Kleinstadt_3[.]5[.]0[.]14[.]exe

resource
Kleinstadt_3.5.0.14.exe
unpack001/$PLUGINSDIR/AdvSplash.dll
unpack001/$PLUGINSDIR/InstallOptions.dll
unpack001/$PLUGINSDIR/LangDLL.dll
unpack001/$PLUGINSDIR/inetc.dll
unpack001/Common.Plugins.dll
unpack001/Common.Zip.dll
unpack001/Common.dll
unpack001/Kleinstadt.exe
unpack001/Microsoft.DirectX.AudioVideoPlayback.dll
unpack001/Microsoft.DirectX.DirectSound.dll
unpack001/Microsoft.DirectX.dll
unpack001/NAudio.dll
unpack001/Signalling.dll
unpack001/Update.exe
unpack001/de/Common.resources.dll
unpack001/de/Kleinstadt.resources.dll
unpack001/de/Signalling.resources.dll
unpack001/en/Kleinstadt.resources.dll
unpack001/fr/Common.resources.dll
unpack001/fr/Kleinstadt.resources.dll
unpack001/fr/Signalling.resources.dll
unpack001/kleinstadt_data.dll
unpack001/nl/Common.resources.dll
unpack001/nl/Kleinstadt.resources.dll
unpack001/nl/Signalling.resources.dll
unpack001/system_de.dll
unpack001/uninst.exe

resource	yara_rule
sample	nsis_installer_1
sample	nsis_installer_2
static1/unpack001/uninst.exe	nsis_installer_1
static1/unpack001/uninst.exe	nsis_installer_2

Kleinstadt_3.5.0.14.exe

IMPHASH 099c0646ea7282d232219f8807883be0
SHA256 38af609ca6d6e40e2feb589d48f99b8b2a28f77d3f4f66ef7b431655ef584223
MD5 3af45639e527bc6fce278170c47d7cf8
SHA1 23f297708fa5f3a8db71a58e1a704d401bd651ea
SHA512 b313966d49a11cf8ba04963f6aa7788a88d0cf08b4d760c55d1534eae1467645d6d960c8d9628e2eac8078e769cd843049e60b804dead149a9999a9472ba7391
SSDEEP 393216:GuBSqU7FgccrInaodbstBO4ia0gxJ9QdF:xMhBgccrMivFialQdF
TLSH
T157D63317A8F42AC6E2579733A9502665AFF265374DCF4E1351079C2E23370BAEF680B4
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

12860

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

CompareFileTime SearchPathA GetShortPathNameA GetFullPathNameA MoveFileA SetCurrentDirectoryA GetFileAttributesA GetLastError CreateDirectoryA SetFileAttributesA Sleep GetTickCount CreateFileA GetFileSize GetModuleFileNameA GetCurrentProcess CopyFileA ExitProcess SetFileTime GetTempPathA GetCommandLineA SetErrorMode LoadLibraryA lstrcpynA GetDiskFreeSpaceA GlobalUnlock GlobalLock CreateThread CreateProcessA RemoveDirectoryA GetTempFileNameA lstrlenA lstrcatA GetSystemDirectoryA GetVersion CloseHandle lstrcmpiA lstrcmpA ExpandEnvironmentStringsA GlobalFree GlobalAlloc WaitForSingleObject GetExitCodeProcess GetModuleHandleA LoadLibraryExA GetProcAddress FreeLibrary MultiByteToWideChar WritePrivateProfileStringA GetPrivateProfileStringA WriteFile ReadFile MulDiv SetFilePointer FindClose FindNextFileA FindFirstFileA DeleteFileA GetWindowsDirectoryA

user32

EndDialog ScreenToClient GetWindowRect EnableMenuItem GetSystemMenu SetClassLongA IsWindowEnabled SetWindowPos GetSysColor GetWindowLongA SetCursor LoadCursorA CheckDlgButton GetMessagePos LoadBitmapA CallWindowProcA IsWindowVisible CloseClipboard SetClipboardData EmptyClipboard RegisterClassA TrackPopupMenu AppendMenuA CreatePopupMenu GetSystemMetrics SetDlgItemTextA GetDlgItemTextA MessageBoxIndirectA CharPrevA DispatchMessageA PeekMessageA DestroyWindow CreateDialogParamA SetTimer SetWindowTextA PostQuitMessage SetForegroundWindow wsprintfA SendMessageTimeoutA FindWindowExA SystemParametersInfoA CreateWindowExA GetClassInfoA DialogBoxParamA CharNextA OpenClipboard ExitWindowsEx IsWindow GetDlgItem SetWindowLongA LoadImageA GetDC EnableWindow InvalidateRect SendMessageA DefWindowProcA BeginPaint GetClientRect FillRect DrawTextA EndPaint ShowWindow

gdi32

SetBkColor GetDeviceCaps DeleteObject CreateBrushIndirect CreateFontIndirectA SetBkMode SetTextColor SelectObject

shell32

SHGetPathFromIDListA SHBrowseForFolderA SHGetFileInfoA ShellExecuteA SHFileOperationA SHGetSpecialFolderLocation

advapi32

RegQueryValueExA RegSetValueExA RegEnumKeyA RegEnumValueA RegOpenKeyExA RegDeleteKeyA RegDeleteValueA RegCloseKey RegCreateKeyExA

comctl32

ImageList_AddMasked ImageList_Destroy ord17 ImageList_Create

ole32

CoTaskMemFree OleInitialize OleUninitialize CoCreateInstance

version

GetFileVersionInfoSizeA GetFileVersionInfoA VerQueryValueA

$PLUGINSDIR/AdvSplash.dll

IMPHASH 741b6bafe355b63a372d737b30543a95
SHA256 eb1ca2b3a6e564c32677d0cdc388e26b74ef686e071d7dbca44d0bfa10488feb
MD5 13cc92f90a299f5b2b2f795d0d2e47dc
SHA1 aa69ead8520876d232c6ed96021a4825e79f542f
SHA512 ff4e6e6e7104568fc85ef3a3f0494a5c7822a4ceaf65c584ad534f08f9a472a8d86f0a62f1f86343c61e2540b2254714b7ea43e4b312ff13d8271ff069386fa3
SSDEEP 96:6hNSXIcmYjkvTS6MnBNZ1BMjDfhkkEkkXstWpPwoS:JXIpzTSd1BSk/kJtWpP
TLSH
T137C1B837B7C216F7C35600F12916375387E9943263A1946909B3EBCAA6A185BDD34703
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

4448

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/InstallOptions.dll

IMPHASH b1cd0d78f652ce5fc63f0879371af012
SHA256 c9cd5c9609e70005926ae5171726a4142ffbcccc771d307efcd195dafc1e6b4b
MD5 325b008aec81e5aaa57096f05d4212b5
SHA1 27a2d89747a20305b6518438eff5b9f57f7df5c3
SHA512 18362b3aee529a27e85cc087627ecf6e2d21196d725f499c4a185cb3a380999f43ff1833a8ebec3f5ba1d3a113ef83185770e663854121f2d8b885790115afdf
SSDEEP 192:86d+dHXLHQOPiY53uiUdigyU+WsPdc/A1A+2jwK72dwF7dBEnbok:86UdHXcIiY535zBt2jw+BEnbo
TLSH
T1ED622A11778888F3DBD2013EB4533707AF9D5126B4929ED2CA271ECA6D2B05D7EB2346
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

