d60d4037325fffb49efd9d0a3bf30e91d692af91719b522049bd071d3515d4c1

Sharing

Copy URL

Twitter E-mail

General

Target

d60d4037325fffb49efd9d0a3bf30e91d692af91719b522049bd071d3515d4c1
Size

2.4MB
MD5

e2aa4ac2a16ce042f6d471423e9f2684
SHA1

ef39058571709ebea2659adfb9d01099f08729ca
SHA256

d60d4037325fffb49efd9d0a3bf30e91d692af91719b522049bd071d3515d4c1
SHA512

14987fab79203f93b5fddd1d7f38bfd387c0227cf1f4488499ab1f80a1be659459a256ec602fa02aa9244823c665e900838e8a743197987535eb086f537fe30f
SSDEEP

49152:DB1UpeM6MNjQAEOtF+EEFDPx79IgPY9aMVAz7hd1OTR:DBif9btF+jDPx7KgPY9kxdoR

Score

3^/10

Malware Config

Signatures

Unsigned PE 7 IoCs

Checks for missing Authenticode signature.

resource
d60d4037325fffb49efd9d0a3bf30e91d692af91719b522049bd071d3515d4c1
unpack001/$PLUGINSDIR/LangDLL.dll
unpack001/$PLUGINSDIR/MoreInfo.dll
unpack001/$PLUGINSDIR/System.dll
unpack001/$PLUGINSDIR/UAC.dll
unpack001/$PLUGINSDIR/UserInfo.dll
unpack001/$PLUGINSDIR/nsDialogs.dll

Files

d60d4037325fffb49efd9d0a3bf30e91d692af91719b522049bd071d3515d4c1
.exe windows:4 windows x86 arch:x86

61259b55b8912888e90f516ca08dc514

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

Imports

advapi32

RegCreateKeyExW
RegEnumKeyW
RegQueryValueExW
RegSetValueExW
RegCloseKey
RegDeleteValueW
RegDeleteKeyW
AdjustTokenPrivileges
LookupPrivilegeValueW
OpenProcessToken
SetFileSecurityW
RegOpenKeyExW
RegEnumValueW

shell32

SHGetSpecialFolderLocation
SHFileOperationW
SHBrowseForFolderW
SHGetPathFromIDListW
ShellExecuteExW
SHGetFileInfoW

ole32

OleInitialize
OleUninitialize
CoCreateInstance
IIDFromString
CoTaskMemFree

comctl32

ord17
ImageList_Create
ImageList_Destroy
ImageList_AddMasked

user32

GetClientRect
EndPaint
DrawTextW
IsWindowEnabled
DispatchMessageW
wsprintfA
CharNextA
CharPrevW
MessageBoxIndirectW
GetDlgItemTextW
SetDlgItemTextW
GetSystemMetrics
FillRect
AppendMenuW
TrackPopupMenu
OpenClipboard
SetClipboardData
CloseClipboard
IsWindowVisible
CallWindowProcW
GetMessagePos
CheckDlgButton
LoadCursorW
SetCursor
GetSysColor
SetWindowPos
GetWindowLongW
PeekMessageW
SetClassLongW
GetSystemMenu
EnableMenuItem
GetWindowRect
ScreenToClient
EndDialog
RegisterClassW
SystemParametersInfoW
CreateWindowExW
GetClassInfoW
DialogBoxParamW
CharNextW
ExitWindowsEx
DestroyWindow
CreateDialogParamW
SetTimer
SetWindowTextW
PostQuitMessage
SetForegroundWindow
ShowWindow
wsprintfW
SendMessageTimeoutW
FindWindowExW
IsWindow
GetDlgItem
SetWindowLongW
LoadImageW
GetDC
ReleaseDC
EnableWindow
InvalidateRect
SendMessageW
DefWindowProcW
BeginPaint
EmptyClipboard
CreatePopupMenu

gdi32

SetBkMode
SetBkColor
GetDeviceCaps
CreateFontIndirectW
CreateBrushIndirect
DeleteObject
SetTextColor
SelectObject

kernel32

GetExitCodeProcess
WaitForSingleObject
GetModuleHandleA
GetProcAddress
GetSystemDirectoryW
lstrcatW
Sleep
lstrcpyA
WriteFile
GetTempFileNameW
lstrcmpiA
RemoveDirectoryW
CreateProcessW
CreateDirectoryW
GetLastError
CreateThread
GlobalLock
GlobalUnlock
GetDiskFreeSpaceW
WideCharToMultiByte
lstrcpynW
lstrlenW
SetErrorMode
GetVersionExW
GetCommandLineW
GetTempPathW
GetWindowsDirectoryW
SetEnvironmentVariableW
CopyFileW
ExitProcess
GetCurrentProcess
GetModuleFileNameW
GetFileSize
CreateFileW
GetTickCount
MulDiv
SetFileAttributesW
GetFileAttributesW
SetCurrentDirectoryW
MoveFileW
GetFullPathNameW
GetShortPathNameW
SearchPathW
CompareFileTime
SetFileTime
CloseHandle
lstrcmpiW
lstrcmpW
ExpandEnvironmentStringsW
GlobalFree
GlobalAlloc
GetModuleHandleW
LoadLibraryExW
MoveFileExW
FreeLibrary
WritePrivateProfileStringW
GetPrivateProfileStringW
lstrlenA
MultiByteToWideChar
ReadFile
SetFilePointer
FindClose
FindNextFileW
FindFirstFileW
DeleteFileW

Sections

.text
Size: 26KB - Virtual size: 25KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1KB - Virtual size: 128KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.ndata
Size: - Virtual size: 140KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 35KB - Virtual size: 34KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
$PLUGINSDIR/LangDLL.dll
.dll windows:4 windows x86 arch:x86

3e8d18bb71c7ebbda2ddc2a4bb03547b

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

lstrlenW
GlobalFree
lstrcpynW
lstrcmpW
GlobalAlloc
MulDiv
GetModuleHandleW
lstrcpyW

user32

DialogBoxParamW
SetDlgItemTextW
SendDlgItemMessageW
EndDialog
SetWindowTextW
LoadIconW
ShowWindow
SendMessageW
GetDC

gdi32

GetDeviceCaps
CreateFontIndirectW
DeleteObject

Exports

Exports

LangDialog

Sections

.text
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 681B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 352B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 352B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/MoreInfo.dll
.dll windows:4 windows x86 arch:x86

149adf074d317fbf0d2f17314bd18969

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

t:\untgz\MoreInfo\SRC\Release\MoreInfo.pdb

Imports

user32

wsprintfW

version

GetFileVersionInfoW
VerQueryValueW
GetFileVersionInfoSizeW

kernel32

lstrlenW
lstrcpyW
lstrcpynW
lstrcatW
GlobalAlloc
GetSystemDirectoryW
GlobalFree

Exports

Exports

GetComments
GetCompanyName
GetFileDescription
GetFileVersion
GetInternalName
GetLegalCopyright
GetLegalTrademarks
GetOSUserinterfaceLanguage
GetOriginalFilename
GetPrivateBuild
GetProductName
GetProductVersion
GetSpecialBuild
GetUserDefined

Sections

.text
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 44B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 188B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/System.dll
.dll windows:4 windows x86 arch:x86

fc0224e99e736751432961db63a41b76

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

GetModuleHandleW
GlobalFree
GlobalSize
lstrcpynW
lstrcpyW
GetProcAddress
WideCharToMultiByte
VirtualFree
FreeLibrary
lstrlenW
LoadLibraryW
GlobalAlloc
MultiByteToWideChar
VirtualAlloc
VirtualProtect
GetLastError

user32

wsprintfW

ole32

StringFromGUID2
CLSIDFromString

Exports

Exports

Alloc
Call
Copy
Free
Get
Int64Op
Store
StrAlloc

Sections

.text
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 867B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 120B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 1024B - Virtual size: 662B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/UAC.dll
.dll windows:4 windows x86 arch:x86

0ef725341a4aecf8398c0e2132f38049

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

SetLastError
GetCurrentProcessId
GetCommandLineW
GetProcAddress
CreateThread
GlobalFree
LoadLibraryA
OpenProcess
GlobalAlloc
CreateFileMappingW
Sleep
MapViewOfFile
GetModuleHandleW
UnmapViewOfFile
CreateEventW
SetCurrentDirectoryW
GetVersionExW
GetExitCodeProcess
lstrcatW
LocalFree
GetPrivateProfileStringW
FormatMessageW
GetPrivateProfileIntW
CreateProcessW
CloseHandle
GetLastError
DuplicateHandle
GetCurrentThreadId
lstrlenW
SetEvent
WaitForSingleObject
lstrcmpiW
GetExitCodeThread
GetModuleFileNameW

user32

SetWindowPos
GetClientRect
GetWindowThreadProcessId
SetWindowLongW
DefWindowProcW
GetDlgItem
CallWindowProcW
CallNextHookEx
GetClassNameW
PeekMessageW
DestroyWindow
SendMessageW
SetForegroundWindow
IsWindowVisible
MsgWaitForMultipleObjects
LoadStringW
EndDialog
EnableWindow
DialogBoxParamW
LoadImageW
MessageBoxW
GetWindowLongW
DispatchMessageW
ShowWindow
wsprintfW
CreateDialogParamW
GetWindowRect
IsDialogMessageW
FindWindowExW
CharNextW
CreateWindowExW
LoadIconW
PostMessageW
SetWindowsHookExW
UnhookWindowsHookEx
TranslateMessage

shell32

ShellExecuteExW

advapi32

OpenServiceW
QueryServiceStatus
CloseServiceHandle
OpenProcessToken
OpenSCManagerW
GetUserNameW
AdjustTokenPrivileges
LookupPrivilegeValueW
GetTokenInformation
EqualSid

ole32

CoInitialize

Exports

Exports

_

Sections

.text
Size: 11KB - Virtual size: 10KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 100B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 488B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/UserInfo.dll
.dll windows:4 windows x86 arch:x86

