floxif | 4a57feb4b1d48c6762fca8abf5bad3f0cf5b5fff02b6fd44bf4175449d7e28c1

Analysis

max time kernel
150s
max time network
153s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
08/08/2026, 17:03

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-08_f28cbf53a4dbf02c88efdf8ce7acc91e_bkransomware_darkgate_elex_floxif_maze.exe
Size 26.8MB
Sample260808-vk7nraee52
SHA256 4a57feb4b1d48c6762fca8abf5bad3f0cf5b5fff02b6fd44bf4175449d7e28c1
MD5 f28cbf53a4dbf02c88efdf8ce7acc91e
SHA1 0b2173b09ba1d0f1f50cfff96ad06c46e10ee5ad
SHA512 be6046dd1eb49010fea808b994cb5962535caa9aa362c8a5acf5ec77085a143a68a9c5b2a04baf6a9e70a5674a87b14a594354610f3c02adf3b4cdc8a4249c14
SSDEEP 786432:vzNKXRZuaQymzhik+/8ZBJGdCCiY5SIiRJ:vzNKBZuFJ1iOCi79J
TLSH
T1E057333276E180B7D83327319ADD736871ADBE718935016722D63E3E1DF0492A53DAA3
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

backdoor defense_evasion discovery floxif ransomware trojan upx

Malware Config

Signatures

Family: Floxif, Floodfix
Floxif aka FloodFix is a file-changing trojan and backdoor written in C++.
backdoor trojan floxif

Detects Floxif payload 1 IoCs

backdoor

resource	yara_rule
behavioral2/files/0x000e00000001c5b8-1.dat	floxif

UPX dump on OEP (original entry point) 4 IoCs

resource	yara_rule
behavioral2/files/0x000e00000001c5b8-1.dat	UPX
behavioral2/memory/1556-4-0x0000000010000000-0x0000000010030000-memory.dmp	UPX
behavioral2/memory/1556-22-0x0000000010000000-0x0000000010030000-memory.dmp	UPX
behavioral2/memory/1556-189-0x0000000010000000-0x0000000010030000-memory.dmp	UPX

ACProtect 1.3x - 1.4x DLL software 1 IoCs

Detects file using ACProtect software.

resource	yara_rule
behavioral2/files/0x000e00000001c5b8-1.dat	acprotect

Executes dropped EXE 3 IoCs

pid	Process
3052	InstallationPathWriter.exe
2608	SWMAgent.exe
824	sAgentSetup.exe

Loads dropped DLL 8 IoCs

pid	Process
1556	2026-08-08_f28cbf53a4dbf02c88efdf8ce7acc91e_bkransomware_darkgate_elex_floxif_maze.exe
5936	MsiExec.exe
5936	MsiExec.exe
4628	MsiExec.exe
4628	MsiExec.exe
3600	MsiExec.exe
3600	MsiExec.exe
3600	MsiExec.exe