10696

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

kernel32

SetCurrentDirectoryA GetCurrentDirectoryA MultiByteToWideChar GetPrivateProfileIntA GlobalLock GetModuleHandleA lstrcmpiA GetPrivateProfileStringA lstrcatA lstrcpynA WritePrivateProfileStringA lstrlenA lstrcpyA GlobalFree GlobalUnlock GlobalAlloc

user32

MapWindowPoints GetDlgCtrlID CloseClipboard GetClipboardData OpenClipboard PtInRect SetWindowRgn LoadIconA LoadImageA SetWindowLongA CreateWindowExA MapDialogRect SetWindowPos GetWindowRect CreateDialogParamA ShowWindow EnableMenuItem GetSystemMenu EnableWindow GetDlgItem DestroyIcon DestroyWindow DispatchMessageA TranslateMessage GetMessageA IsDialogMessageA LoadCursorA SetCursor DrawTextA GetWindowLongA DrawFocusRect CallWindowProcA PostMessageA MessageBoxA CharNextA wsprintfA GetWindowTextA SetWindowTextA SendMessageA GetClientRect

gdi32

SetTextColor CreateCompatibleDC GetObjectA GetDIBits CreateRectRgn CombineRgn DeleteObject SelectObject

shell32

SHBrowseForFolderA SHGetDesktopFolder SHGetPathFromIDListA ShellExecuteA

comdlg32

GetOpenFileNameA GetSaveFileNameA CommDlgExtendedError

ole32

CoTaskMemFree

$PLUGINSDIR/LangDLL.dll

IMPHASH 9b6b6a7858e17fb0b17e1c1428330343
SHA256 60a964095af1be79f6a99b22212fefe2d16f5a0afd7e707d14394e4143e3f4f5
MD5 9384f4007c492d4fa040924f31c00166
SHA1 aba37faef30d7c445584c688a0b5638f5db31c7b
SHA512 68f158887e24302673227adffc688fd3edabf097d7f5410f983e06c6b9c7344ca1d8a45c7fa05553adcc5987993df3a298763477168d4842e554c4eb93b9aaaf
SSDEEP 48:iV6pAvmNC6iMPUptxEZK65x/AmvycNSmwVsOYJyvrpXptp/JvR0Jlof5d2:2811GED5ZTvycNSmwVsTJuftpZR0Sd2
TLSH
T129C18333B3C24AF5D6950633252373C366539E342359804F9B6712AA69208FBDD6E793
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

5526

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

$PLUGINSDIR/inetc.dll

IMPHASH 5bdcdde5acd7b395f3f3d19ebbb8c6cd
SHA256 3bce87b66d9272c82421920c34b0216e12c57a437d1955c36f23c74c1a01d420
MD5 e541458cfe66ef95ffbea40eaaa07289
SHA1 caec1233f841ee72004231a3027b13cdeb13274c
SHA512 0bf6313e4cb7bbdcfba828fb791540b630adc58c43aa4b5ba77790367d0f34f76077cd84cc62e2a2c98c788a88547f32a11e549873d172c5aa2753124847cd0c
SSDEEP 384:b1JO6XgZkjxm+NpXaWgzxUX//EUhU7ya4LQ0Ac9khYLMkIX0+GBty3Sm0:b+6Xgsm+NpKWgzxUXnEUhUua4Li70
TLSH
T1C1921A01AF5566F3D3A90830F569375686EBAE742530A4876BF31FCD186A283FA35703
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

15009

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

msvcrt

_mbschr _adjust_fdiv malloc _initterm free strlen strchr strrchr _mbsrchr strtoul memset _mbsstr strtol

kernel32

GlobalFree CreateThread WaitForSingleObject TerminateThread GetModuleHandleA MulDiv lstrcpyA GlobalAlloc LoadLibraryA GetProcAddress lstrcmpiA CreateFileA GetFileSize lstrlenA WriteFile ReadFile lstrcmpA lstrcpynA lstrcatA GetLastError DeleteFileA CloseHandle SleepEx SetFilePointer GetTickCount

user32

MessageBoxA GetParent ShowWindow SetWindowLongA IsWindow SetWindowTextA SendDlgItemMessageA GetDlgItem PostMessageA GetWindowTextA SendMessageA SetDlgItemTextA SetWindowPos SystemParametersInfoA GetClientRect GetWindowRect SetTimer LoadIconA UpdateWindow DestroyWindow KillTimer RedrawWindow DispatchMessageA TranslateMessage GetMessageA IsDialogMessageA IsWindowVisible EnableWindow CreateDialogParamA FindWindowExA wsprintfA GetWindowLongA

wininet

HttpSendRequestA HttpSendRequestExA HttpQueryInfoA FtpCreateDirectoryA FtpOpenFileA InternetGetLastResponseInfoA InternetSetFilePointer InternetSetOptionA InternetQueryOptionA InternetCloseHandle InternetErrorDlg HttpOpenRequestA HttpAddRequestHeadersA HttpEndRequestA InternetConnectA InternetCrackUrlA InternetOpenA InternetReadFile InternetWriteFile

comctl32

ord17

$PLUGINSDIR/ioSpecial.ini

SHA256 d95aed234f932a1c48a2b1b0d98c60ca31f962310c03158e2884ab4ddd3ea1e0
MD5 e2d5070bc28db1ac745613689ff86067
SHA1 282e080b4cf847174c5c11e4f9157b8c338ecb19
SHA512 a50ca2014869629135b54e848f03cb4983ad8029cd811300d02b0fc54de0436185f418fea4d3db888eb0f3170e33a59d486aa885f024ab29e630e9bc0ae1a2de
TLSH
T1D3D0C9C9501A802944208642A97A2FA263E03E210B1725FAF5724C87EB4CDE79C9D682
MD5 SHA1 SHA512 TLSH

NSIS installer

installer

$PLUGINSDIR/modern-header.bmp

SHA256 f5e8ce7537992b4ce9499487a19711fd4a2aea8adcbeeefcc643b9844f10e38b
MD5 2a2a6b90ca6a9080101c0d3ad00d8322
SHA1 3c3635da3e148666ce8ebe52f052623c1962a2c4
SHA512 d56c126740e619aadc585dc8eb2da5d6eed41ef238cb8b8a697a53dfe06e151a4e1e35e915ce4b359e7725089e0548c8fc12a4d7bd72899b64d450ca964d72d6
SSDEEP 768:GZSsrRYPdfi4yJ9sYwRyRFLbH0Kjg9gDj4MdH6LE9mvJ1ucnHC:O
TLSH
T1DBC2701EEB57284CA80DAA22981BDAD872FD8F2CFDC5C3212D90739F16759CFA604C55
MD5 SHA1 SHA512 SSDEEP TLSH

NSIS installer

installer

$PLUGINSDIR/modern-wizard.bmp

SHA256 d3b0a65d304489603d2aefc0d706b7bf2cfd3e6b5bf5f0346a65c137d7591594
MD5 c8a8b5a53da0e2def0e55b8a4914c28d
SHA1 3d6f3b97b9feed9babad17df07955e713af89e44
SHA512 2f29cca0eec359ccdbd6cb7a5218c579c702dfa1232ee17f6eaa4b06de56fb1500be80c9af3f2accaa5e9f2558c060440b37e7876ced4331857bb263394c4230
SSDEEP 768:yxyHXd07j5KcDXliqdkfAUUKQT3YaQ8QDUVR:yxyHXdqjIcDXWaQ8QoVR
TLSH
T101E38420C793F8A0005D8B3278A3780630FD5EBEF9241BAE1D66766F47F4997258B50E
MD5 SHA1 SHA512 SSDEEP TLSH