5e62e8e248e7364886b604bd1fcf4c13

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

advapi32

FreeSid
EqualSid
AllocateAndInitializeSid
GetTokenInformation
OpenProcessToken
OpenThreadToken
GetUserNameW

kernel32

GlobalFree
GetVersion
GlobalAlloc
CloseHandle
GetModuleHandleA
GetLastError
GetCurrentProcess
GetCurrentThread
GetProcAddress
lstrcpynW

Exports

Exports

GetAccountType
GetName
GetOriginalAccountType

Sections

.text
Size: 1024B - Virtual size: 714B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1024B - Virtual size: 705B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 104B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 240B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
$PLUGINSDIR/modern-wizard.bmp
$PLUGINSDIR/nsDialogs.dll
.dll windows:4 windows x86 arch:x86

6b5c4f7d679059f68f1269aad3a5cecd

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

kernel32

GetFileAttributesW
lstrcpyW
MulDiv
lstrlenW
HeapFree
GetCurrentDirectoryW
lstrcmpiW
GetProcessHeap
HeapReAlloc
GlobalFree
lstrcpynW
GlobalAlloc
SetCurrentDirectoryW
HeapAlloc

user32

DestroyWindow
CallWindowProcW
SetCursor
LoadCursorW
GetPropW
CharPrevW
DrawFocusRect
GetWindowLongW
DrawTextW
GetClientRect
SetWindowLongW
GetDlgItem
GetSysColor
SetWindowPos
CreateDialogParamW
MapDialogRect
GetWindowRect
SetPropW
CreateWindowExW
IsWindow
SetTimer
KillTimer
DispatchMessageW
TranslateMessage
GetMessageW
IsDialogMessageW
ShowWindow
wsprintfW
CharNextW
SendMessageW
MapWindowPoints
RemovePropW
GetWindowTextW

gdi32

SetTextColor

shell32

SHBrowseForFolderW
SHGetPathFromIDListW

comdlg32

GetSaveFileNameW
GetOpenFileNameW
CommDlgExtendedError

ole32

CoTaskMemFree

Exports

Exports

Create
CreateControl
CreateItem
CreateTimer
GetUserData
KillTimer
OnBack
OnChange
OnClick
OnNotify
SelectFileDialog
SelectFolderDialog
SetRTL
SetUserData
Show

Sections

.text
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 152B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 638B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Plugins/ActionTimer.dll
.dll windows:6 windows x86 arch:x86

25548d1e17eaa3a0e7f6578a43f8f2b3

Code Sign

33:12:24:c0:be:b8:7c:69:0d:91:d0:69:09:1e:97:e1:7c:a1:f1:cb
Certificate

Issuer

CN=Rainmeter Team Root Certificate,O=Rainmeter Team,L=Helsinki,ST=Uusimaa,C=FI,1.2.840.113549.1.9.1=#0c127465616d407261696e6d657465722e6e6574

Not Before

29-02-2024 12:17

Not After

26-02-2034 12:17

Subject

CN=Rainmeter Team

Extended Key Usages

ExtKeyUsageCodeSigning

ed:02:d9:9a:47:af:fe:62:e9:f6:a0:87:ee:87:22:e6:0e:bd:8b:66:02:06:d3:45:95:c2:9a:93:80:6e:b8:ad
Signer

Actual PE Digest

ed:02:d9:9a:47:af:fe:62:e9:f6:a0:87:ee:87:22:e6:0e:bd:8b:66:02:06:d3:45:95:c2:9a:93:80:6e:b8:ad

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

C:\build\x32-Release\Obj\PluginActionTimer\ActionTimer.pdb

Imports

rainmeter

RmReadFormula
RmReplaceVariables
RmReadString
RmLogF
RmGet

user32

SendNotifyMessageW
FindWindowW

kernel32

EncodePointer
DecodePointer
WriteConsoleW
CreateFileW
HeapReAlloc
HeapSize
WakeAllConditionVariable
SleepConditionVariableSRW
GetCurrentThreadId
QueryPerformanceCounter
QueryPerformanceFrequency
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
TryAcquireSRWLockExclusive
CloseHandle
GetSystemTimeAsFileTime
GetModuleHandleW
GetProcAddress
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
GetCurrentProcessId
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW
RaiseException
RtlUnwind
InterlockedFlushSList
GetLastError
SetLastError
GetConsoleMode
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
LoadLibraryExW
CreateThread
ExitThread
FreeLibraryAndExitThread
GetModuleHandleExW
ExitProcess
GetModuleFileNameW
HeapAlloc
HeapFree
LCMapStringW
GetStdHandle
GetFileType
SetFilePointerEx
FindClose
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
GetCommandLineA
GetCommandLineW
MultiByteToWideChar
WideCharToMultiByte
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetProcessHeap
GetStringTypeW
FlushFileBuffers
WriteFile
GetConsoleOutputCP
SetStdHandle

Exports

Exports

ExecuteBang
Finalize
Initialize
Reload
Update

Sections

.text
Size: 98KB - Virtual size: 98KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 584B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Plugins/AdvancedCPU.dll
.dll windows:6 windows x86 arch:x86

b1c624bc684847ef7d30ed2ad0b99f96

Code Sign

33:12:24:c0:be:b8:7c:69:0d:91:d0:69:09:1e:97:e1:7c:a1:f1:cb
Certificate

Issuer

CN=Rainmeter Team Root Certificate,O=Rainmeter Team,L=Helsinki,ST=Uusimaa,C=FI,1.2.840.113549.1.9.1=#0c127465616d407261696e6d657465722e6e6574

Not Before

29-02-2024 12:17

Not After

26-02-2034 12:17

Subject

CN=Rainmeter Team

Extended Key Usages

ExtKeyUsageCodeSigning

d3:70:d1:1f:19:e4:2c:32:0b:9b:16:35:42:01:27:a8:2f:24:42:20:4d:46:2d:9e:c3:c0:9d:7b:c0:1d:38:9f
Signer

Actual PE Digest

d3:70:d1:1f:19:e4:2c:32:0b:9b:16:35:42:01:27:a8:2f:24:42:20:4d:46:2d:9e:c3:c0:9d:7b:c0:1d:38:9f

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

C:\build\x32-Release\Obj\PluginAdvancedCPU\AdvancedCPU.pdb

Imports

rainmeter

RmReadFormula
RmReadString

kernel32

lstrcpyW
IsBadStringPtrW
GetTickCount64
CreateFileW
CloseHandle
WriteConsoleW
lstrlenW
GetModuleFileNameW
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
IsDebuggerPresent
GetStartupInfoW
GetModuleHandleW
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
RaiseException
InterlockedFlushSList
GetLastError
SetLastError
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
RtlUnwind
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
GetProcAddress
LoadLibraryExW
EncodePointer
ExitProcess
GetModuleHandleExW
DecodePointer
HeapFree
HeapAlloc
FindClose
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
GetCommandLineA
GetCommandLineW
MultiByteToWideChar
WideCharToMultiByte
GetEnvironmentStringsW
FreeEnvironmentStringsW
LCMapStringW
GetProcessHeap
GetStdHandle
GetFileType
GetStringTypeW
HeapSize
HeapReAlloc
SetStdHandle
FlushFileBuffers
WriteFile
GetConsoleOutputCP
GetConsoleMode
SetFilePointerEx

user32

wsprintfW

advapi32

RegOpenKeyExW
RegQueryValueExW
RegCloseKey

Exports

Exports

Finalize
GetString
Initialize
Reload
Update

Sections

.text
Size: 81KB - Virtual size: 80KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 568B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Plugins/AudioLevel.dll
.dll windows:6 windows x86 arch:x86

c892355687805396f38824de2aa7a25c

Code Sign

33:12:24:c0:be:b8:7c:69:0d:91:d0:69:09:1e:97:e1:7c:a1:f1:cb
Certificate

Issuer

CN=Rainmeter Team Root Certificate,O=Rainmeter Team,L=Helsinki,ST=Uusimaa,C=FI,1.2.840.113549.1.9.1=#0c127465616d407261696e6d657465722e6e6574

Not Before

29-02-2024 12:17

Not After

26-02-2034 12:17

Subject

CN=Rainmeter Team

Extended Key Usages

ExtKeyUsageCodeSigning

f6:ce:c1:a6:eb:f0:8c:a9:5d:7f:09:96:7f:dd:63:23:e9:9f:94:5f:fc:6c:7a:76:bd:4e:a9:99:45:2b:97:bd
Signer

Actual PE Digest

f6:ce:c1:a6:eb:f0:8c:a9:5d:7f:09:96:7f:dd:63:23:e9:9f:94:5f:fc:6c:7a:76:bd:4e:a9:99:45:2b:97:bd

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

C:\build\x32-Release\Obj\PluginAudioLevel\AudioLevel.pdb

Imports

rainmeter

RmReadString
RmLogF
LSLog
RmReadFormula
RmGet

kernel32

HeapAlloc
CreateFileW
DecodePointer
QueryPerformanceFrequency
QueryPerformanceCounter
CloseHandle
HeapReAlloc
HeapSize
GetConsoleMode
GetConsoleOutputCP
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
IsDebuggerPresent
GetStartupInfoW
GetModuleHandleW
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
RaiseException
InterlockedFlushSList
GetLastError
SetLastError
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
RtlUnwind
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
GetProcAddress
LoadLibraryExW
EncodePointer
ExitProcess
GetModuleHandleExW
GetModuleFileNameW
WriteConsoleW
HeapFree
GetStdHandle
GetFileType
LCMapStringW
FindClose
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
GetCommandLineA
GetCommandLineW
MultiByteToWideChar
WideCharToMultiByte
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetProcessHeap
GetStringTypeW
GetFileSizeEx
SetFilePointerEx
SetStdHandle
FlushFileBuffers
WriteFile

ole32

CoCreateInstance
CoTaskMemFree
PropVariantClear

Exports

Exports

Finalize
GetString
Initialize
Reload
Update

Sections

.text
Size: 155KB - Virtual size: 155KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 576B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Plugins/CoreTemp.dll
.dll windows:6 windows x86 arch:x86

b3001b975b34528faf5a531f3015762c

Code Sign

33:12:24:c0:be:b8:7c:69:0d:91:d0:69:09:1e:97:e1:7c:a1:f1:cb
Certificate

Issuer

CN=Rainmeter Team Root Certificate,O=Rainmeter Team,L=Helsinki,ST=Uusimaa,C=FI,1.2.840.113549.1.9.1=#0c127465616d407261696e6d657465722e6e6574

