1740b2e9fe97926a177b78a6a74630ff2d10b49df4f752bd159602e7e02ed64e

Analysis

max time kernel
149s
max time network
144s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
23/10/2026, 18:06

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Setup_OpenRailDesignerx64_26.00.00.154.exe
Size 4.0MB
Sample261023-wpthcstx9m
SHA256 1740b2e9fe97926a177b78a6a74630ff2d10b49df4f752bd159602e7e02ed64e
MD5 85f2fe111b5846e6cb70bc24bad70a86
SHA1 889f0fd9e8ce196165296e38817c1e52b53b7357
SHA512 4ff21efecb8ddd533cca26937caa3dd30bc7f1a36ef471d5bc8a1699faa8dbad6083affa3a5d4db63b6795f6023394845fcf081432e6c25ceadb149b25a6b5cb
SSDEEP 98304:2kl6hjFOZUWce5MTpnSzhFhPTjAvwGz7/srWXer0Ed/2rd:Xl6h5WceLlF1QL1OQG+
TLSH
T18F16F13284125067DAF40973F81261312D2DAF3C7B98A566CAD0F91D373A5F27EB724A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

4^/10

discovery

Malware Config

Signatures

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Executes dropped EXE 1 IoCs

pid	Process
4476	BBWix

Loads dropped DLL 17 IoCs

pid	Process
4476	BBWix
4476	BBWix
4476	BBWix
4476	BBWix
4476	BBWix
4476	BBWix
4476	BBWix
4476	BBWix
4476	BBWix
4476	BBWix
4476	BBWix
4476	BBWix
4476	BBWix
4476	BBWix
4476	BBWix
4476	BBWix
4476	BBWix

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Setup_OpenRailDesignerx64_26.00.00.154.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4476	BBWix
4476	BBWix

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4476	BBWix

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 5588 wrote to memory of 4476	5588	Setup_OpenRailDesignerx64_26.00.00.154.exe	89

C:\Users\Admin\AppData\Local\Temp\Setup_OpenRailDesignerx64_26.00.00.154.exe
"C:\Users\Admin\AppData\Local\Temp\Setup_OpenRailDesignerx64_26.00.00.154.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5588
- C:\Windows\TEMP\{545EB676-31DE-4962-9C57-F5C5958A1FF4}\.ba\BBWix
  "C:\Windows\TEMP\{545EB676-31DE-4962-9C57-F5C5958A1FF4}\.ba\BBWix" -burn.ba.apiver 569705357157400576 -burn.ba.pipe BurnPipe.{C80AF600-C176-4B9A-835F-612387000E0D} {AA6B509F-92DD-4B2C-860A-8BE544522ABB}
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4476

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Newtonsoft.Json.dll

Path C:\Windows\TEMP\{545EB676-31DE-4962-9C57-F5C5958A1FF4}\.ba\Newtonsoft.Json.dll
Size 685KB
SHA256 b624949df8b0e3a6153fdfb730a7c6f4990b6592ee0d922e1788433d276610f3
MD5 081d9558bbb7adce142da153b2d5577a
SHA1 7d0ad03fbda1c24f883116b940717e596073ae96
SHA512 2fdf035661f349206f58ea1feed8805b7f9517a21f9c113e7301c69de160f184c774350a12a710046e3ff6baa37345d319b6f47fd24fbba4e042d54014bee511
SSDEEP 12288:U9BzaPm657wqehcZBLX+HK+kPJUQEKx07N0TCBGiBCjC0PDgM5j9FKjc3Q5:U8m657w6ZBLmkitKqBCjC0PDgM5A5
TLSH
T1B8E44A0633E88F66D1AF2735B8305A1997F6F407A2B6EBCF6904D5B81D677608E00367
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WixToolset.BootstrapperApplicationApi.dll

Path C:\Windows\TEMP\{545EB676-31DE-4962-9C57-F5C5958A1FF4}\.ba\WixToolset.BootstrapperApplicationApi.dll
Size 168KB
SHA256 afaeff3e1c543eb93dfe048de02fb932d8c864a3f2d3340de4dec4a3daf2c858
MD5 e838f3766485a48df018928b2c17378a
SHA1 6b8a9f09884022ccdf34db316f96b333dc8a97ea
SHA512 318ed441ed8a4f60544d27a40349f08ce6b081184203cd02c405e5df1a980e8dee3c0c7487c14b069e80663c3b9fe4320cabd1de9faf315618db33b822ac7efb
SSDEEP 3072:AyBmMtVxcKhL+N5KpjjV10d15g9clpLk9zwdGgJhu:AKFWK2oNjVe15gelpI9zwdGgu
TLSH
T102F3181543EA9173F387793EE0164B5386BAF98914A1F3A956219CFF2C337061921BB3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mbanative.dll

Path C:\Windows\TEMP\{545EB676-31DE-4962-9C57-F5C5958A1FF4}\.ba\mbanative.dll
Size 305KB
SHA256 e92d832d7bceee2356d2229b1bf3e041049ac49bd3147f788a4ed368caa4b982
MD5 eab8dd5bf7a4b455b939858ce1222b40
SHA1 6810c1e41c435935df0b969a9e22537c05d23853
SHA512 7e38f61d872cf42f2a4de94a6a8e7fae3e6f4c5011ddbf69d103a179aed8315a28e20544787e845b5aea747870e5d72572395e96b6206448ee7766569f94612a
SSDEEP 3072:7EMIIfKrJLIaeIjzDZYIwegry+nCfdO/JPETxlVk7yrRaczcpbZrDvnzALwzzoP:fLfeItKV4egry+jJsnVk7MaDnvkP
TLSH
T13D643B6422B414A9C5F956B9DAC2B122FFB0B54C230091DB83548E397F3FB9926BF345
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BBWix

Path C:\Windows\Temp\{545EB676-31DE-4962-9C57-F5C5958A1FF4}\.ba\BBWix
Size 970KB
SHA256 f213bdde3d6e83ddc8a9cc2478051ef13d1ebd65b62123dfc7beda2402f4a4dd
MD5 0b5bc3b293d17a06891eb749457451ef
SHA1 809593ee36ba3a37bd8b0125f2e9d67f292c371d
SHA512 98066d35d945efd9464099096219823bc4ba60bfabbe4ad5885c06bcccbfb089ff3f34f1195029bc2f56d8566dc7a7c5c9462087c9724043299c6ab548333663
SSDEEP 12288:7kYxFSf9lQ0wPcwB9FrIJJaqCNktA+SXfUCHOZU8IAceS:7kYPq+cwB9FrIJJpCNoh+7HOZU8VceS
TLSH
T1D7256D614241D1A4DA7A8F32E022B5F1197A7D7BF6A0E11F0EC57D693BBB381D831722
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BootstrapperApplicationData.xml

Path C:\Windows\Temp\{545EB676-31DE-4962-9C57-F5C5958A1FF4}\.ba\BootstrapperApplicationData.xml
Size 45KB
SHA256 2acfab0ca446ed5f05888360caa301ac6eebe300d44ab5d1e31073d0045f2e2f
MD5 7d5ae697d6844ff4dc5da2a0d687cb20
SHA1 922123b883b0470902e32df18233915d7250034e
SHA512 52b12738fa6eebc3d659e02aca840d66826d8736ad4a97653f6531733d61b0d8d40f8e13586d24b7321fedd472d9a912c2502b27de54c6058cc16b3ee824608b
SSDEEP 768:/tpvQ+GNJPjefedz3U6megecCMZeKeYLw84H212smhI/BNO:/tpI+G3gag3FVjw84H2i
TLSH
T19E23A02127FD1118F1F39B88FFF555664E76BC626A38C81D00612E0E49B2E819D62FB7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BootstrapperCore.config

Path C:\Windows\Temp\{545EB676-31DE-4962-9C57-F5C5958A1FF4}\.ba\BootstrapperCore.config
Size 876B
SHA256 716dac1856252d78cded091009b47c9cee75a0216063899676570fcd1e9dd070
MD5 4fe10552d467348452a4a5e1b8dd0d7e
SHA1 98d8902d8691c965148a19e2dc001279a50163b5
SHA512 7cbdf41980c928155c121b12db5adec92968c34f0ff1b14bd1facc778e4e3a8b682aa4b83c04763cc0a055686741f067339fed4897f7dec2dd4dea1e01f3ffd5
TLSH
T11E11D64992D4BD618B330B1FB6928482EFF062B35180444970AE7B571F7749A7A9333B
MD5 SHA1 SHA512 TLSH