NSIS installer

installer

$PLUGINSDIR/splash.bmp

SHA256 6adb6d1cc78476f3c224393ada0e4f01feaff5ecec2814d501f01b82811b4143
MD5 3fa686a89e84e641f8e04af76492be33
SHA1 97bde41df9416808181cbf3cf562aab8c64c51c7
SHA512 13a8a25f4adce7a94be2febc292c200eba66d599a07c23e48033add235a85cedcbf2e3ed2529b02f42bbd4064646bc66336ac6a5ee828784de1982bc25e4ae34
SSDEEP 768:WmNfWAjeoYiOr4YgPxZGW0i9KNc7OZQiQ0Z1A+3H1H310H1/sU1f71T+O1vq3K1x:L
TLSH
T13E4439BA57BA99C5CAB82DB0CF3A87FC8447FD496D985B9F688B3A4F11F4C104915083
MD5 SHA1 SHA512 SSDEEP TLSH

NSIS installer

installer

Common.Plugins.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 e0b6457f8742ffbaf3e1e5f7eaa065ccede7d2879c065f032af06f9c3a88dbc4
MD5 fa15e5c5a1c0eec40a6b0aeb1f6871c7
SHA1 12f6e5ebe928e3856a82957b63da228990eaa701
SHA512 da20c90ee5de5c087e0d1e8280d21db95ea23f202602bbe9d2ae2f8cb4770f7c1cd0ee1400629ed46d93233a016a99d69ae536151d9983a43f91fec4f49ae2d8
SSDEEP 96:oWn2tfwwdyYDOyND66zYOX8aKvhKbQYw6lK6ooMZ:p2lwddW6UYW8azkYBY6E
TLSH
T139E1A752E7ACC33ECCBA5B76789303151778E791E623DB9B4841681FBD933102632B91
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

12958

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

k:\Post T SVN\trunk\Common-Plugins\obj\x86\Release\Common.Plugins.pdb

Common.Zip.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 336faede896555b3d561a94381e0b2f45aafa1f4e39e4b74c446e32f6f784083
MD5 738a9d42c5f37ce97142f6a866bd5fb5
SHA1 a9418be058d6468162a96b61c85f883bc6096066
SHA512 dac073960e739344dfc6222dd9605fcbe64434e1cb0a01a4e236442f9eda1756cda1c91b8ca65122f0d069defbfed869915031432ff7631da22c6aa08dc28ecb
SSDEEP 3072:9Hwefs/NBJQQR9+NOD3xRWsSY6LPOPAY0hx0yoADielcPpjFlPdrMlaa///ecIDp:qai9+No3x4I6EAY0u2ipVFpdQ
TLSH
T1F8143A281BDD4B2BF2BF5BBDD0B46561C3B1B451B83EDB5A9D8064EE2802790DD103A3
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

202766

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

c:\Post T\DotNetZip-src-v1.9.1.2\DotNetZip\Zip Reduced\obj\Release\Common.Zip.pdb

Common.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 afbe5a9c406179e02c53623c287366c767a18fabb40022d9cb038c0c241e14b5
MD5 339d8d26f6c32b47bea09636f1870054
SHA1 6c004a5189adf39d98511262eabf00bee10008e5
SHA512 67eb60a5d9d3990f8c9b1a631027d7840983ff731233a32fd13585110cd1f75247454060fb8f1c1a2b7b983ce9ff17479f54f431e2ef2122fe287b33872e8792
SSDEEP 12288:BawFIsFE9Q/11VYw+0de0WG8XTTxMx75uO/kh13NChlzuc7tPRNTJnnTLdLXXUe2:pX/1Td94WPusW3NP09UG9s
TLSH
T1CE555B8A33D5DD0BC4AD5234A03440341BB5EB15B386E33F5558E6ACACA77523E86EB3
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

1308846

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

k:\Post T SVN\trunk\Common\obj\x86\Release\Common.pdb

Kleinstadt.exe

IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
SHA256 dde5d28bc9d14d9daa5cd0de4b3505bc1b4bc1c9315fc62da421413a8a3cce2e
MD5 4c2655910e7ec9a7a921ef72268fee3b
SHA1 dadf2b8f2532046058db1071be19d11ba1c22bcf
SHA512 cb603ee1fa9ceb9449063384fa2bbc5b1a74de5c6034f70856342107e97c2f200e45855ddd16ec08698f160f02f5931d3ee192a18075f16562822d53174801cf
SSDEEP 196608:7Es7+I6+YDGPzSx+I6+YD4+I6+YDj+I6+YDI+I6+YDL+I6+YDGk:oA+I6+YeSx+I6+YE+I6+Y3+I6+YU+I69
TLSH
T1A696C520E2518859C13943F258315CA2527FFB29B631C57C284FF27FEAF26269B1275B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

9428238

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

k:\Post T SVN\trunk\Signals Basic\obj\x86\K_Production\Kleinstadt.pdb

Kleinstadt.exe.config

SHA256 5d82b1cfe58b2731577f74fea17f40ff4b2a40db32b87ea4302237a0748a3702
MD5 a0ed71f7817d6bc181862683dd1fe600
SHA1 65543bf19daeb8956f3a370bbabe0e33b478c141
SHA512 9a994ef2c9f140c08d7da853f7e60cd9f42e2c991e309bdb00dee84de4ce8188a8a0728783a27612b0c74695635613d934dc6c4ad041f47f42da380ae1df8d19
SSDEEP 384:TbVha7dIGHWQgBmmvp/WxN5aGk+eBBO59Qgk:HqsmY5WxNDgeQ9
TLSH
T1A913EA0CB1C19F991276A635E73152D1EDA0052311B6B1F078EE31676F70CDA4AF3BAA
MD5 SHA1 SHA512 SSDEEP TLSH

NSIS installer

installer

Microsoft.DirectX.AudioVideoPlayback.dll

IMPHASH c1f83ebb18f3fb1f64e049cc66ecf65d
SHA256 406f473429573e9f0084aae125ef8f19f59291aa4c33cf7d40e7d996995a3238
MD5 75933586afd94ea24c5acd3dbc89a272
SHA1 970fd4b49d1368330c10279798991b901a233c2a
SHA512 c096f0f11fb306c6a84886826306fe9c2862c3c79b14a8991a174224b41c2a68b76e5be506494d23d354384c715c5d82a1cacffff9644de9d6b93e9478087a1d
SSDEEP 768:/BJPuUm+QFYqG9se2k5R7vtv8+80t2TxJNdfr83A/E9t3DAsm:7u8qYqK6k5R7O+80tKxJN983aErm
TLSH
T1DB33B8054784C167D36E07B6907A13718739A1B187A6F7C3141A42E22D7B3EDEB782EB
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

