Rainmeter-4[.]5[.]18[.]exe

resource
unpack001/$PLUGINSDIR/LangDLL.dll
unpack001/$PLUGINSDIR/MoreInfo.dll
unpack001/$PLUGINSDIR/System.dll
unpack001/$PLUGINSDIR/UAC.dll
unpack001/$PLUGINSDIR/UserInfo.dll
unpack001/$PLUGINSDIR/nsDialogs.dll
unpack001/Plugins/ActionTimer.dll
unpack001/Plugins/AdvancedCPU.dll
unpack001/Plugins/AudioLevel.dll
unpack001/Plugins/CoreTemp.dll
unpack001/Plugins/FileView.dll
unpack001/Plugins/FolderInfo.dll
unpack001/Plugins/InputText.dll
unpack001/Plugins/PerfMon.dll
unpack001/Plugins/PingPlugin.dll
unpack001/Plugins/PowerPlugin.dll
unpack001/Plugins/QuotePlugin.dll
unpack001/Plugins/ResMon.dll
unpack001/Plugins/RunCommand.dll
unpack001/Plugins/SpeedFanPlugin.dll
unpack001/Plugins/UsageMonitor.dll
unpack001/Plugins/Win7AudioPlugin.dll
unpack001/Plugins/WindowMessagePlugin.dll
unpack001/Plugins/iTunesPlugin.dll

Rainmeter-4.5.18.exe

IMPHASH 61259b55b8912888e90f516ca08dc514
SHA256 5ac959e5dee9884512f4a34623bbad2c08be427669015b917a750f7cbfbb0a75
MD5 e2d2743839d187982e9c602575efc48c
SHA1 e5b6808770e6bca105c1616e31015160725f855e
SHA512 941936885ee61bcda2d0623a660d5532adecd66d7ee506650d33c5236e15f01dd0689ebab2ebf4f1935bf48f88d0c2579af800602602542521fe349b291d9878
SSDEEP 49152:mQ5YRSuP59wVHUY1jLjTwtuXUaLEikcepufsJvHtgomcyC5eieKalFvv+Xg8V:m7Ss9wVHUCY8TIPC34eieKa/8NV
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Digest

95:86:e7:9e:42:18:44:84:db:f4:e4:c7:59:c5:68:20:c8:75:38:be:3c:e7:6a:7d:c5:e0:3a:59:40:47:99:6c

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Firebit OU,OU=IT,O=Firebit OU,POSTALCODE=15551,STREET=Sepapaja tn 6,L=Tallinn,ST=Harjumaa,C=EE

Chains

Jul 31, 2023

CN=Firebit OU,OU=IT,O=Firebit OU,POSTALCODE=15551,STREET=Sepapaja tn 6,L=Tallinn,ST=Harjumaa,C=EE

CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

PE Signature issue

Digest

79:ba:ff:80:75:37:41:41:b1:7e:60:e7:57:ae:15:4f:2e:3b:c2:3b

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Firebit OU,OU=IT,O=Firebit OU,POSTALCODE=15551,STREET=Sepapaja tn 6,L=Tallinn,ST=Harjumaa,C=EE

Chains

Jun 10, 2024

Subject

CN=Firebit OU,OU=IT,O=Firebit OU,POSTALCODE=15551,STREET=Sepapaja tn 6,L=Tallinn,ST=Harjumaa,C=EE

Serial Number

d6:aa:3c:89:1f:c2:cb:dd:7e:18:52:57:e9:22:70:1a

Issuer

CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jan 28, 2021 - Jan 28, 2024

Subject

CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Serial Number

1d:a2:48:30:6f:9b:26:18:d0:82:e0:96:7d:33:d3:6a

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning, ExtKeyUsageTimeStamping

Timespan

Nov 2, 2018 - Dec 31, 2030

Subject

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Serial Number

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

May 2, 2019 - Jan 18, 2038

Subject

CN=Sectigo RSA Time Stamping Signer #4,O=Sectigo Limited,ST=Manchester,C=GB

Serial Number

39:4c:25:e1:7c:a0:6d:27:a8:65:e2:3b:d9:1d:22:d4

Issuer

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

May 3, 2023 - Aug 2, 2034

Subject

CN=Firebit OU,OU=IT,O=Firebit OU,POSTALCODE=15551,STREET=Sepapaja tn 6,L=Tallinn,ST=Harjumaa,C=EE

Serial Number

d6:aa:3c:89:1f:c2:cb:dd:7e:18:52:57:e9:22:70:1a

Issuer

CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jan 28, 2021 - Jan 28, 2024

Subject

CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Serial Number

1d:a2:48:30:6f:9b:26:18:d0:82:e0:96:7d:33:d3:6a

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning, ExtKeyUsageTimeStamping

Timespan

Nov 2, 2018 - Dec 31, 2030

Subject

CN=Sectigo RSA Time Stamping Signer #4,O=Sectigo Limited,ST=Manchester,C=GB

Serial Number

39:4c:25:e1:7c:a0:6d:27:a8:65:e2:3b:d9:1d:22:d4

Issuer

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

May 3, 2023 - Aug 2, 2034

Subject

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Serial Number

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

May 2, 2019 - Jan 18, 2038

Minor OS version

0

Major OS version

4

Entry point

13888

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

advapi32

RegCreateKeyExW RegEnumKeyW RegQueryValueExW RegSetValueExW RegCloseKey RegDeleteValueW RegDeleteKeyW AdjustTokenPrivileges LookupPrivilegeValueW OpenProcessToken SetFileSecurityW RegOpenKeyExW RegEnumValueW

shell32

SHGetSpecialFolderLocation SHFileOperationW SHBrowseForFolderW SHGetPathFromIDListW ShellExecuteExW SHGetFileInfoW

ole32

OleInitialize OleUninitialize CoCreateInstance IIDFromString CoTaskMemFree

comctl32

ord17 ImageList_Create ImageList_Destroy ImageList_AddMasked

user32

GetClientRect EndPaint DrawTextW IsWindowEnabled DispatchMessageW wsprintfA CharNextA CharPrevW MessageBoxIndirectW GetDlgItemTextW SetDlgItemTextW GetSystemMetrics FillRect AppendMenuW TrackPopupMenu OpenClipboard SetClipboardData CloseClipboard IsWindowVisible CallWindowProcW GetMessagePos CheckDlgButton LoadCursorW SetCursor GetSysColor SetWindowPos GetWindowLongW PeekMessageW SetClassLongW GetSystemMenu EnableMenuItem GetWindowRect ScreenToClient EndDialog RegisterClassW SystemParametersInfoW CreateWindowExW GetClassInfoW DialogBoxParamW CharNextW ExitWindowsEx DestroyWindow CreateDialogParamW SetTimer SetWindowTextW PostQuitMessage SetForegroundWindow ShowWindow wsprintfW SendMessageTimeoutW FindWindowExW IsWindow GetDlgItem SetWindowLongW LoadImageW GetDC ReleaseDC EnableWindow InvalidateRect SendMessageW DefWindowProcW BeginPaint EmptyClipboard CreatePopupMenu

gdi32

SetBkMode SetBkColor GetDeviceCaps CreateFontIndirectW CreateBrushIndirect DeleteObject SetTextColor SelectObject

kernel32

GetExitCodeProcess WaitForSingleObject GetModuleHandleA GetProcAddress GetSystemDirectoryW lstrcatW Sleep lstrcpyA WriteFile GetTempFileNameW lstrcmpiA RemoveDirectoryW CreateProcessW CreateDirectoryW GetLastError CreateThread GlobalLock GlobalUnlock GetDiskFreeSpaceW WideCharToMultiByte lstrcpynW lstrlenW SetErrorMode GetVersionExW GetCommandLineW GetTempPathW GetWindowsDirectoryW SetEnvironmentVariableW CopyFileW ExitProcess GetCurrentProcess GetModuleFileNameW GetFileSize CreateFileW GetTickCount MulDiv SetFileAttributesW GetFileAttributesW SetCurrentDirectoryW MoveFileW GetFullPathNameW GetShortPathNameW SearchPathW CompareFileTime SetFileTime CloseHandle lstrcmpiW lstrcmpW ExpandEnvironmentStringsW GlobalFree GlobalAlloc GetModuleHandleW LoadLibraryExW MoveFileExW FreeLibrary WritePrivateProfileStringW GetPrivateProfileStringW lstrlenA MultiByteToWideChar ReadFile SetFilePointer FindClose FindNextFileW FindFirstFileW DeleteFileW

$PLUGINSDIR/LangDLL.dll

IMPHASH 3e8d18bb71c7ebbda2ddc2a4bb03547b
SHA256 18e8b40ba22c7a1687bd16e8d585380bc2773fff5002d7d67e9485fcc0c51026
MD5 68b287f4067ba013e34a1339afdb1ea8
SHA1 45ad585b3cc8e5a6af7b68f5d8269c97992130b3
SHA512 06c38bbb07fb55256f3cdc24e77b3c8f3214f25bfd140b521a39d167113bf307a7e8d24e445d510bc5e4e41d33c9173bb14e3f2a38bc29a0e3d08c1f0dca4bdb
SSDEEP 48:S46+/nTKYKxbWsptIpBtWZ0iV8jAWiAJCvxft2O2B8mFofjLl:zFuPbOBtWZBV8jAWiAJCdv2Cm0L
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