Not Before

29-02-2024 12:17

Not After

26-02-2034 12:17

Subject

CN=Rainmeter Team

Extended Key Usages

ExtKeyUsageCodeSigning

1c:6e:ef:ed:10:b5:d3:a3:5b:c6:b5:7b:e6:0e:e4:df:42:83:e4:48:74:c1:5a:d0:73:75:f4:22:04:90:75:c2
Signer

Actual PE Digest

1c:6e:ef:ed:10:b5:d3:a3:5b:c6:b5:7b:e6:0e:e4:df:42:83:e4:48:74:c1:5a:d0:73:75:f4:22:04:90:75:c2

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

C:\build\x32-Release\Obj\PluginCoreTemp\CoreTemp.pdb

Imports

rainmeter

RmReadFormula
RmLogF
RmReadString

kernel32

GetModuleFileNameW
CreateFileW
DecodePointer
GetLastError
SetLastError
CreateMutexW
WaitForSingleObject
ReleaseMutex
OpenFileMappingW
UnmapViewOfFile
CloseHandle
MapViewOfFile
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
IsDebuggerPresent
GetStartupInfoW
GetModuleHandleW
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
RaiseException
InterlockedFlushSList
RtlUnwind
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
GetProcAddress
LoadLibraryExW
EncodePointer
ExitProcess
GetModuleHandleExW
WriteConsoleW
HeapFree
HeapAlloc
GetStdHandle
GetFileType
FindClose
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
GetCommandLineA
GetCommandLineW
MultiByteToWideChar
WideCharToMultiByte
GetEnvironmentStringsW
FreeEnvironmentStringsW
LCMapStringW
GetProcessHeap
GetStringTypeW
SetFilePointerEx
SetStdHandle
HeapSize
HeapReAlloc
FlushFileBuffers
WriteFile
GetConsoleOutputCP
GetConsoleMode

Exports

Exports

Finalize
GetString
Initialize
Reload
Update

Sections

.text
Size: 100KB - Virtual size: 99KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 7KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 584B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Plugins/FileView.dll
.dll windows:6 windows x86 arch:x86

fcc7a5b7ccc6ddbfa817dcc3f0cdb7b7

Code Sign

33:12:24:c0:be:b8:7c:69:0d:91:d0:69:09:1e:97:e1:7c:a1:f1:cb
Certificate

Issuer

CN=Rainmeter Team Root Certificate,O=Rainmeter Team,L=Helsinki,ST=Uusimaa,C=FI,1.2.840.113549.1.9.1=#0c127465616d407261696e6d657465722e6e6574

Not Before

29-02-2024 12:17

Not After

26-02-2034 12:17

Subject

CN=Rainmeter Team

Extended Key Usages

ExtKeyUsageCodeSigning

9b:d3:36:91:27:2f:ae:7e:f5:70:34:c1:1c:4c:8a:56:4c:dc:85:e6:b6:fa:a8:0b:9b:ea:cf:08:af:d0:e8:51
Signer

Actual PE Digest

9b:d3:36:91:27:2f:ae:7e:f5:70:34:c1:1c:4c:8a:56:4c:dc:85:e6:b6:fa:a8:0b:9b:ea:cf:08:af:d0:e8:51

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

C:\build\x32-Release\Obj\PluginFileView\FileView.pdb

Imports

shlwapi

PathMatchSpecW

rainmeter

RmReplaceVariables
RmGet
RmReadFormula
RmLogF
RmPathToAbsolute
RmReadString
RmLog
RmExecute

kernel32

HeapReAlloc
HeapSize
GetCurrentDirectoryW
ReadConsoleW
ReadFile
FlushFileBuffers
GetLogicalDrives
CompareFileTime
FindFirstFileExW
EnterCriticalSection
FindNextFileW
InitializeCriticalSectionAndSpinCount
LeaveCriticalSection
InitializeCriticalSectionEx
FindClose
GetPrivateProfileStringW
FileTimeToSystemTime
DisableThreadLibraryCalls
SetEndOfFile
CloseHandle
GetTimeFormatW
DeleteCriticalSection
VerSetConditionMask
SystemTimeToFileTime
VerifyVersionInfoW
SystemTimeToTzSpecificLocalTime
GetDateFormatW
SetStdHandle
CreateFileW
GetStringTypeW
GetFileType
GetStdHandle
GetProcessHeap
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
GetCommandLineA
WriteConsoleW
TerminateThread
GetSystemTimeAsFileTime
GetCPInfo
GetOEMCP
GetACP
IsValidCodePage
WideCharToMultiByte
MultiByteToWideChar
GetDriveTypeW
SetFilePointerEx
GetFileSizeEx
IsProcessorFeaturePresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsDebuggerPresent
GetStartupInfoW
GetModuleHandleW
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
DecodePointer
InitializeSListHead
RaiseException
InterlockedFlushSList
GetLastError
SetLastError
RtlUnwind
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
GetProcAddress
LoadLibraryExW
EncodePointer
CreateThread
ExitThread
FreeLibraryAndExitThread
GetModuleHandleExW
GetFullPathNameW
ExitProcess
GetModuleFileNameW
HeapFree
HeapAlloc
LCMapStringW
WriteFile
GetConsoleOutputCP
GetConsoleMode

user32

ReleaseDC
GetCursorPos
DestroyMenu
DestroyIcon
CreatePopupMenu
GetIconInfo
GetDC
GetWindowRect
TrackPopupMenuEx
PrivateExtractIconsW

gdi32

GetObjectW
DeleteObject
GetDIBits

shell32

SHParseDisplayName
ShellExecuteExW
SHBindToParent
ord727
SHGetFileInfoW

ole32

CoInitializeEx
CoUninitialize

Exports

Exports

ExecuteBang
Finalize
GetString
Initialize
Reload
Update

Sections

.text
Size: 156KB - Virtual size: 156KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 584B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Plugins/FolderInfo.dll
.dll windows:6 windows x86 arch:x86

c47e972939d7b0157e16d0daf4975b22

Code Sign

33:12:24:c0:be:b8:7c:69:0d:91:d0:69:09:1e:97:e1:7c:a1:f1:cb
Certificate

Issuer

CN=Rainmeter Team Root Certificate,O=Rainmeter Team,L=Helsinki,ST=Uusimaa,C=FI,1.2.840.113549.1.9.1=#0c127465616d407261696e6d657465722e6e6574

Not Before

29-02-2024 12:17

Not After

26-02-2034 12:17

Subject

CN=Rainmeter Team

Extended Key Usages

ExtKeyUsageCodeSigning

49:85:4e:fa:78:a3:46:d0:b9:6e:be:ea:2f:62:1e:7c:07:9e:a2:14:56:99:49:4f:ee:8a:65:33:fa:09:d5:c6
Signer

Actual PE Digest

49:85:4e:fa:78:a3:46:d0:b9:6e:be:ea:2f:62:1e:7c:07:9e:a2:14:56:99:49:4f:ee:8a:65:33:fa:09:d5:c6

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

C:\build\x32-Release\Obj\PluginFolderInfo\FolderInfo.pdb

Imports

rainmeter

RmReadFormula
RmPathToAbsolute
RmReadString
RmGet
ord6
ord5

kernel32

GetModuleFileNameW
CreateFileW
CloseHandle
DecodePointer
FindFirstFileW
FindNextFileW
FindClose
GetTickCount64
GetConsoleMode
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
IsDebuggerPresent
GetStartupInfoW
GetModuleHandleW
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
RaiseException
InterlockedFlushSList
GetLastError
SetLastError
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
RtlUnwind
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
GetProcAddress
LoadLibraryExW
EncodePointer
ExitProcess
GetModuleHandleExW
WriteConsoleW
HeapFree
HeapAlloc
GetStdHandle
GetFileType
FindFirstFileExW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
GetCommandLineA
GetCommandLineW
MultiByteToWideChar
WideCharToMultiByte
GetEnvironmentStringsW
FreeEnvironmentStringsW
LCMapStringW
GetProcessHeap
GetStringTypeW
SetFilePointerEx
SetStdHandle
HeapSize
HeapReAlloc
FlushFileBuffers
WriteFile
GetConsoleOutputCP

Exports

Exports

Finalize
Initialize
Reload
Update

Sections

.text
Size: 102KB - Virtual size: 102KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 568B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Plugins/InputText.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Code Sign

33:12:24:c0:be:b8:7c:69:0d:91:d0:69:09:1e:97:e1:7c:a1:f1:cb
Certificate

Issuer

CN=Rainmeter Team Root Certificate,O=Rainmeter Team,L=Helsinki,ST=Uusimaa,C=FI,1.2.840.113549.1.9.1=#0c127465616d407261696e6d657465722e6e6574

Not Before

29-02-2024 12:17

Not After

26-02-2034 12:17

Subject

CN=Rainmeter Team

Extended Key Usages

ExtKeyUsageCodeSigning

52:a0:35:a9:bc:3a:99:3f:03:0f:af:7b:f0:a9:49:19:9e:1d:0c:58:00:4e:54:21:3b:72:85:99:e9:7b:26:34
Signer