Enumerates connected drives 3 TTPs 47 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\D:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\d:	2026-08-08_f28cbf53a4dbf02c88efdf8ce7acc91e_bkransomware_darkgate_elex_floxif_maze.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\D:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/0x000e00000001c5b8-1.dat	upx
behavioral2/memory/1556-4-0x0000000010000000-0x0000000010030000-memory.dmp	upx
behavioral2/memory/1556-22-0x0000000010000000-0x0000000010030000-memory.dmp	upx
behavioral2/memory/1556-189-0x0000000010000000-0x0000000010030000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Samsung\SW Update\Help\SW_Update_ITA.chm	msiexec.exe
File opened for modification	C:\Program Files (x86)\Samsung\SW Update\Help\SW_Update_AZE.chm	msiexec.exe
File created	C:\Program Files (x86)\Samsung\SW Update\Help\SW_Update_FRE.chm	msiexec.exe
File created	C:\Program Files (x86)\Samsung\SW Update\Help\SW_Update_UZB.chm	msiexec.exe
File opened for modification	C:\Program Files (x86)\Samsung\SW Update\Help\SW_Update_SLV.chm	msiexec.exe
File opened for modification	C:\Program Files (x86)\Samsung\SW Update\SecSWMgrGuide.exe	msiexec.exe
File opened for modification	C:\Program Files (x86)\Samsung\SW Update\Help\SW_Update_POR.chm	msiexec.exe
File opened for modification	C:\Program Files (x86)\Samsung\SW Update\Help\SW_Update_SPA-MX.chm	msiexec.exe
File opened for modification	C:\Program Files (x86)\Samsung\SW Update\Help\SW_Update_FAR.chm	msiexec.exe
File opened for modification	C:\Program Files (x86)\Samsung\SW Update\sManager.exe	msiexec.exe
File created	C:\Program Files (x86)\Samsung\SW Update\Help\SW_Update_RUS.chm	msiexec.exe
File created	C:\Program Files (x86)\Samsung\SW Update\sManager.lang	msiexec.exe
File created	C:\Program Files (x86)\Samsung\SW Update\Help\SW_Update_RUM.chm	msiexec.exe
File created	C:\Program Files (x86)\Samsung\SW Update\Help\SW_Update_CHS.chm	msiexec.exe
File opened for modification	C:\Program Files (x86)\Samsung\SW Update\Help\SW_Update_KAZ.chm	msiexec.exe
File opened for modification	C:\Program Files (x86)\Samsung\SW Update\Help\SW_Update_THA.chm	msiexec.exe
File opened for modification	C:\Program Files (x86)\Samsung\SW Update\Help\SW_Update_UZB.chm	msiexec.exe
File opened for modification	C:\Program Files (x86)\Samsung\SW Update\Help\SW_Update_HEB.chm	msiexec.exe
File created	C:\Program Files (x86)\Samsung\SW Update\Help\SW_Update_ITA.chm	msiexec.exe
File created	C:\Program Files (x86)\Samsung\SW Update\Help\SW_Update_HUN.chm	msiexec.exe
File created	C:\Program Files (x86)\Samsung\SW Update\Help\SW_Update_VIE.chm	msiexec.exe
File created	C:\Program Files (x86)\Samsung\SW Update\InstallationPathWriter.exe	msiexec.exe
File created	C:\Program Files (x86)\Samsung\SW Update\Help\SW_Update_SPA-MX.chm	msiexec.exe
File opened for modification	C:\Program Files (x86)\Samsung\SW Update\Help\SW_Update_ENG.chm	msiexec.exe
File opened for modification	C:\Program Files (x86)\Samsung\SW Update\sManager.ico	msiexec.exe
File opened for modification	C:\Program Files (x86)\Samsung\SW Update\InstallationPathWriter.exe	msiexec.exe
File created	C:\Program Files (x86)\Samsung\SW Update\Help\SW_Update_FIN.chm	msiexec.exe
File created	C:\Program Files (x86)\Samsung\SW Update\Help\SW_Update_CHT-HK.chm	msiexec.exe
File created	C:\Program Files (x86)\Samsung\SW Update\Help\SW_Update_SWE.chm	msiexec.exe
File created	C:\Program Files (x86)\Samsung\SW Update\Help\SW_Update_SLO.chm	msiexec.exe
File opened for modification	C:\Program Files (x86)\Samsung\SW Update\Help\SW_Update_TUR.chm	msiexec.exe
File opened for modification	C:\Program Files (x86)\Samsung\SW Update\Help\SW_Update_FRE.chm	msiexec.exe
File opened for modification	C:\Program Files (x86)\Samsung\SW Update\Help\SW_Update_IND.chm	msiexec.exe
File opened for modification	C:\Program Files (x86)\Samsung\SW Update\Help\SW_Update_KOR.chm	msiexec.exe
File opened for modification	C:\Program Files (x86)\Samsung\SW Update\Help\SW_Update_HIN.chm	msiexec.exe
File created	C:\Program Files (x86)\Samsung\SW Update\Help\SW_Update_SLV.chm	msiexec.exe
File created	C:\Program Files (x86)\Samsung\SW Update\Help\SW_Update_GER.chm	msiexec.exe
File created	C:\Program Files (x86)\Samsung\SW Update\Help\SW_Update_DUT.chm	msiexec.exe
File created	C:\Program Files (x86)\Samsung\SW Update\Help\SW_Update_HEB.chm	msiexec.exe
File opened for modification	C:\Program Files (x86)\Samsung\SW Update\Help\SW_Update_CHT-HK.chm	msiexec.exe
File opened for modification	C:\Program Files (x86)\Samsung\SW Update\Help\SW_Update_GRE.chm	msiexec.exe
File opened for modification	C:\Program Files (x86)\Samsung\SW Update\Help\SW_Update_BUL.chm	msiexec.exe
File opened for modification	C:\Program Files (x86)\Samsung\SW Update\Help\SW_Update_CHS.chm	msiexec.exe
File created	C:\Program Files (x86)\Samsung\SW Update\Help\SW_Update_AZE.chm	msiexec.exe
File created	C:\Program Files (x86)\Samsung\SW Update\Help\SW_Update_CHT-TW.chm	msiexec.exe
File created	C:\Program Files (x86)\Samsung\SW Update\Help\SW_Update_FAR.chm	msiexec.exe
File opened for modification	C:\Program Files (x86)\Samsung\SW Update\Help\SW_Update_GER.chm	msiexec.exe
File opened for modification	C:\Program Files (x86)\Samsung\SW Update\SWMSetupCustomAction.dll	msiexec.exe
File opened for modification	C:\Program Files (x86)\Samsung\SW Update\Help\SW_Update_SLO.chm	msiexec.exe
File created	C:\Program Files (x86)\Samsung\SW Update\sManager.ico	msiexec.exe
File created	C:\Program Files (x86)\Samsung\SW Update\SWM_ChangeShortcutToChinese.exe	msiexec.exe
File created	C:\Program Files (x86)\Samsung\SW Update\SWMSetupCustomAction.dll	msiexec.exe
File created	C:\Program Files (x86)\Samsung\SW Update\Help\SW_Update_SCR.chm	msiexec.exe
File opened for modification	C:\Program Files (x86)\Samsung\SW Update\Help\SW_Update_CZE.chm	msiexec.exe
File opened for modification	C:\Program Files (x86)\Samsung\SW Update\Help\SW_Update_DAN.chm	msiexec.exe
File opened for modification	C:\Program Files (x86)\Samsung\SW Update\Help\SW_Update_VIE.chm	msiexec.exe
File opened for modification	C:\Program Files (x86)\Samsung\SW Update\Help\SW_Update_SCC.chm	msiexec.exe
File created	C:\Program Files (x86)\Samsung\SW Update\Help\SW_Update_POL.chm	msiexec.exe
File created	C:\Program Files (x86)\Samsung\SW Update\Help\SW_Update_UKR.chm	msiexec.exe
File created	C:\Program Files (x86)\Samsung\SW Update\Help\SW_Update_SCC.chm	msiexec.exe
File created	C:\Program Files (x86)\Samsung\SW Update\sManager.exe	msiexec.exe
File opened for modification	C:\Program Files (x86)\Samsung\SW Update\Help\SW_Update_ARA.chm	msiexec.exe
File opened for modification	C:\Program Files (x86)\Samsung\SW Update\Help\SW_Update_SCR.chm	msiexec.exe
File opened for modification	C:\Program Files (x86)\Samsung\SW Update\Help\SW_Update_SPA.chm	msiexec.exe

