38af609ca6d6e40e2feb589d48f99b8b2a28f77d3f4f66ef7b431655ef584223

Analysis

user interaction
yes
max time kernel
149s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
30/09/2026, 12:54

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Kleinstadt_3.5.0.14.exe
Size 12.1MB
Sample260930-p5mlesff89
SHA256 38af609ca6d6e40e2feb589d48f99b8b2a28f77d3f4f66ef7b431655ef584223
MD5 3af45639e527bc6fce278170c47d7cf8
SHA1 23f297708fa5f3a8db71a58e1a704d401bd651ea
SHA512 b313966d49a11cf8ba04963f6aa7788a88d0cf08b4d760c55d1534eae1467645d6d960c8d9628e2eac8078e769cd843049e60b804dead149a9999a9472ba7391
SSDEEP 393216:GuBSqU7FgccrInaodbstBO4ia0gxJ9QdF:xMhBgccrMivFialQdF
TLSH
T157D63317A8F42AC6E2579733A9502665AFF265374DCF4E1351079C2E23370BAEF680B4
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
4436	Kleinstadt.exe

Loads dropped DLL 58 IoCs

pid	Process
4752	Kleinstadt_3.5.0.14.exe
4752	Kleinstadt_3.5.0.14.exe
4752	Kleinstadt_3.5.0.14.exe
4436	Kleinstadt.exe
4436	Kleinstadt.exe
4436	Kleinstadt.exe
4436	Kleinstadt.exe
4436	Kleinstadt.exe
4436	Kleinstadt.exe
4436	Kleinstadt.exe
4436	Kleinstadt.exe
4436	Kleinstadt.exe
4436	Kleinstadt.exe
4436	Kleinstadt.exe
4436	Kleinstadt.exe
4436	Kleinstadt.exe
4436	Kleinstadt.exe
4436	Kleinstadt.exe
4436	Kleinstadt.exe
4436	Kleinstadt.exe
4436	Kleinstadt.exe
4436	Kleinstadt.exe
4436	Kleinstadt.exe
4436	Kleinstadt.exe
4436	Kleinstadt.exe
4436	Kleinstadt.exe
4436	Kleinstadt.exe
4436	Kleinstadt.exe
4436	Kleinstadt.exe
4436	Kleinstadt.exe
4436	Kleinstadt.exe
4436	Kleinstadt.exe
4436	Kleinstadt.exe
4436	Kleinstadt.exe
4436	Kleinstadt.exe
4436	Kleinstadt.exe
4436	Kleinstadt.exe
4436	Kleinstadt.exe
4436	Kleinstadt.exe
4436	Kleinstadt.exe
4436	Kleinstadt.exe
4436	Kleinstadt.exe
4436	Kleinstadt.exe
4436	Kleinstadt.exe
4436	Kleinstadt.exe
4436	Kleinstadt.exe
4436	Kleinstadt.exe
4436	Kleinstadt.exe
4436	Kleinstadt.exe
4436	Kleinstadt.exe
4436	Kleinstadt.exe
4436	Kleinstadt.exe
4436	Kleinstadt.exe
4436	Kleinstadt.exe
4436	Kleinstadt.exe
4436	Kleinstadt.exe
4436	Kleinstadt.exe
4436	Kleinstadt.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops desktop.ini file(s) 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\assembly\Desktop.ini	Kleinstadt.exe
File created	C:\Windows\assembly\Desktop.ini	Kleinstadt.exe

