee727dce9f02414e096578a694f71301d5b2f90d0fbb161d985929f19e77679bec1bda532d0aea5bf1f79bd11516b1db75a
- SSDEEP 6144:NGl9drIYf5735Te1sS661unmOgjtYP125cMSfvpWc0G/Ts2W9rqe+mWvF:NGl9drbR9TeG99gOA5UXpWc0Gw2W9rqj
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
301618
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
C:\Users\User\Downloads\Nexar_X_Source_Code\nexarX\obj\Debug\net8.0-windows7.0\MineralX.pdb
mscoree
_CorExeMain
Name
.text
Size
287KB
Virtual Size
286KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
MineralXBeta/MineralX.exe
- IMPHASH 6a91eb82bfd19d2706c7d43c46f7064e
- SHA256 eb5dc85ca79de1939291c3dde636dba057f64e79bf75d06536e287c8c330e19d
- MD5 30144332d60d901eaa22afa5f48224f7
- SHA1 66d8b50a09a816917dfc77d4a082a59207e189e2
- SHA512 7d699c2e03e70e94828f9abaa0a56b228044f2ddb98975b9e2a2e01bc5dd77d95fa7aa1ee48f4887a317dbdfc3851386054e650697c13cd0426b68f4892234f2
- SSDEEP 3072:7iS4omp03WQthI/9S3BZi08iRQ1G78IVn2ebSkcJ+8ltG:7iS4ompB9S3BZi0a1G78IVhcIct
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
70496
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
D:\a\_work\1\s\artifacts\obj\win-x64.Release\corehost\apphost\standalone\apphost.pdb
kernel32
FreeLibrary
LoadLibraryExW
OutputDebugStringW
FindFirstFileExW
EnterCriticalSection
GetFullPathNameW
FindNextFileW
GetCurrentProcess
GetModuleHandleExW
GetModuleFileNameW
LeaveCriticalSection
GetEnvironmentVariableW
GetModuleHandleW
MultiByteToWideChar
GetFileAttributesExW
LoadLibraryA
DeleteCriticalSection
WideCharToMultiByte
IsWow64Process
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
InitializeCriticalSectionAndSpinCount
GetProcAddress
GetWindowsDirectoryW
FindResourceW
GetLastError
ActivateActCtx
FindClose
CreateActCtxW
SetLastError
RaiseException
RtlPcToFileHeader
RtlUnwindEx
InitializeSListHead
GetCurrentProcessId
IsDebuggerPresent
IsProcessorFeaturePresent
TerminateProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
GetStringTypeW
SwitchToThread
GetCurrentThreadId
InitializeCriticalSectionEx
EncodePointer
DecodePointer
LCMapStringEx
QueryPerformanceCounter
GetSystemTimeAsFileTime
user32
MessageBoxW
shell32
ShellExecuteW
advapi32
RegOpenKeyExW
RegGetValueW
DeregisterEventSource
RegisterEventSourceW
ReportEventW
RegCloseKey
api-ms-win-crt-runtime-l1-1-0
_invalid_parameter_noinfo_noreturn
_exit
exit
_initterm_e
_initterm
_get_initial_wide_environment
_initialize_wide_environment
_configure_wide_argv
_set_app_type
_seh_filter_exe
_cexit
_crt_atexit
_register_onexit_function
_initialize_onexit_table
_errno
abort
__p___wargv
_c_exit
_register_thread_local_exe_atexit_callback
terminate
__p___argc
api-ms-win-crt-stdio-l1-1-0
__acrt_iob_func
fputwc
__p__commode
_set_fmode
fputws
_wfsopen
fflush
__stdio_common_vfwprintf
__stdio_common_vsnwprintf_s
__stdio_common_vswprintf
setvbuf
api-ms-win-crt-heap-l1-1-0
calloc
_set_new_mode
free
_callnewh
malloc
api-ms-win-crt-string-l1-1-0
toupper
_wcsdup
wcsncmp
wcsnlen
strcpy_s
api-ms-win-crt-convert-l1-1-0
wcstoul
_wtoi
api-ms-win-crt-time-l1-1-0
_gmtime64_s
_time64
wcsftime
api-ms-win-crt-locale-l1-1-0
setlocale
___mb_cur_max_func
_configthreadlocale