5439

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/MoreInfo.dll

IMPHASH 149adf074d317fbf0d2f17314bd18969
SHA256 227a4fc9408a44faa5eca608a974bd536814f97b8a4d28b4cac479727167b026
MD5 bd393029cc49b415b6c9aeb8a4936516
SHA1 c67fd92fffd18941bed41bfd6ac4f3b04fd123df
SHA512 3bb8e5cf4bea7e8adaa62196e58fff9031f49fd4efa78e5bd3e4b9c4e9ba1523864567521793053595d90abec719761a5964ff3abe04b93b24d52e5ffa4c1f96
SSDEEP 96:LEjAlUFPxXJugoImuaKbkBSEPTpsxKaVQ4Ad:gjAiFPxXJugoImJKQk8yxKaVVe
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

5017

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

t:\untgz\MoreInfo\SRC\Release\MoreInfo.pdb

$PLUGINSDIR/System.dll

IMPHASH fc0224e99e736751432961db63a41b76
SHA256 8dc562cda7217a3a52db898243de3e2ed68b80e62ddcb8619545ed0b4e7f65a8
MD5 cff85c549d536f651d4fb8387f1976f2
SHA1 d41ce3a5ff609df9cf5c7e207d3b59bf8a48530e
SHA512 531d6328daf3b86d85556016d299798fa06fefc81604185108a342d000e203094c8c12226a12bd6e1f89b0db501fb66f827b610d460b933bd4ab936ac2fd8a88
SSDEEP 192:Zjvco0qWTlt70m5Aj/lQ0sEWD/wtYbBHFNaDybC7y+XBz0QPi:FHQlt70mij/lQRv/9VMjzr
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

10879

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/UAC.dll

IMPHASH 0ef725341a4aecf8398c0e2132f38049
SHA256 2f7f8fc05dc4fd0d5cda501b47e4433357e887bbfed7292c028d99c73b52dc08
MD5 adb29e6b186daa765dc750128649b63d
SHA1 160cbdc4cb0ac2c142d361df138c537aa7e708c9
SHA512 b28adcccf0c33660fecd6f95f28f11f793dc9988582187617b4c113fb4e6fdad4cf7694cd8c0300a477e63536456894d119741a940dda09b7df3ff0087a7eada
SSDEEP 192:DiF6v2imI36Op/tGZGfWxdyWHD0I53vLl7WVl8e04IpDlPjs:DGVY6ClGoWxXH75T1WVl83lLs
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

10632

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

kernel32

SetLastError GetCurrentProcessId GetCommandLineW GetProcAddress CreateThread GlobalFree LoadLibraryA OpenProcess GlobalAlloc CreateFileMappingW Sleep MapViewOfFile GetModuleHandleW UnmapViewOfFile CreateEventW SetCurrentDirectoryW GetVersionExW GetExitCodeProcess lstrcatW LocalFree GetPrivateProfileStringW FormatMessageW GetPrivateProfileIntW CreateProcessW CloseHandle GetLastError DuplicateHandle GetCurrentThreadId lstrlenW SetEvent WaitForSingleObject lstrcmpiW GetExitCodeThread GetModuleFileNameW

user32

SetWindowPos GetClientRect GetWindowThreadProcessId SetWindowLongW DefWindowProcW GetDlgItem CallWindowProcW CallNextHookEx GetClassNameW PeekMessageW DestroyWindow SendMessageW SetForegroundWindow IsWindowVisible MsgWaitForMultipleObjects LoadStringW EndDialog EnableWindow DialogBoxParamW LoadImageW MessageBoxW GetWindowLongW DispatchMessageW ShowWindow wsprintfW CreateDialogParamW GetWindowRect IsDialogMessageW FindWindowExW CharNextW CreateWindowExW LoadIconW PostMessageW SetWindowsHookExW UnhookWindowsHookEx TranslateMessage

shell32

ShellExecuteExW

advapi32

OpenServiceW QueryServiceStatus CloseServiceHandle OpenProcessToken OpenSCManagerW GetUserNameW AdjustTokenPrivileges LookupPrivilegeValueW GetTokenInformation EqualSid

ole32

CoInitialize

$PLUGINSDIR/UserInfo.dll

IMPHASH 5e62e8e248e7364886b604bd1fcf4c13
SHA256 e54989d2b83e7282d0bec56b098635146aab5d5a283f1f89486816851ef885a0
MD5 2f69afa9d17a5245ec9b5bb03d56f63c
SHA1 e0a133222136b3d4783e965513a690c23826aec9
SHA512 bfd4af50e41ebc56e30355c722c2a55540a5bbddb68f1522ef7aabfe4f5f2a20e87fa9677ee3cdb3c0bf5bd3988b89d1224d32c9f23342a16e46c542d8dc0926
MD5 SHA1 SHA512

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

4734

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/modern-wizard.bmp

SHA256 20abb0c4188442ce1aecbe40455ba4f797a6db706157bc188615b49420c2dac3
MD5 e713642c356c0a90d844f0df15e2c686
SHA1 773eaa2a2f2e222940ea8774556f71466d248f79
SHA512 480679901611388a40cb1116cfa2a5769abd8e73b1b4a0e32b8a61d8a81cfc0d80a1f8641fbd222f2620fb2792f94295a1c7eacdc5c0a4ebc0b304a07af4aa16
SSDEEP 1536:Ak3CUPSyWVo/ztc33SgQjF56w+1CdAYavYmPnahENr6hIXT3dWqLq3qfAXHr:LL
MD5 SHA1 SHA512 SSDEEP

$PLUGINSDIR/nsDialogs.dll

IMPHASH 6b5c4f7d679059f68f1269aad3a5cecd
SHA256 56b96add1978b1abba286f7f8982b0efbe007d4a48b3ded6a4d408e01d753fe2
MD5 6c3f8c94d0727894d706940a8a980543
SHA1 0d1bcad901be377f38d579aafc0c41c0ef8dcefd
SHA512 2094f0e4bb7c806a5ff27f83a1d572a5512d979eefda3345baff27d2c89e828f68466d08c3ca250da11b01fc0407a21743037c25e94fbe688566dd7deaebd355
SSDEEP 96:o0svUu3Uy+sytcS8176b+XR8pCHFcMcxSgB5PKtAtgt+Nt+rnt3DVEB3YcNqkzfS:o0svWyNO81b8pCHFcM0PuAgkOyuIFc
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

7527

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

Plugins/ActionTimer.dll

IMPHASH 437d7587b4d59be6cbefe94815d364b5
SHA256 6630a385acb7f88c70f964fc08b411003801ee1575d23de7838ffaff9531b92f
MD5 e88ac8138e253c9ef0c068438d3e5586
SHA1 d68f2b9f3041af6c8e36175e822c79bf3e4e995c
SHA512 0f144f8a3b739b1d89fa5ddac5c97ee51e15e735cde4acea91a84a443f667b361c12a3d8591932da16fd6fe279450c8cd5a38f7582ca0cd30c07d110f2fdfe65
SSDEEP 1536:jkRlfSe/sWmcd+xvu98p+3m2cIlbyjzRDAfuEGVv3wE+tZPNqKSPgqU:ylfhZ+xm9R22cIlwzRDe/GV+SPgqU
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

48389

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

C:\Rainmeter4\x32-Release\Obj\PluginActionTimer\ActionTimer.pdb

rainmeter

RmReadFormula RmReplaceVariables RmReadString RmLogF RmGet

user32

SendNotifyMessageW FindWindowW

kernel32

IsDebuggerPresent DecodePointer WriteConsoleW CreateFileW HeapReAlloc HeapSize InitializeSRWLock ReleaseSRWLockExclusive AcquireSRWLockExclusive TryAcquireSRWLockExclusive GetCurrentThreadId InitializeConditionVariable WakeConditionVariable WakeAllConditionVariable SleepConditionVariableSRW QueryPerformanceCounter QueryPerformanceFrequency CloseHandle InitializeCriticalSectionEx GetSystemTimeAsFileTime GetModuleHandleW GetProcAddress EnterCriticalSection LeaveCriticalSection DeleteCriticalSection UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent GetCurrentProcessId InitializeSListHead GetConsoleMode GetStartupInfoW RaiseException RtlUnwind InterlockedFlushSList GetLastError SetLastError EncodePointer InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary LoadLibraryExW CreateThread ExitThread FreeLibraryAndExitThread GetModuleHandleExW ExitProcess GetModuleFileNameW HeapAlloc HeapFree LCMapStringW GetStdHandle GetFileType SetFilePointerEx FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetCPInfo GetCommandLineA GetCommandLineW MultiByteToWideChar WideCharToMultiByte GetEnvironmentStringsW FreeEnvironmentStringsW GetProcessHeap GetStringTypeW FlushFileBuffers WriteFile GetConsoleOutputCP SetStdHandle

Plugins/AdvancedCPU.dll

IMPHASH b1c624bc684847ef7d30ed2ad0b99f96
SHA256 588ffaf985166e119c9ac8dc37d190c9f6f4e71ccad83f17e2972b60ff233454
MD5 9479b71abccc8b4baf28f18ae1b62829
SHA1 ab375c0992ff752e2b2338793eb11165dd07da24
SHA512 3f886239965334204c510e779db05f8ac07af9185a2c62f71e8c25f5f2ff46d8891f42c05ddbe35ea7a12858e06d3868713a19187ed19cff163678ae3b8184c0
SSDEEP 1536:6kSlfsWoAYcdvaf2aNOiNb4OQZZVieo21AfhfDq6zWjuNL7AHtW8OZUMWE8Gk:6kVWvaeaNTb4OQ3omAfNGuNnAaUMWE8f
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