Drops file in Program Files directory 49 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Signalsoft\Kleinstadt\nl\titleimage.gif	Kleinstadt_3.5.0.14.exe
File created	C:\Program Files (x86)\Signalsoft\Kleinstadt\nl\Kleinstadt_Timetable_SortedByTime_[NL].pdf	Kleinstadt_3.5.0.14.exe
File opened for modification	C:\Program Files (x86)\Signalsoft\Kleinstadt\fr\index.html	Kleinstadt_3.5.0.14.exe
File created	C:\Program Files (x86)\Signalsoft\Kleinstadt\Kleinstadt.exe	Kleinstadt_3.5.0.14.exe
File created	C:\Program Files (x86)\Signalsoft\Kleinstadt\css\reset-min.css	Kleinstadt_3.5.0.14.exe
File created	C:\Program Files (x86)\Signalsoft\Kleinstadt\de\Common.resources.dll	Kleinstadt_3.5.0.14.exe
File created	C:\Program Files (x86)\Signalsoft\Kleinstadt\en\Kleinstadt.resources.dll	Kleinstadt_3.5.0.14.exe
File created	C:\Program Files (x86)\Signalsoft\Kleinstadt\nl\Kleinstadt_Timetable_SortedByTrainNumber_[NL].pdf	Kleinstadt_3.5.0.14.exe
File created	C:\Program Files (x86)\Signalsoft\Kleinstadt\NAudio.dll	Kleinstadt_3.5.0.14.exe
File created	C:\Program Files (x86)\Signalsoft\Kleinstadt\Update.exe	Kleinstadt_3.5.0.14.exe
File created	C:\Program Files (x86)\Signalsoft\Kleinstadt\css\base-min.css	Kleinstadt_3.5.0.14.exe
File created	C:\Program Files (x86)\Signalsoft\Kleinstadt\de\Kleinstadt.resources.dll	Kleinstadt_3.5.0.14.exe
File created	C:\Program Files (x86)\Signalsoft\Kleinstadt\fr\Kleinstadt.resources.dll	Kleinstadt_3.5.0.14.exe
File created	C:\Program Files (x86)\Signalsoft\Kleinstadt\en\titleimage.gif	Kleinstadt_3.5.0.14.exe
File created	C:\Program Files (x86)\Signalsoft\Kleinstadt\fr\Signalling.resources.dll	Kleinstadt_3.5.0.14.exe
File created	C:\Program Files (x86)\Signalsoft\Kleinstadt\fr\Kleinstadt_Timetable_SortedByTime_[FR].pdf	Kleinstadt_3.5.0.14.exe
File created	C:\Program Files (x86)\Signalsoft\Kleinstadt\uninst.exe	Kleinstadt_3.5.0.14.exe
File created	C:\Program Files (x86)\Signalsoft\Kleinstadt\Kleinstadt.exe.config	Kleinstadt_3.5.0.14.exe
File created	C:\Program Files (x86)\Signalsoft\Kleinstadt\system_de.dll	Kleinstadt_3.5.0.14.exe
File created	C:\Program Files (x86)\Signalsoft\Kleinstadt\Microsoft.DirectX.DirectSound.dll	Kleinstadt_3.5.0.14.exe
File created	C:\Program Files (x86)\Signalsoft\Kleinstadt\Microsoft.DirectX.AudioVideoPlayback.dll	Kleinstadt_3.5.0.14.exe
File created	C:\Program Files (x86)\Signalsoft\Kleinstadt\fr\titleimage.gif	Kleinstadt_3.5.0.14.exe
File created	C:\Program Files (x86)\Signalsoft\Kleinstadt\kleinstadt_data.dll	Kleinstadt_3.5.0.14.exe
File created	C:\Program Files (x86)\Signalsoft\Kleinstadt\Microsoft.DirectX.dll	Kleinstadt_3.5.0.14.exe
File created	C:\Program Files (x86)\Signalsoft\Kleinstadt\en\index.html	Kleinstadt_3.5.0.14.exe
File created	C:\Program Files (x86)\Signalsoft\Kleinstadt\en\Kleinstadt_Timetable_SortedByTrainNumber.pdf	Kleinstadt_3.5.0.14.exe
File created	C:\Program Files (x86)\Signalsoft\Kleinstadt\nl\index.html	Kleinstadt_3.5.0.14.exe
File opened for modification	C:\Program Files (x86)\Signalsoft\Kleinstadt\fr\titleimage.gif	Kleinstadt_3.5.0.14.exe
File created	C:\Program Files (x86)\Signalsoft\Kleinstadt\Common.Plugins.dll	Kleinstadt_3.5.0.14.exe
File created	C:\Program Files (x86)\Signalsoft\Kleinstadt\Signalling.dll	Kleinstadt_3.5.0.14.exe
File created	C:\Program Files (x86)\Signalsoft\Kleinstadt\de\Signalling.resources.dll	Kleinstadt_3.5.0.14.exe
File created	C:\Program Files (x86)\Signalsoft\Kleinstadt\de\index.html	Kleinstadt_3.5.0.14.exe
File created	C:\Program Files (x86)\Signalsoft\Kleinstadt\en\Kleinstadt_Timetable_SortedByTime.pdf	Kleinstadt_3.5.0.14.exe
File created	C:\Program Files (x86)\Signalsoft\Kleinstadt\nl\Kleinstadt.resources.dll	Kleinstadt_3.5.0.14.exe
File opened for modification	C:\Program Files (x86)\Signalsoft\Kleinstadt\nl\titleimage.gif	Kleinstadt_3.5.0.14.exe
File opened for modification	C:\Program Files (x86)\Signalsoft\Kleinstadt\nl\index.html	Kleinstadt_3.5.0.14.exe
File created	C:\Program Files (x86)\Signalsoft\Kleinstadt\system_de.dat	Kleinstadt_3.5.0.14.exe
File created	C:\Program Files (x86)\Signalsoft\Kleinstadt\Common.Zip.dll	Kleinstadt_3.5.0.14.exe
File created	C:\Program Files (x86)\Signalsoft\Kleinstadt\de\Kleinstadt_Timetable_SortedByTime_[DE].pdf	Kleinstadt_3.5.0.14.exe
File created	C:\Program Files (x86)\Signalsoft\Kleinstadt\de\Kleinstadt_Timetable_SortedByTrainNumber_[DE].pdf	Kleinstadt_3.5.0.14.exe
File created	C:\Program Files (x86)\Signalsoft\Kleinstadt\fr\Common.resources.dll	Kleinstadt_3.5.0.14.exe
File created	C:\Program Files (x86)\Signalsoft\Kleinstadt\fr\index.html	Kleinstadt_3.5.0.14.exe
File created	C:\Program Files (x86)\Signalsoft\Kleinstadt\fr\Kleinstadt_Timetable_SortedByTrainNumber_[FR].pdf	Kleinstadt_3.5.0.14.exe
File opened for modification	C:\Program Files (x86)\Signalsoft\Kleinstadt\system.mdb	Kleinstadt.exe
File created	C:\Program Files (x86)\Signalsoft\Kleinstadt\Common.dll	Kleinstadt_3.5.0.14.exe
File created	C:\Program Files (x86)\Signalsoft\Kleinstadt\css\layout.css	Kleinstadt_3.5.0.14.exe
File created	C:\Program Files (x86)\Signalsoft\Kleinstadt\de\titleimage.gif	Kleinstadt_3.5.0.14.exe
File created	C:\Program Files (x86)\Signalsoft\Kleinstadt\nl\Signalling.resources.dll	Kleinstadt_3.5.0.14.exe
File created	C:\Program Files (x86)\Signalsoft\Kleinstadt\nl\Common.resources.dll	Kleinstadt_3.5.0.14.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\assembly	Kleinstadt.exe
File created	C:\Windows\assembly\Desktop.ini	Kleinstadt.exe
File opened for modification	C:\Windows\assembly\Desktop.ini	Kleinstadt.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	Kleinstadt.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	Kleinstadt.exe