Actual PE Digest

52:a0:35:a9:bc:3a:99:3f:03:0f:af:7b:f0:a9:49:19:9e:1d:0c:58:00:4e:54:21:3b:72:85:99:e9:7b:26:34

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

mscoree

_CorDllMain

Exports

Exports

ExecuteBang
Finalize
GetString
Initialize
Reload
Update

Sections

.text
Size: 20KB - Virtual size: 19KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.sdata
Size: 512B - Virtual size: 195B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 800B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 24B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Plugins/PerfMon.dll
.dll windows:6 windows x86 arch:x86

d6311df7e9e9fa35c7f4bf6f36ce56e1

Code Sign

33:12:24:c0:be:b8:7c:69:0d:91:d0:69:09:1e:97:e1:7c:a1:f1:cb
Certificate

Issuer

CN=Rainmeter Team Root Certificate,O=Rainmeter Team,L=Helsinki,ST=Uusimaa,C=FI,1.2.840.113549.1.9.1=#0c127465616d407261696e6d657465722e6e6574

Not Before

29-02-2024 12:17

Not After

26-02-2034 12:17

Subject

CN=Rainmeter Team

Extended Key Usages

ExtKeyUsageCodeSigning

28:4b:9f:f5:04:7b:f4:fc:19:50:f8:95:41:4d:bf:ea:7e:70:ef:94:7e:60:22:cf:06:4f:2a:46:50:95:e4:4e
Signer

Actual PE Digest

28:4b:9f:f5:04:7b:f4:fc:19:50:f8:95:41:4d:bf:ea:7e:70:ef:94:7e:60:22:cf:06:4f:2a:46:50:95:e4:4e

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

C:\build\x32-Release\Obj\PluginPerfMon\PerfMon.pdb

Imports

rainmeter

RmReadFormula
RmReadString

kernel32

IsBadStringPtrW
lstrcpyW
CreateFileW
CloseHandle
WriteConsoleW
lstrlenW
GetModuleFileNameW
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
IsDebuggerPresent
GetStartupInfoW
GetModuleHandleW
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
RaiseException
InterlockedFlushSList
GetLastError
SetLastError
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
RtlUnwind
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
GetProcAddress
LoadLibraryExW
EncodePointer
ExitProcess
GetModuleHandleExW
DecodePointer
HeapFree
HeapAlloc
FindClose
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
GetCommandLineA
GetCommandLineW
MultiByteToWideChar
WideCharToMultiByte
GetEnvironmentStringsW
FreeEnvironmentStringsW
LCMapStringW
GetProcessHeap
GetStdHandle
GetFileType
GetStringTypeW
HeapSize
HeapReAlloc
SetStdHandle
FlushFileBuffers
WriteFile
GetConsoleOutputCP
GetConsoleMode
SetFilePointerEx

user32

wsprintfW

advapi32

RegOpenKeyExW
RegQueryValueExW
RegCloseKey

Exports

Exports

Finalize
Initialize
Reload
Update

Sections

.text
Size: 77KB - Virtual size: 77KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 568B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Plugins/PingPlugin.dll
.dll windows:6 windows x86 arch:x86

dd760caf43effecb12952cdaa5b6b865

Code Sign

33:12:24:c0:be:b8:7c:69:0d:91:d0:69:09:1e:97:e1:7c:a1:f1:cb
Certificate

Issuer

CN=Rainmeter Team Root Certificate,O=Rainmeter Team,L=Helsinki,ST=Uusimaa,C=FI,1.2.840.113549.1.9.1=#0c127465616d407261696e6d657465722e6e6574

Not Before

29-02-2024 12:17

Not After

26-02-2034 12:17

Subject

CN=Rainmeter Team

Extended Key Usages

ExtKeyUsageCodeSigning

df:43:b8:ea:2d:fd:98:12:ea:94:e3:93:f9:1a:3c:73:fd:03:db:ba:a3:2c:bc:6c:70:2b:0b:63:83:57:56:b4
Signer

Actual PE Digest

df:43:b8:ea:2d:fd:98:12:ea:94:e3:93:f9:1a:3c:73:fd:03:db:ba:a3:2c:bc:6c:70:2b:0b:63:83:57:56:b4

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

C:\build\x32-Release\Obj\PluginPing\PingPlugin.pdb

Imports

ws2_32

WSACleanup
FreeAddrInfoW
WSAStartup
GetAddrInfoW
WSAGetLastError

iphlpapi

IcmpSendEcho2
GetIpErrorString
Icmp6CreateFile
Icmp6SendEcho2
IcmpCreateFile
IcmpCloseHandle

rainmeter

RmGet
RmReadFormula
RmLogF
RmReadString
RmExecute

kernel32

CreateFileW
WriteConsoleW
TlsSetValue
SetFilePointerEx
GetConsoleMode
GetConsoleOutputCP
WriteFile
FlushFileBuffers
EnterCriticalSection
GetModuleHandleExW
InitializeCriticalSectionAndSpinCount
LeaveCriticalSection
InitializeCriticalSectionEx
FreeLibraryAndExitThread
FormatMessageW
GetLastError
DisableThreadLibraryCalls
CloseHandle
CreateThread
LocalFree
DeleteCriticalSection
SetStdHandle
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW
GetModuleHandleW
RaiseException
InterlockedFlushSList
RtlUnwind
SetLastError
TlsAlloc
TlsGetValue
DecodePointer
TlsFree
FreeLibrary
GetProcAddress
LoadLibraryExW
EncodePointer
ExitProcess
GetModuleFileNameW
HeapAlloc
HeapFree
FindClose
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
GetCommandLineA
GetCommandLineW
MultiByteToWideChar
WideCharToMultiByte
GetEnvironmentStringsW
FreeEnvironmentStringsW
LCMapStringW
GetProcessHeap
GetStdHandle
GetFileType
GetStringTypeW
HeapSize
HeapReAlloc

Exports

Exports

Finalize
Initialize
Reload
Update

Sections

.text
Size: 75KB - Virtual size: 74KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 568B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Plugins/PowerPlugin.dll
.dll windows:6 windows x86 arch:x86

28658fb492f9db33226fa3c32566a78d

Code Sign

33:12:24:c0:be:b8:7c:69:0d:91:d0:69:09:1e:97:e1:7c:a1:f1:cb
Certificate

Issuer

CN=Rainmeter Team Root Certificate,O=Rainmeter Team,L=Helsinki,ST=Uusimaa,C=FI,1.2.840.113549.1.9.1=#0c127465616d407261696e6d657465722e6e6574

Not Before

29-02-2024 12:17

Not After

26-02-2034 12:17

Subject

CN=Rainmeter Team

Extended Key Usages

ExtKeyUsageCodeSigning

74:e8:8c:3a:ab:bb:35:c3:fa:ef:a4:59:03:cb:0a:14:e1:28:b9:74:e0:47:13:8a:08:cb:c8:a2:c7:de:af:3e
Signer

Actual PE Digest

74:e8:8c:3a:ab:bb:35:c3:fa:ef:a4:59:03:cb:0a:14:e1:28:b9:74:e0:47:13:8a:08:cb:c8:a2:c7:de:af:3e

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

C:\build\x32-Release\Obj\PluginPower\PowerPlugin.pdb

Imports

rainmeter

RmLogF
RmReadString

kernel32

HeapAlloc
WriteConsoleW
CloseHandle
GetSystemPowerStatus
GetLastError
GetSystemInfo
CreateFileW
RaiseException
VirtualProtect
VirtualQuery
FreeLibrary
GetModuleHandleW
GetProcAddress
LoadLibraryExA
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW
InterlockedFlushSList
RtlUnwind
SetLastError
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
LoadLibraryExW
EncodePointer
ExitProcess
GetModuleHandleExW
GetModuleFileNameW
HeapFree
DecodePointer
GetDateFormatW
GetTimeFormatW
CompareStringW
LCMapStringW
GetTimeZoneInformation
FindClose
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
GetCommandLineA
GetCommandLineW
MultiByteToWideChar
WideCharToMultiByte
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableW
GetProcessHeap
GetStdHandle
GetFileType
GetStringTypeW
HeapSize
HeapReAlloc
SetStdHandle
FlushFileBuffers
WriteFile
GetConsoleOutputCP
GetConsoleMode
SetFilePointerEx

Exports

Exports

Finalize
GetString
Initialize
Reload
Update

Sections

.text
Size: 87KB - Virtual size: 87KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 568B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Plugins/QuotePlugin.dll
.dll windows:6 windows x86 arch:x86

57370f325ba7deef6021730c1c29c9dc

Code Sign

33:12:24:c0:be:b8:7c:69:0d:91:d0:69:09:1e:97:e1:7c:a1:f1:cb
Certificate

Issuer

CN=Rainmeter Team Root Certificate,O=Rainmeter Team,L=Helsinki,ST=Uusimaa,C=FI,1.2.840.113549.1.9.1=#0c127465616d407261696e6d657465722e6e6574

Not Before

29-02-2024 12:17

Not After

26-02-2034 12:17

Subject

CN=Rainmeter Team

Extended Key Usages

ExtKeyUsageCodeSigning

b8:a0:49:aa:8d:40:1f:02:1a:1a:22:40:11:3b:49:3d:4a:f9:b3:04:1e:d4:9d:16:4c:66:31:51:80:45:1e:2c
Signer

Actual PE Digest

b8:a0:49:aa:8d:40:1f:02:1a:1a:22:40:11:3b:49:3d:4a:f9:b3:04:1e:d4:9d:16:4c:66:31:51:80:45:1e:2c