1

Major OS version

5

Entry point

52236

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

Microsoft.DirectX.AudioVideoPlayback.pdb

Microsoft.DirectX.DirectSound.dll

IMPHASH 00214b053aa5cf80d5f0b263184e853d
SHA256 2e28c8fb8b87b5ffd1e0ea27710a2e785ef4741a89e4b3c3af726ec63d15a1fa
MD5 d035348ec8968861af585b7132fe4c7b
SHA1 877ffdf77b9cdc1be14135cff0b756a231401617
SHA512 94358b581510c68049ac92990674a6cb495cb8ff005f7fc03696c57ba8b4cb384c5035d9332d0ea39093ba5fa5c8082143896cd2fc7ac24a192520789c707458
SSDEEP 1536:QP0W6HY2WLuj4eWGolnfI8srFxq1tu5uxMc7q2eFrIuQD+hDLb:2p6HTLEeWvS8Q5uxMc7qdFrIuQD0
TLSH
T12E04740D5340D63FD61E57B059C20B666639408A5322B6EF0189967578FE3CAC83AAFF
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

1

Major OS version

5

Entry point

176800

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

Microsoft.DirectX.DirectSound.pdb

Microsoft.DirectX.dll

IMPHASH 272e9f998b44bd5348f4d46d5b74bed2
SHA256 942e98f142373547493f13b14e1603b2420851aff013d3085bada7b6b2214d9c
MD5 0c453970e89db1c1eb9de087e6eab5ba
SHA1 c4c7e034773a240909332814f499730575a1cd71
SHA512 ef3b2cc2598b4ea58f00f93155319674450c8c35b706108ce3bbb5c2502efa179046d9d50e12725e6dc7a555f4880404ed03de15a0753606f20a1654799886fb
SSDEEP 6144:o/JepwLNyV1VYTduT/iQanWWdQeeaQee0QeesQee4SQeehQeeZ+M:CjLYV1yTALKl
TLSH
T1DD24290173FC652BF1877AB54FCE92A9F12FD6C5434262CB109407AB6E94AC697322F1
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

1

Major OS version

5

Entry point

111506

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

Microsoft.DirectX.pdb

NAudio.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 d2f61b2f636782f3db9cdf42b8849a94acee0edab11766b157cb5650cd4bf253
MD5 f84c1ecba4701533a66279cb72d097b2
SHA1 03685a1df652108a140e29b4b6ac1f5e4fefdd43
SHA512 a400e8cdcba1b7eb8005b7460cb5fb45ea81204540b50df494ecf3911411a476c5b47b9930b0a344885e95c40cab3b0126051ff79815f9d1e66856dd7caf9b97
SSDEEP 6144:208gRgP13SmAmiQ3UIlZB7YZuYu0qM92pYrGJoOYO4QOBEWM:a2gPNB7WxmG3c
TLSH
T105647B541BF45666D47F23B8E0E215068BB0F1527827E70E4BE415BE3CB37A1CA817AB
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

334158

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

C:\Users\Mark\Documents\Code\CodePlex\NAudio\NAudio\obj\Debug\NAudio.pdb

Signalling.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 18dea720949c18ebe923fa06b978c51ac5086514dd0b4797f15b07e800d8e2ca
MD5 d8be3cf946bb0f513619deff4d3c8eac
SHA1 b7db85e0ed75ce46cec539ca99b62a7a49b354a3
SHA512 86f2a633db210c8560401dd7e71b3389c30cf0c68bacf7fbb6da9686c2c369c1113612458612dde43666efbb4e73d420f5ef2d242ba835895daa405d235ed256
SSDEEP 98304:MQL0JxUGD+TUwkDo97OFVSSkceK+lBGumfQaGA49R:MQIxUGD+TYs9qT5JEGumYaGV9R
TLSH
T1B556CF10B3F4AD1ED87E87B5403141250BF2FE8A77A2F75DAE05A1AD2DA27015F427A3
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

6076718

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

k:\Post T SVN\trunk\SimpleSignals\obj\x86\K_Production\Signalling.pdb

Update.exe

IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
SHA256 6afc7e3aef6f2a3921fb58733dbd3a69799c8710a7462a8cee16a6f52c58782f
MD5 b8c0619ad438fec6508fa02eff6fb430
SHA1 86d5143ad21a008dc50fdfd475e8c9d4d390c988
SHA512 06d07cb3c4f7619daffbe6c70e2d9bd19f6a40ad0e06ba16474fac935c8c88554a32ab9bee30348b287f5de975cfe3d9f5113e19d840daaae46c358e72654b55
SSDEEP 6144:L01N3Zt755ic1N3Zt755iSN1N3Zt755i:YH5sUH5sYH5s
TLSH
T1AA15FF643F10C627F7A6277578B1AB348B614DF1E068C31B4AB263B4147B55AFB360CA
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

638398

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

k:\Post T SVN\trunk\sim_updater\Update\obj\x86\K_Production\Update.pdb

css/base-min.css

SHA256 6d9b4ed8c58fa981f3712824b7888b716d3ee4dbb65f565c5e9d1efa9c7a16bf
MD5 023bedcc0b07110264740d1c29b69f33
SHA1 6c82c15573ab40fa9d348cdce53e474a4321dccf
SHA512 7193e8ee1df41a4f00affbd2c3ca7720298d25ae97d8b852102bc37cb8f6aef3f9bbd4abda2b65f40e5cc87b2e9c41dc0f633f403a8cd420ed95defe046c15f8
TLSH
T1A301252123620004A11547237952F6ADB5644670852FA9F13373C174DAD40F95634BEC
MD5 SHA1 SHA512 TLSH

NSIS installer

installer

css/layout.css

SHA256 b97ee50dd31cbbcb0f157d26ff60753d26bef77531e3b73370885de6b393a3bc
MD5 4915c2ab3b7ff624ce9f6b19b85de7aa
SHA1 67fcd6c833d5f9c0e5dd77df2b91047f84501337
SHA512 a94ba2d535394417a5b524899095bad0a1ff75925063bc99e05c4b9a4ecfef6c03aec5c935ab5d5d7b939933d6c4521b7b2fdab79a246231e12329a687daae11
TLSH
T147110A6BD58D80EFA32328D8B7718E114E5008851C6EEBF038F42249D8856B93FB62DD
MD5 SHA1 SHA512 TLSH

NSIS installer

installer

css/reset-min.css

SHA256 9bab281672aea6d79d0da1262e65bbe19c7a36aafa9f5673738852e04875337a
MD5 7fd5264d7242fdba29f78fb9cca5a95f
SHA1 8c021c5e3e9d48644c02ff253167c6956deb6bd6
SHA512 23cb29d9cc3062a099cd10087d97d20a6448eca5a26d2576a51deda7e62ce049abdddffa844df8a9c58e41c68fd0bf228f59454fb1e1f670cc70dc5b5ef45219
TLSH
T19201C021B374DCA435A74965310D95AA69482311C8178730F72798A99C860FB53D1BA4
MD5 SHA1 SHA512 TLSH

NSIS installer

installer

de/Common.resources.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 e68796303c94892f78e12f199c04b207b023f27572412a62005583dd0cbf0e85
MD5 a5e380a46af68d0f6b1148774f96bd16
SHA1 9c679a5e24dc63632715104091e43c76387290e1
SHA512 c0d89a2eebfd550c0dac5e850032e6751384d113c881044df5e5d95923679d0edefd33d6b181de6d463618c66123e1fbb37f3c33069058fc349dfa589e5b530f
SSDEEP 384:DXRa09+cn9RXb399t9r97949L9qXK9S9D9/oXRau9Ncx9BXwu9o91K9GvZXd9BoK:N3heQE
TLSH
T1AEB2CE3237965028C9B55B331834F2C1637BBA59BF68CB2D559A231C5FB22139B12F62
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