___lc_codepage_func
___lc_locale_name_func
__pctype_func
_lock_locales
_unlock_locales
api-ms-win-crt-math-l1-1-0
__setusermatherr
Name
.text
Size
90KB
Virtual Size
90KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
37KB
Virtual Size
37KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
2KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
5KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
_RDATA
Size
512B
Virtual Size
500B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
1024B
Virtual Size
792B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=1, productName=Unmarked objects (old),
count=12, id=260, version=33218,
count=18, id=259, version=33218,
count=86, id=261, version=33218,
count=16, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=9, id=257, version=30795,
count=201, id=1, productName=Unmarked objects,
count=10, id=265, version=33523,
count=1, id=258, version=33523,
MineralXBeta/MineralX.pdb
- SHA256 d7e4876a4a7a1d8816bbbec812c2df86c02c6de0bb9182463f4dd30dadc20878
- MD5 d3fb1536ecd22234970a7048dac856cc
- SHA1 f30f9c215f90ec475d9f1ee37c25bc77640eed47
- SHA512 e68b8d905bc03131c8a0811394d28cf7c749aef088c81aa0017dc4ebe4c9210e057953c007ac7202d0a23b2ef491d7fb7b16df08af9ca2ccb4c3b70d1c99c1b7
- SSDEEP 384:70o5PyEPOe7IUqCdfaMsb0xButYiskCd7AiDfCLTDPvBGboIfCIHEfYEABb2h7VP:5PyE2esKkmXigb0BKTzA
- MD5 SHA1 SHA512 SSDEEP
MineralXBeta/MineralX.runtimeconfig.json
- SHA256 e1e0974d0e8833375024eb7c78521b3b5cad4228aad22b23d506cbe702445844
- MD5 186a65581e2f29258f54d396660409fa
- SHA1 6f998d3be2e85cb5419205f867135874f27c0a3a
- SHA512 7dea87b523aab01ea3c794779b71bc0b52179e1d5e7b9a45539ddd39c775969ef22853c4c193699aec1e3fa3cbe26e90e3a4881226c52a3aacae1eac260ff896
- MD5 SHA1 SHA512
MineralXBeta/Solara.lnk
- SHA256 d336ea9f46c51f34c887e5e6fc918c18976e8d70ca28c599a965fc5a70e01ec8
- MD5 03cb69f71881c70814690138efbd6169
- SHA1 4a4c04a8bbc02f94bef51c9d94ad3f565a64c9f7
- SHA512 63b6cb2b8d9633f8583676ac36828b55505b1a3ed39567d8183f11a02bceb9fea6b279b47a6fe41d3c65f898a53885348ccef92af1b74a66723412204a341a56
- MD5 SHA1 SHA512
MineralXBeta/Solara/SolaraBootstrapper.exe
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 a7fecfc225dfdd4e14dcd4d1b4ba1b9f8e4d1984f1cdd8cda3a9987e5d53c239
- MD5 6557bd5240397f026e675afb78544a26
- SHA1 839e683bf68703d373b6eac246f19386bb181713
- SHA512 f2399d34898a4c0c201372d2dd084ee66a66a1c3eae949e568421fe7edada697468ef81f4fcab2afd61eaf97bcb98d6ade2d97295e2f674e93116d142e892e97
- SSDEEP 192:konexQO0FoAWyEfJkVIaqaLHmr/XKT0ifnTJ1jvVXctNjA:HnexHAWyEfJoIaqayzKAifd1LVEj
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
18834
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
C:\Users\Ashtin\Desktop\WTF\SolaraBootstrapper\SolaraBootstrapper\obj\Debug\SolaraBootstrapper.pdb
mscoree
_CorExeMain
Name
.text
Size
10KB
Virtual Size
10KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
MineralXBeta/Solara/autoexec/newinjector.txt
- SHA256 3099eb64c5c4f49022388624f8cb18545e97c885ac66935907818583d70ca073
- MD5 fb4bcbadff658e7d720773012e8bc7f7
- SHA1 f79749149e4f797466fe4ddf131ac34d1bb84134
- SHA512 1f80c488b0be8b88aa78cb064a5f226b8a160478a1605f88746348204e8e863808018e64c679add0095b14bdad487312e0107ffba5e01a32b67be1669ee90eec