Submit Download

BootstrapperExtensionData.xml

Path C:\Windows\Temp\{545EB676-31DE-4962-9C57-F5C5958A1FF4}\.ba\BootstrapperExtensionData.xml
Size 276B
SHA256 258fac237622533e7f9ec3f95bcec8abcc31ae87e2017e5717af0841c61e9df4
MD5 240bac991e5860465ce0dfd580ea7cb3
SHA1 a352934cbb14ab877883ac219ceb78c92e27f495
SHA512 67ff8063a071436ae7dca8ee12ad1991bb70752dcc63f00f129f38dffa1aaf9299fff591fc67dbf4d2fdc57a9242831b149d575181b84857cd4f22463076f315
TLSH
T1DAD05E432FBE2304F1B30F49A6BA94102475BE009D78CC6D0228080C0573D92C8B2F77
MD5 SHA1 SHA512 TLSH

Submit Download

CompanionProductExtension.dll

Path C:\Windows\Temp\{545EB676-31DE-4962-9C57-F5C5958A1FF4}\.ba\CompanionProductExtension.dll
Size 138KB
SHA256 7d5d6c02655af57ea7e296b969feea9769dad8150bc05fea176ea1f3b29a395d
MD5 b84dfe1dd59b2fd4c7ecc0444967449e
SHA1 cb77e3ea5d5fd12dc417e117c54bcf7e63b990cb
SHA512 367af880c5a90f89ca6bcd6f600aa576687c018d94465d3d4896343b6a84ed557809fcde4f9bbfd662931c6bc4955cd7fe0370187ad335f90e86d1c8ba0f1f7b
SSDEEP 3072:a18gyPpzRXzWJWsNx/RUwj/45ob/MEPfk3Fq2COOmX1gdtRN93:W92Dmjr3
TLSH
T1ADD32A403BF50429F6BB8F79BBBB60506DB57E950E90C46E18C9288F49E1F448B5237B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Eula.htm

Path C:\Windows\Temp\{545EB676-31DE-4962-9C57-F5C5958A1FF4}\.ba\Eula.htm
Size 106KB
SHA256 4b02f9ae82ed364c2dcc54aadadc0aa950530bf5c69659dc1c926c666250f646
MD5 87c8e0a6e2a249413b88080dab0e3a95
SHA1 42a46f75c8a9a4e0f6d154a46db074c9cf5fb388
SHA512 855f50c8a2dbc4b7fa25454a21c5ee40c19a9228156aaf0b32ef5c3e44cc647aaa79c53cddbb67c9cf0ac17a61660e8a4bc90227753b406adba238fd6b6761c8
SSDEEP 1536:4Z9cTd1iIOnUa8CmIbkGja5jVNMA+i86eFQjYLQJOJimaLglndcN6d9DoPAcjyzQ:4ZEnN/u3qidQW97KmZ6IE61APz
TLSH
T168B38642F361115245338188B1960BDEB94199B8DB87DFA2E23AE17BB1CEDDD27250FC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Interop.Shell32.dll

Path C:\Windows\Temp\{545EB676-31DE-4962-9C57-F5C5958A1FF4}\.ba\Interop.Shell32.dll
Size 48KB
SHA256 995d364a7396028314503d6e94ade774a562fb09a5d3347d0b840fd596d47eb9
MD5 26a0959c90b97d5e7d73cbb652c99e49
SHA1 fc31dbc77734dbc37274673eb7f3892bd54e3d7e
SHA512 ea8c6efeb74a07169fc3bbd12d5aa401fec9d003f03b1973daecda2670c39bcea7cba891b804197827c20daea41772c09209839211102997cf92cf666113564f
SSDEEP 768:0exl81nX6ZxlvUAa7KoBv7epginbCe7AXjuw9tL0Duxj7tr+BrLFS:0exl81nK34PJepgqcVz7
TLSH
T1B623D3AB326C9278CC7D47FE80A34A400371D019566ACF07496DE32E4F032D99E977BA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NuGet.Protocol.dll

Path C:\Windows\Temp\{545EB676-31DE-4962-9C57-F5C5958A1FF4}\.ba\NuGet.Protocol.dll
Size 773KB
SHA256 1d058f2f31d61e5057ab21438d3691a84618fc35dcd341c2be95d53b19e265f4
MD5 b691288476cabf8b8548439b10fb749c
SHA1 6e4785f579f90d49423a3f5b5c9d38f2c5821413
SHA512 b3171ecb5becce5c08bc6398612b344a631a7924a0fb3ad2255595e2b47cb24f2ece3e877f60eab6c0d500621cf34f01fc4b2ab37a007e31f98f2b5f1c22246e
SSDEEP 12288:k8Cqr7yjhRotzXZIhmi5BDGkQ9v4lW4SgBViZ280oxSw5Oh+qKn:kTAARotOh1BDTC4lW43BViZ280oxF5Oc
TLSH
T135F45B4673E68B76CDDFA2FDB16C468B43B9E1879216F34F2A1CE5E01C527526D80223
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NuGet.Versioning.dll

Path C:\Windows\Temp\{545EB676-31DE-4962-9C57-F5C5958A1FF4}\.ba\NuGet.Versioning.dll
Size 62KB
SHA256 30b4049b8a8b3c64c6c4e910f6b56ad061bda531c3a2fb0dabf7d14300f1ea63
MD5 fa79cea4af7eb6da346314aefcd05429
SHA1 a3d19c77491b34fb5f17718b6ec34ec7f6ee4508
SHA512 e4a492fd4946f9c788798888c60a1f3623b041a68846e5f20641bfde80e8c34e5c49d0593610f8d6e5341e70aee26c96d7c2ac716403e448eef8d024d71451eb
SSDEEP 768:Xr8DRhi0JM/tz32eJLj2LUY7x3tdBQRTCcRPmRba5gbZ4rwmaM09K+PEoUOi89zZ:uoaZLd+AROprwoL8ECi0zzt
TLSH
T14B535C19A3EC4377CBDD0AF8B2A871550BFAE2467203E71E2C9CE1E61D533C446612B6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ObjectEnablerLookUpExtension.beext.dll

Path C:\Windows\Temp\{545EB676-31DE-4962-9C57-F5C5958A1FF4}\.ba\ObjectEnablerLookUpExtension.beext.dll
Size 26KB
SHA256 dd8ed97b21e7397063ac25253b9db2c38416b1fdfd68d8c264faabbe85a449df
MD5 f2ba2ca2dac579e0c4d883318d4a024b
SHA1 35a1be08429c47ffe7033aadc144d8c15d0c8fcf
SHA512 a4e6f853cb4dc1b6e9f7beeebf8fb217e4d590b5b9fe62b2b3004beba99d8c563047f48cfe19de8ee9f936fe0fec1c97041a631fbbc2ad4761d6e6d11957376e
SSDEEP 384:DjaANmOLOHaOAOOy2+ZkoEBqHwsjHQIYiK+DFf+y8RbmL4nNy8oaySr:DeAzLO6kOOGwT5YiRW5ALla7
TLSH
T1B9C24B526BF40C04FAFFAF78BDF285501AB9FD576C71E58E1484408D4AB27840A9077B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PPInstallerExtension.beext.dll

Path C:\Windows\Temp\{545EB676-31DE-4962-9C57-F5C5958A1FF4}\.ba\PPInstallerExtension.beext.dll
Size 16KB
SHA256 5ca3c85f8eb9b67638662c4659177efb250a5d1ecc6e12033935f4048ca90376
MD5 f1854a0e86d49bb8fe9bbdde4a50339e
SHA1 309a2520708d55ab51c28079db0c7040412eb12a
SHA512 3b39a5998a413eee1b178d3f780d00a84f4c325a96250198332d60afbb4f9c548c1057c95f80d5c3422fc2c23ecaea9c2a0f9bd11374eab5f5f9cd9435718567
SSDEEP 192:zVuH6pEdFgQrDbnPIIYiYF88+v8KZKFCbK7MCULc8pq8RuwdmL4pUQrNy2GP:5uH6pagUHQIYiK+DFKQby8RbmL4nNy2Q
TLSH
T194725B134FD00C16F92B8E30F9D081626AB8BD533D91C2FF6289C1494BA13466AE96BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RedefineWixPackageCacheExe.exe