34267

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

C:\Rainmeter4\x32-Release\Obj\PluginAdvancedCPU\AdvancedCPU.pdb

rainmeter

RmReadFormula RmReadString

kernel32

lstrcpyW IsBadStringPtrW GetTickCount64 CreateFileW CloseHandle WriteConsoleW lstrlenW GetModuleFileNameW UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent IsDebuggerPresent GetStartupInfoW GetModuleHandleW QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead RaiseException InterlockedFlushSList GetLastError SetLastError EnterCriticalSection LeaveCriticalSection DeleteCriticalSection RtlUnwind InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary GetProcAddress LoadLibraryExW EncodePointer ExitProcess GetModuleHandleExW DecodePointer HeapFree HeapAlloc FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetCPInfo GetCommandLineA GetCommandLineW MultiByteToWideChar WideCharToMultiByte GetEnvironmentStringsW FreeEnvironmentStringsW LCMapStringW GetProcessHeap GetStdHandle GetFileType GetStringTypeW HeapSize HeapReAlloc SetStdHandle FlushFileBuffers WriteFile GetConsoleOutputCP GetConsoleMode SetFilePointerEx

user32

wsprintfW

advapi32

RegOpenKeyExW RegQueryValueExW RegCloseKey

Plugins/AudioLevel.dll

IMPHASH c892355687805396f38824de2aa7a25c
SHA256 37d3094cf0dd66efdb239752cf2b62ba53dc3d6408fb738f9ee403524f5c1f55
MD5 9b81a346383d152c2dbd7df6778596f4
SHA1 e6bd3a9d390b8f0d33ecc42e735e512aad5df77d
SHA512 5cb5a8147434b4ed87d24f574c4f65ec10432d078b41cb06d835c3a3163eabf68b59d9c78e2c535b16528f6027a0300d493d12f176193218ea1221c4c679a4c0
SSDEEP 3072:O6A6K1Xc0sAg0FuROHNMNt5FSvjMKq7npgKxCkaszl+L27vDHCdHPs2:WO0sAO0HNMr5FSYd7BCkDzgLyved02
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

72537

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

C:\Rainmeter4\x32-Release\Obj\PluginAudioLevel\AudioLevel.pdb

rainmeter

RmReadString RmLogF LSLog RmReadFormula RmGet

kernel32

HeapAlloc CreateFileW DecodePointer QueryPerformanceFrequency QueryPerformanceCounter CloseHandle HeapReAlloc HeapSize GetConsoleMode GetConsoleOutputCP UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent IsDebuggerPresent GetStartupInfoW GetModuleHandleW GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead RaiseException InterlockedFlushSList GetLastError SetLastError EnterCriticalSection LeaveCriticalSection DeleteCriticalSection RtlUnwind InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary GetProcAddress LoadLibraryExW EncodePointer ExitProcess GetModuleHandleExW GetModuleFileNameW WriteConsoleW HeapFree GetStdHandle GetFileType LCMapStringW FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetCPInfo GetCommandLineA GetCommandLineW MultiByteToWideChar WideCharToMultiByte GetEnvironmentStringsW FreeEnvironmentStringsW GetProcessHeap GetStringTypeW GetFileSizeEx SetFilePointerEx SetStdHandle FlushFileBuffers WriteFile

ole32

CoCreateInstance CoTaskMemFree PropVariantClear

Plugins/CoreTemp.dll

IMPHASH b3001b975b34528faf5a531f3015762c
SHA256 8aa49a2fe7cc2419d53f0fb68fe9c549e4b746e6919bcbb90f07842e3e7c2c8a
MD5 7ee5008e90570c5ffa8afe9ec0693070
SHA1 720117e3a3a4a0562e76dd5e91cecf1bc07846ac
SHA512 bc9e7ff2de8fe38a32a77bcdccb2ab02b1986c4f07c20877e5f03a35d7323f87a6616f6dbe72b0413921defc4823968b4967b6361b289ad149058d531e7df040
SSDEEP 3072:3sHQOgc/AnrAm7ObimiRBLjhdMOWTKkI3t:VO6hw3irjjDWett
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

33081

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

C:\Rainmeter4\x32-Release\Obj\PluginCoreTemp\CoreTemp.pdb

rainmeter

RmReadFormula RmLogF RmReadString

kernel32

GetModuleFileNameW CreateFileW DecodePointer GetLastError SetLastError CreateMutexW WaitForSingleObject ReleaseMutex OpenFileMappingW UnmapViewOfFile CloseHandle MapViewOfFile UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent IsDebuggerPresent GetStartupInfoW GetModuleHandleW QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead RaiseException InterlockedFlushSList RtlUnwind EnterCriticalSection LeaveCriticalSection DeleteCriticalSection InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary GetProcAddress LoadLibraryExW EncodePointer ExitProcess GetModuleHandleExW WriteConsoleW HeapFree HeapAlloc GetStdHandle GetFileType FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetCPInfo GetCommandLineA GetCommandLineW MultiByteToWideChar WideCharToMultiByte GetEnvironmentStringsW FreeEnvironmentStringsW LCMapStringW GetProcessHeap GetStringTypeW SetFilePointerEx SetStdHandle HeapSize HeapReAlloc FlushFileBuffers WriteFile GetConsoleOutputCP GetConsoleMode

Plugins/FileView.dll

IMPHASH fcc7a5b7ccc6ddbfa817dcc3f0cdb7b7
SHA256 c922ee6dd39574e64eed027cba93d0a2edbc29cfd1993d9b6ce84de27324cb54
MD5 57553f9302b159abc002cbc0f6d64163
SHA1 a295fc11c0ef0f35992412fd10b02c93d77a92b9
SHA512 5b05d0c48b5429cd5b77905798b1031376c41745113b0bb954a4b92b371b12e4125bca04f74086a686bb2abf74d06685001654d5afc23b680ae6da395e14ceda
SSDEEP 3072:45Ob10FBT4TOsPxO9Rj3rwKPWUwI1SFlFnbWubPJi20HQwT2qelY4PoLalzip1Ie:4QW4TNxORjbwljE20/2pY4EpfbI
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

97349

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

C:\Rainmeter4\x32-Release\Obj\PluginFileView\FileView.pdb

shlwapi

PathMatchSpecW

rainmeter

RmReplaceVariables RmGet RmReadFormula RmLogF RmPathToAbsolute RmReadString RmLog RmExecute

kernel32

HeapReAlloc HeapSize GetCurrentDirectoryW ReadConsoleW ReadFile FlushFileBuffers GetLogicalDrives CompareFileTime FindFirstFileExW EnterCriticalSection FindNextFileW InitializeCriticalSectionAndSpinCount LeaveCriticalSection InitializeCriticalSectionEx FindClose GetPrivateProfileStringW FileTimeToSystemTime DisableThreadLibraryCalls SetEndOfFile CloseHandle GetTimeFormatW DeleteCriticalSection VerSetConditionMask SystemTimeToFileTime VerifyVersionInfoW SystemTimeToTzSpecificLocalTime GetDateFormatW SetStdHandle CreateFileW GetStringTypeW GetFileType GetStdHandle GetProcessHeap FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW GetCommandLineA WriteConsoleW TerminateThread GetSystemTimeAsFileTime GetCPInfo GetOEMCP GetACP IsValidCodePage WideCharToMultiByte MultiByteToWideChar GetDriveTypeW SetFilePointerEx GetFileSizeEx IsProcessorFeaturePresent UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsDebuggerPresent GetStartupInfoW GetModuleHandleW QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId DecodePointer InitializeSListHead RaiseException InterlockedFlushSList GetLastError SetLastError RtlUnwind TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary GetProcAddress LoadLibraryExW EncodePointer CreateThread ExitThread FreeLibraryAndExitThread GetModuleHandleExW GetFullPathNameW ExitProcess GetModuleFileNameW HeapFree HeapAlloc LCMapStringW WriteFile GetConsoleOutputCP GetConsoleMode

user32

ReleaseDC GetCursorPos DestroyMenu DestroyIcon CreatePopupMenu GetIconInfo GetDC GetWindowRect TrackPopupMenuEx PrivateExtractIconsW

gdi32

GetObjectW DeleteObject GetDIBits

shell32

SHParseDisplayName ShellExecuteExW SHBindToParent ord727 SHGetFileInfoW

ole32

CoInitializeEx CoUninitialize

Plugins/FolderInfo.dll

IMPHASH c47e972939d7b0157e16d0daf4975b22
SHA256 9f533dd0123cb8f5744a5f8407d91ce80fbbec02e41f305b09eced8f9651dc35
MD5 fdd62b0490e0b6e9e53378c3797eedcc
SHA1 28daaacfbb1d1a6f19831b1e902dcb6e2aedc206
SHA512 bedceef149e13bd7375890a5e72ad706d22bfc97be09034192231ca9b1f4ca39648956bfd3e6e351059d4e6e56cdc019de53e85112c782e697cbff9a8474aa00
SSDEEP 3072:2CggYfOQoFugz7IfV7Zhnx4TngNoYO6LmIDsWF:md4s73x4bg1ZLTsW
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