- MD5 SHA1 SHA512
MineralXBeta/Solara/scripts/qsdfsdfsdfsdfsdfsdfdsfsdf.txt
- SHA256 58e2971b886918c6cef16f57915dc42aa0ac2e40240456d5d6af201a0c179a40
- MD5 3155f3a1967de4aa9b1e34b3195253cd
- SHA1 1d1c9e34225afdb5440413d7961b45a44621853d
- SHA512 2360200ceb2391138d3459d06163d5ae4e7e08ee67737a309c6f997d8a138cdcb42409a26c68208046c4060ddb187651ebc872fa93b36ca84c095dd5d3ac8e4f
- MD5 SHA1 SHA512
MineralXBeta/Solara/workspace/.tests/appendfile.txt
- SHA256 aee408847d35e44e99430f0979c3357b85fe8dbb4535a494301198adbee85f27
- MD5 260ca9dd8a4577fc00b7bd5810298076
- SHA1 53a5687cb26dc41f2ab4033e97e13adefd3740d6
- SHA512 51e85deb51c2b909a21ec5b8e83b1cb28da258b1be227620105a345a2bd4c6aea549cd5429670f2df33324667b9f623a420b3a0bdbbd03ad48602211e75478a7
- MD5 SHA1 SHA512
MineralXBeta/Solara/workspace/.tests/getcustomasset.txt
- SHA256 aee408847d35e44e99430f0979c3357b85fe8dbb4535a494301198adbee85f27
- MD5 260ca9dd8a4577fc00b7bd5810298076
- SHA1 53a5687cb26dc41f2ab4033e97e13adefd3740d6
- SHA512 51e85deb51c2b909a21ec5b8e83b1cb28da258b1be227620105a345a2bd4c6aea549cd5429670f2df33324667b9f623a420b3a0bdbbd03ad48602211e75478a7
- MD5 SHA1 SHA512
MineralXBeta/Solara/workspace/.tests/isfile.txt
- SHA256 aee408847d35e44e99430f0979c3357b85fe8dbb4535a494301198adbee85f27
- MD5 260ca9dd8a4577fc00b7bd5810298076
- SHA1 53a5687cb26dc41f2ab4033e97e13adefd3740d6
- SHA512 51e85deb51c2b909a21ec5b8e83b1cb28da258b1be227620105a345a2bd4c6aea549cd5429670f2df33324667b9f623a420b3a0bdbbd03ad48602211e75478a7
- MD5 SHA1 SHA512
MineralXBeta/Solara/workspace/.tests/listfiles/test_1.txt
- SHA256 aee408847d35e44e99430f0979c3357b85fe8dbb4535a494301198adbee85f27
- MD5 260ca9dd8a4577fc00b7bd5810298076
- SHA1 53a5687cb26dc41f2ab4033e97e13adefd3740d6
- SHA512 51e85deb51c2b909a21ec5b8e83b1cb28da258b1be227620105a345a2bd4c6aea549cd5429670f2df33324667b9f623a420b3a0bdbbd03ad48602211e75478a7
- MD5 SHA1 SHA512
MineralXBeta/Solara/workspace/.tests/listfiles/test_2.txt
- SHA256 aee408847d35e44e99430f0979c3357b85fe8dbb4535a494301198adbee85f27
- MD5 260ca9dd8a4577fc00b7bd5810298076
- SHA1 53a5687cb26dc41f2ab4033e97e13adefd3740d6
- SHA512 51e85deb51c2b909a21ec5b8e83b1cb28da258b1be227620105a345a2bd4c6aea549cd5429670f2df33324667b9f623a420b3a0bdbbd03ad48602211e75478a7
- MD5 SHA1 SHA512
MineralXBeta/Solara/workspace/.tests/loadfile.txt
- SHA256 252f10c83610ebca1a059c0bae8255eba2f95be4d1d7bcfa89d7248a82d9f111
- MD5 8fa14cdd754f91cc6554c9e71929cce7
- SHA1 4a0a19218e082a343a1b17e5333409af9d98f0f5
- SHA512 711c22448e721e5491d8245b49425aa861f1fc4a15287f0735e203799b65cffec50b5abd0fddd91cd643aeb3b530d48f05e258e7e230a94ed5025c1387bb4e1b
- MD5 SHA1 SHA512
MineralXBeta/Solara/workspace/.tests/readfile.txt
- SHA256 aee408847d35e44e99430f0979c3357b85fe8dbb4535a494301198adbee85f27
- MD5 260ca9dd8a4577fc00b7bd5810298076
- SHA1 53a5687cb26dc41f2ab4033e97e13adefd3740d6
- SHA512 51e85deb51c2b909a21ec5b8e83b1cb28da258b1be227620105a345a2bd4c6aea549cd5429670f2df33324667b9f623a420b3a0bdbbd03ad48602211e75478a7
- MD5 SHA1 SHA512
MineralXBeta/Solara/workspace/.tests/writefile
- SHA256 aee408847d35e44e99430f0979c3357b85fe8dbb4535a494301198adbee85f27