System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	csc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kleinstadt_3.5.0.14.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Kleinstadt.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	csc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	csc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	csc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	csc.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3976	mspaint.exe
3976	mspaint.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
4436	Kleinstadt.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4436	Kleinstadt.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4436	Kleinstadt.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
3976	mspaint.exe
3976	mspaint.exe
3976	mspaint.exe
3976	mspaint.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 4436 wrote to memory of 4732	4436	Kleinstadt.exe	100
PID 4732 wrote to memory of 4248	4732	csc.exe	102
PID 4436 wrote to memory of 2364	4436	Kleinstadt.exe	111
PID 2364 wrote to memory of 3660	2364	csc.exe	113
PID 4436 wrote to memory of 3528	4436	Kleinstadt.exe	114
PID 3528 wrote to memory of 388	3528	csc.exe	116
PID 4436 wrote to memory of 1120	4436	Kleinstadt.exe	117
PID 1120 wrote to memory of 4636	1120	csc.exe	119
PID 4436 wrote to memory of 1752	4436	Kleinstadt.exe	120
PID 1752 wrote to memory of 2884	1752	csc.exe	122

C:\Users\Admin\AppData\Local\Temp\Kleinstadt_3.5.0.14.exe
"C:\Users\Admin\AppData\Local\Temp\Kleinstadt_3.5.0.14.exe"
1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:4752

C:\Program Files (x86)\Signalsoft\Kleinstadt\Kleinstadt.exe
"C:\Program Files (x86)\Signalsoft\Kleinstadt\Kleinstadt.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops desktop.ini file(s)
- Drops file in Program Files directory
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:4436
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe
  "C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\b9fupfql.cmdline"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4732
- - C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
    C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES4E17.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC4E16.tmp"
    3⤵
    PID:4248
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe
  "C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\0blb9bxt.cmdline"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2364
- - C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
    C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESADDB.tmp" "c:\Users\Admin\AppData\Local\Temp\CSCADDA.tmp"
    3⤵
    PID:3660
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe
  "C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\jkdhqrko.cmdline"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3528
- - C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
    C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESBCB0.tmp" "c:\Users\Admin\AppData\Local\Temp\CSCBCAF.tmp"
    3⤵
    PID:388
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe
  "C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\adb0eehl.cmdline"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1120
- - C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
    C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESBE56.tmp" "c:\Users\Admin\AppData\Local\Temp\CSCBE55.tmp"
    3⤵
    PID:4636
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe
  "C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\vkxx1tsm.cmdline"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1752
- - C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
    C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESC088.tmp" "c:\Users\Admin\AppData\Local\Temp\CSCC087.tmp"
    3⤵
    PID:2884

C:\Windows\system32\mspaint.exe
"C:\Windows\system32\mspaint.exe" "C:\Users\Admin\Desktop\ExpandAssert.bmp"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:3976

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DeviceAssociationService
1⤵
PID:1648

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Common.Plugins.dll

Path C:\Program Files (x86)\Signalsoft\Kleinstadt\Common.Plugins.dll
Size 7KB
SHA256 e0b6457f8742ffbaf3e1e5f7eaa065ccede7d2879c065f032af06f9c3a88dbc4
MD5 fa15e5c5a1c0eec40a6b0aeb1f6871c7
SHA1 12f6e5ebe928e3856a82957b63da228990eaa701
SHA512 da20c90ee5de5c087e0d1e8280d21db95ea23f202602bbe9d2ae2f8cb4770f7c1cd0ee1400629ed46d93233a016a99d69ae536151d9983a43f91fec4f49ae2d8
SSDEEP 96:oWn2tfwwdyYDOyND66zYOX8aKvhKbQYw6lK6ooMZ:p2lwddW6UYW8azkYBY6E
TLSH
T139E1A752E7ACC33ECCBA5B76789303151778E791E623DB9B4841681FBD933102632B91
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Common.Zip.dll

Path C:\Program Files (x86)\Signalsoft\Kleinstadt\Common.Zip.dll
Size 193KB
SHA256 336faede896555b3d561a94381e0b2f45aafa1f4e39e4b74c446e32f6f784083
MD5 738a9d42c5f37ce97142f6a866bd5fb5
SHA1 a9418be058d6468162a96b61c85f883bc6096066
SHA512 dac073960e739344dfc6222dd9605fcbe64434e1cb0a01a4e236442f9eda1756cda1c91b8ca65122f0d069defbfed869915031432ff7631da22c6aa08dc28ecb
SSDEEP 3072:9Hwefs/NBJQQR9+NOD3xRWsSY6LPOPAY0hx0yoADielcPpjFlPdrMlaa///ecIDp:qai9+No3x4I6EAY0u2ipVFpdQ
TLSH
T1F8143A281BDD4B2BF2BF5BBDD0B46561C3B1B451B83EDB5A9D8064EE2802790DD103A3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Common.dll