34692

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

C:\Rainmeter4\x32-Release\Obj\PluginFolderInfo\FolderInfo.pdb

rainmeter

RmReadFormula RmPathToAbsolute RmReadString RmGet ord6 ord5

kernel32

GetModuleFileNameW CreateFileW CloseHandle DecodePointer FindFirstFileW FindNextFileW FindClose GetTickCount64 GetConsoleMode UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent IsDebuggerPresent GetStartupInfoW GetModuleHandleW QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead RaiseException InterlockedFlushSList GetLastError SetLastError EnterCriticalSection LeaveCriticalSection DeleteCriticalSection RtlUnwind InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary GetProcAddress LoadLibraryExW EncodePointer ExitProcess GetModuleHandleExW WriteConsoleW HeapFree HeapAlloc GetStdHandle GetFileType FindFirstFileExW IsValidCodePage GetACP GetOEMCP GetCPInfo GetCommandLineA GetCommandLineW MultiByteToWideChar WideCharToMultiByte GetEnvironmentStringsW FreeEnvironmentStringsW LCMapStringW GetProcessHeap GetStringTypeW SetFilePointerEx SetStdHandle HeapSize HeapReAlloc FlushFileBuffers WriteFile GetConsoleOutputCP

Plugins/InputText.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 f35770dde8d01b7e10f969aa1202155b8b0bed9c29c4f8b40d7e683ebe73d0ab
MD5 d4a3ccfa86889eca3b7cb333e33257ac
SHA1 2a0b39115b1d20457c67e082ff32d84e61ebb26b
SHA512 65ed0b36cb181b75478b50d5880e7301dd32c8933fc43d95a346a49b9fe69d8efd7bb67719e030ea79079034b7d04737fa12ebd4ba08299169a44ee03769ca1e
SSDEEP 384:ALTJ6I2BatWSdduVbdJjgaseXPG69d4NjU7J:AvJ6/atWSdYM+esjl
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

28558

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

Plugins/PerfMon.dll

IMPHASH d6311df7e9e9fa35c7f4bf6f36ce56e1
SHA256 8f3f7bf9f290190ded0ccacf21e5027eea14e31ef2eba59a7bc0cfccd8701325
MD5 77c1bb511ba882dd1f6b68a8fa6a3e16
SHA1 308c7edd447932f3e62e444cb1b7a16351d826fb
SHA512 2a1350b8103c770142b078d915e3e979bf3fe52a93d42ada3fd47ee014a1eb9b1075ab068c44f6449312b3b02300714beb3fb8396917e3817c8ae5d29fb57919
SSDEEP 1536:770aS0fsW1AYcdO/L3a+XRIArIPb2YvJAeMfrw1X+pB17S/sk2O+xWU0G:770aHWOxRIAgSYxAeKHpBNSOxWU0G
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

30660

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

C:\Rainmeter4\x32-Release\Obj\PluginPerfMon\PerfMon.pdb

rainmeter

RmReadFormula RmReadString

kernel32

IsBadStringPtrW lstrcpyW CreateFileW CloseHandle WriteConsoleW lstrlenW GetModuleFileNameW UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent IsDebuggerPresent GetStartupInfoW GetModuleHandleW QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead RaiseException InterlockedFlushSList GetLastError SetLastError EnterCriticalSection LeaveCriticalSection DeleteCriticalSection RtlUnwind InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary GetProcAddress LoadLibraryExW EncodePointer ExitProcess GetModuleHandleExW DecodePointer HeapFree HeapAlloc FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetCPInfo GetCommandLineA GetCommandLineW MultiByteToWideChar WideCharToMultiByte GetEnvironmentStringsW FreeEnvironmentStringsW LCMapStringW GetProcessHeap GetStdHandle GetFileType GetStringTypeW HeapSize HeapReAlloc SetStdHandle FlushFileBuffers WriteFile GetConsoleOutputCP GetConsoleMode SetFilePointerEx

user32

wsprintfW

advapi32

RegOpenKeyExW RegQueryValueExW RegCloseKey

Plugins/PingPlugin.dll

IMPHASH dd760caf43effecb12952cdaa5b6b865
SHA256 9558ecfd0df85b4865baf26cd984e29d53840307c00331638533ef4f2a184534
MD5 9bfda79c3aee286817e1579b15579b9c
SHA1 07fb8d727ec0af97b684d51bf053239321a38c9e
SHA512 e6cd7a2d8ab78b6c23655af07d3f0b283a0cfc572dbc415c2d9b0adc5f9f2baa1e56575c2ed50b08e90bcaf1d6dbecda5eac057eaaf9578d8d7e73e45194a9a1
SSDEEP 1536:6QStrsWVHcdhgFM6eI7Az4FzqRHM7JnNbtEVe0DjSoikQ9VWqToN:6QQ32hgCXI7ZulMtnEVeuc9VWqTo
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

31052

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

C:\Rainmeter4\x32-Release\Obj\PluginPing\PingPlugin.pdb

ws2_32

WSACleanup FreeAddrInfoW WSAStartup GetAddrInfoW WSAGetLastError

iphlpapi

IcmpSendEcho2 GetIpErrorString Icmp6CreateFile Icmp6SendEcho2 IcmpCreateFile IcmpCloseHandle

rainmeter

RmGet RmReadFormula RmLogF RmReadString RmExecute

kernel32

CreateFileW WriteConsoleW TlsSetValue SetFilePointerEx GetConsoleMode GetConsoleOutputCP WriteFile FlushFileBuffers EnterCriticalSection GetModuleHandleExW InitializeCriticalSectionAndSpinCount LeaveCriticalSection InitializeCriticalSectionEx FreeLibraryAndExitThread FormatMessageW GetLastError DisableThreadLibraryCalls CloseHandle CreateThread LocalFree DeleteCriticalSection SetStdHandle UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead IsDebuggerPresent GetStartupInfoW GetModuleHandleW RaiseException InterlockedFlushSList RtlUnwind SetLastError TlsAlloc TlsGetValue DecodePointer TlsFree FreeLibrary GetProcAddress LoadLibraryExW EncodePointer ExitProcess GetModuleFileNameW HeapAlloc HeapFree FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetCPInfo GetCommandLineA GetCommandLineW MultiByteToWideChar WideCharToMultiByte GetEnvironmentStringsW FreeEnvironmentStringsW LCMapStringW GetProcessHeap GetStdHandle GetFileType GetStringTypeW HeapSize HeapReAlloc

Plugins/PowerPlugin.dll

IMPHASH 28658fb492f9db33226fa3c32566a78d
SHA256 d3d33cd87bdc7ed2562bbc0ed6ff2f8ef728c409cf131b1a712fce4c33f21d60
MD5 621bd5d9f61a53ed00f47955857d86d3
SHA1 95ddc14b8aafb49d1422bc10bd81c1080337d7a6
SHA512 3aaeeb03f7b25162d36bad2be09d620f1a9f1172c5586a9582d53685d9de8a27eb3048e26f5542c2afba93125009fac7c9a61ad56f053407c79f7cfcbbc0e19d
SSDEEP 3072:W39s/79rSoE7f2ZnHs8oxydzTLyV/L++AGYo:WevoAHVox+3yR+zo
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

30952

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

C:\Rainmeter4\x32-Release\Obj\PluginPower\PowerPlugin.pdb

rainmeter

RmLogF RmReadString

kernel32

HeapAlloc WriteConsoleW CloseHandle GetSystemPowerStatus GetLastError GetSystemInfo CreateFileW RaiseException VirtualProtect VirtualQuery FreeLibrary GetModuleHandleW GetProcAddress LoadLibraryExA UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead IsDebuggerPresent GetStartupInfoW InterlockedFlushSList RtlUnwind SetLastError EnterCriticalSection LeaveCriticalSection DeleteCriticalSection InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree LoadLibraryExW EncodePointer ExitProcess GetModuleHandleExW GetModuleFileNameW HeapFree DecodePointer GetDateFormatW GetTimeFormatW CompareStringW LCMapStringW GetTimeZoneInformation FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetCPInfo GetCommandLineA GetCommandLineW MultiByteToWideChar WideCharToMultiByte GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW GetProcessHeap GetStdHandle GetFileType GetStringTypeW HeapSize HeapReAlloc SetStdHandle FlushFileBuffers WriteFile GetConsoleOutputCP GetConsoleMode SetFilePointerEx

Plugins/QuotePlugin.dll

IMPHASH 2d64d7a5543eb831d72eadf43ee0ea6a
SHA256 921e909722f68326cefa811293254dc083268d9f68137ef9fc9e9f7815cb9271
MD5 5fa4cf739244d320858192ba989caac6
SHA1 bdbac76fa33a5478c7ad7ee7d2243f9a6b54cdfc
SHA512 9054e16bc8e90786a333f6d07133d7523fa8b4c47a2d5793ebb6e062d006605308d146f75817df87857db24e89b9a8b4b75544cd8ac699e5e93924b56634ca19
SSDEEP 3072:tzWYDV8iNlSb87BnhYECj7QiYhSTnQk6aOTW4:PNlSb8thYxoiYMJ4TW
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