- MD5 260ca9dd8a4577fc00b7bd5810298076
- SHA1 53a5687cb26dc41f2ab4033e97e13adefd3740d6
- SHA512 51e85deb51c2b909a21ec5b8e83b1cb28da258b1be227620105a345a2bd4c6aea549cd5429670f2df33324667b9f623a420b3a0bdbbd03ad48602211e75478a7
- MD5 SHA1 SHA512
MineralXBeta/Solara/workspace/.tests/writefile.txt
- SHA256 aee408847d35e44e99430f0979c3357b85fe8dbb4535a494301198adbee85f27
- MD5 260ca9dd8a4577fc00b7bd5810298076
- SHA1 53a5687cb26dc41f2ab4033e97e13adefd3740d6
- SHA512 51e85deb51c2b909a21ec5b8e83b1cb28da258b1be227620105a345a2bd4c6aea549cd5429670f2df33324667b9f623a420b3a0bdbbd03ad48602211e75478a7
- MD5 SHA1 SHA512
MineralXBeta/Solara/workspace/ClipfipScripts/options.json
- SHA256 5c465a32dc1a755ec17ee9ab67286667139eca668e2c042aa59f2a838dbea964
- MD5 b2e73fd2050c185a87741943774a82f4
- SHA1 60abe99bc73d67273515242a2f9c5de3045f5be8
- SHA512 679b515a9736a383776b8a181b8e16ef69edd34d07301accac333e5996e749cff33a4e80c70427465bc7ed2da0eb1de6bfb50f8ae33480350e15f0cd7b659ab3
- MD5 SHA1 SHA512
MineralXBeta/Solara/workspace/IY_FE.iy
- SHA256 73bb58ba5b81960caf5a8e66675cc89b5761b77db99c6ceb9435f7211d400452
- MD5 291d5636a434c4f1ceb0f3f776c2a51f
- SHA1 ae287e08f71c522a72812f0dace94b8ffb569341
- SHA512 7dab8034f85aef1b2b7a86cc8220ebdbb95a3f083d1565e1cff38414367aa69fc597a11aaba11dbef411e13fbfb285855d9c46ae59738f6e88c22dd55c81a743
- MD5 SHA1 SHA512
MineralXBeta/Solara/workspace/SimpleSpy/Settings.json
- SHA256 7a6d007139606bca836bc2d1f2d98f09f7bee99d539dfe63beaf535bac7f80b9
- MD5 6ec1da5657d2f22ba0d0f4f8325b35b6
- SHA1 589f75e02b3c6f4f68366a2d29ea0072ef966f9a
- SHA512 1b398c8502d4da1dd2264992101b3ff717fa595ffea763cc2726e1b70deeeb3960e3f4c466bc69238415848d77b053f70395ea0fb01a1a378d834d17301a1900
- MD5 SHA1 SHA512
MineralXBeta/Solara/workspace/dex/deps_version.dat
- SHA256 d2e5a78a7045e40b5b1af1d747d280c91a7c502d6af2139bb8c2093d9b6bd8f3
- MD5 f5c0ff24740b6617847debe75d2b3081
- SHA1 44a1286fd91d4976fc515cd23f2acbfb069b2fd8
- SHA512 9f9c9ffcc61807dc46ddbf1dac7245122673bd6786a2646c5ddfcc5e06c4d9813b8bec532ff3f71241610babed2cc073eb6e9a2ba0cf162026bc1a02861b768e
- MD5 SHA1 SHA512
MineralXBeta/Solara/workspace/dex/rbx_api.dat
- SHA256 02276f872886a6bc29e2e05a2e551a8c92c0e1745276520f4203d52a15679856
- MD5 c31c192974d091badb971fde16825795
- SHA1 2d72dace0c277e6c94a361576dea524627b7278a
- SHA512 2267bf393ca8da01a20497fbab8583b4839bc6b7f8cfdbc40707242b78f38c3ae1947e9e4fa8986099ceecdd58017569d0d4144824210a584a5972f4ed76688f
- SSDEEP 3072:dH3MzPTBhlIe9ZMWTyjOQl11g1wPxMIrKCf6ZKgnMj9zgp7VqgT2rwFrGBHOCo80:dkVleRs8TGLczG
- MD5 SHA1 SHA512 SSDEEP
MineralXBeta/Solara/workspace/inject.txt
- SHA256 e0468f2f2928c18af9342e40d6737c00ce516009de9308c2fafb77b3fc561e92
- MD5 b91615faa0cba1e0815b46de7b7b1f24
- SHA1 877bf26be05dba8f8850e7c42a4836cadb493a22
- SHA512 52b7d6af4654c6619484aeb7446acddda1cf68834df767335b9c1002246f5e1aaad93c99cff5ef18b8689ef68338c85619c0b4648da5001aa5ee42f0e5bba0a8
- MD5 SHA1 SHA512
MineralXBeta/System.Management.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 c5f69a258fc609d42e6d50903e9b4449027f4d332faa8daec04bdc3cb9286d4b
- MD5 bfce986befff53f3270f1476bcb11c54
- SHA1 98f67b72cb9c3943c390ca2c00addfe291f1c25b