Path C:\Program Files (x86)\Signalsoft\Kleinstadt\Common.dll
Size 1.2MB
SHA256 afbe5a9c406179e02c53623c287366c767a18fabb40022d9cb038c0c241e14b5
MD5 339d8d26f6c32b47bea09636f1870054
SHA1 6c004a5189adf39d98511262eabf00bee10008e5
SHA512 67eb60a5d9d3990f8c9b1a631027d7840983ff731233a32fd13585110cd1f75247454060fb8f1c1a2b7b983ce9ff17479f54f431e2ef2122fe287b33872e8792
SSDEEP 12288:BawFIsFE9Q/11VYw+0de0WG8XTTxMx75uO/kh13NChlzuc7tPRNTJnnTLdLXXUe2:pX/1Td94WPusW3NP09UG9s
TLSH
T1CE555B8A33D5DD0BC4AD5234A03440341BB5EB15B386E33F5558E6ACACA77523E86EB3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Kleinstadt.exe

Path C:\Program Files (x86)\Signalsoft\Kleinstadt\Kleinstadt.exe
Size 9.0MB
SHA256 dde5d28bc9d14d9daa5cd0de4b3505bc1b4bc1c9315fc62da421413a8a3cce2e
MD5 4c2655910e7ec9a7a921ef72268fee3b
SHA1 dadf2b8f2532046058db1071be19d11ba1c22bcf
SHA512 cb603ee1fa9ceb9449063384fa2bbc5b1a74de5c6034f70856342107e97c2f200e45855ddd16ec08698f160f02f5931d3ee192a18075f16562822d53174801cf
SSDEEP 196608:7Es7+I6+YDGPzSx+I6+YD4+I6+YDj+I6+YDI+I6+YDL+I6+YDGk:oA+I6+YeSx+I6+YE+I6+Y3+I6+YU+I69
TLSH
T1A696C520E2518859C13943F258315CA2527FFB29B631C57C284FF27FEAF26269B1275B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Kleinstadt.exe.config

Path C:\Program Files (x86)\Signalsoft\Kleinstadt\Kleinstadt.exe.config
Size 42KB
SHA256 5d82b1cfe58b2731577f74fea17f40ff4b2a40db32b87ea4302237a0748a3702
MD5 a0ed71f7817d6bc181862683dd1fe600
SHA1 65543bf19daeb8956f3a370bbabe0e33b478c141
SHA512 9a994ef2c9f140c08d7da853f7e60cd9f42e2c991e309bdb00dee84de4ce8188a8a0728783a27612b0c74695635613d934dc6c4ad041f47f42da380ae1df8d19
SSDEEP 384:TbVha7dIGHWQgBmmvp/WxN5aGk+eBBO59Qgk:HqsmY5WxNDgeQ9
TLSH
T1A913EA0CB1C19F991276A635E73152D1EDA0052311B6B1F078EE31676F70CDA4AF3BAA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.DirectX.AudioVideoPlayback.dll

Path C:\Program Files (x86)\Signalsoft\Kleinstadt\Microsoft.DirectX.AudioVideoPlayback.dll
Size 52KB
SHA256 406f473429573e9f0084aae125ef8f19f59291aa4c33cf7d40e7d996995a3238
MD5 75933586afd94ea24c5acd3dbc89a272
SHA1 970fd4b49d1368330c10279798991b901a233c2a
SHA512 c096f0f11fb306c6a84886826306fe9c2862c3c79b14a8991a174224b41c2a68b76e5be506494d23d354384c715c5d82a1cacffff9644de9d6b93e9478087a1d
SSDEEP 768:/BJPuUm+QFYqG9se2k5R7vtv8+80t2TxJNdfr83A/E9t3DAsm:7u8qYqK6k5R7O+80tKxJN983aErm
TLSH
T1DB33B8054784C167D36E07B6907A13718739A1B187A6F7C3141A42E22D7B3EDEB782EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.DirectX.dll

Path C:\Program Files (x86)\Signalsoft\Kleinstadt\Microsoft.DirectX.dll
Size 218KB
SHA256 942e98f142373547493f13b14e1603b2420851aff013d3085bada7b6b2214d9c
MD5 0c453970e89db1c1eb9de087e6eab5ba
SHA1 c4c7e034773a240909332814f499730575a1cd71
SHA512 ef3b2cc2598b4ea58f00f93155319674450c8c35b706108ce3bbb5c2502efa179046d9d50e12725e6dc7a555f4880404ed03de15a0753606f20a1654799886fb
SSDEEP 6144:o/JepwLNyV1VYTduT/iQanWWdQeeaQee0QeesQee4SQeehQeeZ+M:CjLYV1yTALKl
TLSH
T1DD24290173FC652BF1877AB54FCE92A9F12FD6C5434262CB109407AB6E94AC697322F1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Signalling.dll