20238

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

de/Kleinstadt.resources.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 80f2f258712dfba259382c3f26f7d98b8323bc492080be7484a7a966cf426d69
MD5 aefcfbbdd0cac70b0e78e8f09f3b6977
SHA1 8b9febd2936c4b27de3c0f27f966e3ac567147fe
SHA512 f9286505385616574a94db2bd8d163b96e67083ef83b9c8b1c44f746220d34bd27f4df10c1a720b8092ec261df7481c674373e0a91da5da4bbb78128cdaf94bf
SSDEEP 24576:Jxeg3rW+I6+YDwU+I6+YDwj+I6+YDwVTbmURxiVrn:JxC+I6+YDf+I6+YDK+I6+YD
TLSH
T1EEE5E9D5D701C82AC2344AF19C215CA0911FFA6CA6768C345C5FFABFF4F2521BA9264B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

3122126

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

de/Kleinstadt_Timetable_SortedByTime_[DE].pdf

SHA256 3398ff3770fce0103e6827df83dfc7e4c3539a279df5a2f9034d55103b7208e3
MD5 221e376e2ff51c436cd1b1de63424ec2
SHA1 35352966cc8922aa75f73f9ac66038103788dfc8
SHA512 e88189634fac3cdd11b1c0857a0dc5ea2ea8c765ddeccbd1a4a9b376c45e16405aae5e3960046199a816165b221e4a36feaf9edee922c319fdefaa9a0c0a4006
SSDEEP 1536:K4gouwuEsoMpJUXgOBm0LZE7m/G+IShQNPcuUgJsBlw7zziLwh:qoFYJWE75zS6PcuUgsBlwvuu
TLSH
T190A3E036C9D62CEEF891CA42A1B5B52D497C364BC5CC74C6273D4B896340C89E267EE3
MD5 SHA1 SHA512 SSDEEP TLSH

NSIS installer

installer

de/Kleinstadt_Timetable_SortedByTrainNumber_[DE].pdf

SHA256 eb6db09e8184ae6687eb525f5e4b51fc284b2a2414099282479021e1a3dc9b58
MD5 967c4d5ede1947528c9b1f16f94d1441
SHA1 517e8d09f759ac2b8d9e28f0a2047494e0ca6a7f
SHA512 c454c4003b4022972b00b810c37303e83910b957baeac6f99de4b1497f1b6ed891a11f9896409b735fa28df2b5183368818c6f0621c1a043280b6490e2e4f46a
SSDEEP 1536:I0Fwq1jg6KkRK9u8N19oc4bFnjCBbmry+Mo98dgscuUgssBlw7zzik0:gq1jXX+79oHnA4UdvcuUbsBlwvuF
TLSH
T17593E001D5967CEDF881C6459172783E423FB217C6CC34D626AE0F8AA350CADD967AE3
MD5 SHA1 SHA512 SSDEEP TLSH

NSIS installer

installer

de/Signalling.resources.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 33c0f389f2a0bd4fdff5c589a982dff202a66425b4d1677e49f75e12473c173a
MD5 2a5b88d5f57b127481d88251a8599970
SHA1 e4a5bbbe3b100c715bc9c23f99e5a5fb2b11ca5e
SHA512 9fea6ae16f05503d09edc4db363874d856dc265af657d5d5e4c8a88305fc2f01fb86f61ca86f263e1bbd3132d1b6b763d925b44c6cb8ca6401b06594ce661b65
SSDEEP 384:oXY9S9F9u94XRa9D9p9r9mcz9X9qn95cx9JP9gXJ9c9LXG9iXD9S9z9U9m9I9N9f:pakt3ZknCKiL
TLSH
T10D537D303BE75158CAA867311C34E6C1227BBB5ABF28CB2D655E130C9E726139B11F67
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

59086

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

de/index.html

SHA256 59ad0b206034047633d7343292097815cdf5acc8f3b0c38d150da0f653e6e5d4
MD5 dad5950f1d033dd1594b375cbd6c20f6
SHA1 e933e375980837328627b0a0fc0e5fabe3f160ad
SHA512 08d00dcdd5c077031d4b207d49868fce6f454b41fe3a3a2b9b12713172915fd425e52a95ad99aec07450295338914e808bce6d48f4e2e145131a6be7e289ed11
TLSH
T1F441651A344CFB24838B47DB90762B29B567D682E3736408FCF782B3DBC9045946B59B
MD5 SHA1 SHA512 TLSH

NSIS installer

installer

de/titleimage.gif

SHA256 46d68e43952386885454343d209fc988b6a6da137ee2070d285726170d4b60f3
MD5 1c8e76d941276ce37fa59ae6776e4a54
SHA1 fd04363a75d92a255dae9fccde4fc5bb295bee31
SHA512 4426d4d8a72c1cf100b19fa2e6239718b3558587aa181f0810e6a0c76b2442df209df620abb8aeb9a082c052694f629d3d5a60629106a701cc5ed0e9dc1bec64
TLSH
T17F51F96ED5401FC06168EF1A68FB185649890D929FECF0C57FEDD93345210B1A62D787
MD5 SHA1 SHA512 TLSH

NSIS installer

installer

en/Kleinstadt.resources.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 7973430c3391e1d48c55dcd1f17227fb9898054ddfe20e8ccecddf39da582588
MD5 d03d34c5309736ae3ca917ee130ddcb3
SHA1 83e67016caa163ead9bfef79f915f514741cf48a
SHA512 3f5f4ac45bb78e4b4ad6c09502490965af928dd489351adafe8000f31c23839edd930f2671906db6d3f39ad8dfd160b6240b5ec2a1002f6745718f44a28ed5f2
SSDEEP 96:4oXRaswjTLHF9f9N9b9+ca9tlXkVv8sW4z:4oXRa/9f9N9b9+ca9ttEEsWS
TLSH
T1CCB1102177A2211DD9710B72287693C16376BE14BF65CB2D168A531CAE33263EF21F32
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

10830

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

en/Kleinstadt_Timetable_SortedByTime.pdf

SHA256 d5b5913cc43404cca854c42d761f8b192b1e49fb8c383da484013040a899741b
MD5 dbd2b21370207435f10d04e67eec6b6a
SHA1 f23bded4621410ad1f8f16b86dae04530470d710
SHA512 45464e344f0c449dc240631ec81017c44ecf675ea9ceafeb8b536e4a3b13757f3cfa7899024ed82ce7adb653434147110e11e6e47906cbeb8825d786414f38b4
SSDEEP 1536:sQb6HkBYzRQPgQpLv/GWY2WL6cvAz3LcuUgW7O/Oa9IFu:j6RRQPgQXGWpCvAz3LcuUl7O/7
TLSH
T115A3E116C8A75C6CF852EF05D039386D04BC725686D8BCD62AAF4F84E340C99AB57DE3
MD5 SHA1 SHA512 SSDEEP TLSH

NSIS installer

installer

en/Kleinstadt_Timetable_SortedByTrainNumber.pdf

SHA256 a117e9ed0dbb39954f58efd81a243784b6741c34da300488f1278508b577552a
MD5 0860d47d5d5f599409f947149dc22dc3
SHA1 15b5798a899c82e374a375f5cd05f3dc308d26ff
SHA512 c8b2aaba9f65532b77517c0059d7ff3e79f857b5df4e46cd98015eab1d410af1b727206c46dd67184daa192dc4555609875008694af5ec091b066aae9ebd822a
SSDEEP 1536:0mIr4NRqwuTgulU3ZbEzgt4VJvs+cixxYOGf8Kfw9n/93Lw48ngEcuUg27O/Oa9s:0EqwuzO39E0CSZZ0K49nBKZcuUH7O/u
TLSH
T17393D060DAEABCADFC82C64A8578347D4ABD710AC0C8B4C2349F4F42B704C955B37AD6
MD5 SHA1 SHA512 SSDEEP TLSH