Path C:\Windows\Temp\{545EB676-31DE-4962-9C57-F5C5958A1FF4}\.ba\RedefineWixPackageCacheExe.exe
Size 135KB
SHA256 28d584fd758114d97a3aac8e37eba8b1e5d83589b3080d6f9cca79ba5f598a43
MD5 30cb5da04f6b820d5d063f1416311f1d
SHA1 2c0d5a0d5f4b30bfe1c259c4c3b531f46b32fca4
SHA512 b838e0f3bd8cc143f4692f82e7bbb0f1fc167685e2322f0fac50e2e7027774ab5924f7a605e65d9aac74d1843277657c6125942a235d47a18f6b9a9ba5a53fe3
SSDEEP 3072:HcLVLSkEJe2dsUoOOvjk/2snsXVNN1NZ16siP17aNVV:HcJSkEMMokOsn6B65PKV
TLSH
T1FDD36B5BB3A930F8E1778679C4910A46E772BC321B609BEF03A042961F237D59D3DB61
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Setup.lyt

Path C:\Windows\Temp\{545EB676-31DE-4962-9C57-F5C5958A1FF4}\.ba\Setup.lyt
Size 15KB
SHA256 25d987b362853c275292b55d62cd6b4c0fcb67402f951884b1e136bd24ff42c3
MD5 4fa6151c4449900dc1ec5e29a828babb
SHA1 74f46bbc4c9637c273e37afdebcd71adeb96df7d
SHA512 c7b5bd20e03b0f549cfb0c444d787275636839cb12157515c7e4aaa8b0755641d716788a123e19df8199cac14e9852ecafda68b9d809b39364b9ae17fb665424
SSDEEP 96:RvWel55nLutyS9yWGji66z6YCyZouNPsUbuEuhuc5WpPu1PudPuDywNPuhuV9uGB:tmxVm+y2nu3vITijR3oSnRudW
TLSH
T1DA728E9D90796D34C10B20F427FA17CA1C6C1D9C681823D9B06C57BEA9958F2D76B23F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SetupPagesLib.dll

Path C:\Windows\Temp\{545EB676-31DE-4962-9C57-F5C5958A1FF4}\.ba\SetupPagesLib.dll
Size 381KB
SHA256 f613a732f20dfdd23f4c86d613444f257c813e21a0356864bd4ec938e2d44836
MD5 6722a94f5d683bd98404d3a97b0d8ddb
SHA1 dc45385af82ec422c75e3e82fb69f91f2a6a0e89
SHA512 0280078a5996d117b6e5a50028ac6b237a6cb992912013549d148437ed186a84ceed5ed9259f434c62d521442bc5e5d61b919b11c1f51568d30ee64cff013447
SSDEEP 6144:KCC1wf1b7SkFf1s8PxFVZ6cwL6MH56EA36gN46dTi6SJe6pGp6K9F26Q0N6bXw6V:gSf1n9s8PxF6cwL6MH56EA36gN46dTiJ
TLSH
T19084F7407666C828E16B5EB5F86780F47E313EB6FA80C55F09893C4E79FE7018652367
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Wix.exe

Path C:\Windows\Temp\{545EB676-31DE-4962-9C57-F5C5958A1FF4}\.ba\Wix.exe
Size 14KB
SHA256 2c610d0bb2faeb10818ef6e9c63c543dc87b3819e35ccddd1a3efb3937d29530
MD5 4743c0533acb405bfd77cec0f13d64b3
SHA1 01ea72fbe100d63623a98ca6649cd0195e106189
SHA512 63f74e50a253c6d2a6ffa7f6739bcc200f0b8ed1e752af22f276055693b5306f9e6ae72c9005fb2d80256e74d4dfcfe13c10efcdc3eba9850d1efc76907c2a9b
SSDEEP 384:iDfb6b/NYEd8DnDDC8yyNMfinAUFxtBU:BbTCnC81GfQnxXU
TLSH
T152624C51C7F8C635EA7F1B3B6CA3424002F1FB52AC22DF2E1DC8654B5D53A456A62352
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WixBundleExtractor.dll

Path C:\Windows\Temp\{545EB676-31DE-4962-9C57-F5C5958A1FF4}\.ba\WixBundleExtractor.dll
Size 21KB
SHA256 6dcc9e0256cfab6bef33ccc6de7540baa4b4ebee36166e7369b16270b64559d0
MD5 4fed02a3d528cbbda78debed9587714f
SHA1 feb2374095b90847b8f84e2b0740595a872d7c77
SHA512 7c107a359c2bec1fa83c24a4e23f25618b7cdbde0f6a1fd90de46795265e940220b892e8f2c7ed35bab7a7453c1679256d7a201a565a6e09ec5b6cf8db5c8dc0
SSDEEP 384:LjdE+azPseBJvUXTOGEgkdHQIYiK+DFtRRy8RbmL4nNy3L:LpXa3lwhkB5YiRjR5ALt
TLSH
T155A26B268BD54926EC578E39F4D280B12AB47B477C82D1AF6B4DC0054F933492AD87B9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WixToolset.BootstrapperApplicationApi.xml

Path C:\Windows\Temp\{545EB676-31DE-4962-9C57-F5C5958A1FF4}\.ba\WixToolset.BootstrapperApplicationApi.xml
Size 344KB
SHA256 d762559ec1066f2c67daecc6a829369cfe350289fa7f7f260b82c76395df5f66
MD5 548d04134cb665e60b6d90f704577a0d
SHA1 0587ee4323fa3baeef59a11796592ed0bff79177
SHA512 7b6bc225f09064f8272b5640d61c5ffd95b1c4239b699015ae0fa9e760a83c0cf445c79d23c5ffc706160a76bd2dc29f50c789efddf9d7f399fde654c8a64549
SSDEEP 768:URbtBrn0ptKGVQYUBPteqhNR0K6p7RjE6xJ0le9U9EVGqc9UzOvKyoaS+gaR/g57:AeqHSNRjEYClelNP+kYZzCKeBq5W
TLSH
T1B3744AC567E1A9D08A63003F6A48B2D4F9A22C7F49C5D43A31CE1E4B4F3B85B776B650
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WixToolset.Converters.dll

Path C:\Windows\Temp\{545EB676-31DE-4962-9C57-F5C5958A1FF4}\.ba\WixToolset.Converters.dll
Size 141KB
SHA256 b6991908f3cc0f69db899a53bee5f2cb62339caed289f3060aeb078c166949c5
MD5 358208df0e1430090675765c23875e64
SHA1 a15e772add644b5ec4091359f15d756b5511fc37
SHA512 6e5aa46dca5e5fe0a2c3594fca00f5262d7b327d7283dce3c66f5a2e5a0f67aa403af434ff1087d39601b68bc31fe84d1e6ee085a87b518482761f74fbe92f53
SSDEEP 1536:ZgWsa8LYCXsekuTZIaQx5RaU1s6g9eKOiRy1PBhbAyS5rg/oCuriZHlxF7qNQu:WWsa8Dsekdap6soP7bTS5rg/o/iZFxFA
TLSH
T19FE39241BBFA5619F2FF7FB82DB551140AB2BD92AD74D64D0982408E0A72F80D960F73
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WixToolset.Core.Burn.dll

Path C:\Windows\Temp\{545EB676-31DE-4962-9C57-F5C5958A1FF4}\.ba\WixToolset.Core.Burn.dll
Size 217KB
SHA256 7cdd413b0338530861fb4a36d2cd44c4831d6080a0afce7a0d8d949f1b1301e5
MD5 588e6331a24b616f1afd3d7e134223ce
SHA1 67d153c7c879437f9d93d3e9e7c5da69443891fd
SHA512 c517f2b00b51d8912fecaae109db1e0357f91bb85ba4166fd3b19b317d58e3fd44f4282dafddc2ac065946bf9ecc8cf15c4bfd0d4b17dc65c0b502af2d39db12
SSDEEP 3072:V4DknzUYFRR92QmIzC2Xsbf00vASSClJimQv7r6KK3Fqa2P87un2aFrd7ymFqZk3:V4DwbFR9mCC2XsTtvdXJiYkptd7yqk30
TLSH
T1AA247C2A53E94B06E6BF1F78B5B044514ABAF617B9B0DE4C7EC475CA0D32B8092407B7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WixToolset.Core.ExtensionCache.dll