39534

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

C:\Rainmeter4\x32-Release\Obj\PluginQuote\QuotePlugin.pdb

shlwapi

PathIsDirectoryW PathMatchSpecW

rainmeter

RmReadFormula RmPathToAbsolute RmReadString

kernel32

FreeLibrary DecodePointer SetEndOfFile HeapReAlloc HeapSize CreateFileW MultiByteToWideChar LCMapStringW WideCharToMultiByte FindFirstFileW FindNextFileW FindClose GetConsoleOutputCP CloseHandle EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionAndSpinCount DeleteCriticalSection SetEvent ResetEvent WaitForSingleObjectEx CreateEventW GetModuleHandleW GetProcAddress UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent IsDebuggerPresent GetStartupInfoW QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead RaiseException InterlockedFlushSList GetLastError SetLastError RtlUnwind TlsAlloc TlsGetValue TlsSetValue TlsFree WriteConsoleW LoadLibraryExW EncodePointer ReadFile ExitProcess GetModuleHandleExW GetModuleFileNameW HeapFree HeapAlloc GetStdHandle GetFileType SetFilePointerEx GetConsoleMode ReadConsoleW FindFirstFileExW IsValidCodePage GetACP GetOEMCP GetCPInfo GetCommandLineA GetCommandLineW GetEnvironmentStringsW FreeEnvironmentStringsW GetProcessHeap GetStringTypeW SetStdHandle FlushFileBuffers WriteFile

Plugins/ResMon.dll

IMPHASH aabaed3bb862f8b1662f7e7aa1ed87ff
SHA256 8fe8b72d39ba4445ca3b49fc46afcd8dad8b938ff9e6403a95d8c12abed9be5e
MD5 f0ff4da36e55341615f493ea4177b3c4
SHA1 6cd4c70ebd4f0cfd679c72f7254970f7f8603aa4
SHA512 538f6baa5a6c52ecea88cfa3c6614ff4733955e03c9af000a58b2594a122553dc50f6d7f6b141cf3df948989e9e6be7b80c3991fe1a3ca61a68345c2bafd2401
SSDEEP 1536:oaS0fsW1AYcdvb5Rv1NfFcRHoEFIvRofNYy1dO+E779roOMv1WpUGw:oaHWv9Rv1NfcoEFIvR2PdOf7sv1WpUG
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

28092

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

C:\Rainmeter4\x32-Release\Obj\PluginResMon\ResMon.pdb

psapi

EnumProcesses GetModuleBaseNameW EnumProcessModules

rainmeter

RmLogF RmReadString

kernel32

GetModuleFileNameW WriteConsoleW CreateFileW SetFilePointerEx OpenProcess CloseHandle GetProcessHandleCount GetConsoleMode GetConsoleOutputCP WriteFile UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead IsDebuggerPresent GetStartupInfoW GetModuleHandleW RaiseException InterlockedFlushSList RtlUnwind GetLastError SetLastError EnterCriticalSection LeaveCriticalSection DeleteCriticalSection InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary GetProcAddress LoadLibraryExW EncodePointer ExitProcess GetModuleHandleExW DecodePointer HeapFree HeapAlloc FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetCPInfo GetCommandLineA GetCommandLineW MultiByteToWideChar WideCharToMultiByte GetEnvironmentStringsW FreeEnvironmentStringsW LCMapStringW GetProcessHeap GetStdHandle GetFileType GetStringTypeW HeapSize HeapReAlloc SetStdHandle FlushFileBuffers

user32

EnumChildWindows GetGuiResources

Plugins/RunCommand.dll

IMPHASH 943186a063cb29aac98e025eb2877065
SHA256 ad624724177cdbd548b45b41fea4c512c71ace909272e45de58571f35be9f864
MD5 3a83b9423ef46a5b03343f3edeaa6b05
SHA1 8c4d1cda516ee9b6c3ada3e049f64379719917d7
SHA512 32036ac2cd91cc6f6f45207f6a3f3ca882ecb76cdff82ba0b8b0bb1c0c2d574eee3adcaac1e01a9a4469770834ca482a168aa85c27250d10c70cb824e05cd489
SSDEEP 3072:UHPEkG/P5Q31MOzyW34mQVVbHiySPaYOmfaiFI/4:0JCOx347VVb0Pz7xFIg
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

46034

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

C:\Rainmeter4\x32-Release\Obj\PluginRunCommand\RunCommand.pdb

rainmeter

RmExecute RmReplaceVariables RmLog RmLogF RmReadString RmReadFormula RmGet RmPathToAbsolute

kernel32

GetModuleHandleW WriteConsoleW ReadConsoleW SetEndOfFile HeapReAlloc HeapSize GetConsoleMode GetConsoleOutputCP ReadFile GetCurrentProcess WriteFile GetModuleHandleExW TerminateProcess CreatePipe PeekNamedPipe WaitForSingleObject FreeLibraryAndExitThread DuplicateHandle DisableThreadLibraryCalls CloseHandle CreateProcessW GetExitCodeProcess FlushFileBuffers SetStdHandle CreateFileW GetStringTypeW GetProcessHeap WideCharToMultiByte MultiByteToWideChar LCMapStringW InitializeSRWLock ReleaseSRWLockExclusive AcquireSRWLockExclusive TryAcquireSRWLockExclusive GetCurrentThreadId QueryPerformanceCounter InitializeCriticalSectionEx GetSystemTimeAsFileTime DecodePointer GetProcAddress EnterCriticalSection LeaveCriticalSection DeleteCriticalSection InitializeCriticalSectionAndSpinCount CreateEventW IsProcessorFeaturePresent UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcessId InitializeSListHead IsDebuggerPresent GetStartupInfoW RaiseException RtlUnwind InterlockedFlushSList GetLastError SetLastError EncodePointer TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary LoadLibraryExW CreateThread ExitThread ExitProcess GetModuleFileNameW HeapFree HeapAlloc GetStdHandle GetFileType GetFileSizeEx SetFilePointerEx FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetCPInfo GetCommandLineA GetCommandLineW GetEnvironmentStringsW FreeEnvironmentStringsW

user32

PostMessageW GetWindowThreadProcessId EnumWindows

Plugins/SpeedFanPlugin.dll

IMPHASH d483aaee46df655d33c40104f3965356
SHA256 ac059220d7d78cbe094067e0efe0fd758e36ff60757a6b0ea37124910f95e91a
MD5 278d191ea406456b1ace2ab4f1924df0
SHA1 7dbb53bee0a398a2c6f72c5c8e9f4862b1d9579e
SHA512 5b5e325dcbb47560bc0dbc15b3d79b58f250db19e1c73a6fe3b1710202f00b4a6a27fbb1e61540435f09b3266db156116237c30a17d766fee65d9e7f067a22ab
SSDEEP 3072:9sHQOgc/9aexU1VDkVoFEdq1cK9babYAfIDJXdl:LOqdGyOdqGK98YACX
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

31231

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

C:\Rainmeter4\x32-Release\Obj\PluginSpeedFan\SpeedFanPlugin.pdb

rainmeter

RmReadFormula RmReadString LSLog RmGet

kernel32

HeapFree CreateFileW DecodePointer OpenFileMappingW UnmapViewOfFile CloseHandle MapViewOfFile UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead IsDebuggerPresent GetStartupInfoW GetModuleHandleW RaiseException InterlockedFlushSList RtlUnwind GetLastError SetLastError EnterCriticalSection LeaveCriticalSection DeleteCriticalSection InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary GetProcAddress LoadLibraryExW EncodePointer ExitProcess GetModuleHandleExW GetModuleFileNameW WriteConsoleW HeapAlloc GetStdHandle GetFileType FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetCPInfo GetCommandLineA GetCommandLineW MultiByteToWideChar WideCharToMultiByte GetEnvironmentStringsW FreeEnvironmentStringsW LCMapStringW GetProcessHeap GetStringTypeW SetFilePointerEx SetStdHandle HeapSize HeapReAlloc FlushFileBuffers WriteFile GetConsoleOutputCP GetConsoleMode

Plugins/UsageMonitor.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 52ce9296b863c5f900140562989443f9b97ab77236168f4be504fa2de2992145
MD5 6d5a929df5550b56727a7cf2464a76e7
SHA1 f4cd425a0fb71db146c243093f4504cbe0dc68a7
SHA512 85ea7b9b04c07578811b407ba34e28b9927130004106b03110286415318964ba97760106144537fa63946e37838093a4f4436c421697f0151cdd9bbc4bbc3ba0
SSDEEP 384:rVy/J2YCcfHLGyRZU5cFbdHn1xvvdZKl/hw+9XXy2anHoeSKAamMBeJD77:5y/9CILGyjUOFbtFZKDw+9yXI/UBeVv
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

31470

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

Plugins/Win7AudioPlugin.dll

IMPHASH 1e59eb2bbcc4adcdc2d2d27c472e6bad
SHA256 68606d6353e8bcb6a4c28255ab97cf79668ae38662585ebee07193b2f3b693ae
MD5 b06e6c4e350a4315d876abeae9a9a6d1
SHA1 262a43e685ab3b1c5430044b76b7b1f19d5a46e5
SHA512 34c1e357347b119ff4cc58679c5b5c9bdb8b3ba82382dbe99471173ae535ad272913a75a43c698947bdcb137357d904a3ac6618f853c039d0b04d566d1e79234
SSDEEP 3072:ACe9E4fS6JzkdujhaJi4MtLJTWcnBsO2ka7asMm7p9Wo5LBV4CIivI:AXJfeKEWo7pYo1BCWvI
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

39928

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

C:\Rainmeter4\x32-Release\Obj\PluginWin7Audio\Win7AudioPlugin.pdb

rainmeter

LSLog

ole32

CoUninitialize PropVariantClear CoInitialize CoCreateInstance CoTaskMemFree

kernel32

GetStdHandle WriteConsoleW CreateFileW DecodePointer CloseHandle UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent IsDebuggerPresent GetStartupInfoW GetModuleHandleW QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead RaiseException InterlockedFlushSList GetLastError SetLastError EnterCriticalSection LeaveCriticalSection DeleteCriticalSection RtlUnwind InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary GetProcAddress LoadLibraryExW EncodePointer ExitProcess GetModuleHandleExW GetModuleFileNameW HeapAlloc HeapFree GetConsoleOutputCP GetFileType FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetCPInfo GetCommandLineA GetCommandLineW MultiByteToWideChar WideCharToMultiByte GetEnvironmentStringsW FreeEnvironmentStringsW LCMapStringW GetProcessHeap GetStringTypeW SetStdHandle SetFilePointerEx HeapSize HeapReAlloc FlushFileBuffers WriteFile GetConsoleMode