NSIS installer

installer

en/index.html

SHA256 fd4af6fcab6ec1f14b4a074ed470fcda24fb6d4cbc2678b5462ba39e886474b8
MD5 1b23e6847ee69f4ec3bf716e0868ee58
SHA1 40e1e191f8a383cfcb215ec67123bcf041ee85ef
SHA512 e7532c4abd9e04446948cda9ccecc790940b2ae660f8c9bfcbaa8c049cdff2d68ab1b5a63e75944cb6b0bb880887f121fe30bf59d400a5ef0b6ebc33e49da6de
TLSH
T14D4182397189FB29828346DBC0B222C8F693D58293B32144F9B2027FE6CB401A0175A7
MD5 SHA1 SHA512 TLSH

NSIS installer

installer

en/titleimage.gif

SHA256 7ad9b9d8acf4c80879270235c7a52c212246bccb9faa3a970bc1b1d35c7f69d9
MD5 651e3f7ec379dd70e0b96a95b2464564
SHA1 9c03a805290fb542858468b4dc0b1ecbc907f3e2
SHA512 a540973c27f947eecf9668383dc0950ddbac64fcb264712cea4f43be6873e09516cef764ca64d4fe28f0aa887d0cee3d8181e693c852e34ee0f17658dd1053ce
TLSH
T12151196DD6542A81922DDD27EAFF585B09890D918DFCE0817FDE81238910071B22EB9B
MD5 SHA1 SHA512 TLSH

NSIS installer

installer

fr/Common.resources.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 aa39cc70a8562c71ede40a17d3a0975cdc563f90201ab590aa6398954bada49d
MD5 e9b47cfc8d52db049272cd88849159f6
SHA1 87aed561427103594e5d8c01c6efb699d8ae8132
SHA512 5fe2eb47234dc4b01327ac6ae875a2c847ce0a5ca3a7bf6aca706a531c1433a87eb0609f3b479cbc914c37dc94eb9e9e9a7fd02daae254cb753ac6b3283bec14
SSDEEP 192:O1d5DmB9Mx8w++nziN2DnZ8Dmb1yw6In:OX5DmBvSnuQMa5
TLSH
T1310244270BDC1176D6B16B372835B3821637FB65D534D62EC886221C1AF33528B81F76
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

14782

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

fr/Kleinstadt.resources.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 a56cbc60793f080b72a790075061b21e8d191133d95c640b170e1fd841b1a398
MD5 2627a2fa83630f0cf37602fcf890d7bc
SHA1 42ba7e83554e0528fbb1b393cd673bbfe2af5827
SHA512 6f824c25edf90e083e9bbcbf2a897fb70d729369d49cef00f3b1bc6422d75943ae612f57d58364fa79b75d7023fef084c35c0e7e412f0ef1baa12d9b65d43a59
SSDEEP 12288:m+I6+YDwUlo6Xo9yEr0eRtKhO6V+kzZVMrel2opZhQPs5wrTq:m+I6+YDwn9ShO6V+kzZh
TLSH
T13C65FA98A3845616C13303F048717D60721BFBDDEA76CA3A5C4EF1BFD2E6865B60172A
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

1405758

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

fr/Kleinstadt_Timetable_SortedByTime_[FR].pdf

SHA256 4f612f3a463f33e6905d2d9699af2f447e6832ac58e93c2e7c0aa3b1f1ef15f5
MD5 4e006af8d204bdc6616d206df6e801b9
SHA1 d40d50401896242dca500968352a73a655b1b0f8
SHA512 de86c53b1fc1f04639f26f5832718a723ce8cdec7395191e6e146b64a0d69ce7f789243a6c046d99b94045c600ee450c18bb99aa7f3c89ba873aaec1d7d72bd0
SSDEEP 3072:qKVV9mLIrV4Tmz/i7A5+/EcuUn8KKLA8ag0:qcSM6TmzK7yNU/DD
TLSH
T1A2A3E179D6FB5C6CED11C61582753E1D087FB24B85C874C2226F4FCA83408A5BA976E3
MD5 SHA1 SHA512 SSDEEP TLSH

NSIS installer

installer

fr/Kleinstadt_Timetable_SortedByTrainNumber_[FR].pdf

SHA256 96edcba9bbe126046e23e1c4915731f032ec9371e61947b5c471c24761fe2001
MD5 90fd80e919354fe15ff30bc207e3fbe3
SHA1 872170a202619fef1b7135d3748a311f3143e14a
SHA512 d778cc83249f03fb65bf10039f2986f6dbcf0fff0a4a09a84eb73d1e1974fa35a5892844e9f37f382a5e58d69ca7360eb8b5da38dc6b835e8f60d2a4f3989b50
SSDEEP 1536:eXOWpsxNm04vfTPM758ISozQiN/kxGpYc/jfgAcuUgE1OKIrLA8aSpEX4jW:e+WKxIAF8ISo0iJYyjfJcuUf8KKLA8aX
TLSH
T19393E0A7D5D66CACE811DA025171753D00BEB24682CC788736BE0F867350CEAEA675F3
MD5 SHA1 SHA512 SSDEEP TLSH

NSIS installer

installer

fr/Signalling.resources.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 d99f34d1096fee427eff7c7ad222c4de745981123e372a375f31b44a496b790a
MD5 b4e7bf1d7d9dab08925687071f03f537
SHA1 ffed41d685ae7438c25960173c774f093ea82316
SHA512 c3b8a83428a50fef84fe2247b6677374a21a32f71d2a2dfe05e50f46a55e399b0da9dc846ce13816b1cf195a81c5f9fd0cbd5f6bdc91a9f472ddeb3fc70a837f
SSDEEP 384:7p2IXL9B9KN9Z9j9tE9n969pBaYQXJQ9FXr9O9D9m9g9I9v9l9N91N9Z9b9j9O9h:92RPTYYlB1M2ZAlDq1X7A
TLSH
T1D803AF213BEA5168D7E86B322C30E6C1523BBB66EA38CB1D455A130D5E737435B11F27
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

35470

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

fr/index.html

SHA256 392e4241a0542ea70ef3c0e26ac533a54eee57417a14be852dba3d684f63f410
MD5 0179cc1c0e8e85cd9adcda5f1decee91
SHA1 da686ed8a19df1715d837913ba5161efc8138794
SHA512 aaf6d8903330c88bd3b606a393a19e4467537fcfb5a2b354de6a3f15815f8dc1901bdc89baa9576d4c9dcc1e9e4282094fdb8a35fd1090bcc0efb28fe661a4f5
TLSH
T15E41402C3488B919E2838BDBD076279B9483E491D37BB4A8F9B54273DAC3901B133197
MD5 SHA1 SHA512 TLSH