Path C:\Windows\Temp\{545EB676-31DE-4962-9C57-F5C5958A1FF4}\.ba\WixToolset.Core.ExtensionCache.dll
Size 40KB
SHA256 80df6bcbc39e49f0d847fa8450d6a680b68170af3e0f763fbff4e61972a9c295
MD5 3d3d7374d68e696da552e589bb77ad5f
SHA1 fdeef1303cfeada8552233bef0a1554c7ca42515
SHA512 97a453c40e9e2a1085cbca6d7f8e16f8294ea0d5bfcff7d50cff345321ee3fa34e280bbba4d97e0b6c10884fb56e98f507ccfc19bbb7429a6f3974fdc0c00b42
SSDEEP 768:/rhj62u+LBntF+7hXHSHxYvSh25YiqN32Es:/oAtFYXHiY8M7qtm
TLSH
T19B038D01479C8923DA6F9FB9FDF016114BB5B753A9A1E7EA158CD0E90FA23800D943B7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WixToolset.Core.Native.dll

Path C:\Windows\Temp\{545EB676-31DE-4962-9C57-F5C5958A1FF4}\.ba\WixToolset.Core.Native.dll
Size 80KB
SHA256 f07f98c1edc2fb8a2985f5137a76c93784b3ba89ec35aca82578f1da6883fcd4
MD5 4f2d76acccd99f311bf9a0671de4b2cc
SHA1 023434d5a536bf3e88698ebfb6a5d43132cf682f
SHA512 fad48aa519d3be599ee4ba94c978231547cd0d6b1755e9113b92148920e4ea761eafd951cf65e77ed5fb88d06ebc03a8e85b2d9c4298de716f561d40330c20f0
SSDEEP 1536:5YERHdR5bJScXDcWjpD4uUzpEwvWz/pAepwdfBcdCjPrX7qUr:5YERHH1XgWjpMuUzMhAepwdOYjPrXX
TLSH
T1FB839C2157E88A57C2DE5979F4F0460003B0F6573243DB9F2F9AC5EA2A27F8036567E2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WixToolset.Core.WindowsInstaller.dll

Path C:\Windows\Temp\{545EB676-31DE-4962-9C57-F5C5958A1FF4}\.ba\WixToolset.Core.WindowsInstaller.dll
Size 467KB
SHA256 f17bae6f3b2c155e3d5a92fb6b2e131b5ccfc2850f85923ada233ce1c0ef13d2
MD5 c963e92107315bbf56eff81b7c5e8aa0
SHA1 6a227ff6ffbe833ecd5061594a054fc833de4635
SHA512 ee64e2a98451334386bc38180995ac3e046ee0f1c9f17cecf92805c4fc9897c531daa9226db09a949d8f4a86b42b4715cbc30efad6918ef635a8e5a25b82b0a3
SSDEEP 12288:UAy4MMzaPkgEDyR+F8OfFzOcKZ+yY813n:/MMzaPkgE2s6qOhl
TLSH
T186A47C2467E45B25EAFF0B31A8B0004A35B2B80765DBDB5F2D8B58D90E72740D60FA77
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WixToolset.Core.dll

Path C:\Windows\Temp\{545EB676-31DE-4962-9C57-F5C5958A1FF4}\.ba\WixToolset.Core.dll
Size 606KB
SHA256 00b9eacf799a2a4fe68c6438b32e73763248e76df6e20abc11cd24421b76bb8b
MD5 6674a01e0fa66cfcc91b3fbc4cd8d9e4
SHA1 8cb884ad4b000a6bd86bb742fc08adb0e026347c
SHA512 5d900511bf1c566bdc7152bb98a9d1e0e7ebe4e458fbd6f7bac01bebf3618c259de2274abd6366e7bb8f24d809dc5f4cd59d673bd729455acd66850fde62550b
SSDEEP 12288:dUSxg3ARD+x2QyOEp7owhhlYK13Af0SHIqknW05oYlN8sBzXFX9:dUag3ARDi2QyOK7owhhlY06IqknW02Y7
TLSH
T150D4276572ED8A1CE0BF0A79A0F0054965F5E41B76A0C74B1DC31CFA1E237C19D62AEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CompanionProductExtension.resources.dll

Path C:\Windows\Temp\{545EB676-31DE-4962-9C57-F5C5958A1FF4}\.ba\cs\CompanionProductExtension.resources.dll
Size 51KB
SHA256 0c03b9286c966840d73d20e4850bea60217334704880a59614074f6ec17b3c6a
MD5 3e29d81d6cbf5274e3d4f566a898cc82
SHA1 25fd586b81a93f6ce05290ffc50bb221bca066cf
SHA512 e8b6a2078c8385130cad55a189185021dc4a6c894f45d1bb8d855ba6905f587096095013adab89c5330d2a11dd4a80250328421a49cb10c76b58c37b1ef72287
SSDEEP 768:om6OSyANvdVI8BGygb4CFvUjXyov0TZCmzrvLc7/m5YiR45ALo:omHcd2bzc7/c7R8
TLSH
T1183371065BF60415F5F35F38BFBA04902EBEBE973942E0AFDA45540D02A1B4989E0B77
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Eula.htm

Path C:\Windows\Temp\{545EB676-31DE-4962-9C57-F5C5958A1FF4}\.ba\cs\Eula.htm
Size 106KB
SHA256 66e450873884621b9dfa769a3f2121e4299dd047a7c3f9422a418999fb1b546b
MD5 b7389acc50b0f8dfe250110dfd1fa905
SHA1 db668806f0b6b8eafca3c16c2ed93f14e28c0178
SHA512 c0ce9a94ed3df9dd80850793e5a9b66a49923c12c947a9ee8a1aab1f0c0243bd008fa3780c747f8d6e8d5a44d4eacc418633154e9ae4c09a0a054f26b06555ad
SSDEEP 768:9rz06qeC0//qeuFwh1UrsKLrIPUO1ijATZtpbnBHyUiNxU9IXLkB6LP/q/MIAH8f:5Rid+fB1HvyRdeQeQxQRH
TLSH
T199B3C702F9E24205D531C1AEB1A75B5C30416E15D78BE8B3F6837A6FE8C29E52F513AC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SetupPagesLib.resources.dll

Path C:\Windows\Temp\{545EB676-31DE-4962-9C57-F5C5958A1FF4}\.ba\cs\SetupPagesLib.resources.dll
Size 38KB
SHA256 2028b6099c70127dcc6d0f8386964dea6a19d82c037edc0292b5625fb51c57fc
MD5 e98d159e33a29b46b7dc1380e386e1c0
SHA1 9fa2884b1b2824d850a34b03167f7567055be888
SHA512 dfdfd53c2a2b5e8f8b2377fa812930dfde56007201b0784d1a4aa423ab73cd327773c0507a111d835dd73ef790de4ebe28803669536e4e4c3596171684811b7a
SSDEEP 768:BmeLProxBLKVrwBFQygo4CFvyjXyTQv5P1VTvjcg6hwzhi5YiRb5ALwL:BmnQV9+VwzhA7RX
TLSH
T13003B442ABF81414F6F3AF78BEBA55206EBAFE971C11D0AE5145640E0272F419EE0737
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WixInstallBA.resources.dll

Path C:\Windows\Temp\{545EB676-31DE-4962-9C57-F5C5958A1FF4}\.ba\cs\WixInstallBA.resources.dll
Size 27KB
SHA256 27414e35548aa610c240aa4f231e72a103a6aba80100202e0f216516379b48ac
MD5 7a440038c3687a98eb0a9130afecf8f3
SHA1 7b1b16fcb49315f43302f80927f0d3d71c2f42ea
SHA512 a8e92d9fb2f62b00f83c260a6a6479a6ed117b12de4abfd7acb586aae65884075ce7885f8f11f1c55274c7f88c6be92acd4b4db5684f072f65781370c288d0ce
SSDEEP 768:9J+Wfoxo0bOPTDfrXQyFU27ZXVBT5YiRm5ALD:9soXXQyFBVBd7RB
TLSH
T150C228129FF51414FEB34F74BAB589665D7BBE922D12C0AE418A910E0273705EAF133B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CompanionProductExtension.resources.dll

Path C:\Windows\Temp\{545EB676-31DE-4962-9C57-F5C5958A1FF4}\.ba\de\CompanionProductExtension.resources.dll
Size 51KB
SHA256 0e09b35ebcf2c91e446c6f8734f7a847e11ac03c4ce23d3ac0d5ed1273b02248
MD5 892d65b467c9ddfc0de8c1b6adc3f4b4
SHA1 ebaa46ca46c66af7805bf74891eced426b615c26
SHA512 96eed84f5a31efdee6aba8574aac5435386c831fac78ac1c56ab87c956b419d76832ada53cf31ae627a8d875349dfd769b01a93b5b5ab1b15c8a6e0e8fa9dab1
SSDEEP 768:WmSvFmBRh69lXNCfvD/vxG6ePe2dItc8t6z5YiRf5ALJ7:Wm4CIXwfvzw6YdItp697RC
TLSH
T1323391066BF70419F5F36F79BBB558D12E7EBE973842E02F8704600D06A1A448AE4B77
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Eula.htm