Path C:\Program Files (x86)\Signalsoft\Kleinstadt\Signalling.dll
Size 5.8MB
SHA256 18dea720949c18ebe923fa06b978c51ac5086514dd0b4797f15b07e800d8e2ca
MD5 d8be3cf946bb0f513619deff4d3c8eac
SHA1 b7db85e0ed75ce46cec539ca99b62a7a49b354a3
SHA512 86f2a633db210c8560401dd7e71b3389c30cf0c68bacf7fbb6da9686c2c369c1113612458612dde43666efbb4e73d420f5ef2d242ba835895daa405d235ed256
SSDEEP 98304:MQL0JxUGD+TUwkDo97OFVSSkceK+lBGumfQaGA49R:MQIxUGD+TYs9qT5JEGumYaGV9R
TLSH
T1B556CF10B3F4AD1ED87E87B5403141250BF2FE8A77A2F75DAE05A1AD2DA27015F427A3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Common.resources.dll

Path C:\Program Files (x86)\Signalsoft\Kleinstadt\de\Common.resources.dll
Size 24KB
SHA256 e68796303c94892f78e12f199c04b207b023f27572412a62005583dd0cbf0e85
MD5 a5e380a46af68d0f6b1148774f96bd16
SHA1 9c679a5e24dc63632715104091e43c76387290e1
SHA512 c0d89a2eebfd550c0dac5e850032e6751384d113c881044df5e5d95923679d0edefd33d6b181de6d463618c66123e1fbb37f3c33069058fc349dfa589e5b530f
SSDEEP 384:DXRa09+cn9RXb399t9r97949L9qXK9S9D9/oXRau9Ncx9BXwu9o91K9GvZXd9BoK:N3heQE
TLSH
T1AEB2CE3237965028C9B55B331834F2C1637BBA59BF68CB2D559A231C5FB22139B12F62
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Kleinstadt.resources.dll

Path C:\Program Files (x86)\Signalsoft\Kleinstadt\de\Kleinstadt.resources.dll
Size 3.0MB
SHA256 80f2f258712dfba259382c3f26f7d98b8323bc492080be7484a7a966cf426d69
MD5 aefcfbbdd0cac70b0e78e8f09f3b6977
SHA1 8b9febd2936c4b27de3c0f27f966e3ac567147fe
SHA512 f9286505385616574a94db2bd8d163b96e67083ef83b9c8b1c44f746220d34bd27f4df10c1a720b8092ec261df7481c674373e0a91da5da4bbb78128cdaf94bf
SSDEEP 24576:Jxeg3rW+I6+YDwU+I6+YDwj+I6+YDwVTbmURxiVrn:JxC+I6+YDf+I6+YDK+I6+YD
TLSH
T1EEE5E9D5D701C82AC2344AF19C215CA0911FFA6CA6768C345C5FFABFF4F2521BA9264B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kleinstadt_data.dll

Path C:\Program Files (x86)\Signalsoft\Kleinstadt\kleinstadt_data.dll
Size 1.8MB
SHA256 16c1616f25d46c2b9d1d55ec83b0d9159f265867f0e8794879f781de95e16fa6
MD5 80d8cc80e96b7fc092fc9ae9fc049c44
SHA1 4e010dbfc36df5f10b3960e1ebe60e489ae54aa5
SHA512 34ab9adafba9b105feae55f965d5cdd115474233c04d55777cccb4a7c0268c6275ce786c87d3dc27929113e139dbe072b9ab81590857d22f5cfa01cd0adabf8c
SSDEEP 12288:g2lOjiNCTpZMBricKthNBHyiEjaocr3aP/+PIcjOGrR/9p5DY6wjlS:g1qCNZMBri5hNBHVrKHKRP5jwjlS
TLSH
T194855B11B7DD041EF4B75A30AEF363545237BD112A39CB1F601C2A5F6A63780AE22BE5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Kleinstadt.resources.dll

Path C:\Program Files (x86)\Signalsoft\Kleinstadt\nl\Kleinstadt.resources.dll
Size 3.0MB
SHA256 550addc2d22c19e373b43498f8709a58fbc7360587a4c62ef510b87d21b84c29
MD5 05bbdb89aba167914d91376818fe2d91
SHA1 62f6e17f01cf55fbfa78f2d8d397feca916d8710
SHA512 c611104162a4d721907150873c661cd25a8f15d7ebcaf80c9d74d1ae2ac73762c3f5d84e76a00d8f6ee14e21928706ebe9d13cfa2bc382046013291cb1d01905
SSDEEP 49152:5+I6+YDL/+I6+YDw+I6+YDj+I6+YDq0L:5+I6+YDb+I6+YDw+I6+YDj+I6+YDq0
TLSH
T173E5FEA2E6414CA5C13443F098615FB1626FFA6CEA72887A5C5FF17FE0F1530A92264F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

system_de.dat

Path C:\Program Files (x86)\Signalsoft\Kleinstadt\system_de.dat
Size 1.1MB
SHA256 16d36ed6bacbfff0d92cc0a2c4e90558921a87bc1f10b60d0a20eb822c62661d
MD5 31f9e16df3a84e1eb19425cbaa3c21ac
SHA1 f1d4ec64be86269e51b4020784dd0222ebffdbba
SHA512 645c87ebfb3b0f0e66b8ad8c75697b35ac066dc3f6380a1c01eed68f56a389633d4e7a37d286388359b0bff59b414fbe6a5462b9f9e4b6d54757b6d635d90424
SSDEEP 24576:dFtF1OZfu/yT7n5a0TpvzU58yCUJa/QfGKafK5dB5ySCeNZejLBZ34q:dFtrOZyyPn4kpvzUDJa/LCHB5ySJv8zh
TLSH
T14235332D2BF1064A61865A897E705183CCF788BD56C22CFC643D71911CABFCAA397D4B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