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

C:\build\x32-Release\Obj\PluginQuote\QuotePlugin.pdb

Imports

shlwapi

PathIsDirectoryW
PathMatchSpecW

rainmeter

RmReadFormula
RmPathToAbsolute
RmReadString

kernel32

LoadLibraryExW
DecodePointer
SetEndOfFile
HeapReAlloc
HeapSize
CreateFileW
MultiByteToWideChar
LCMapStringW
WideCharToMultiByte
FindFirstFileW
FindNextFileW
FindClose
GetConsoleOutputCP
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
WakeAllConditionVariable
SleepConditionVariableSRW
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
IsDebuggerPresent
GetStartupInfoW
GetModuleHandleW
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
RaiseException
InterlockedFlushSList
GetLastError
SetLastError
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
RtlUnwind
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
GetProcAddress
WriteConsoleW
EncodePointer
ReadFile
ExitProcess
GetModuleHandleExW
GetModuleFileNameW
HeapFree
HeapAlloc
GetStdHandle
GetFileType
SetFilePointerEx
GetConsoleMode
ReadConsoleW
CloseHandle
FindFirstFileExW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
GetCommandLineA
GetCommandLineW
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetProcessHeap
GetStringTypeW
SetStdHandle
FlushFileBuffers
WriteFile

Exports

Exports

Finalize
GetString
Initialize
Reload
Update

Sections

.text
Size: 96KB - Virtual size: 96KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 568B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Plugins/ResMon.dll
.dll windows:6 windows x86 arch:x86

aabaed3bb862f8b1662f7e7aa1ed87ff

Code Sign

33:12:24:c0:be:b8:7c:69:0d:91:d0:69:09:1e:97:e1:7c:a1:f1:cb
Certificate

Issuer

CN=Rainmeter Team Root Certificate,O=Rainmeter Team,L=Helsinki,ST=Uusimaa,C=FI,1.2.840.113549.1.9.1=#0c127465616d407261696e6d657465722e6e6574

Not Before

29-02-2024 12:17

Not After

26-02-2034 12:17

Subject

CN=Rainmeter Team

Extended Key Usages

ExtKeyUsageCodeSigning

8f:85:6e:1f:4f:8f:a9:c5:06:eb:6d:b6:43:ac:bc:7e:5c:b8:e9:7b:d3:e8:04:02:91:26:36:1b:6f:6f:54:5d
Signer

Actual PE Digest

8f:85:6e:1f:4f:8f:a9:c5:06:eb:6d:b6:43:ac:bc:7e:5c:b8:e9:7b:d3:e8:04:02:91:26:36:1b:6f:6f:54:5d

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

C:\build\x32-Release\Obj\PluginResMon\ResMon.pdb

Imports

psapi

EnumProcesses
GetModuleBaseNameW
EnumProcessModules

rainmeter

RmLogF
RmReadString

kernel32

GetModuleFileNameW
WriteConsoleW
CreateFileW
SetFilePointerEx
OpenProcess
CloseHandle
GetProcessHandleCount
GetConsoleMode
GetConsoleOutputCP
WriteFile
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW
GetModuleHandleW
RaiseException
InterlockedFlushSList
RtlUnwind
GetLastError
SetLastError
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
GetProcAddress
LoadLibraryExW
EncodePointer
ExitProcess
GetModuleHandleExW
DecodePointer
HeapFree
HeapAlloc
FindClose
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
GetCommandLineA
GetCommandLineW
MultiByteToWideChar
WideCharToMultiByte
GetEnvironmentStringsW
FreeEnvironmentStringsW
LCMapStringW
GetProcessHeap
GetStdHandle
GetFileType
GetStringTypeW
HeapSize
HeapReAlloc
SetStdHandle
FlushFileBuffers

user32

EnumChildWindows
GetGuiResources

Exports

Exports

Finalize
Initialize
Reload
Update

Sections

.text
Size: 73KB - Virtual size: 73KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 584B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Plugins/RunCommand.dll
.dll windows:6 windows x86 arch:x86

e7eef522e8f275c872f8fc2e4864d1aa

Code Sign

33:12:24:c0:be:b8:7c:69:0d:91:d0:69:09:1e:97:e1:7c:a1:f1:cb
Certificate

Issuer

CN=Rainmeter Team Root Certificate,O=Rainmeter Team,L=Helsinki,ST=Uusimaa,C=FI,1.2.840.113549.1.9.1=#0c127465616d407261696e6d657465722e6e6574

Not Before

29-02-2024 12:17

Not After

26-02-2034 12:17

Subject

CN=Rainmeter Team

Extended Key Usages

ExtKeyUsageCodeSigning

1a:0b:94:9f:43:00:53:9b:b8:60:15:73:be:4d:8d:74:7e:91:1f:0b:70:e8:51:a9:b8:6d:52:70:01:cd:25:e8
Signer

Actual PE Digest

1a:0b:94:9f:43:00:53:9b:b8:60:15:73:be:4d:8d:74:7e:91:1f:0b:70:e8:51:a9:b8:6d:52:70:01:cd:25:e8

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

C:\build\x32-Release\Obj\PluginRunCommand\RunCommand.pdb

Imports

rainmeter

RmExecute
RmReplaceVariables
RmLog
RmLogF
RmReadString
RmReadFormula
RmGet
RmPathToAbsolute

kernel32

IsProcessorFeaturePresent
WriteConsoleW
ReadConsoleW
SetEndOfFile
HeapReAlloc
HeapSize
GetConsoleMode
GetConsoleOutputCP
ReadFile
GetCurrentProcess
WriteFile
GetModuleHandleExW
TerminateProcess
CreatePipe
PeekNamedPipe
WaitForSingleObject
FreeLibraryAndExitThread
DuplicateHandle
DisableThreadLibraryCalls
CloseHandle
CreateProcessW
GetExitCodeProcess
FlushFileBuffers
SetStdHandle
CreateFileW
GetStringTypeW
GetProcessHeap
WideCharToMultiByte
MultiByteToWideChar
LCMapStringW
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
TryAcquireSRWLockExclusive
GetCurrentThreadId
QueryPerformanceCounter
WakeAllConditionVariable
GetSystemTimeAsFileTime
GetModuleHandleW
GetProcAddress
DecodePointer
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcessId
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW
RaiseException
RtlUnwind
InterlockedFlushSList
GetLastError
SetLastError
EncodePointer
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
LoadLibraryExW
CreateThread
ExitThread
ExitProcess
GetModuleFileNameW
HeapFree
HeapAlloc
GetStdHandle
GetFileType
GetFileSizeEx
SetFilePointerEx
FindClose
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
GetCommandLineA
GetCommandLineW
GetEnvironmentStringsW
FreeEnvironmentStringsW

user32

PostMessageW
GetWindowThreadProcessId
EnumWindows

Exports

Exports

ExecuteBang
Finalize
GetString
Initialize
Reload
Update

Sections

.text
Size: 103KB - Virtual size: 103KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 584B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Plugins/SpeedFanPlugin.dll
.dll windows:6 windows x86 arch:x86

d483aaee46df655d33c40104f3965356

Code Sign

33:12:24:c0:be:b8:7c:69:0d:91:d0:69:09:1e:97:e1:7c:a1:f1:cb
Certificate

Issuer

CN=Rainmeter Team Root Certificate,O=Rainmeter Team,L=Helsinki,ST=Uusimaa,C=FI,1.2.840.113549.1.9.1=#0c127465616d407261696e6d657465722e6e6574

Not Before

29-02-2024 12:17

Not After

26-02-2034 12:17

Subject

CN=Rainmeter Team

Extended Key Usages

ExtKeyUsageCodeSigning

84:c2:4e:a5:27:2e:ff:e7:17:60:c4:a5:a7:4c:58:79:9d:f9:f3:c4:b1:1f:40:5a:ea:f8:a8:e5:1a:15:aa:0e
Signer

Actual PE Digest

84:c2:4e:a5:27:2e:ff:e7:17:60:c4:a5:a7:4c:58:79:9d:f9:f3:c4:b1:1f:40:5a:ea:f8:a8:e5:1a:15:aa:0e

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

C:\build\x32-Release\Obj\PluginSpeedFan\SpeedFanPlugin.pdb

Imports

rainmeter

RmReadFormula
RmReadString
LSLog
RmGet

kernel32

HeapFree
CreateFileW
DecodePointer
OpenFileMappingW
UnmapViewOfFile
CloseHandle
MapViewOfFile
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW
GetModuleHandleW
RaiseException
InterlockedFlushSList
RtlUnwind
GetLastError
SetLastError
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
GetProcAddress
LoadLibraryExW
EncodePointer
ExitProcess
GetModuleHandleExW
GetModuleFileNameW
WriteConsoleW
HeapAlloc
GetStdHandle
GetFileType
FindClose
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
GetCommandLineA
GetCommandLineW
MultiByteToWideChar
WideCharToMultiByte
GetEnvironmentStringsW
FreeEnvironmentStringsW
LCMapStringW
GetProcessHeap
GetStringTypeW
SetFilePointerEx
SetStdHandle
HeapSize
HeapReAlloc
FlushFileBuffers
WriteFile
GetConsoleOutputCP
GetConsoleMode

Exports

Exports

Finalize
Initialize
Reload
Update

Sections

.text
Size: 98KB - Virtual size: 98KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 568B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Plugins/UsageMonitor.dll
.dll windows:4 windows x86 arch:x86

dae02f32a21e03ce65412f6e56942daa

Code Sign

33:12:24:c0:be:b8:7c:69:0d:91:d0:69:09:1e:97:e1:7c:a1:f1:cb
Certificate

Issuer

CN=Rainmeter Team Root Certificate,O=Rainmeter Team,L=Helsinki,ST=Uusimaa,C=FI,1.2.840.113549.1.9.1=#0c127465616d407261696e6d657465722e6e6574

Not Before

29-02-2024 12:17

Not After

26-02-2034 12:17

Subject

CN=Rainmeter Team

Extended Key Usages

ExtKeyUsageCodeSigning

2f:89:80:5b:96:56:16:a9:e5:dd:80:ae:92:c4:47:7b:4a:18:b2:79:68:10:d9:7b:c6:eb:42:f2:15:ab:8a:78
Signer