Path C:\Windows\Temp\{545EB676-31DE-4962-9C57-F5C5958A1FF4}\.ba\de\Eula.htm
Size 105KB
SHA256 aaf6e2699f2479bfa5fcf48148c9f4b00b32cd9746d4019f2ff29e4dcfadfc29
MD5 61ac1547605a330757156203e27eb2fc
SHA1 91cbc3944c5155e3751b24a862c26c18c579fa30
SHA512 8dce3a5aeb5350d59c1f52492feae9f6bfcea84f3a774cd476bfe0b9aa4828945db330cfa5fae5e1d217b0ce617b7ee3417b5f7703931112a12234f1286be81e
SSDEEP 768:DOzd1WSPhdJBPu53N3Aw9PxwU/meDCRuPnE5L8PWa4iI2Vg+4d1QndURClbZmuVD:vfpSdA1FL0/XUNOyXrdPvl7sGGlGPAQt
TLSH
T1D2B3B511F8E1030A9131826BB15B5E5C3145BE09C783F5B3F6AAA5BBF8879F50B453AC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SetupPagesLib.resources.dll

Path C:\Windows\Temp\{545EB676-31DE-4962-9C57-F5C5958A1FF4}\.ba\de\SetupPagesLib.resources.dll
Size 39KB
SHA256 4f770bf7bfe5e713264d4341caa2eb8667c158b0e193907b4194f8c311e108e3
MD5 b23bec9f2ff4d5066f3dfba380bf53bf
SHA1 54308b34d303c7d1b29b92d89d748ef513d315af
SHA512 96bcf38006e672e46bc6f9fe730295f4e229468c797751851f9847743838616a72b3d365873e30ae934a3f3378aa1a5cbddfe89ad38b7b3bcdf98004191d9b13
SSDEEP 768:2FmSPo1oFuMIAHhLVSOD/vuFjBdTU+HBMtvoh75YiRZ5ALC:2FmgdhEOzuJBdTSvohF7Rr
TLSH
T1A003F7126BF50418F6F3AF79BEBA99653E3AFF971C02D05D4144610E4B62B908AE4337
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WixInstallBA.resources.dll

Path C:\Windows\Temp\{545EB676-31DE-4962-9C57-F5C5958A1FF4}\.ba\de\WixInstallBA.resources.dll
Size 27KB
SHA256 ca9808eb29e800847c92bcc4ab242e201a55ef1ff9f87a837db72323e1087c33
MD5 11e6464691912721e2c1af97bb282374
SHA1 1bab44dd486a4f5ef50e317e57122c83b6b64563
SHA512 873ce2d08aa3da50269a1109d66acbf68c92ad79dd37d4e39d0fabec474e08588b0c951ee54cec193cae982f43dd01070ec6fcf79876943d27f33338f65fcd10
SSDEEP 384:EAjJBG1KRMpQpRVoWNDXxImGi8EBRufX88fPMkB3DHQIYiK+DFlW1Py8RbmL4nNg:EqJ+A5DXdvfw5nBj5YiR0P5ALTW6
TLSH
T1A0D207125BF91428F5B34F74BAB189A62A7BBDD22D12D09E428A810E0737745D7F8337
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CompanionProductExtension.resources.dll

Path C:\Windows\Temp\{545EB676-31DE-4962-9C57-F5C5958A1FF4}\.ba\es\CompanionProductExtension.resources.dll
Size 51KB
SHA256 443fe23b716fa6dafdefa60713a32165ee48169013bf1ca609031685df0d1e6c
MD5 232de3a374484db2cd37a20e29367d4e
SHA1 93f1e34d08fe2a9a39caee8ed8f3c7d9f2ef74fb
SHA512 c4bf706af7d5314978f4c7168ba9b6a4a239bfce025273629f8f4d20031a03739523970bb7b2f0fb8eafc83762e7434ce72839f24d016da65743d83066467c22
SSDEEP 384:r33mmMVdPmUdSd1K1/wR3rq78qJLC5oC5rE+8SjDGDlYLHQIYiK+DFLAWy8RbmL4:zmBV0UW1K1/wRmI4CJEOoyb5YiRz5AL4
TLSH
T1433352165BFA0806F5F35F78BBF680A66EBDBD533941D0AFC244510D06A1B4889E0BB7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Eula.htm

Path C:\Windows\Temp\{545EB676-31DE-4962-9C57-F5C5958A1FF4}\.ba\es\Eula.htm
Size 103KB
SHA256 5c130d0c9d605e6bf1fbd4b961d6cf2bd5f07a4b1877dff07d90b2bd796baac4
MD5 6c5a5125210010a71a902a46b8012173
SHA1 96d28d58998f529ac13a6d884c5b3d399699934b
SHA512 81337489ee01805da0e13da6e764833dbf7f399ab55a88369d884b6547c9ee7efc70e82c1d02e0bad600a4bad79ffe53816f8fbd9f8a13026b47c29d2affee67
SSDEEP 1536:ziNyxjDTYImwr812RozqEKlZFtH54UFDJQ+YDrUwQa0aXSaFRKve:mADY125EKlVCUF/e
TLSH
T165A3A811E4E003429172819EF0976A1EF084A945E78BD5B3E3A76B7FF4C9AD817163EC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SetupPagesLib.resources.dll

Path C:\Windows\Temp\{545EB676-31DE-4962-9C57-F5C5958A1FF4}\.ba\es\SetupPagesLib.resources.dll
Size 39KB
SHA256 cea12b2c1c129a1800c9a9b9639ac32d8341996f1a7874c474f228ab10878478
MD5 972fa1aca3025d96e8fba584a392fa07
SHA1 0ea1ef6e3b816d4de7d7b69333a0d438171020be
SHA512 ac13a0d6a8162f5eedfdf65d18bdd60b0bc402a3ada913d7ac08252268a6a10e267819069321bc234e8f063f63ee42f44b55aedece9e563e7e615212d9c262d6
SSDEEP 768:nmPaSecERQbj3JEdC1NzLD2isJ+hR5YiRmD5ALx:nmSij3SmIJ+hf7RmA
TLSH
T14203B6126BF80805F6F39FB9BEFAC026ADB6BD523D00C09E4155510E06A1F84DAB17B7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WixInstallBA.resources.dll

Path C:\Windows\Temp\{545EB676-31DE-4962-9C57-F5C5958A1FF4}\.ba\es\WixInstallBA.resources.dll
Size 27KB
SHA256 79e2e4f0abe71514f258bbfb9209e0ffa26066b8ba106e1766a7f1de0f35bcca
MD5 00e6bd8a31b86bd69301f51083329579
SHA1 6b1f2ac83623b8c0ba83c0315b79045b5b94d69b
SHA512 3af56953599e82fe54043cee95f8ae3dcac442d06d15d56bc3762a247f5a2ffe616bd0c99824016f273092d10300529df0dcbc572ff5c567f7d77e456d1382bf
SSDEEP 384:XijJBG1a4Ux/mStoylgXRaHmg4ulGHAai1MxBVHQIYiK+DFabGy8RbmL4nNy3pLR:XcJ+0lgYHgHAzuBZ5YiRr5ALPl
TLSH
T11EC219134BF80819F9F34F74BAB5856A9ABBBC813C01C09F415A811E16B3748D6B5B77
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

extRes.bin

Path C:\Windows\Temp\{545EB676-31DE-4962-9C57-F5C5958A1FF4}\.ba\extRes.bin
Size 1KB
SHA256 95a2b77aabcc146b2e4c5d76947469a12d2422a3c8697b342a3c666c6d2c9e7e
MD5 72406707dd1a833428716d011565253c
SHA1 92209e881568d08cce8b973825bff9b304734fac
SHA512 f33bd392135e0eee6955e736488aceab41f47972c0f66dd6a3cb10caa45e098a8257a440fc774cf610403a15cf51d323acb25cb17ea602f421c64b3d7e8898a2
TLSH
T1282144C133161A65AF01ECFB8D25E4464DE3852A076D3409256EE7C27AFA516CBEDEC0
MD5 SHA1 SHA512 TLSH