system_de.dll

Path C:\Program Files (x86)\Signalsoft\Kleinstadt\system_de.dll
Size 7.0MB
SHA256 bf277dd80947a51ad90bd44b727c61738fceb05f8f3ccd6784db3b51a2fa35b4
MD5 db49aa1d7a0b6d71939473b341652199
SHA1 114d402461e6284498181bab66efed8fb8555546
SHA512 7cf25657230c34f75b1fb78183d0ee2d2dc7c36914708ac709228685a2f24fa28f1140c02f86e0a89f3a3fd79ed0f8d7ce1e13ccfb86081454265954ae5d9feb
SSDEEP 98304:CbQyneCpbHXn2jOcau9JkLVHim6LUNdASIXaCVhgXrF4ZuAF8rz7J702NsSayrFr:vC13ncau9Jk5Hiv6dtVC3gbG1EsSay
TLSH
T1E076AD13B341E912C1156A769E69D7D82336FC089F15A32B3496FF1F3DBE2938D66280
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

4dsy5fye.newcfg

Path C:\Users\Admin\AppData\Local\SIGNALSOFT_Rail_Consultan\Kleinstadt.exe_Url_1wgkv33pqdczcgr3jcpexz1aq3buxb1k\3.5.0.14\4dsy5fye.newcfg
Size 1KB
SHA256 a6517020b8f7fc0560a9e0bb24088bc4b6d4b0a9a50385f8de7d423edb6e26bc
MD5 2c81066c585e176ed9f9f24ef1218a29
SHA1 2cd88fd75394f627ac33a9d9817c2aa20b01fcb1
SHA512 431c220865a32f117b40481ce93c0ab73ee7ca1ce95b56eac1a8442422c803568fe20221bf3587f464cbd7c8ece856904070c0cf2c412e36fcd58b00316a1dc5
TLSH
T1A5416F0CB1C1DF9A11766635E73252D1EDA00A631176B0F0B8ED31675F70CDA0AE3BA6
MD5 SHA1 SHA512 TLSH

Submit Download

as3nmxyr.newcfg

Path C:\Users\Admin\AppData\Local\SIGNALSOFT_Rail_Consultan\Kleinstadt.exe_Url_1wgkv33pqdczcgr3jcpexz1aq3buxb1k\3.5.0.14\as3nmxyr.newcfg
Size 15KB
SHA256 f327cf7269ab92751f281b6f9870ac32e57daf0d78ff4273b5eb8572c17d047f
MD5 4562c715690727b7793a2941a81fe38c
SHA1 875718b587790880997cf411ec73d420881fc39b
SHA512 da791716527317f95e583b3a103d5083d54e858130d824b5cce5c5eb21f0fe82a1d510315e14e85795c7a1d6ff615b1ef14aeb4c998b31b09f231bf5e69624c3
SSDEEP 96:ecvSsbCIj1r3PMVnRAnOs+jZF7oiocydibhdgnceTpjZYGdji0lQnjMEnoVkXRHh:znxQRA0aEd1b
TLSH
T1B962604CB1C19F9911BA6736E63252D1EEA00923117AB1F078ED31675F70CDE0AE3BA5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bhbsdzlq.newcfg

Path C:\Users\Admin\AppData\Local\SIGNALSOFT_Rail_Consultan\Kleinstadt.exe_Url_1wgkv33pqdczcgr3jcpexz1aq3buxb1k\3.5.0.14\bhbsdzlq.newcfg
Size 4KB
SHA256 ffc378cb2399b27e2bb51e25d45b762abaee6a6531bf1f1a92a97a343409715d
MD5 ea642e14fe1dfe26693b18655a4080fa
SHA1 0173560a361772e761f0a61b228d8fb1428b22ee
SHA512 ca52254095da5e413a2322818b70e33dafd250cf4f95710e5bc4707b1e8fad5e56adbfb33684654227e322b8e0647d61d2a41d8020f3b503c65ce5ae34e2b563
SSDEEP 96:ecvSsbCr3PMVnRAnOs+9An1j7ddqnvbvJAnrNRaLQtA:sUF
TLSH
T16F81190CB1C19F99127AA635E73152D1EDA005231176B0F078EE72635F70C9A4AF3BA5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

user.config

Path C:\Users\Admin\AppData\Local\SIGNALSOFT_Rail_Consultan\Kleinstadt.exe_Url_1wgkv33pqdczcgr3jcpexz1aq3buxb1k\3.5.0.14\user.config
Size 332B
SHA256 7aaca253f803f1f562dc9735d108bb53d9e64109f85f3b0a88688eb190df2848
MD5 be882dd4b406d961a7f7421522aa069a
SHA1 8782846977ca25f52ea72d2015cce05b62b8a34b
SHA512 8fa153ce22697ceb1c76123db2e055b0c9213b974de101189fda96a464c8f8ad57048b3ef7878b1452c105926372119ef335436e792dfe9f209608fb034364b9
TLSH
T134E01709A0C05D6B5172BE21D6258640FEB426E3806660B4F96DA6371B308940BD3BA6
MD5 SHA1 SHA512 TLSH