- SHA512 8e4a59352284f2fa15b6aa7e3af26314569f70245ab7fd3e347b299719f62fbca712b214e2955f1c50ad80d7e0136f08b3230f7f25f462da0e2b16dfdc956b05
- SSDEEP 768:xtppppIpppp4ppppXSsZPk7kUTAvA3DZUm8CT/1dB8eVE9hoQD1kiSLJKdbYx6/H:xhPknOHCT9xK2QD1xS9ycxyiKzR
- MD5 SHA1 SHA512 SSDEEP
PE Signature issue
Digest
b8:96:b4:54:f5:5f:55:38:b2:6f:02:28:c9:f8:a9:f7:3d:7e:2b:9c:c0:7d:8c:3d:6f:f0:8e:5d:e5:99:31:ed
Digest Algorithm
sha256
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Jun 12, 2024
Subject
CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:03:7c:c9:f6:bc:ed:07:59:ae:08:00:00:00:00:03:7c
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
May 11, 2023 - May 8, 2024
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 8, 2011 - Jul 8, 2026
Minor OS version
0
Major OS version
4
Entry point
67318
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
/_/artifacts/obj/System.Management/Release/net8.0/System.Management.pdb
mscoree
_CorDllMain
Name
.text
Size
58KB
Virtual Size
57KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
MineralXBeta/runtimes/win-arm64/native/WebView2Loader.dll
- SHA256 40a7d2f125b30211a5fef4f0e440ec6d71fdda299e2aeb34ff32f943c232182f
- MD5 45e5009b2972d41acfc7f6959584f004
- SHA1 67d7fe4c2561cf9be093e2e37da6047d11ea3f27
- SHA512 a92cbe8fb1afac6defa08a1b43d1bb83ea96f9e882ce5a996da9e5df55708e100635056c5974536c395047f973f19fa90f3e5d72c3a3a81c78208670dbb5ea7a
- SSDEEP 3072:7gpD1l8o58rpoJbMPN6OSBTN0zEtJW6tyup52:Uphl8omrhrzEtJNt2
- MD5 SHA1 SHA512 SSDEEP
MineralXBeta/runtimes/win-x64/native/WebView2Loader.dll
- IMPHASH f6946d311bccc86e2042a388e375de41
- SHA256 e2004ecd9ddebd1bb7edfff5fa62781fe037eca4282c2be3483dc6f78779899c
- MD5 d2033aa3200206b0d44255a36686124e
- SHA1 e34b92f052afc26412298dde95088fd1bdf20c09
- SHA512 e266b16a265262447a7f4e3d2fea99b273976102206a4287e635164f9de7e40a8f9b3548da7a9a412530ca8f65a1a27e4a2c7ad55c05b9b58b78ae3f93703773
- SSDEEP 3072:Wcb8oTTlTRTyiuPThTNTKm81SbbMYSPLNsknZiZ2HZ5AaliiT8jFEtJ57cXS77Xj:WcFTlTRTyiuPThTNTKmFQdhsknZiMHSk
- MD5 SHA1 SHA512 SSDEEP
Digest
91:d5:76:b5:70:67:38:de:13:42:4f:d7:e3:ba:32:9e:4f:cf:f0:8e:b7:95:fa:6d:98:99:29:80:84:ba:db:0c
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Jun 12, 2024
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:03:a5:41:11:e8:f0:7f:be:0b:75:00:00:00:00:03:a5
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Oct 19, 2023 - Oct 16, 2024
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 8, 2011 - Jul 8, 2026
Minor OS version
0
Major OS version
10
Entry point
17984
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
D:\a\_work\e\src\out\Release_x64\WebView2Loader.dll.pdb
kernel32
AcquireSRWLockExclusive
CloseHandle
CreateFileW
DeleteCriticalSection
EncodePointer
EnterCriticalSection
ExitProcess
FindClose
FindFirstFileExW
FindNextFileW
FlsAlloc
FlsFree
FlsGetValue
FlsSetValue
FlushFileBuffers
FreeEnvironmentStringsW
FreeLibrary
GetACP
GetCPInfo
GetCommandLineA
GetCommandLineW
GetConsoleMode
GetConsoleOutputCP
GetCurrentProcess
GetCurrentProcessId
GetCurrentThreadId
GetEnvironmentStringsW
GetEnvironmentVariableW
GetFileAttributesW
GetFileType
GetLastError