Submit Download

CompanionProductExtension.resources.dll

Path C:\Windows\Temp\{545EB676-31DE-4962-9C57-F5C5958A1FF4}\.ba\fr\CompanionProductExtension.resources.dll
Size 51KB
SHA256 a019c35876c1994afa8edbded5948263f9abae499bb2e3dfc4403e0ca47c3dea
MD5 9f3ff3ea1ffb20a3aa5c7c9618ffce71
SHA1 561abc0fec65903c7b2111745c4e006f4e642ae2
SHA512 1c5923c6464e21cce813c25444a7cbd38b03b8ec2d832ea4f2663d266b0c40d19bee4d96cab4816cfd9fe2d0641d215edc7c2297ba36ee4948a629eceebdf27d
SSDEEP 768:vmCg8eVR98kH6Mv0QznoGUmkGQ05YiRcp5AL/C:vmCy36E0QznoTGQe7Re
TLSH
T1E433A24AABF61116F5F31F35FBFA50A25E7DBD973842E06FC644100D02A2A8886D17B3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Eula.htm

Path C:\Windows\Temp\{545EB676-31DE-4962-9C57-F5C5958A1FF4}\.ba\fr\Eula.htm
Size 99KB
SHA256 59dfdcf91542bfad5a7b68becbca80b4365248c0a1217d96e3aa1fa038f63ab8
MD5 24fc8192109390fe6cc85c1d71863362
SHA1 ff1c3710ff2258f3ca97353199bf82d1177f86a8
SHA512 872e1dfdc2957b2b1f5daed3a5b00187884ddd7363b2d771fae0e65dad4f6e51bb25558164784988eb636450c99bb43be2ecab3acc2ed2e469c7c0cc6fcd64e2
SSDEEP 1536:AbfV9h0uEKgkdlkqXvae67I3Z4paGfTcc:ATJJIkd2qXvjuaGLZ
TLSH
T18FA3B805D4D10242696280B6F1631B9EA048FD48E7D7E672F2E765EAE8C5CDC634A3FC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SetupPagesLib.resources.dll

Path C:\Windows\Temp\{545EB676-31DE-4962-9C57-F5C5958A1FF4}\.ba\fr\SetupPagesLib.resources.dll
Size 39KB
SHA256 fbff468f71d7cb97d7b0fa064f7aa5ed005eedc94e611d2fe60e578dd0dd33f9
MD5 ae0397ac7bcc9c4b46db87e54d22f096
SHA1 69cb17b4ae0ee8cb485506cb2b69df281d9cf854
SHA512 9e40c23bf6f490e19d98997c48c4fd5e92b775b15fb1303bf277c5d18d85facf17a6960f6a009726b346a60ef9750a9afd7bb363f21d6633fb536b3df922e220
SSDEEP 768:ZsmCCMJsnmb5kfOeU8Qb0ZznR755pWPWu3hq5YiRAWy5ALV:ZsmCFaOlb0ZznRbZu3ho7RAWj
TLSH
T16203D546ABF41515F6F36F7ABEBA9022AD3AFE962D10C06D4145110E0362F84CBE6377
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WixInstallBA.resources.dll

Path C:\Windows\Temp\{545EB676-31DE-4962-9C57-F5C5958A1FF4}\.ba\fr\WixInstallBA.resources.dll
Size 27KB
SHA256 8a24cef8dd477d449583ab9f1003c450e35815f501971c1888fd742912900a20
MD5 8e97bec7f202746078e5ed856dc69f7b
SHA1 86c0d5aabc1e3415b49fc11c4165c6890b73f74c
SHA512 a9602ebcc5148bf9b086e36c31ecd9bf96f505487194f3aa0f1ca07637b80997687b04432ab7a7179aeea51b9e5adb73304a2768dca161ce4d036a90e5facc4f
SSDEEP 384:xjJBG1eSW3PTKW0HoN1L5JMCJxJpMABOHQIYiK+DFQKecry8RbmL4nNyisx:dJ+0FJ4CHDBk5YiRjr5ALLx
TLSH
T1B8D207465BF41429F9F30F75BAB29466997BBC863C12C08E0286814E0673B94E7F6376
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CompanionProductExtension.resources.dll

Path C:\Windows\Temp\{545EB676-31DE-4962-9C57-F5C5958A1FF4}\.ba\it\CompanionProductExtension.resources.dll
Size 51KB
SHA256 3d5610c8c1cd96104d77ea2a47720aaf105208feaa4398f8305e8c1d22bef0f0
MD5 24773460f7137a56068a9c1227d61a6b
SHA1 6258c8cdfbf8e768e06babdec59ba177e6257aa8
SHA512 5efcd29a4042b3f790ab940476586f7253b9f3d842cc346150774b61c640ef3ec3672ab2b2b83fbd69b704a585619a5bec7eceb5ee9fe25912029729af59ba32
SSDEEP 1536:ZmdOpTcetamJ4LSGfLTYObxF7qepOl7Rk:ZmdOpTcetamJ4LSGfPYIF74lNk
TLSH
T1293393166BF60416F8F35F78EAB690906E7EBD973D52E02FC345100D02A2B8498E47B7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Eula.htm

Path C:\Windows\Temp\{545EB676-31DE-4962-9C57-F5C5958A1FF4}\.ba\it\Eula.htm
Size 105KB
SHA256 6b8d452181742256c43c3e7318a6be6df4fa5fb14b68fc098a19c89af100399b
MD5 bcedf13ce1b1d90759e4a2ee749d451b
SHA1 b2dab7d95637d69a284583ac531ff397a1125b2f
SHA512 def431660d9ab7d5226d01be9df5e7d936e888b47eef1fcde6c6931eeb568fb59114d2a267f577d7f9d21565826a66ebcb11da7ddc9e3c32ac0c1f08cd1d4c4f
SSDEEP 768:Pofb+gtmlbTQtDTKTFSvIW1sOZCcoeuqcHUwNlv26EcFAB+iz7NsT9P617nql87k:bF6r1TG63GAgWRdB7YLROV2Aqfal6BTR
TLSH
T10EB3C721E0E10302857182AAF1F7261CB089AE85DB8BF573F697667EF4CADD0671539C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SetupPagesLib.resources.dll

Path C:\Windows\Temp\{545EB676-31DE-4962-9C57-F5C5958A1FF4}\.ba\it\SetupPagesLib.resources.dll
Size 39KB
SHA256 3aa6edc74300a0db056db1a9798329ce487905701059cb27287194efa51fe4b8
MD5 b8d2e2c929a882befe43c9a3780cd04d
SHA1 fef835d69181961141b0274fae69a4dc39c374bb
SHA512 60fdc4172cc53fc60efb72d3949057a5615a178f0dd64631493b792993351f6e5326e4f3595cb6d757928611b826bd2f605ced7d15f2406ef242fc4bc39da17e
SSDEEP 768:hmSth6DgnQHgdvzeNamJ4bDG9qfLTYs2b871eGIkl0hg5YiRN5ALp:hms0gdzeNamJ4bS9qfLTYs2Q71hl0hya
TLSH
T11603C7226BF90418F9F3AF79BABA9111BE3EBDD67D11D05D4145210D03A2F80A9E437B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WixInstallBA.resources.dll

Path C:\Windows\Temp\{545EB676-31DE-4962-9C57-F5C5958A1FF4}\.ba\it\WixInstallBA.resources.dll
Size 27KB
SHA256 dd75372a7cb647c40f22cfdf397a059cfffedb5d08997efc48df8737141e8505
MD5 522278a03b95ac2b706f9489cf07b7b5
SHA1 074619395d64c4a1f44549853e83021010e678c6
SHA512 522105dc1830fa2031e422b05dd12ac5d19fab52e692784a67401c6bb3626824df0f86fc5617c9ee6b429d9626a4cfa2f80b3f1a8f91e716b6edfc041657ba52
SSDEEP 768:tJ+BpbBL94spu28FfiBY5YiRT5ALZBymX:tcln4spu28FfiBq7RoBH
TLSH
T133D2E7225BF41418F9B35F7CBAB5955AAA7BBCC23D02D04E014A420E17B7B40E6B477B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CompanionProductExtension.resources.dll

Path C:\Windows\Temp\{545EB676-31DE-4962-9C57-F5C5958A1FF4}\.ba\pl\CompanionProductExtension.resources.dll
Size 51KB
SHA256 6660bb91c5081efb943c84034ed3edfa967bbabb8b1054a2b91096bfe8fa5f7a
MD5 840d10da584e466255e19a1bc129460b
SHA1 71d2e233261bd641fb856678cb8f6ce9e1dba259
SHA512 54614aa634784bb8573e9ab65018d793e20430b6da6dace2c14e0fa7269c9f29921bef652fe295393666792b89ff00d347bc41beaf4b2441cb8e18b16ba874a7
SSDEEP 768:VmMjP0gG2rlKEUrmapEyVj+SOTo3EoYAX70k1J2GrNPRqk5YiRx5ALMh:VmZ3aKDqu7RPh
TLSH
T1363391056BFA0819F9F35F78BBF655D05EBEBD977842D06F8244100E02A5B488AE0B77
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Eula.htm