Plugins/WindowMessagePlugin.dll

IMPHASH 01d2fca22b52cf1a7c801c66c481b311
SHA256 eac6edeb9fc114d259248baee3082cb6eee642ef0c14eca2d4052cb1bc2c2461
MD5 26228a771353829a7dd2874fe3cb1a20
SHA1 708c2ee5c8f01a0207410dada305e8e9f8d89a50
SHA512 9923d4be6cb6bbfca272c5e093036bc00f33ae127ac087db14c94bcfc228367641f25200bc90b4dd689be2a8bf088c92189182f46451345db250de26ff8c5d24
SSDEEP 3072:GkWddO0buPRanHtLJoWjeOsmmw7JQWZrcu9ox7dKI9b8:qPuscurcPVdZQ
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

31470

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

C:\Rainmeter4\x32-Release\Obj\PluginWindowMessage\WindowMessagePlugin.pdb

rainmeter

RmReadString RmLog

user32

GetWindowTextW FindWindowW SendMessageW PostMessageW

kernel32

GetStdHandle DecodePointer WriteConsoleW CreateFileW CloseHandle UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead IsDebuggerPresent GetStartupInfoW GetModuleHandleW RaiseException InterlockedFlushSList RtlUnwind GetLastError SetLastError EnterCriticalSection LeaveCriticalSection DeleteCriticalSection InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary GetProcAddress LoadLibraryExW EncodePointer ExitProcess GetModuleHandleExW GetModuleFileNameW HeapAlloc HeapFree GetFileType FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetCPInfo GetCommandLineA GetCommandLineW MultiByteToWideChar WideCharToMultiByte GetEnvironmentStringsW FreeEnvironmentStringsW LCMapStringW GetProcessHeap GetStringTypeW SetStdHandle HeapSize HeapReAlloc FlushFileBuffers WriteFile GetConsoleOutputCP GetConsoleMode SetFilePointerEx

Plugins/iTunesPlugin.dll

IMPHASH 6e8f0a852b12b05bb9219c17b70c0294
SHA256 834072095ffc4b746f894c07429d8b24084d132726b947fcd0f545db2ea2bfb0
MD5 b9214d664da613530894bc8bbdb5f6ed
SHA1 0d73953733eace553aa38a4af012ce78128493b8
SHA512 e59e5508466757201a7f04ecac53548af39af37f819f352d0e1633903aaf4f1b4e5965f25608bf8ab9b9180a500d70797655597e090ef0b7af15a661f390a9be
SSDEEP 3072:CYRLsF8zro1ebDaRXYRQjByBDCiNyIqGE:RLq4W9YaBUDCaeG
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

40875

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

C:\Rainmeter4\x32-Release\Obj\PluginiTunes\iTunesPlugin.pdb

rainmeter

LSLog ReadConfigString

kernel32

HeapFree CreateDirectoryW GetConsoleMode GetConsoleOutputCP WriteFile FlushFileBuffers WriteConsoleW CreateFileW HeapReAlloc HeapSize SetStdHandle CloseHandle UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent IsDebuggerPresent GetStartupInfoW GetModuleHandleW QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead LocalFree GetLastError RaiseException InterlockedFlushSList SetLastError EnterCriticalSection LeaveCriticalSection DeleteCriticalSection RtlUnwind InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary GetProcAddress LoadLibraryExW EncodePointer QueryPerformanceFrequency ExitProcess GetModuleHandleExW GetModuleFileNameW SetFilePointerEx HeapAlloc GetStdHandle GetFileType FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetCPInfo GetCommandLineA GetCommandLineW MultiByteToWideChar WideCharToMultiByte GetEnvironmentStringsW FreeEnvironmentStringsW LCMapStringW GetProcessHeap GetStringTypeW DecodePointer

user32

FindWindowW

ole32

OleRun CoInitialize CoCreateInstance

oleaut32

SysAllocString SysFreeString LoadRegTypeLi

Rainmeter.VisualElementsManifest.xml

SHA256 31f202eb450d1691d1ea74d3fc3aa4de8045cbd91107965890e595918d07e6a3
MD5 e4098704c3efc586c9f15ce77915be65
SHA1 7299ee2050d83cf46497d61aa0eba69fb1c28d55
SHA512 158d2e401d9898c779ceffe6522c67c1ca6184f4b0792f5cf10320122ae2bc6c0c189a185d39ec0b3f8a47c9ec5a6e28c4376710ab862c6cbede3bcdcf29eb7d
MD5 SHA1 SHA512

Rainmeter.dll

IMPHASH 82b1bf6d25db56a27c4debe400aff25a
SHA256 b581e431f1dfe1f11a85af976c6ff635f596789572313a845c84d10537513f1d
MD5 a65154d1508aab4e6b955d9e8b66266c
SHA1 8ee71e0772163c1aefaed93728723e7afc493361
SHA512 52943c031c5c5d19b0f40e1b81eb054a7a09247627929fca4015fc5c07265d1cfa097e06cb27c27fad59c92e2c6035471fd63ec3ded919dd649a8bc227030fd8
SSDEEP 49152:bOwTzxjWIHYwholKwzSGlV8OP7yE20gevptppYIWxi7nG/r0L3M7u:bDxjW3lKwzSGnny550L7
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x86 arch:x86

Digest

1a:4a:37:d5:43:8c:5a:53:57:b3:6a:35:b1:e1:f0:aa:eb:1c:09:45:89:62:f5:5f:61:d5:27:e8:49:70:9e:6d

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Firebit OU,OU=IT,O=Firebit OU,POSTALCODE=15551,STREET=Sepapaja tn 6,L=Tallinn,ST=Harjumaa,C=EE

Chains

Jul 31, 2023

CN=Firebit OU,OU=IT,O=Firebit OU,POSTALCODE=15551,STREET=Sepapaja tn 6,L=Tallinn,ST=Harjumaa,C=EE

CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Subject

CN=Firebit OU,OU=IT,O=Firebit OU,POSTALCODE=15551,STREET=Sepapaja tn 6,L=Tallinn,ST=Harjumaa,C=EE

Serial Number

d6:aa:3c:89:1f:c2:cb:dd:7e:18:52:57:e9:22:70:1a

Issuer

CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jan 28, 2021 - Jan 28, 2024

Subject

CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Serial Number

1d:a2:48:30:6f:9b:26:18:d0:82:e0:96:7d:33:d3:6a

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning, ExtKeyUsageTimeStamping

Timespan

Nov 2, 2018 - Dec 31, 2030

Subject

CN=Sectigo RSA Time Stamping Signer #4,O=Sectigo Limited,ST=Manchester,C=GB

Serial Number

39:4c:25:e1:7c:a0:6d:27:a8:65:e2:3b:d9:1d:22:d4

Issuer

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

May 3, 2023 - Aug 2, 2034

Subject

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Serial Number

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

May 2, 2019 - Jan 18, 2038

Minor OS version

0

Major OS version

6

Entry point

1668026

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

C:\Rainmeter4\x32-Release\Obj\Library\Rainmeter.pdb

comctl32

ord413 ord17 ord412 ImageList_Create ImageList_Destroy ImageList_ReplaceIcon ord410

wininet

InternetReadFile InternetOpenW InternetCloseHandle DeleteUrlCacheEntryW InternetGetLastResponseInfoW InternetOpenUrlW InternetCrackUrlW

uxtheme

EnableThemeDialogTexture SetWindowTheme

gdiplus

GdipGetImageWidth GdipCreateHICONFromBitmap GdipFillPolygonI GdipFillRectangleI GdipDeleteBrush GdipCreateSolidFill GdipGetImageHeight GdipDeleteGraphics GdipDrawImageRectRectI GdipCreateBitmapFromScan0 GdipSaveImageToFile GdipDisposeImage GdipFree GdipCloneImage GdipAlloc GdipSetSmoothingMode GdipCreateBitmapFromFile GdiplusShutdown GdiplusStartup GdipGetImageGraphicsContext

powrprof

CallNtPowerInformation

netapi32

NetApiBufferFree NetWkstaGetInfo

ntdll

VerSetConditionMask RtlIpv4AddressToStringW RtlUnwind RtlIpv6AddressToStringW

shlwapi

AssocQueryStringW PathFindFileNameW PathFindExtensionW PathAddBackslashW PathCreateFromUrlW PathSetDlgItemPathW PathRemoveExtensionW PathFileExistsW PathIsDirectoryW PathCanonicalizeW PathRemoveFileSpecW