Submit Download

RES4E17.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES4E17.tmp
Size 1KB
SHA256 eaac70161b364890400d56a0d62bdb722f665e32d572752efc501359a6eb8cba
MD5 dc6d27853807179756f008a0767f8bce
SHA1 641e2a370b7a6cb71c9988c3097830789d289eb7
SHA512 03cb8406cde0f55c9804dd0dc5b9ed3c34a2a66e20bb3ec1330408a71d4f25093b830340acfe8c90f78c5687ec5aab96daead40ef516bd34d2f9e2e40a66962f
TLSH
T1E6215C0593F9470BF0B78731A8F51367A239FE64EFB5A75B858012292C11544FEB1B72
MD5 SHA1 SHA512 TLSH

Submit Download

b9fupfql.dll

Path C:\Users\Admin\AppData\Local\Temp\b9fupfql.dll
Size 10KB
SHA256 49bcfc0144f29fc51c6bda89cf44cc8d33e544adb17c9de46e514400ba2d2882
MD5 5f71e266aa06e687eefc26386219f1b9
SHA1 ecfd5734f6b3c6347aa542b6c3f87238ed5121c6
SHA512 83e034fa9eb711dafffef1bd7f943a937f86d320e33930b91ef2dbff97500ae5518f35aeb6de16226a6c348ac7db75bf0be3d815a89760c730c52adf19257d2f
SSDEEP 192:gAialpv3gkipxFUug4rzAmA5yrRVYtVzQkjAEpUFfN:gAigF3GxawzG8ROtVzDjAEpURN
TLSH
T15322F907B7F48D1BD9FE4BB868B3522412F5ED56BC22C6998CC500AD5CA23499902F97
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AdvSplash.dll

Path C:\Users\Admin\AppData\Local\Temp\nsv509.tmp\AdvSplash.dll
Size 6KB
SHA256 eb1ca2b3a6e564c32677d0cdc388e26b74ef686e071d7dbca44d0bfa10488feb
MD5 13cc92f90a299f5b2b2f795d0d2e47dc
SHA1 aa69ead8520876d232c6ed96021a4825e79f542f
SHA512 ff4e6e6e7104568fc85ef3a3f0494a5c7822a4ceaf65c584ad534f08f9a472a8d86f0a62f1f86343c61e2540b2254714b7ea43e4b312ff13d8271ff069386fa3
SSDEEP 96:6hNSXIcmYjkvTS6MnBNZ1BMjDfhkkEkkXstWpPwoS:JXIpzTSd1BSk/kJtWpP
TLSH
T137C1B837B7C216F7C35600F12916375387E9943263A1946909B3EBCAA6A185BDD34703
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

InstallOptions.dll

Path C:\Users\Admin\AppData\Local\Temp\nsv509.tmp\InstallOptions.dll
Size 14KB
SHA256 c9cd5c9609e70005926ae5171726a4142ffbcccc771d307efcd195dafc1e6b4b
MD5 325b008aec81e5aaa57096f05d4212b5
SHA1 27a2d89747a20305b6518438eff5b9f57f7df5c3
SHA512 18362b3aee529a27e85cc087627ecf6e2d21196d725f499c4a185cb3a380999f43ff1833a8ebec3f5ba1d3a113ef83185770e663854121f2d8b885790115afdf
SSDEEP 192:86d+dHXLHQOPiY53uiUdigyU+WsPdc/A1A+2jwK72dwF7dBEnbok:86UdHXcIiY535zBt2jw+BEnbo
TLSH
T1ED622A11778888F3DBD2013EB4533707AF9D5126B4929ED2CA271ECA6D2B05D7EB2346
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LangDLL.dll

Path C:\Users\Admin\AppData\Local\Temp\nsv509.tmp\LangDLL.dll
Size 5KB
SHA256 60a964095af1be79f6a99b22212fefe2d16f5a0afd7e707d14394e4143e3f4f5
MD5 9384f4007c492d4fa040924f31c00166
SHA1 aba37faef30d7c445584c688a0b5638f5db31c7b
SHA512 68f158887e24302673227adffc688fd3edabf097d7f5410f983e06c6b9c7344ca1d8a45c7fa05553adcc5987993df3a298763477168d4842e554c4eb93b9aaaf
SSDEEP 48:iV6pAvmNC6iMPUptxEZK65x/AmvycNSmwVsOYJyvrpXptp/JvR0Jlof5d2:2811GED5ZTvycNSmwVsTJuftpZR0Sd2
TLSH
T129C18333B3C24AF5D6950633252373C366539E342359804F9B6712AA69208FBDD6E793
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ioSpecial.ini

Path C:\Users\Admin\AppData\Local\Temp\nsv509.tmp\ioSpecial.ini
Size 652B
SHA256 348234e37cb9fc6100fb201e8c4460f7e11517ae9a068dd2cb47ab2b7b5bdacd
MD5 5b90274149ee58a94afdf1fbacfd4bdd
SHA1 48ad316d97ac6050e35975a09523e64370b53d70
SHA512 0be108d5b2da065e0abbb79e7b558d8b83ab3f2c151c9416ff2aac2528ddf075f72938e2d6ccc4a467b5686a4b4266ff82bcfb53dd884ed240508a46e1824953
TLSH
T142F07D88940A436B8C20524295FB7B9257E02C3447663AF0F1628C47EB4EDD7C8FEBC2
MD5 SHA1 SHA512 TLSH