Path C:\Windows\Temp\{545EB676-31DE-4962-9C57-F5C5958A1FF4}\.ba\pl\Eula.htm
Size 97KB
SHA256 0d94c93562037ffdb3e465197c38d23cbfbae07c6ab8b3d269f70488a2126013
MD5 208e1d5b24dc2843d98e44df378d83dc
SHA1 e2938fdea36e239eec77a11a4a8457d1283e94ec
SHA512 b7d6e8ee9fc1d84bbd8a513a3c7ab50df9978155ecbb260ef08862828a063df3a4edcd8a5a139ab3f650880a54a7d580d3a34fd8e8baa2edeeb2343f4adf0fdd
SSDEEP 768:7kItY776mKh7AYehQGHfuB9Z39MvkVt8fL+JovwrYQQeljxD0CCYllEhPQ/QZ/wd:WlXSCvkD1tljx4CshCsEVG9C
TLSH
T15BA39602C4D10206C53080AEF1E71F6D10C4AD85D7CBDAA7B6AF19BEE986D98176D7BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SetupPagesLib.resources.dll

Path C:\Windows\Temp\{545EB676-31DE-4962-9C57-F5C5958A1FF4}\.ba\pl\SetupPagesLib.resources.dll
Size 39KB
SHA256 d070b4da60b817cac13f44e607bf39201403dd95a116a06ac81aa63b6a12e4c3
MD5 483ca9adcf31e625941cab32bbcfbfd0
SHA1 6e4fbb4c4dd8d3fe0ebdab245f451561a8920ece
SHA512 2efd25a70b597d6527a78e9eaab7384f081545749dc47a46f09d2648b9d0cfcc3459774e2f27d3914cfc689506c4660a53b85ace820c807ca838d902ab64a209
SSDEEP 768:FmjDIMHouF7HYajuYpEyVjJSOTo30YAX7voGeoPGDLMxh65YiRZj/5ALHe:FmWyHYDMxhY7Roe
TLSH
T1DB03D502ABF80818FAF75FB8BEF655516D7BFEAB9C11C05E0155110E0266B858EB433B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WixInstallBA.resources.dll

Path C:\Windows\Temp\{545EB676-31DE-4962-9C57-F5C5958A1FF4}\.ba\pl\WixInstallBA.resources.dll
Size 27KB
SHA256 729eba9aa92beea539ec87f3cc55337c0418e45e84b59cbe64556b5b9d0d4da8
MD5 42ec9e69a1e8eb0483f5676dcbf80671
SHA1 da495b9353f76007004f1eac5169f12e49f3d8e6
SHA512 a561481e7278653bdb24e548560391b9d3e8ce77d68f1ed75ac0ebf9f707ab4970d8563270404af4a7563567feeaf73a8fbc83720676d93bfa9514cc098b639b
SSDEEP 768:PiJ+Kj6A51C3+DKxQ+ORoW9tZx3MFHWW6Bl5YiR95ALJ1:PiNr46Br7RO1
TLSH
T107D2F6125BF81808FEB34F78BAF16969997FBC86AD01C09E118A510E0677344DBB537B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ppWixStrings.wxl

Path C:\Windows\Temp\{545EB676-31DE-4962-9C57-F5C5958A1FF4}\.ba\ppWixStrings.wxl
Size 35KB
SHA256 ac345388aa9bfee8cbdac2be006520fae4903e760971b13a94a361b97bbae4fb
MD5 0efd624a76c022103deb58912b8558fe
SHA1 c94aa014ae6c7cea7e444d94cdefaa7a407e9724
SHA512 7f64f1c0899fc3be9d117035d3beab49a0a579dac7c1575327aae6f96f167d7ad6df12ba195ad9539bd36ff456eabf7d66327557dfad02f4f04fcd57e1330b15
SSDEEP 768:EOdkC/COR0Kx1eRLtyqI0CfENdNtAV3VAo:EOl0KxcLtyqI0e
TLSH
T172F27C0E9CDEED60A15366213BE1464E5F2DC3830B3A9DF1F4604E2661D75B0477BE2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ppWixStrings_cs.wxl

Path C:\Windows\Temp\{545EB676-31DE-4962-9C57-F5C5958A1FF4}\.ba\ppWixStrings_cs.wxl
Size 36KB
SHA256 af714ff435e0c81be4c6f84d6ba58374b5710d870ee0185676b8e1cd37bd5b1f
MD5 cb22be8405c19e408e851b2cd1998e76
SHA1 92dc76afa83ffccdb5e791e74330006ef98e9276
SHA512 49ecf467c796e81aeac3e648f9a67c5a53186b48954b86c99eb87d949288f9017af56d05c0732b4c60670c29bc74e146742e9399d25f40261aef3e993ff76aa2
SSDEEP 768:xwn6o2DNCRg7/vi2PT8YPLC75hRgKxv1eaY13hgwhUTT9v+u69Tu4T:x8R8/KS8sC7D+kc
TLSH
T16EF29A0EACDAED60E52756113BF1464E1F1DC3830B3AACF1F8654E2656D70B046B7E2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ppWixStrings_de.wxl

Path C:\Windows\Temp\{545EB676-31DE-4962-9C57-F5C5958A1FF4}\.ba\ppWixStrings_de.wxl
Size 37KB
SHA256 70aa2fa3015e4e7ff0a9b60b88de7368a6411b1580536394c460faa7be8c9ac2
MD5 108aa8cc354383e458580b58e9a55f2e
SHA1 20ad26b48cc93fa32caf8b0be00edc40626e18a0
SHA512 b87bfb369340474bbc20fb1d8ea33bd02ebaa9b6bfae3a6b5f2247e6b8c83fbb3d1ae9b42eb0dbed65cc3ce057a707d16fb92bb4aa2e73bc57d29c785fb63c84
SSDEEP 768:xH/K4BS+KY1z0cOYhH/YQCN3HMqzagj/L488PSTbCbtB71:xHyOHQQCN3H5zBj/k
TLSH
T1C703890E5CDAED60E253A6113BE2464E1F2DC3830B3A6DF1F4608E6656D71F0467BD2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ppWixStrings_es.wxl

Path C:\Windows\Temp\{545EB676-31DE-4962-9C57-F5C5958A1FF4}\.ba\ppWixStrings_es.wxl
Size 37KB
SHA256 49c7f591c69153c50d0ccf37a5067f53fcaecd3060057a37485f97152aa90d63
MD5 b20ea11ac4b7b7602183c255d4d0be8e
SHA1 2361e42f84c8077ca90e5b43c214c0bc8130254f
SHA512 ce0b88238a13edab597c6ef737417b736e8629a21e448ede6b88c2d54e0c4fd82902df1307d8dcc91e578c39b9709fcab28c73a22a8cf907490bc8d21c3bf1f2
SSDEEP 384:AYK+TnjkF6L6a0gJZVH2C8/Cc3WVIhgg75sKPiOv0c9PIxvPeqOheEc5dGm:hg8Oa0I0/tsQ5ViOv0c9vhwim
TLSH
T18703C90EACDEED50E16366117BE1460F4B19C3832B2ADDF2F4604E3651D65F0827BE6A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ppWixStrings_fr.wxl

Path C:\Windows\Temp\{545EB676-31DE-4962-9C57-F5C5958A1FF4}\.ba\ppWixStrings_fr.wxl
Size 37KB
SHA256 b07647bf754bdc0b60035086e90d39f4e625af2db5e0ee706a13eb372072654c
MD5 e32406f39a24cd7bf008760d32bf1927
SHA1 020b60787dbd94438e2f9adbee1af5e07e69b07f
SHA512 5ed0db820d02edcc2a191617b0a7c00b31c09b66edeb1a87953190974805fd5eb0760c8a3add0c06e298a6919fa9e56f675a14525feb9af0bf1b22696f5f87c4
SSDEEP 384:A7uvg5u0uTzPXHXkXiW+sEVOYDAdPElMJdnqRAxm2isagymd91nFTONbn4:0sNXHXkXAidPEleOAxtioymd9Cp4
TLSH
T17A03AC0E9CDAED50925366227BE2464F4F29C3831B399DF1F8614E2651DB4F043BBD2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ppWixStrings_it.wxl