Actual PE Digest

2f:89:80:5b:96:56:16:a9:e5:dd:80:ae:92:c4:47:7b:4a:18:b2:79:68:10:d9:7b:c6:eb:42:f2:15:ab:8a:78

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

Imports

mscoree

_CorDllMain

Exports

Exports

Finalize
GetString
Initialize
Reload
Update

Sections

.text
Size: 23KB - Virtual size: 22KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.sdata
Size: 512B - Virtual size: 172B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 816B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 20B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Plugins/Win7AudioPlugin.dll
.dll windows:6 windows x86 arch:x86

1e59eb2bbcc4adcdc2d2d27c472e6bad

Code Sign

33:12:24:c0:be:b8:7c:69:0d:91:d0:69:09:1e:97:e1:7c:a1:f1:cb
Certificate

Issuer

CN=Rainmeter Team Root Certificate,O=Rainmeter Team,L=Helsinki,ST=Uusimaa,C=FI,1.2.840.113549.1.9.1=#0c127465616d407261696e6d657465722e6e6574

Not Before

29-02-2024 12:17

Not After

26-02-2034 12:17

Subject

CN=Rainmeter Team

Extended Key Usages

ExtKeyUsageCodeSigning

c0:e7:55:8c:a9:14:56:75:76:20:4c:3a:67:da:aa:0a:af:db:98:04:b7:cc:ce:c6:2f:30:3c:09:59:99:bf:04
Signer

Actual PE Digest

c0:e7:55:8c:a9:14:56:75:76:20:4c:3a:67:da:aa:0a:af:db:98:04:b7:cc:ce:c6:2f:30:3c:09:59:99:bf:04

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

C:\build\x32-Release\Obj\PluginWin7Audio\Win7AudioPlugin.pdb

Imports

rainmeter

LSLog

ole32

CoUninitialize
PropVariantClear
CoInitialize
CoCreateInstance
CoTaskMemFree

kernel32

GetStdHandle
WriteConsoleW
CreateFileW
DecodePointer
CloseHandle
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
IsDebuggerPresent
GetStartupInfoW
GetModuleHandleW
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
RaiseException
InterlockedFlushSList
GetLastError
SetLastError
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
RtlUnwind
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
GetProcAddress
LoadLibraryExW
EncodePointer
ExitProcess
GetModuleHandleExW
GetModuleFileNameW
HeapAlloc
HeapFree
GetConsoleOutputCP
GetFileType
FindClose
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
GetCommandLineA
GetCommandLineW
MultiByteToWideChar
WideCharToMultiByte
GetEnvironmentStringsW
FreeEnvironmentStringsW
LCMapStringW
GetProcessHeap
GetStringTypeW
SetStdHandle
SetFilePointerEx
HeapSize
HeapReAlloc
FlushFileBuffers
WriteFile
GetConsoleMode

Exports

Exports

ExecuteBang
Finalize
GetString
Initialize
Reload
Update

Sections

.text
Size: 130KB - Virtual size: 130KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 576B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Plugins/WindowMessagePlugin.dll
.dll windows:6 windows x86 arch:x86

01d2fca22b52cf1a7c801c66c481b311

Code Sign

33:12:24:c0:be:b8:7c:69:0d:91:d0:69:09:1e:97:e1:7c:a1:f1:cb
Certificate

Issuer

CN=Rainmeter Team Root Certificate,O=Rainmeter Team,L=Helsinki,ST=Uusimaa,C=FI,1.2.840.113549.1.9.1=#0c127465616d407261696e6d657465722e6e6574

Not Before

29-02-2024 12:17

Not After

26-02-2034 12:17

Subject

CN=Rainmeter Team

Extended Key Usages

ExtKeyUsageCodeSigning

34:29:cf:fc:1d:37:bd:5f:fe:3f:40:98:15:a2:96:cb:53:51:fc:7a:47:7d:11:f1:d5:25:93:16:ac:e4:f6:df
Signer

Actual PE Digest

34:29:cf:fc:1d:37:bd:5f:fe:3f:40:98:15:a2:96:cb:53:51:fc:7a:47:7d:11:f1:d5:25:93:16:ac:e4:f6:df

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

C:\build\x32-Release\Obj\PluginWindowMessage\WindowMessagePlugin.pdb

Imports

rainmeter

RmReadString
RmLog

user32

GetWindowTextW
FindWindowW
SendMessageW
PostMessageW

kernel32

GetStdHandle
DecodePointer
WriteConsoleW
CreateFileW
CloseHandle
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW
GetModuleHandleW
RaiseException
InterlockedFlushSList
RtlUnwind
GetLastError
SetLastError
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
GetProcAddress
LoadLibraryExW
EncodePointer
ExitProcess
GetModuleHandleExW
GetModuleFileNameW
HeapAlloc
HeapFree
GetFileType
FindClose
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
GetCommandLineA
GetCommandLineW
MultiByteToWideChar
WideCharToMultiByte
GetEnvironmentStringsW
FreeEnvironmentStringsW
LCMapStringW
GetProcessHeap
GetStringTypeW
SetStdHandle
HeapSize
HeapReAlloc
FlushFileBuffers
WriteFile
GetConsoleOutputCP
GetConsoleMode
SetFilePointerEx

Exports

Exports

ExecuteBang
Finalize
GetString
Initialize
Reload
Update

Sections

.text
Size: 101KB - Virtual size: 101KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 568B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Plugins/iTunesPlugin.dll
.dll windows:6 windows x86 arch:x86

3b60a5debcab06429c526c817e684858

Code Sign

33:12:24:c0:be:b8:7c:69:0d:91:d0:69:09:1e:97:e1:7c:a1:f1:cb
Certificate

Issuer

CN=Rainmeter Team Root Certificate,O=Rainmeter Team,L=Helsinki,ST=Uusimaa,C=FI,1.2.840.113549.1.9.1=#0c127465616d407261696e6d657465722e6e6574

Not Before

29-02-2024 12:17

Not After

26-02-2034 12:17

Subject

CN=Rainmeter Team

Extended Key Usages

ExtKeyUsageCodeSigning

69:f3:11:c5:eb:96:e4:8e:94:fc:89:f2:b9:4f:30:cf:1c:80:2b:84:66:c9:cd:87:58:f8:87:da:a2:67:fa:55
Signer

Actual PE Digest

69:f3:11:c5:eb:96:e4:8e:94:fc:89:f2:b9:4f:30:cf:1c:80:2b:84:66:c9:cd:87:58:f8:87:da:a2:67:fa:55

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

C:\build\x32-Release\Obj\PluginiTunes\iTunesPlugin.pdb

Imports

rainmeter

LSLog
ReadConfigString

kernel32

HeapFree
CreateDirectoryW
GetConsoleMode
GetConsoleOutputCP
WriteFile
FlushFileBuffers
WriteConsoleW
CreateFileW
HeapReAlloc
HeapSize
SetStdHandle
CloseHandle
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
IsDebuggerPresent
GetStartupInfoW
GetModuleHandleW
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
LocalFree
GetLastError
RaiseException
InterlockedFlushSList
RtlUnwind
SetLastError
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
EncodePointer
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
GetProcAddress
LoadLibraryExW
QueryPerformanceFrequency
ExitProcess
GetModuleHandleExW
GetModuleFileNameW
SetFilePointerEx
HeapAlloc
GetStdHandle
GetFileType
FindClose
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
GetCommandLineA
GetCommandLineW
MultiByteToWideChar
WideCharToMultiByte
GetEnvironmentStringsW
FreeEnvironmentStringsW
LCMapStringW
GetProcessHeap
GetStringTypeW
DecodePointer

user32

FindWindowW

ole32

OleRun
CoInitialize
CoCreateInstance

oleaut32

SysAllocString
SysFreeString
LoadRegTypeLi

Exports

Exports

ExecuteBang
Finalize
GetPluginAuthor
GetPluginVersion
GetString
Initialize
Update

Sections

.text
Size: 108KB - Virtual size: 108KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 568B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Rainmeter.VisualElementsManifest.xml
Rainmeter.dll
.dll windows:6 windows x86 arch:x86

cd86374d6ea2c48d41711c5fd16146bf

Code Sign

33:12:24:c0:be:b8:7c:69:0d:91:d0:69:09:1e:97:e1:7c:a1:f1:cb
Certificate

Issuer

CN=Rainmeter Team Root Certificate,O=Rainmeter Team,L=Helsinki,ST=Uusimaa,C=FI,1.2.840.113549.1.9.1=#0c127465616d407261696e6d657465722e6e6574

Not Before

29-02-2024 12:17

Not After

26-02-2034 12:17

Subject

CN=Rainmeter Team

Extended Key Usages

ExtKeyUsageCodeSigning

29:b3:f0:3c:0e:5a:cd:9d:43:c8:37:7e:8d:e3:a2:d4:03:36:46:83:07:ed:d4:10:75:ab:30:c0:39:d3:15:28
Signer

Actual PE Digest

29:b3:f0:3c:0e:5a:cd:9d:43:c8:37:7e:8d:e3:a2:d4:03:36:46:83:07:ed:d4:10:75:ab:30:c0:39:d3:15:28