d2d1

ord3 ord1 ord2

rpcrt4

UuidToStringW RpcStringFreeW

wtsapi32

WTSRegisterSessionNotification WTSUnRegisterSessionNotification

kernel32

ReadConsoleW GetConsoleMode GetFileType GetStdHandle ExitProcess GetModuleHandleExW FreeLibraryAndExitThread WriteConsoleW CompareStringW ResumeThread ExitThread GetFileAttributesExW TlsFree TlsSetValue TlsGetValue TlsAlloc InterlockedFlushSList InitializeSListHead GetCurrentProcessId GetStartupInfoW IsDebuggerPresent IsProcessorFeaturePresent SetUnhandledExceptionFilter UnhandledExceptionFilter CreateEventW WaitForSingleObjectEx ResetEvent SetEvent GetCPInfo CompareStringEx LCMapStringEx DecodePointer GetFileAttributesW WritePrivateProfileStringW GetPrivateProfileSectionNamesW GetPrivateProfileSectionW GetCurrentThreadId GetModuleHandleW FindFirstFileW GetProcAddress FreeLibrary FindNextFileW FindClose GetLocaleInfoW GetUserDefaultUILanguage GetPrivateProfileIntW ReleaseMutex CreateFileW WriteFile CloseHandle MultiByteToWideChar GetTempPathW GetTempFileNameW DeleteFileW GetPrivateProfileStringW CreateDirectoryW RemoveDirectoryW WaitForSingleObject WritePrivateProfileSectionW GetLastError GetVersionExW LoadLibraryExW MoveFileW ReadFile FindFirstFileExW DeleteCriticalSection TryEnterCriticalSection EnterCriticalSection LeaveCriticalSection GetSystemTimes GetSystemInfo GetDriveTypeW GetDiskFreeSpaceExW GetVolumeInformationW GlobalMemoryStatusEx GetModuleFileNameW GetLongPathNameW SetDllDirectoryW CreateThread FileTimeToLocalFileTime GetTimeZoneInformation GetNativeSystemInfo GetTickCount64 GetComputerNameW GetCurrentProcess LocalFree SystemTimeToFileTime FileTimeToSystemTime GetSystemTime IsValidLocale GetTimeFormatW GetDateFormatW GetLocalTime FormatMessageW TerminateThread GetShortPathNameW UnmapViewOfFile OpenFileMappingW MapViewOfFile GetSystemWow64DirectoryW OpenProcess TerminateProcess ReadProcessMemory LoadLibraryW VerifyVersionInfoW CreateMutexW BeginUpdateResourceW FindResourceW SizeofResource LoadResource LockResource UpdateResourceW EndUpdateResourceW SetFileAttributesW GetFileSizeEx SetFilePointerEx SetEndOfFile LocalAlloc GetExitCodeProcess GetCurrentDirectoryW SetLastError Sleep SetCurrentDirectoryW InitializeCriticalSectionEx InitializeCriticalSectionAndSpinCount GlobalAlloc GlobalLock GlobalUnlock GlobalFree CreateToolhelp32Snapshot Process32FirstW Process32NextW HeapFree GetProcessHeap HeapAlloc HeapSize EncodePointer GetStringTypeW GetLocaleInfoEx QueryPerformanceFrequency QueryPerformanceCounter CreateFileA GetModuleHandleA SetFilePointer GetFileTime GetFileSize GetUserDefaultLocaleName CreateFileMappingW LCMapStringW WideCharToMultiByte ExpandEnvironmentStringsW LoadLibraryExA VirtualQuery VirtualProtect RaiseException GetUserDefaultLCID EnumSystemLocalesW SetStdHandle SetEnvironmentVariableW GetConsoleOutputCP IsValidCodePage FreeEnvironmentStringsW GetACP GetOEMCP HeapReAlloc FlushFileBuffers CreateProcessW MoveFileExW GetCommandLineA GetCommandLineW GetEnvironmentStringsW GetSystemTimeAsFileTime

user32

EmptyClipboard SetClipboardData CloseClipboard RegisterWindowMessageW CopyIcon LoadStringW MapDialogRect RegisterClassW IsWindow DestroyCursor LoadCursorW LoadCursorFromFileW DestroyIcon LoadIconW IntersectRect GetLastInputInfo GetSystemMetrics SendInput GetMessageExtraInfo KillTimer SetTimer GetWindowTextLengthW FlashWindow SetFocus ScreenToClient GetDlgCtrlID GetFocus InvalidateRect TrackMouseEvent ShowScrollBar SendDlgItemMessageW CreateWindowExW OpenClipboard GetMessagePos EnumWindows GetClassNameW GetShellWindow EnumDisplayMonitors MonitorFromPoint EnumDisplaySettingsW EnumDisplayDevicesW GetMonitorInfoW UnhookWinEvent SetWinEventHook IsDialogMessageW GetRawInputData CreateDialogIndirectParamW GetParent SetCursor GetAncestor IsWindowVisible UpdateLayeredWindow LoadMenuW MessageBoxW MonitorFromRect GetWindow RegisterRawInputDevices RegisterClassExW SendMessageTimeoutW DispatchMessageW MoveWindow MapWindowPoints GetWindowRect EndDialog DialogBoxParamW FindWindowW SetWindowTextW SetWindowLongW GetSysColor GetKeyState GetWindowTextW LoadImageW SetWindowPlacement SetWindowPos ShowWindow GetWindowPlacement GetDlgItem BringWindowToTop EnableWindow DestroyWindow CreateDialogParamW ReleaseDC DrawFrameControl IsWindowEnabled GetDC GetClientRect SendMessageW EnumChildWindows SystemParametersInfoW SetMenuItemInfoW GetMenuItemInfoW AppendMenuW GetMenuStringW GetMenuState ModifyMenuW CheckMenuRadioItem TrackPopupMenu SetForegroundWindow AttachThreadInput GetWindowThreadProcessId GetForegroundWindow CreatePopupMenu HiliteMenuItem GetSubMenu CheckMenuItem EnableMenuItem SetMenuDefaultItem InsertMenuW DeleteMenu GetMenuItemCount DestroyMenu WindowFromPoint GetCursorPos PostMessageW TranslateMessage GetMessageW PostQuitMessage FindWindowExW DefWindowProcW UnregisterClassW GetWindowLongW

gdi32

CreateRoundRectRgn CreateEllipticRgn GetObjectW CreateSolidBrush DeleteObject CreateRectRgn GetPixel CombineRgn CreateFontIndirectW

comdlg32

GetOpenFileNameW

advapi32

GetTokenInformation RegEnumValueW RegCloseKey RegEnumKeyExW RegQueryInfoKeyW RegOpenKeyExW RegOpenKeyW GetUserNameW OpenProcessToken RegSetValueExW ConvertSidToStringSidW IsValidSid RegQueryValueExW

shell32

SHFileOperationW SHBrowseForFolderW SHGetPathFromIDListW SHGetFolderPathW SHQueryUserNotificationState SHQueryRecycleBinW SHEmptyRecycleBinW Shell_NotifyIconW Shell_NotifyIconGetRect ShellExecuteExW ShellExecuteW

ole32

CoTaskMemFree CoCreateInstance StringFromGUID2 CoUninitialize CoCreateGuid CoInitialize CoInitializeEx

oleaut32

SysFreeString SysAllocString

d3d11

D3D11CreateDevice

dwrite

DWriteCreateFactory

Rainmeter.exe

IMPHASH 9a66e65f22017f3d7b9d3b2daf36e546
SHA256 4bb118165ff97683c9d188a7b49075142d3a6d40a91222ac436faba58714c615
MD5 2588f7768cc525b7b6530f077486341d
SHA1 36ddc233bf176004911911fbb79bb4963861037b
SHA512 b37b90df0cb4d54794813f01c3e7c6f49c196f89f60fa5f85c96daffede6dc2c4dd6afc0f58bd852703c4b5323d3e890ef6743371395ea5a4ba2ea73f61df155
SSDEEP 1536:Rp3QVCSl4ckovg4BmO2PHAmxbd3RHs6MNgu1B9c2ei/:/gVJlmoTmO2vBp4Ngs94g
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x86 arch:x86

Digest

63:4e:15:6d:37:96:55:c6:4e:0a:a8:d1:2c:27:5a:8a:68:1f:66:af:90:a9:00:ec:de:c2:66:f9:83:f6:98:ce

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Firebit OU,OU=IT,O=Firebit OU,POSTALCODE=15551,STREET=Sepapaja tn 6,L=Tallinn,ST=Harjumaa,C=EE

Chains

Jul 31, 2023

CN=Firebit OU,OU=IT,O=Firebit OU,POSTALCODE=15551,STREET=Sepapaja tn 6,L=Tallinn,ST=Harjumaa,C=EE

CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Subject

CN=Firebit OU,OU=IT,O=Firebit OU,POSTALCODE=15551,STREET=Sepapaja tn 6,L=Tallinn,ST=Harjumaa,C=EE

Serial Number

d6:aa:3c:89:1f:c2:cb:dd:7e:18:52:57:e9:22:70:1a

Issuer

CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jan 28, 2021 - Jan 28, 2024

Subject

CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Serial Number

1d:a2:48:30:6f:9b:26:18:d0:82:e0:96:7d:33:d3:6a

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning, ExtKeyUsageTimeStamping

Timespan

Nov 2, 2018 - Dec 31, 2030

Subject

CN=Sectigo RSA Time Stamping Signer #4,O=Sectigo Limited,ST=Manchester,C=GB

Serial Number

39:4c:25:e1:7c:a0:6d:27:a8:65:e2:3b:d9:1d:22:d4

Issuer

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

May 3, 2023 - Aug 2, 2034

Subject

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Serial Number

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

May 2, 2019 - Jan 18, 2038

Minor OS version

0

Major OS version

6

Entry point

5184

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\Rainmeter4\x32-Release\Obj\Application\Rainmeter.pdb