Submit Download

ioSpecial.ini

Path C:\Users\Admin\AppData\Local\Temp\nsv509.tmp\ioSpecial.ini
Size 687B
SHA256 bf0698da896b80fdad101fcbdc65c702ee13b9ffd5d0a199b7a62afdc6de5899
MD5 28507524b9ce9c9ed146fe0d5f4eec4b
SHA1 0d7248c95209668cb862818aa843489a1f098454
SHA512 d9bf2da8680cd0a2a8550c985662c4eb7ade6fd675b87213c06d50ae34b45d286f880168c50b54e571b1c99f8944a8c2d11a9766059cf083dfe3a1e1b0a75612
TLSH
T181019E89841FE369486065D664FA379287D03C2C47213DF6F0528C87978DDD38AEAED3
MD5 SHA1 SHA512 TLSH

Submit Download

ioSpecial.ini

Path C:\Users\Admin\AppData\Local\Temp\nsv509.tmp\ioSpecial.ini
Size 664B
SHA256 176499929db5ecd3ac1a33d413fa2c6ade2e427613bfd54b5e0ab39566344813
MD5 fa3b92827d4b29fcdd1da87966ce59e3
SHA1 f15edda934c1c419e378ec358a0a858d44b5e3cd
SHA512 f9a22ad6011f932412af2612d43eb193be189eef56fadf38f995a4b7f2474382eafcc93929cecf5ba1730dcc599f26bc65b7855bcaaf0c679deda6728c4c1afb
TLSH
T1E4019E48401A429B48205286A6FB7B9253D02C3447662AF0F162CC43974DDD2D8FEBC3
MD5 SHA1 SHA512 TLSH

Submit Download

CSC4E16.tmp

Path \??\c:\Users\Admin\AppData\Local\Temp\CSC4E16.tmp
Size 664B
SHA256 4903e874bc9f5a6756af109c5650432a248d86f50b6d5dd2af3aad05f16b159b
MD5 ce4c0c742a690eacd42f9b8e941aaf6d
SHA1 f55a7118c044c7906614c1f1ebf274de97d02c8e
SHA512 9ffb23179368a7744a2369f4951cb4940178c70eda1db1f47c37b659c2710c452b60618a61a3ed58f4cfe95f0cb8e770692dec8b5361ec47801d691ca83bbb31
TLSH
T18F01540A73F8420EF0F38B31BDF543A3A16DBD61EE7697AD558407192C60510A962F72
MD5 SHA1 SHA512 TLSH

Submit Download

b9fupfql.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\b9fupfql.0.cs
Size 16KB
SHA256 9f2bda1999242f86c019d8e52a3a392836dbdd8211e724a028d4bb51e681ccfb
MD5 a36e2bdfb98c693b5424a3e176a685c3
SHA1 da6f9697e1a31ac2f79fa04887d0be7e6f4eb536
SHA512 4e192cff07aa122c017c268317fced5e73b11696119ed34f29311757251390a4bfc478adb2795ec995dcc4f58a1af0cebcdfba27215d18920a0a5d70a239a2d3
SSDEEP 192:FIjWXJt6/mHGP94oSKBxXNxceB87qp486zc8e:28FHKBdceB87qp486zc8e
TLSH
T1F57222AB11309512007BB7B9DA73D269DD79824318384DA0BD8CC4D2EF7B249E737DA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

b9fupfql.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\b9fupfql.cmdline
Size 412B
SHA256 24ed382dc026ceaf49feed2483430603048e02a68c0eb50f3774a6c2910bcb69
MD5 8ceba91ff0982123a9c01d7b9cbdf809
SHA1 6e0b952bbdeb24136d9fbd535ccebb824c758ccb
SHA512 aae02eac77075659a567ae130ddd3482f944990741cb97597c9aeb3ba350a555b13b0b612a07137d2655e3ba8121a492a5a2ad4d3baca0d64bea0b2aa1b706d8
TLSH
T147E0AB2E065AC1B226B2354273D8AE4C52A26A0F39116E28DA00890E209B9392692B95
MD5 SHA1 SHA512 TLSH

Submit Download

memory/4436-348-0x0000000074ED0000-0x0000000075481000-memory.dmp

Download

memory/4436-294-0x00000000087B0000-0x00000000087EB000-memory.dmp

Download

memory/4436-323-0x0000000002200000-0x0000000002210000-memory.dmp

Download

memory/4436-253-0x0000000074ED2000-0x0000000074ED4000-memory.dmp

Download

memory/4436-330-0x0000000074ED0000-0x0000000075481000-memory.dmp

Download

memory/4436-252-0x0000000002200000-0x0000000002210000-memory.dmp

Download

memory/4436-307-0x0000000074ED0000-0x0000000075481000-memory.dmp

Download

memory/4436-423-0x0000000074ED0000-0x0000000075481000-memory.dmp

Download

memory/4436-301-0x0000000074ED0000-0x0000000075481000-memory.dmp

Download

memory/4436-352-0x0000000074ED0000-0x0000000075481000-memory.dmp

Download

memory/4436-324-0x0000000074ED2000-0x0000000074ED4000-memory.dmp

Download

memory/4436-365-0x000000000EC60000-0x000000000EC9B000-memory.dmp

Download

memory/4436-396-0x0000000016AD0000-0x0000000016B32000-memory.dmp

Download

memory/4732-283-0x0000000074ED0000-0x0000000075481000-memory.dmp

Download

memory/4732-276-0x0000000074ED0000-0x0000000075481000-memory.dmp

Download