GetModuleFileNameW
GetModuleHandleExW
GetModuleHandleW
GetOEMCP
GetProcAddress
GetProcessHeap
GetStartupInfoW
GetStdHandle
GetStringTypeW
GetSystemInfo
GetSystemTimeAsFileTime
HeapAlloc
HeapFree
HeapReAlloc
HeapSize
InitializeCriticalSectionAndSpinCount
InitializeSListHead
InterlockedFlushSList
IsDebuggerPresent
IsProcessorFeaturePresent
IsValidCodePage
LCMapStringW
LeaveCriticalSection
LoadLibraryExA
LoadLibraryExW
LoadLibraryW
MultiByteToWideChar
OutputDebugStringA
OutputDebugStringW
QueryPerformanceCounter
RaiseException
ReleaseSRWLockExclusive
RtlCaptureContext
RtlLookupFunctionEntry
RtlPcToFileHeader
RtlUnwindEx
RtlVirtualUnwind
SetFilePointerEx
SetLastError
SetStdHandle
SetUnhandledExceptionFilter
SleepConditionVariableSRW
TerminateProcess
TlsAlloc
TlsFree
TlsGetValue
TlsSetValue
UnhandledExceptionFilter
VirtualProtect
VirtualQuery
WakeAllConditionVariable
WideCharToMultiByte
WriteConsoleW
WriteFile
CompareBrowserVersions
CreateCoreWebView2Environment
CreateCoreWebView2EnvironmentWithOptions
GetAvailableCoreWebView2BrowserVersionString
GetAvailableCoreWebView2BrowserVersionStringWithOptions
Name
.text
Size
87KB
Virtual Size
86KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
45KB
Virtual Size
45KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
3KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
5KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.gxfg
Size
4KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.retplne
Size
512B
Virtual Size
140B
Characteristics
Name
.tls
Size
512B
Virtual Size
9B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
_RDATA
Size
512B
Virtual Size
500B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
MineralXBeta/runtimes/win-x86/native/WebView2Loader.dll
- IMPHASH 72229ff546c74d09d9030ca49ce61b31
- SHA256 256510c2872a3a96a8e0a7db0db6c6e7b31ebed34cd6b7c430712ca640c73842
- MD5 df6b6e71cb65552cd9fb283b91ef9908
- SHA1 e10f9cccaa4666f070db8209fb99f6fcaf9d9075
- SHA512 80561a65c7dc7dee4517240718d85ffa59782fb8c5be744862d041759db8fd818fefcdeff87a98f904ded0674b873e7f39b1e53d549aab96ff15a88cc85c93a0
- SSDEEP 3072:VJ7FfqJR70vRq2KVsCKKa/gqeNZ/TcxEtJlAlpAIgr4fmzk:V7fqJRQY0RKDAEtJeTEr2m4
- MD5 SHA1 SHA512 SSDEEP
Digest
d2:a1:98:4b:0f:32:93:2f:0a:17:7f:c3:21:1b:97:b3:4a:a4:04:7d:4e:c6:a3:c1:9f:50:8e:9a:36:f0:17:22
Digest Algorithm
sha256
PE Digests Matches
Trusted
Signing Certificate
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Jun 12, 2024
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Subject
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:03:a4:cb:e3:56:b8:cb:7f:e4:27:00:00:00:00:03:a4
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Oct 19, 2023 - Oct 16, 2024
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 8, 2011 - Jul 8, 2026
Minor OS version
0
Major OS version
10
Entry point
16000
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
PDB paths
D:\a\_work\e\src\out\Release\WebView2Loader.dll.pdb
kernel32
AcquireSRWLockExclusive
CloseHandle
CreateFileW
DecodePointer
DeleteCriticalSection
EncodePointer
EnterCriticalSection
ExitProcess
FindClose
FindFirstFileExW
FindNextFileW
FlushFileBuffers
FreeEnvironmentStringsW