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

C:\build\x32-Release\Obj\Library\Rainmeter.pdb

Imports

comctl32

ord413
ord17
ord412
ImageList_Create
ImageList_Destroy
ImageList_ReplaceIcon
ord410

wininet

InternetGetLastResponseInfoW
InternetOpenW
InternetCloseHandle
DeleteUrlCacheEntryW
InternetCrackUrlW
InternetOpenUrlW
InternetReadFile

uxtheme

SetWindowTheme
EnableThemeDialogTexture

gdiplus

GdipGetImageWidth
GdipCreateHICONFromBitmap
GdipFillPolygonI
GdipFillRectangleI
GdipDeleteBrush
GdipCreateSolidFill
GdipGetImageHeight
GdipDeleteGraphics
GdipDrawImageRectRectI
GdipCreateBitmapFromScan0
GdipSaveImageToFile
GdipDisposeImage
GdipFree
GdipCloneImage
GdipAlloc
GdipSetSmoothingMode
GdipCreateBitmapFromFile
GdiplusShutdown
GdiplusStartup
GdipGetImageGraphicsContext

powrprof

CallNtPowerInformation

netapi32

NetApiBufferFree
NetWkstaGetInfo

ntdll

VerSetConditionMask
RtlIpv4AddressToStringW
RtlUnwind
RtlIpv6AddressToStringW

shlwapi

PathFindExtensionW
PathAddBackslashW
PathSetDlgItemPathW
PathRemoveExtensionW
PathFileExistsW
PathIsDirectoryW
PathCanonicalizeW
PathRemoveFileSpecW
PathCreateFromUrlW
PathFindFileNameW
AssocQueryStringW

d2d1

ord2
ord3
ord1

rpcrt4

RpcStringFreeW
UuidToStringW

wtsapi32

WTSUnRegisterSessionNotification
WTSRegisterSessionNotification

kernel32

GetConsoleMode
GetFileType
GetStdHandle
ExitProcess
GetModuleHandleExW
FreeLibraryAndExitThread
WriteConsoleW
ReadConsoleW
ResumeThread
ExitThread
GetFileAttributesExW
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
InterlockedFlushSList
InitializeSListHead
GetCurrentProcessId
GetStartupInfoW
IsDebuggerPresent
IsProcessorFeaturePresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
SleepConditionVariableSRW
WakeAllConditionVariable
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
GetCPInfo
CompareStringEx
GetFileAttributesW
WritePrivateProfileStringW
GetPrivateProfileSectionNamesW
GetPrivateProfileSectionW
GetCurrentThreadId
GetModuleHandleW
FindFirstFileW
GetProcAddress
FreeLibrary
FindNextFileW
FindClose
GetLocaleInfoW
GetUserDefaultUILanguage
GetPrivateProfileIntW
ReleaseMutex
CreateFileW
WriteFile
CloseHandle
MultiByteToWideChar
GetTempPathW
GetTempFileNameW
DeleteFileW
GetPrivateProfileStringW
CreateDirectoryW
RemoveDirectoryW
WaitForSingleObject
WritePrivateProfileSectionW
GetLastError
GetVersionExW
LoadLibraryExW
MoveFileW
ReadFile
FindFirstFileExW
DeleteCriticalSection
TryEnterCriticalSection
EnterCriticalSection
LeaveCriticalSection
GetSystemTimes
GetSystemInfo
GetDriveTypeW
GetDiskFreeSpaceExW
GetVolumeInformationW
GlobalMemoryStatusEx
GetModuleFileNameW
GetLongPathNameW
SetDllDirectoryW
CreateThread
FileTimeToLocalFileTime
GetTimeZoneInformation
CompareStringW
GetTickCount64
GetComputerNameW
GetCurrentProcess
LocalFree
SystemTimeToFileTime
FileTimeToSystemTime
GetSystemTime
GetSystemTimeAsFileTime
GetTimeFormatW
GetDateFormatW
GetLocalTime
FormatMessageW
TerminateThread
GetShortPathNameW
UnmapViewOfFile
OpenFileMappingW
MapViewOfFile
GetSystemWow64DirectoryW
OpenProcess
TerminateProcess
ReadProcessMemory
LoadLibraryW
VerifyVersionInfoW
CreateMutexW
BeginUpdateResourceW
FindResourceW
SizeofResource
LoadResource
LockResource
UpdateResourceW
EndUpdateResourceW
SetFileAttributesW
GetFileSizeEx
SetFilePointerEx
SetEndOfFile
LocalAlloc
GetExitCodeProcess
GetCurrentDirectoryW
SetLastError
Sleep
SetCurrentDirectoryW
InitializeCriticalSectionEx
InitializeCriticalSectionAndSpinCount
GlobalAlloc
GlobalLock
GlobalUnlock
GlobalFree
CreateToolhelp32Snapshot
Process32FirstW
Process32NextW
HeapFree
GetProcessHeap
HeapAlloc
HeapSize
LCMapStringEx
DecodePointer
EncodePointer
GetLocaleInfoEx
QueryPerformanceFrequency
QueryPerformanceCounter
GetStringTypeW
CreateFileA
GetModuleHandleA
SetFilePointer
GetFileTime
GetFileSize
GetUserDefaultLocaleName
CreateFileMappingW
LCMapStringW
WideCharToMultiByte
ExpandEnvironmentStringsW
LoadLibraryExA
VirtualQuery
VirtualProtect
RaiseException
IsValidLocale
GetUserDefaultLCID
SetStdHandle
SetEnvironmentVariableW
EnumSystemLocalesW
GetConsoleOutputCP
IsValidCodePage
GetACP
GetOEMCP
HeapReAlloc
FlushFileBuffers
CreateProcessW
MoveFileExW
GetCommandLineA
FreeEnvironmentStringsW
GetCommandLineW
GetEnvironmentStringsW
GetNativeSystemInfo

user32

GetAncestor
SetCursor
GetParent
GetRawInputData
SetWinEventHook
UnhookWinEvent
GetMonitorInfoW
EnumDisplayDevicesW
EnumDisplaySettingsW
MonitorFromPoint
EnumDisplayMonitors
GetShellWindow
GetClassNameW
EnumWindows
GetMessagePos
OpenClipboard
EmptyClipboard
SetClipboardData
CloseClipboard
RegisterWindowMessageW
CopyIcon
LoadStringW
MapDialogRect
SetFocus
ScreenToClient
GetDlgCtrlID
GetFocus
InvalidateRect
TrackMouseEvent
ShowScrollBar
GetWindowLongW
SendDlgItemMessageW
CreateWindowExW
LoadMenuW
MessageBoxW
MoveWindow
MapWindowPoints
GetWindowRect
DialogBoxParamW
FindWindowW
SetWindowTextW
SetWindowLongW
GetSysColor
GetKeyState
GetWindowTextW
IsWindowVisible
SetWindowPlacement
SetWindowPos
UpdateLayeredWindow
MonitorFromRect
GetWindow
RegisterRawInputDevices
RegisterClassExW
SendMessageTimeoutW
DispatchMessageW
TranslateMessage
GetMessageW
PostQuitMessage
FindWindowExW
DefWindowProcW
IsDialogMessageW
CreateDialogIndirectParamW
UnregisterClassW
RegisterClassW
IsWindow
DestroyCursor
LoadCursorW
ShowWindow
GetWindowPlacement
LoadCursorFromFileW
DestroyIcon
LoadIconW
IntersectRect
EndDialog
GetLastInputInfo
GetDlgItem
BringWindowToTop
EnableWindow
DestroyWindow
CreateDialogParamW
ReleaseDC
DrawFrameControl
IsWindowEnabled
GetDC
GetClientRect
SendMessageW
EnumChildWindows
SystemParametersInfoW
SetMenuItemInfoW
GetMenuItemInfoW
AppendMenuW
GetMenuStringW
GetMenuState
ModifyMenuW
CheckMenuRadioItem
TrackPopupMenu
SetForegroundWindow
AttachThreadInput
GetWindowThreadProcessId
GetForegroundWindow
CreatePopupMenu
HiliteMenuItem
GetSubMenu
CheckMenuItem
EnableMenuItem
SetMenuDefaultItem
InsertMenuW
DeleteMenu
GetMenuItemCount
DestroyMenu
WindowFromPoint
GetCursorPos
PostMessageW
GetSystemMetrics
SendInput
GetMessageExtraInfo
KillTimer
SetTimer
GetWindowTextLengthW
LoadImageW
FlashWindow

gdi32

CreateRoundRectRgn
CreateEllipticRgn
GetObjectW
CreateSolidBrush
DeleteObject
CreateRectRgn
GetPixel
CombineRgn
CreateFontIndirectW

comdlg32

GetOpenFileNameW

advapi32

GetTokenInformation
RegEnumValueW
RegCloseKey
RegEnumKeyExW
RegQueryInfoKeyW
RegOpenKeyExW
RegOpenKeyW
GetUserNameW
OpenProcessToken
RegSetValueExW
ConvertSidToStringSidW
IsValidSid
RegQueryValueExW

shell32

SHBrowseForFolderW
SHFileOperationW
SHQueryRecycleBinW
SHEmptyRecycleBinW
SHGetFolderPathW
SHGetPathFromIDListW
Shell_NotifyIconW
Shell_NotifyIconGetRect
ShellExecuteExW
SHQueryUserNotificationState
ShellExecuteW

ole32

CoTaskMemFree
CoCreateInstance
StringFromGUID2
CoUninitialize
CoCreateGuid
CoInitialize
CoInitializeEx

oleaut32

SysFreeString
SysAllocString

d3d11

D3D11CreateDevice

dwrite

DWriteCreateFactory

Exports

Exports

LSLog
PluginBridge
ReadConfigString
RmExecute
RmGet
RmLog
RmLogF
RmPathToAbsolute
RmReadFormula
RmReadString
RmReplaceVariables

Sections

.text
Size: 1.8MB - Virtual size: 1.8MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 21KB - Virtual size: 43KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 11KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 61KB - Virtual size: 60KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Rainmeter.exe
.exe windows:6 windows x86 arch:x86

4e334e7d9f9b29226c17f51b28e8ceb8

Code Sign

33:12:24:c0:be:b8:7c:69:0d:91:d0:69:09:1e:97:e1:7c:a1:f1:cb
Certificate

Issuer

CN=Rainmeter Team Root Certificate,O=Rainmeter Team,L=Helsinki,ST=Uusimaa,C=FI,1.2.840.113549.1.9.1=#0c127465616d407261696e6d657465722e6e6574