Path C:\Windows\Temp\{545EB676-31DE-4962-9C57-F5C5958A1FF4}\.ba\ppWixStrings_it.wxl
Size 37KB
SHA256 8825689be3fac9df062409919d480b5f81b2eac1ecc26b3f325c3997d6948ee0
MD5 c57d54c95cb5e839279ba0b628722a77
SHA1 62f733902355933d918be75473fe8be30cca1255
SHA512 4941b2b12ebb5168b2d58ec8ed00c6b42bf4fb9478d658a4bc3b680c02a2ea85adc211361fbb793ddab17d983aaf9996a4a1023acdccdab6615e8cabd1670a77
SSDEEP 384:AT46pxwBNS6LcWMz3qqjX+p8jqnABTJjvmbP8kX7D/4cc3LeYALdAc0XH:Kr6L+ji8Q7D/3/xGH
TLSH
T111039B1E9CEAED10D52366113BE1464E5F2AC3C31F296CF1F8614E2A52D75F0427BE2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ppWixStrings_pl.wxl

Path C:\Windows\Temp\{545EB676-31DE-4962-9C57-F5C5958A1FF4}\.ba\ppWixStrings_pl.wxl
Size 36KB
SHA256 317f1bd0f1cd9d932a5f51b3fa9cd7a97f27326ae60f169501a685fb48f85394
MD5 e8d977f894f581026e9608085bce4602
SHA1 528bad9a891b1c383b214fe6c91c047c0c07d80d
SHA512 0a598a43b1a6c4b3840fa190ea972b1fe36afa53202d972bda2a0126c9b8b22f2d7a71078ea9b3e0a7e9798bfd0c05286eee1b19005ca6c74d964541b47df7f2
SSDEEP 768:iOsHev5B4XOb8yWUBv7f7OzCOMO0bbWZt8f5d:eaYlUBftnXj
TLSH
T17AF2AD0EACDAED50E5635A113BE2460E0F1D83C20B3A9CF1F8614E3655DB5F046BBE66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ppWixStrings_zh-cn.wxl

Path C:\Windows\Temp\{545EB676-31DE-4962-9C57-F5C5958A1FF4}\.ba\ppWixStrings_zh-cn.wxl
Size 33KB
SHA256 c480daff75bc6e5b6ef8480d02e1c4774e66858aeee156fb6d96aee49d86ff27
MD5 50fe6fefba6f77b677c08c63561e01d8
SHA1 b02dfa5cd584af3af3ff46d3976976d2367754d0
SHA512 ae9f85e1e71e6039d9dfef705db29a772d4f25bb9ec64fc8d56021ac983cb8ec3b48000761f619e6e11c830b509522af6e81f51678f89bf7b99dd9cb89c763b2
SSDEEP 384:AIaN8DnBuTG+TUIBI7IeyiwlXQw3azOUUxQ59Nx/cpdqe9z+q+:taABuTG+TOy7QYazOUcex0pdqQ+q+
TLSH
T137F2594E68DEEDA0A5175A213BE04A4E1F19C3820F3A9DF1F4605E2656DB4F047BBD28
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

readMe_OpenRailDesigner.zip

Path C:\Windows\Temp\{545EB676-31DE-4962-9C57-F5C5958A1FF4}\.ba\readMe_OpenRailDesigner.zip
Size 367KB
SHA256 baa9ba81e0df3a29649361ed502e2384d884c6689256bf853e667f76db11a209
MD5 90b5cf4253b2bd5fc54650eab1961e67
SHA1 260dbd063986d81f6dd47adde5ef63f947cbf4e0
SHA512 78d19df070180dd6c43ea58e8d3502c50c558b9dc463dcbc34fe5c6f91ed316b5d1eb9a34de02b052814e37c5ceb111b64cb0bee666fc93556f4a150acce209a
SSDEEP 6144:+nDdwVzdWpbS6K/r2X8DezGJZdTsNzMQE6WnOr8d9SibJ72SnrIxIaNOubvgAeHl:+nEZWpOOsCaJZdTCzGFLKYJKSnoQMgPF
TLSH
T14F84236CFDE515FFC876ACBE826C2E40821DC7913A69BF4DD8001229CCA3ED1557369A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wixnative.exe

Path C:\Windows\Temp\{545EB676-31DE-4962-9C57-F5C5958A1FF4}\.ba\wixnative.exe
Size 215KB
SHA256 02171af6bee9c6c79360dd946e523d69a232acb81c9433654bc8b5ace6c1939a
MD5 81e0d8eeef6941c56d34135ad315893a
SHA1 c279aef976efde953980fab82c59d124a9becc6c
SHA512 37122ffc77373581ac314688a3ec1a7064a6790f4141bcb661db65f205be417e50d10f623f081252909db5539cede45325eb78564cadc2a171b747519b6d0427
SSDEEP 3072:fllVMW0T1rex5w3Hrdag3uc2yqbtuXU3wxaUbxIk3ur/xx2j:pZ0haw4g+6o0qGR+s
TLSH
T142248D6673A404FDD5B74235C9D14125FF76780A27209BEF03A4822AAF2B6D0ADBF711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4476-84-0x00000157EAD20000-0x00000157EADD0000-memory.dmp

Download

memory/4476-79-0x00000157D2330000-0x00000157D235E000-memory.dmp

Download

memory/4476-153-0x00007FFF1A620000-0x00007FFF1AFC4000-memory.dmp

Download

memory/4476-147-0x00000157EABB0000-0x00000157EABB6000-memory.dmp

Download

memory/4476-152-0x00000157EBDA0000-0x00000157EBDE0000-memory.dmp

Download

memory/4476-151-0x00000157EBA20000-0x00000157EBA44000-memory.dmp

Download

memory/4476-157-0x00000157EBA50000-0x00000157EBA5E000-memory.dmp

Download

memory/4476-156-0x00000157EBF90000-0x00000157EBFCE000-memory.dmp

Download

memory/4476-146-0x00000157EAB90000-0x00000157EAB98000-memory.dmp

Download

memory/4476-144-0x00007FFF1A620000-0x00007FFF1AFC4000-memory.dmp

Download

memory/4476-145-0x00007FFF1A620000-0x00007FFF1AFC4000-memory.dmp

Download

memory/4476-143-0x00007FFF1A620000-0x00007FFF1AFC4000-memory.dmp

Download

memory/4476-155-0x00000157EACD0000-0x00000157EACD8000-memory.dmp

Download

memory/4476-82-0x00007FFF1A620000-0x00007FFF1AFC4000-memory.dmp

Download

memory/4476-148-0x00000157EBAE0000-0x00000157EBB9A000-memory.dmp

Download

memory/4476-154-0x00007FFF1A620000-0x00007FFF1AFC4000-memory.dmp

Download

memory/4476-150-0x00000157EBA80000-0x00000157EBAE0000-memory.dmp

Download

memory/4476-149-0x00000157EACB0000-0x00000157EACCC000-memory.dmp

Download

memory/4476-78-0x00007FFF1A620000-0x00007FFF1AFC4000-memory.dmp

Download

memory/4476-75-0x00007FFF1A7AF000-0x00007FFF1A7B0000-memory.dmp

Download

memory/4476-76-0x00000157D05F0000-0x00000157D06E6000-memory.dmp

Download

memory/4476-158-0x00000157EE530000-0x00000157EE538000-memory.dmp

Download

memory/4476-159-0x00007FFF1A620000-0x00007FFF1AFC4000-memory.dmp

Download

memory/4476-160-0x00007FFF1A620000-0x00007FFF1AFC4000-memory.dmp

Download

memory/4476-161-0x00007FFF1A620000-0x00007FFF1AFC4000-memory.dmp

Download

memory/4476-162-0x00007FFF1A620000-0x00007FFF1AFC4000-memory.dmp

Download

memory/4476-163-0x00007FFF1A620000-0x00007FFF1AFC4000-memory.dmp

Download

memory/4476-164-0x00007FFF1A620000-0x00007FFF1AFC4000-memory.dmp

Download

memory/4476-165-0x00007FFF1A620000-0x00007FFF1AFC4000-memory.dmp

Download

memory/4476-166-0x00007FFF1A620000-0x00007FFF1AFC4000-memory.dmp

Download

memory/4476-167-0x00007FFF1A620000-0x00007FFF1AFC4000-memory.dmp

Download