FreeLibrary
GetACP
GetCPInfo
GetCommandLineA
GetCommandLineW
GetConsoleMode
GetConsoleOutputCP
GetCurrentProcess
GetCurrentProcessId
GetCurrentThreadId
GetEnvironmentStringsW
GetEnvironmentVariableW
GetFileAttributesW
GetFileType
GetLastError
GetModuleFileNameW
GetModuleHandleExW
GetModuleHandleW
GetOEMCP
GetProcAddress
GetProcessHeap
GetStartupInfoW
GetStdHandle
GetStringTypeW
GetSystemInfo
GetSystemTimeAsFileTime
HeapAlloc
HeapFree
HeapReAlloc
HeapSize
InitializeCriticalSectionAndSpinCount
InitializeSListHead
InterlockedFlushSList
IsDebuggerPresent
IsProcessorFeaturePresent
IsValidCodePage
LCMapStringW
LeaveCriticalSection
LoadLibraryExA
LoadLibraryExW
LoadLibraryW
MultiByteToWideChar
OutputDebugStringA
OutputDebugStringW
QueryPerformanceCounter
RaiseException
ReleaseSRWLockExclusive
RtlUnwind
SetFilePointerEx
SetLastError
SetStdHandle
SetUnhandledExceptionFilter
SleepConditionVariableSRW
TerminateProcess
TlsAlloc
TlsFree
TlsGetValue
TlsSetValue
UnhandledExceptionFilter
VirtualProtect
VirtualQuery
WakeAllConditionVariable
WideCharToMultiByte
WriteConsoleW
WriteFile
CompareBrowserVersions
CreateCoreWebView2Environment
CreateCoreWebView2EnvironmentWithOptions
GetAvailableCoreWebView2BrowserVersionString
GetAvailableCoreWebView2BrowserVersionStringWithOptions
Name
.text
Size
63KB
Virtual Size
63KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
29KB
Virtual Size
29KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
2KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.tls
Size
512B
Virtual Size
9B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
5KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
MineralXBeta/runtimes/win/lib/net8.0/System.Management.dll
- IMPHASH dae02f32a21e03ce65412f6e56942daa
- SHA256 b2d6e7e991dc9ef154b29f4966f04fd8ed4ebb2c1d1242ea1d5f3e90f8ae5143
- MD5 e1422b4c04b923dcfe00a55290dc18a6
- SHA1 0609ecde6bc8a87f88bc32b98d19800ff19529b6
- SHA512 297f54fceeb0cde17745323e7c41fea830a376fe9c3cf92a692c48199c0a05f1533a3045fd9c6d21352d084aa9ccec7b6cf630c7df49b52ed4025ae156509a7c
- SSDEEP 6144:9q4+FutZbJcMFEG3LbPhmlmsUwHdYhJkXUXewcn:j+FutZbJcMFEG3/KmFwHdKIUXmn
- MD5 SHA1 SHA512 SSDEEP
PE Signature issue
Digest
49:77:8d:dc:15:13:5f:8d:f7:74:af:cd:a0:90:66:08:03:f3:bf:ee:4b:1b:24:2b:69:b4:8c:4e:9f:11:64:aa
Digest Algorithm
sha256
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Chains
Jun 12, 2024
Subject
CN=.NET,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
33:00:00:03:7b:a1:0a:3e:cb:66:e9:01:c0:00:00:00:00:03:7b
Issuer
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
May 11, 2023 - May 8, 2024
Subject
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Serial Number
61:0e:90:d2:00:00:00:00:00:03
Issuer
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Jul 8, 2011 - Jul 8, 2026
Minor OS version
0
Major OS version
4
Entry point
306366
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
/_/artifacts/obj/System.Management/Release/net8.0-windows/System.Management.pdb
mscoree
_CorDllMain
Name
.text
Size
291KB
Virtual Size
291KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
2KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