Not Before

29-02-2024 12:17

Not After

26-02-2034 12:17

Subject

CN=Rainmeter Team

Extended Key Usages

ExtKeyUsageCodeSigning

3f:01:a8:0d:e5:4c:29:f2:81:7b:3c:af:9c:61:24:01:b5:c9:ed:5b:cd:d6:27:aa:87:6d:84:ca:3f:b6:0d:8b
Signer

Actual PE Digest

3f:01:a8:0d:e5:4c:29:f2:81:7b:3c:af:9c:61:24:01:b5:c9:ed:5b:cd:d6:27:aa:87:6d:84:ca:3f:b6:0d:8b

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

C:\build\x32-Release\Obj\Application\Rainmeter.pdb

Imports

shlwapi

PathFindFileNameW

kernel32

SetErrorMode
GetLastError
lstrcatW
GetModuleFileNameW
FindResourceW
SetCurrentDirectoryW
GetProcAddress
GetCommandLineW
lstrcmpiW
LoadLibraryW
ExitProcess

user32

wsprintfW
MessageBoxW

advapi32

RegOpenKeyExW
RegCloseKey
RegQueryValueExW

shell32

ShellExecuteW

Sections

.text
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.idata
Size: 1024B - Virtual size: 664B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 452KB - Virtual size: 451KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 72B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Rainmeter.exe.config
.xml
RestartRainmeter.exe
.exe windows:6 windows x86 arch:x86

57d82a4bdac8c9f7729a1f07acfc3aa0

Code Sign

33:12:24:c0:be:b8:7c:69:0d:91:d0:69:09:1e:97:e1:7c:a1:f1:cb
Certificate

Issuer

CN=Rainmeter Team Root Certificate,O=Rainmeter Team,L=Helsinki,ST=Uusimaa,C=FI,1.2.840.113549.1.9.1=#0c127465616d407261696e6d657465722e6e6574

Not Before

29-02-2024 12:17

Not After

26-02-2034 12:17

Subject

CN=Rainmeter Team

Extended Key Usages

ExtKeyUsageCodeSigning

0a:3d:38:93:af:c7:39:e4:2d:3b:da:24:4a:32:e3:86:8d:0c:cd:e2:c8:5f:c1:7c:dd:67:b1:1c:27:23:f7:31
Signer

Actual PE Digest

0a:3d:38:93:af:c7:39:e4:2d:3b:da:24:4a:32:e3:86:8d:0c:cd:e2:c8:5f:c1:7c:dd:67:b1:1c:27:23:f7:31

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

C:\build\x32-Release\Obj\RestartRainmeter\RestartRainmeter.pdb

Imports

kernel32

SetErrorMode
CreateMutexW
ReleaseMutex
CreateToolhelp32Snapshot
GetLastError
Process32NextW
Process32FirstW
CloseHandle
WriteConsoleW
CreateFileW
SetFilePointerEx
GetConsoleMode
GetConsoleOutputCP
FlushFileBuffers
HeapReAlloc
HeapSize
GetProcessHeap
LCMapStringW
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetStartupInfoW
IsProcessorFeaturePresent
GetModuleHandleW
GetCurrentProcess
TerminateProcess
RaiseException
RtlUnwind
SetLastError
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
GetProcAddress
LoadLibraryExW
EncodePointer
GetStdHandle
WriteFile
GetModuleFileNameW
ExitProcess
GetModuleHandleExW
HeapAlloc
HeapFree
FindClose
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
GetCommandLineA
GetCommandLineW
MultiByteToWideChar
WideCharToMultiByte
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetStdHandle
GetFileType
GetStringTypeW
DecodePointer

user32

PostQuitMessage
KillTimer
GetMessageW
DefWindowProcW
PostMessageW
CreateWindowExW
UnregisterClassW
RegisterClassExW
DispatchMessageW
SetTimer
TranslateMessage
FindWindowW

shell32

ShellExecuteExW
ShellExecuteW

ole32

CoInitializeEx
CoUninitialize

Sections

.text
Size: 74KB - Virtual size: 73KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
SkinInstaller.exe
.exe windows:6 windows x86 arch:x86

d1c635d2dd9d0f09293048819fd6e737

Code Sign

33:12:24:c0:be:b8:7c:69:0d:91:d0:69:09:1e:97:e1:7c:a1:f1:cb
Certificate

Issuer

CN=Rainmeter Team Root Certificate,O=Rainmeter Team,L=Helsinki,ST=Uusimaa,C=FI,1.2.840.113549.1.9.1=#0c127465616d407261696e6d657465722e6e6574

Not Before

29-02-2024 12:17

Not After

26-02-2034 12:17

Subject

CN=Rainmeter Team

Extended Key Usages

ExtKeyUsageCodeSigning

7a:1b:20:c6:19:ac:e6:85:49:41:9e:4d:c5:65:81:65:02:e2:05:48:b2:82:f9:40:a0:60:69:59:f1:30:4b:be
Signer

Actual PE Digest

7a:1b:20:c6:19:ac:e6:85:49:41:9e:4d:c5:65:81:65:02:e2:05:48:b2:82:f9:40:a0:60:69:59:f1:30:4b:be

Digest Algorithm

sha256

PE Digest Matches

true

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

C:\build\x32-Release\Obj\SkinInstallerLauncher\SkinInstaller.pdb

Imports

kernel32

SetErrorMode
ExitProcess
GetCommandLineW

rainmeter

ord8

Sections

.text
Size: 1024B - Virtual size: 640B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.idata
Size: 512B - Virtual size: 184B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 450KB - Virtual size: 450KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 20B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
VisualElements/Rainmeter_176.png
.png
VisualElements/Rainmeter_600.png
.png

Sharing

General

Malware Config

Signatures

Files

61259b55b8912888e90f516ca08dc514

Headers

DLL Characteristics

File Characteristics

Imports

advapi32

shell32

ole32

comctl32

user32

gdi32

kernel32

Sections

.text Size: 26KB - Virtual size: 25KB

.rdata Size: 5KB - Virtual size: 4KB

.data Size: 1KB - Virtual size: 128KB

.ndata Size: - Virtual size: 140KB

.rsrc Size: 35KB - Virtual size: 34KB

3e8d18bb71c7ebbda2ddc2a4bb03547b

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

gdi32

Exports

Exports

Sections

.text Size: 2KB - Virtual size: 1KB

.rdata Size: 1024B - Virtual size: 681B

.data Size: 512B - Virtual size: 6KB

.rsrc Size: 512B - Virtual size: 352B

.reloc Size: 512B - Virtual size: 352B

149adf074d317fbf0d2f17314bd18969

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

user32

version

kernel32

Exports

Exports

Sections

.text Size: 1KB - Virtual size: 1KB

.rdata Size: 1KB - Virtual size: 1KB

.data Size: - Virtual size: 44B

.rsrc Size: 2KB - Virtual size: 2KB

.reloc Size: 512B - Virtual size: 188B

fc0224e99e736751432961db63a41b76

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

ole32

Exports

Exports

Sections

.text Size: 8KB - Virtual size: 8KB

.rdata Size: 1024B - Virtual size: 867B

.data Size: 512B - Virtual size: 120B

.reloc Size: 1024B - Virtual size: 662B

0ef725341a4aecf8398c0e2132f38049

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

shell32

advapi32

.text
Size: 26KB - Virtual size: 25KB

.rdata
Size: 5KB - Virtual size: 4KB

.data
Size: 1KB - Virtual size: 128KB

.ndata
Size: - Virtual size: 140KB

.rsrc
Size: 35KB - Virtual size: 34KB

.text
Size: 2KB - Virtual size: 1KB

.rdata
Size: 1024B - Virtual size: 681B

.data
Size: 512B - Virtual size: 6KB

.rsrc
Size: 512B - Virtual size: 352B

.reloc
Size: 512B - Virtual size: 352B

.text
Size: 1KB - Virtual size: 1KB

.rdata
Size: 1KB - Virtual size: 1KB

.data
Size: - Virtual size: 44B

.rsrc
Size: 2KB - Virtual size: 2KB

.reloc
Size: 512B - Virtual size: 188B

.text
Size: 8KB - Virtual size: 8KB

.rdata
Size: 1024B - Virtual size: 867B

.data
Size: 512B - Virtual size: 120B

.reloc
Size: 1024B - Virtual size: 662B

.text
Size: 11KB - Virtual size: 10KB

.data
Size: 512B - Virtual size: 100B

.rsrc
Size: 512B - Virtual size: 488B

.reloc
Size: 1KB - Virtual size: 1KB

.text
Size: 1024B - Virtual size: 714B

.rdata
Size: 1024B - Virtual size: 705B

.data
Size: 512B - Virtual size: 104B

.reloc
Size: 512B - Virtual size: 240B

.text
Size: 4KB - Virtual size: 4KB

.rdata
Size: 2KB - Virtual size: 1KB

.data
Size: 512B - Virtual size: 8KB

.rsrc
Size: 512B - Virtual size: 152B

.reloc
Size: 1024B - Virtual size: 638B

33:12:24:c0:be:b8:7c:69:0d:91:d0:69:09:1e:97:e1:7c:a1:f1:cb
Certificate

ed:02:d9:9a:47:af:fe:62:e9:f6:a0:87:ee:87:22:e6:0e:bd:8b:66:02:06:d3:45:95:c2:9a:93:80:6e:b8:ad
Signer

.text
Size: 98KB - Virtual size: 98KB

.data
Size: 3KB - Virtual size: 5KB

.idata
Size: 2KB - Virtual size: 2KB

.rsrc
Size: 1024B - Virtual size: 584B

.reloc
Size: 5KB - Virtual size: 4KB

33:12:24:c0:be:b8:7c:69:0d:91:d0:69:09:1e:97:e1:7c:a1:f1:cb
Certificate

d3:70:d1:1f:19:e4:2c:32:0b:9b:16:35:42:01:27:a8:2f:24:42:20:4d:46:2d:9e:c3:c0:9d:7b:c0:1d:38:9f
Signer