Rainmeter.exe.config

SHA256 e46068c9a86eff44d657a2221b128558468820776bb5902cb5948525f642ad3d
MD5 150de4d93067ceb1bb07c2e60fd75cb4
SHA1 134d4f64bb1b05896db12b5abdc29917953f5b0a
SHA512 0dbe4b6dba3fcddefe773b32a20e1123b55d08747e95dfa0b152ce5645b1140a3d0bf5425bda60cf6013278efd0904c38f90b0bd5072f7ab89d0e00326c1c4ed
MD5 SHA1 SHA512

RestartRainmeter.exe

IMPHASH 57d82a4bdac8c9f7729a1f07acfc3aa0
SHA256 9f97b35cac1aacbf7762e0034147d2b1ce1ab2feb327325e4e80899cfaca4f96
MD5 5936d924958d16cf86ad22a65fa52cf3
SHA1 afe1b4ed29257e144798ff6983f49fe895336abf
SHA512 d7815da26f64d7dcab7bd70589ba890c6493d882c53ff0c1f60ebe205925e3474a0167ede2d1575ac1cd63ed936d8db6fe7acfabd75387cea96a79b904bef8f8
SSDEEP 1536:tQYwsWBcdKsyjyNNpiEz/ur5Mrr9ULfvgS3hrnmOehNOvDVAg5HUCzF8jYUT7cYx:tQWKsyGiESr5Mrrq3pnmOeGv3UCzF8jR
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x86 arch:x86

Digest

e1:9d:87:0d:1d:3a:16:97:15:c6:24:29:fc:44:1c:a2:10:f2:e6:08:f7:5b:7b:90:15:88:59:f0:18:d5:a3:72

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Firebit OU,OU=IT,O=Firebit OU,POSTALCODE=15551,STREET=Sepapaja tn 6,L=Tallinn,ST=Harjumaa,C=EE

Chains

Jul 31, 2023

CN=Firebit OU,OU=IT,O=Firebit OU,POSTALCODE=15551,STREET=Sepapaja tn 6,L=Tallinn,ST=Harjumaa,C=EE

CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Subject

CN=Firebit OU,OU=IT,O=Firebit OU,POSTALCODE=15551,STREET=Sepapaja tn 6,L=Tallinn,ST=Harjumaa,C=EE

Serial Number

d6:aa:3c:89:1f:c2:cb:dd:7e:18:52:57:e9:22:70:1a

Issuer

CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jan 28, 2021 - Jan 28, 2024

Subject

CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Serial Number

1d:a2:48:30:6f:9b:26:18:d0:82:e0:96:7d:33:d3:6a

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning, ExtKeyUsageTimeStamping

Timespan

Nov 2, 2018 - Dec 31, 2030

Subject

CN=Sectigo RSA Time Stamping Signer #4,O=Sectigo Limited,ST=Manchester,C=GB

Serial Number

39:4c:25:e1:7c:a0:6d:27:a8:65:e2:3b:d9:1d:22:d4

Issuer

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

May 3, 2023 - Aug 2, 2034

Subject

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Serial Number

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

May 2, 2019 - Jan 18, 2038

Minor OS version

0

Major OS version

6

Entry point

29296

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\Rainmeter4\x32-Release\Obj\RestartRainmeter\RestartRainmeter.pdb

kernel32

SetErrorMode CreateMutexW ReleaseMutex CreateToolhelp32Snapshot GetLastError Process32NextW Process32FirstW CloseHandle WriteConsoleW CreateFileW SetFilePointerEx GetConsoleMode GetConsoleOutputCP FlushFileBuffers HeapReAlloc HeapSize GetProcessHeap LCMapStringW QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead IsDebuggerPresent UnhandledExceptionFilter SetUnhandledExceptionFilter GetStartupInfoW IsProcessorFeaturePresent GetModuleHandleW GetCurrentProcess TerminateProcess RaiseException RtlUnwind SetLastError EnterCriticalSection LeaveCriticalSection DeleteCriticalSection InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary GetProcAddress LoadLibraryExW EncodePointer GetStdHandle WriteFile GetModuleFileNameW ExitProcess GetModuleHandleExW HeapAlloc HeapFree FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetCPInfo GetCommandLineA GetCommandLineW MultiByteToWideChar WideCharToMultiByte GetEnvironmentStringsW FreeEnvironmentStringsW SetStdHandle GetFileType GetStringTypeW DecodePointer

user32

PostQuitMessage KillTimer GetMessageW DefWindowProcW PostMessageW CreateWindowExW UnregisterClassW RegisterClassExW DispatchMessageW SetTimer TranslateMessage FindWindowW

shell32

ShellExecuteExW ShellExecuteW

ole32

CoInitializeEx CoUninitialize

SkinInstaller.exe

IMPHASH d1c635d2dd9d0f09293048819fd6e737
SHA256 4ecbaecdb5919e654383cb6d1fe968784a50f348bbf2c5fedbe179c8b36c2e06
MD5 d401bdeb6a9c5ff06b336a4e40184893
SHA1 7e0b3015cc4b53df55a6f8d02ea2f584bd65cb28
SHA512 b0eec568967656709da66283b78b94b1b379937808019577441d9b2fdbb9d461b11249c407a1cd57553ec72d4b167bdf374d386a3a1f3472758e68084e0e3b58
SSDEEP 768:TLCxdCZeXbswvsTcxY4lmL9KKtfkkIxBQsTO0fYVus1AIQcWUFsivqEFiR7la:TCdkOfvsC8KK90vQsG2ufFscqeiZla
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x86 arch:x86

Digest

4b:b6:2d:5b:b0:23:b2:ef:4e:be:ec:33:82:61:48:bb:a8:ba:e9:16:51:ba:25:8c:41:fa:9e:9d:52:4b:2b:bb

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Firebit OU,OU=IT,O=Firebit OU,POSTALCODE=15551,STREET=Sepapaja tn 6,L=Tallinn,ST=Harjumaa,C=EE

Chains

Jul 31, 2023

CN=Firebit OU,OU=IT,O=Firebit OU,POSTALCODE=15551,STREET=Sepapaja tn 6,L=Tallinn,ST=Harjumaa,C=EE

CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Subject

CN=Firebit OU,OU=IT,O=Firebit OU,POSTALCODE=15551,STREET=Sepapaja tn 6,L=Tallinn,ST=Harjumaa,C=EE

Serial Number

d6:aa:3c:89:1f:c2:cb:dd:7e:18:52:57:e9:22:70:1a

Issuer

CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jan 28, 2021 - Jan 28, 2024

Subject

CN=Sectigo RSA Code Signing CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Serial Number

1d:a2:48:30:6f:9b:26:18:d0:82:e0:96:7d:33:d3:6a

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning, ExtKeyUsageTimeStamping

Timespan

Nov 2, 2018 - Dec 31, 2030

Subject

CN=Sectigo RSA Time Stamping Signer #4,O=Sectigo Limited,ST=Manchester,C=GB

Serial Number

39:4c:25:e1:7c:a0:6d:27:a8:65:e2:3b:d9:1d:22:d4

Issuer

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Key Usages

KeyUsageDigitalSignature, KeyUsageContentCommitment

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

May 3, 2023 - Aug 2, 2034

Subject

CN=Sectigo RSA Time Stamping CA,O=Sectigo Limited,L=Salford,ST=Greater Manchester,C=GB

Serial Number

30:0f:6f:ac:dd:66:98:74:7c:a9:46:36:a7:78:2d:b9

Issuer

CN=USERTrust RSA Certification Authority,O=The USERTRUST Network,L=Jersey City,ST=New Jersey,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

May 2, 2019 - Jan 18, 2038

Minor OS version

0

Major OS version

6

Entry point

4720

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\Rainmeter4\x32-Release\Obj\SkinInstallerLauncher\SkinInstaller.pdb

VisualElements/Rainmeter_176.png

SHA256 8d7877fbd9c13ab4c7b6f00ba461f564775fdf89a05b2381d6d4f26d4c099b84
MD5 3e92cd2c272056f0fa1a5ebc3b4c1549
SHA1 d7761bf8c289548c5d2f88ac00a0642d70bca320
SHA512 3ae97c155ba1fd1a05301671b6acc0adfe137d5488e8c61e8ad53aa1b54cd44a95b444433e1144d139487ab09be48c24c9c73d5eeb20ddef922340d9349c9803
SSDEEP 192:jvPwCpW7HpOWz1lAe7KUMpyDZm2sF6tTlu3KsXs:jQaKcWJlAQFzDZxsGTlu3s
MD5 SHA1 SHA512 SSDEEP

VisualElements/Rainmeter_600.png

SHA256 abef784c64c988fbac66c58ffc9ab64bb33642a8d8ceb5cee953dc56f7de0b2f
MD5 c7f56473aa0e6a06df975d9400932eb8
SHA1 30ab28d2e1c838da8cc85a0797c0190118b3858f
SHA512 21465d6e26502920a9dd695189fb2deaa1ad48c4fa1264dfdb8573497608e28f70189181ae9b3eaacb35eff62da780c4c3ee3919d35f8b50c7e4d8d76f5ff4ee
SSDEEP 384:CsZvyCpRR/vfhwU+zYscbKw0oAArQCx32mL7zokAMf0w1zo8/SK0Sv+v3rYkC:wKlfQs50srQCr/0TVw1E8/eQ+f8f
MD5 SHA1 SHA512 SSDEEP

Resubmissions

Sharing

General

Malware Config

Signatures

File Explorer