NSIS installer

installer

fr/titleimage.gif

SHA256 e0011f6e9b1f93faeb8c33a6a96b1f42416501fb74eea60ff2a332ee50e369ca
MD5 0bc66f22036241b969c83de849f27871
SHA1 6f2b619d5ea141e4aabfdf971594fd8cb1cafe14
SHA512 0e545ee8bb19ded8d7661d4de33ef488a70ed1627056e60fa01c3cf012eac21462f2e2ebe849e8c5b23dcdcfa35175d9b1787feaf838b50ac277b803e7af65c6
TLSH
T15A5119ADC98069C01118DA16A8FB085B458D0DD15DEDE0C16FAFD53749180B1B22DB87
MD5 SHA1 SHA512 TLSH

NSIS installer

installer

kleinstadt_data.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 16c1616f25d46c2b9d1d55ec83b0d9159f265867f0e8794879f781de95e16fa6
MD5 80d8cc80e96b7fc092fc9ae9fc049c44
SHA1 4e010dbfc36df5f10b3960e1ebe60e489ae54aa5
SHA512 34ab9adafba9b105feae55f965d5cdd115474233c04d55777cccb4a7c0268c6275ce786c87d3dc27929113e139dbe072b9ab81590857d22f5cfa01cd0adabf8c
SSDEEP 12288:g2lOjiNCTpZMBricKthNBHyiEjaocr3aP/+PIcjOGrR/9p5DY6wjlS:g1qCNZMBri5hNBHVrKHKRP5jwjlS
TLSH
T194855B11B7DD041EF4B75A30AEF363545237BD112A39CB1F601C2A5F6A63780AE22BE5
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

1852030

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

k:\Post T SVN\trunk\kleinstadt_data\obj\x86\Release\kleinstadt_data.pdb

nl/Common.resources.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 ddbe0b53b4e68b319967f9a2792d799b2eeadc796ae074b95eecc490d34a8a17
MD5 4126da324c0885e86e1039e9b5595668
SHA1 48ed547b13dd5cdc4a0ab47047a7784cf5be7966
SHA512 fbcc35de6dedf8152b8acbfb7cdd8c76c29ee72bece7d47e36652baeea2b4c76836f948452912fef1d5d426690efde664d6ac11dd00166e30a3c729d6cceecdb
SSDEEP 384:GXRaw9Rc69eXb3z9r9C919D9+9MXS9/9M9nCXRab9/9icB9gc590XaooD9/W9Yod:R36wcSgBC
TLSH
T1C362DF3237965028C9B45B321834F2C16777BB59BF68CB2D559A231C6FA32139B12F72
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

20510

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

nl/Kleinstadt.resources.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 550addc2d22c19e373b43498f8709a58fbc7360587a4c62ef510b87d21b84c29
MD5 05bbdb89aba167914d91376818fe2d91
SHA1 62f6e17f01cf55fbfa78f2d8d397feca916d8710
SHA512 c611104162a4d721907150873c661cd25a8f15d7ebcaf80c9d74d1ae2ac73762c3f5d84e76a00d8f6ee14e21928706ebe9d13cfa2bc382046013291cb1d01905
SSDEEP 49152:5+I6+YDL/+I6+YDw+I6+YDj+I6+YDq0L:5+I6+YDb+I6+YDw+I6+YDj+I6+YDq0
TLSH
T173E5FEA2E6414CA5C13443F098615FB1626FFA6CEA72887A5C5FF17FE0F1530A92264F
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

3125134

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

nl/Kleinstadt_Timetable_SortedByTime_[NL].pdf

SHA256 4f612f3a463f33e6905d2d9699af2f447e6832ac58e93c2e7c0aa3b1f1ef15f5
MD5 4e006af8d204bdc6616d206df6e801b9
SHA1 d40d50401896242dca500968352a73a655b1b0f8
SHA512 de86c53b1fc1f04639f26f5832718a723ce8cdec7395191e6e146b64a0d69ce7f789243a6c046d99b94045c600ee450c18bb99aa7f3c89ba873aaec1d7d72bd0
SSDEEP 3072:qKVV9mLIrV4Tmz/i7A5+/EcuUn8KKLA8ag0:qcSM6TmzK7yNU/DD
TLSH
T1A2A3E179D6FB5C6CED11C61582753E1D087FB24B85C874C2226F4FCA83408A5BA976E3
MD5 SHA1 SHA512 SSDEEP TLSH

NSIS installer

installer

nl/Kleinstadt_Timetable_SortedByTrainNumber_[NL].pdf

SHA256 96edcba9bbe126046e23e1c4915731f032ec9371e61947b5c471c24761fe2001
MD5 90fd80e919354fe15ff30bc207e3fbe3
SHA1 872170a202619fef1b7135d3748a311f3143e14a
SHA512 d778cc83249f03fb65bf10039f2986f6dbcf0fff0a4a09a84eb73d1e1974fa35a5892844e9f37f382a5e58d69ca7360eb8b5da38dc6b835e8f60d2a4f3989b50
SSDEEP 1536:eXOWpsxNm04vfTPM758ISozQiN/kxGpYc/jfgAcuUgE1OKIrLA8aSpEX4jW:e+WKxIAF8ISo0iJYyjfJcuUf8KKLA8aX
TLSH
T19393E0A7D5D66CACE811DA025171753D00BEB24682CC788736BE0F867350CEAEA675F3
MD5 SHA1 SHA512 SSDEEP TLSH

NSIS installer

installer

nl/Signalling.resources.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 174e268eba3ecc14243e644abc542399764b5b1bc29b1624a796cd759a550dfd
MD5 02543d099649ce44e94b4ab7969a7573
SHA1 82f1774750de5f2442c3047c0334d175939d7d4b
SHA512 02b6bbcf8f0e5134034b1afa86ad0efb3b3349e050b1b113983cb5c7e709b89e3171f3028e92d7b2b02eb5411c14c90361fc795cdcade6c5c4c5ff601235a40b
SSDEEP 384:/X1949h949PXRa979g929+cz949+9jocpI9b9OXb9f9fXK9d9n9C919E9O9cTXz/:gt50F2M/8hLckLox/
TLSH
T1A4539C3037E75158CAA867311C34E6C1227BBB6ABF28CB2D655A130C9E726139B11F67
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

57502

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

nl/index.html

SHA256 0f92701bede77eb15368edca1ae167edb226c6646ed3434bbda1b5132711974b
MD5 ba2e437f2dd37c3ccd6b4e21b27edbbb
SHA1 b2a8602194fc9fd47d846730775cc1d0b3addcbe
SHA512 9198f9f28b22ef908b03d0d0398bab844413b55be0c5c2830c233493c1913fc19cf364abd0afe769be8e94bc4efaf7f8ba6ba4a699a87f5af0ea9e744708f664
TLSH
T14741402C7488BA19E2839BDBC075279B9083E491D37BB5A8F9B54273DAC3901B133197
MD5 SHA1 SHA512 TLSH

NSIS installer

installer

nl/titleimage.gif

SHA256 e0011f6e9b1f93faeb8c33a6a96b1f42416501fb74eea60ff2a332ee50e369ca
MD5 0bc66f22036241b969c83de849f27871
SHA1 6f2b619d5ea141e4aabfdf971594fd8cb1cafe14
SHA512 0e545ee8bb19ded8d7661d4de33ef488a70ed1627056e60fa01c3cf012eac21462f2e2ebe849e8c5b23dcdcfa35175d9b1787feaf838b50ac277b803e7af65c6
TLSH
T15A5119ADC98069C01118DA16A8FB085B458D0DD15DEDE0C16FAFD53749180B1B22DB87
MD5 SHA1 SHA512 TLSH

NSIS installer

installer

system_de.dat

SHA256 16d36ed6bacbfff0d92cc0a2c4e90558921a87bc1f10b60d0a20eb822c62661d
MD5 31f9e16df3a84e1eb19425cbaa3c21ac
SHA1 f1d4ec64be86269e51b4020784dd0222ebffdbba
SHA512 645c87ebfb3b0f0e66b8ad8c75697b35ac066dc3f6380a1c01eed68f56a389633d4e7a37d286388359b0bff59b414fbe6a5462b9f9e4b6d54757b6d635d90424
SSDEEP 24576:dFtF1OZfu/yT7n5a0TpvzU58yCUJa/QfGKafK5dB5ySCeNZejLBZ34q:dFtrOZyyPn4kpvzUDJa/LCHB5ySJv8zh
TLSH
T14235332D2BF1064A61865A897E705183CCF788BD56C22CFC643D71911CABFCAA397D4B
MD5 SHA1 SHA512 SSDEEP TLSH

NSIS installer

installer

system_de.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 bf277dd80947a51ad90bd44b727c61738fceb05f8f3ccd6784db3b51a2fa35b4
MD5 db49aa1d7a0b6d71939473b341652199
SHA1 114d402461e6284498181bab66efed8fb8555546
SHA512 7cf25657230c34f75b1fb78183d0ee2d2dc7c36914708ac709228685a2f24fa28f1140c02f86e0a89f3a3fd79ed0f8d7ce1e13ccfb86081454265954ae5d9feb
SSDEEP 98304:CbQyneCpbHXn2jOcau9JkLVHim6LUNdASIXaCVhgXrF4ZuAF8rz7J702NsSayrFr:vC13ncau9Jk5Hiv6dtVC3gbG1EsSay
TLSH
T1E076AD13B341E912C1156A769E69D7D82336FC089F15A32B3496FF1F3DBE2938D66280
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

7350014

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

k:\Post T SVN\trunk\system_de\obj\x86\Release\system_de.pdb

uninst.exe

IMPHASH 099c0646ea7282d232219f8807883be0
SHA256 920526cbf866fb1609854a3104a123581418e89b71f0660a2935cd6818796680
MD5 390d8232e85b1ee5a9ab995e3c837b43
SHA1 1ed03155bfe59d27697945c7f739986d761d78d6
SHA512 487c80706dbfb8f18d620c92f733c9251dbb8e748193e144051af968c2a1eec1dff8de54ee29952687bf83e2ac4832213821c9c5b0e8b2a7c6e67a07c921e53d
SSDEEP 1536:kQpQ5EP0ijnRTXJP5yZUvkztgeeQh5CyEGve4aG4pTGgk4iW6Y:kQIURTXJP5BWenyESsZGJW6Y
TLSH
T17F93C05535D48CB7E89A473149B7DAAADEB1FF041A304107BBA42F7F3EA4293A407247
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.
NSIS installer

installer

Minor OS version

0

Major OS version

4

Entry point

12860

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

CompareFileTime SearchPathA GetShortPathNameA GetFullPathNameA MoveFileA SetCurrentDirectoryA GetFileAttributesA GetLastError CreateDirectoryA SetFileAttributesA Sleep GetTickCount CreateFileA GetFileSize GetModuleFileNameA GetCurrentProcess CopyFileA ExitProcess SetFileTime GetTempPathA GetCommandLineA SetErrorMode LoadLibraryA lstrcpynA GetDiskFreeSpaceA GlobalUnlock GlobalLock CreateThread CreateProcessA RemoveDirectoryA GetTempFileNameA lstrlenA lstrcatA GetSystemDirectoryA GetVersion CloseHandle lstrcmpiA lstrcmpA ExpandEnvironmentStringsA GlobalFree GlobalAlloc WaitForSingleObject GetExitCodeProcess GetModuleHandleA LoadLibraryExA GetProcAddress FreeLibrary MultiByteToWideChar WritePrivateProfileStringA GetPrivateProfileStringA WriteFile ReadFile MulDiv SetFilePointer FindClose FindNextFileA FindFirstFileA DeleteFileA GetWindowsDirectoryA

user32

EndDialog ScreenToClient GetWindowRect EnableMenuItem GetSystemMenu SetClassLongA IsWindowEnabled SetWindowPos GetSysColor GetWindowLongA SetCursor LoadCursorA CheckDlgButton GetMessagePos LoadBitmapA CallWindowProcA IsWindowVisible CloseClipboard SetClipboardData EmptyClipboard RegisterClassA TrackPopupMenu AppendMenuA CreatePopupMenu GetSystemMetrics SetDlgItemTextA GetDlgItemTextA MessageBoxIndirectA CharPrevA DispatchMessageA PeekMessageA DestroyWindow CreateDialogParamA SetTimer SetWindowTextA PostQuitMessage SetForegroundWindow wsprintfA SendMessageTimeoutA FindWindowExA SystemParametersInfoA CreateWindowExA GetClassInfoA DialogBoxParamA CharNextA OpenClipboard ExitWindowsEx IsWindow GetDlgItem SetWindowLongA LoadImageA GetDC EnableWindow InvalidateRect SendMessageA DefWindowProcA BeginPaint GetClientRect FillRect DrawTextA EndPaint ShowWindow

gdi32

SetBkColor GetDeviceCaps DeleteObject CreateBrushIndirect CreateFontIndirectA SetBkMode SetTextColor SelectObject

shell32

SHGetPathFromIDListA SHBrowseForFolderA SHGetFileInfoA ShellExecuteA SHFileOperationA SHGetSpecialFolderLocation

advapi32

RegQueryValueExA RegSetValueExA RegEnumKeyA RegEnumValueA RegOpenKeyExA RegDeleteKeyA RegDeleteValueA RegCloseKey RegCreateKeyExA

comctl32

ImageList_AddMasked ImageList_Destroy ord17 ImageList_Create

ole32

CoTaskMemFree OleInitialize OleUninitialize CoCreateInstance

version

GetFileVersionInfoSizeA GetFileVersionInfoA VerQueryValueA

Sharing

General

Malware Config

Signatures

File Explorer

Kleinstadt_3.5.0.14.exe

kernel32

user32

gdi32

shell32

advapi32

comctl32

ole32

version

generic

$PLUGINSDIR/AdvSplash.dll

kernel32

user32

gdi32

winmm

generic

$PLUGINSDIR/InstallOptions.dll

kernel32

user32

gdi32

shell32

comdlg32

ole32

generic

$PLUGINSDIR/LangDLL.dll

kernel32

user32

gdi32

generic

$PLUGINSDIR/inetc.dll

msvcrt

kernel32

user32

wininet

comctl32

generic

$PLUGINSDIR/ioSpecial.ini

$PLUGINSDIR/modern-header.bmp

$PLUGINSDIR/modern-wizard.bmp

$PLUGINSDIR/splash.bmp

Common.Plugins.dll

mscoree

dotnet

Common.Zip.dll

mscoree

dotnet

Common.dll

mscoree

dotnet

Kleinstadt.exe

mscoree

dotnet

Kleinstadt.exe.config

Microsoft.DirectX.AudioVideoPlayback.dll

kernel32

mscoree

msvcrt

user32

ole32

generic

Microsoft.DirectX.DirectSound.dll

kernel32

mscoree

msvcrt

msacm32

dsound

winmm

generic

Microsoft.DirectX.dll

kernel32

mscoree

msvcrt

advapi32

generic

NAudio.dll