Drops file in Windows directory 18 IoCs

description	ioc	Process
File created	C:\Windows\Installer\e59cdb6.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\e59cdb6.msi	msiexec.exe
File created	C:\Windows\SystemTemp\~DFF53D5E7C51A344CE.TMP	msiexec.exe
File created	C:\Windows\Installer\SourceHash{0CAAEAAE-5401-4FFA-88BC-EB6F89947DC4}	msiexec.exe
File created	C:\Windows\Installer\{0CAAEAAE-5401-4FFA-88BC-EB6F89947DC4}\_853F67D554F05449430E7E.exe	msiexec.exe
File created	C:\Windows\Installer\e59cdb8.msi	msiexec.exe
File created	C:\Windows\SystemTemp\~DFC91333FA8FB452F6.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\~DF7688E0724681D555.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File opened for modification	C:\Windows\Installer\MSID662.tmp	msiexec.exe
File created	C:\Windows\SystemTemp\~DFA0215EAD34015759.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\MSID99F.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\{0CAAEAAE-5401-4FFA-88BC-EB6F89947DC4}\_853F67D554F05449430E7E.exe	msiexec.exe
File created	C:\Windows\Installer\{0CAAEAAE-5401-4FFA-88BC-EB6F89947DC4}\_9A897177992B19BE48FA33.exe	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File opened for modification	C:\Windows\Installer\MSID383.tmp	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\{0CAAEAAE-5401-4FFA-88BC-EB6F89947DC4}\_9A897177992B19BE48FA33.exe	msiexec.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 15 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msiexec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sAgentSetup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	InstallationPathWriter.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-08_f28cbf53a4dbf02c88efdf8ce7acc91e_bkransomware_darkgate_elex_floxif_maze.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SWMAgent.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 000000000400000031a81fc62ba3bf350000000000000000000000000000000000000000000000000000000000000000000000000000000000001071020000000000c012000000000000000000000000270101000088380131a81fc60000000000001071020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d0830200000000006025c501000000000000000000000700010000e8410131a81fc6000000000000d08302000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9c701000000000000050000000000000000000000070001000098d4e331a81fc600000000000030a9c7010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9cc0100000000000005000000000000000000000007000100009854e631a81fc600000000000030a9cc01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe

Kills process with taskkill 6 IoCs

defense_evasion

pid	Process
4660	taskkill.exe
4652	taskkill.exe
1692	taskkill.exe
5140	taskkill.exe
1764	taskkill.exe
4200	taskkill.exe

Modifies data under HKEY_USERS 8 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	MsiExec.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	MsiExec.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	MsiExec.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	MsiExec.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	MsiExec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\27\52C64B7E	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27	msiexec.exe

Modifies registry class 23 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\EAAEAAC01045AFF488CBBEF69849D74C\PackageCode = "C72DF840951E1824DAD1E9D61A3DD7FA"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\EAAEAAC01045AFF488CBBEF69849D74C\Assignment = "1"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\EAAEAAC01045AFF488CBBEF69849D74C\SourceList\Net	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\EAAEAAC01045AFF488CBBEF69849D74C\SourceList\Media	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\EAAEAAC01045AFF488CBBEF69849D74C\ProductName = "Samsung Update"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\EAAEAAC01045AFF488CBBEF69849D74C\InstanceType = "0"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\EAAEAAC01045AFF488CBBEF69849D74C\DeploymentFlags = "3"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\BF3805105D8948C4D93B598B404C92A9\EAAEAAC01045AFF488CBBEF69849D74C	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\EAAEAAC01045AFF488CBBEF69849D74C	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\EAAEAAC01045AFF488CBBEF69849D74C\Language = "1033"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\EAAEAAC01045AFF488CBBEF69849D74C\Version = "33685555"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\EAAEAAC01045AFF488CBBEF69849D74C\AdvertiseFlags = "388"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\EAAEAAC01045AFF488CBBEF69849D74C\SourceList	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\EAAEAAC01045AFF488CBBEF69849D74C\SourceList\Net\1 = "C:\\ProgramData\\Samsung\\SWUpdate\\Temp\\"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\EAAEAAC01045AFF488CBBEF69849D74C	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\EAAEAAC01045AFF488CBBEF69849D74C\ProductIcon = "C:\\Windows\\Installer\\{0CAAEAAE-5401-4FFA-88BC-EB6F89947DC4}\\_853F67D554F05449430E7E.exe"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\EAAEAAC01045AFF488CBBEF69849D74C\AuthorizedLUAApp = "0"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\BF3805105D8948C4D93B598B404C92A9	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\EAAEAAC01045AFF488CBBEF69849D74C\SourceList\PackageName = "sManagerSetup.msi"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\EAAEAAC01045AFF488CBBEF69849D74C\SourceList\Media\1 = ";"	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\EAAEAAC01045AFF488CBBEF69849D74C\Clients = 3a0000000000	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\EAAEAAC01045AFF488CBBEF69849D74C\SourceList\LastUsedSource = "n;1;C:\\ProgramData\\Samsung\\SWUpdate\\Temp\\"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\EAAEAAC01045AFF488CBBEF69849D74C\DefaultFeature	msiexec.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
1556	2026-08-08_f28cbf53a4dbf02c88efdf8ce7acc91e_bkransomware_darkgate_elex_floxif_maze.exe
1556	2026-08-08_f28cbf53a4dbf02c88efdf8ce7acc91e_bkransomware_darkgate_elex_floxif_maze.exe
5664	msiexec.exe
5664	msiexec.exe
3600	MsiExec.exe
3600	MsiExec.exe
3600	MsiExec.exe
3600	MsiExec.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	1556	2026-08-08_f28cbf53a4dbf02c88efdf8ce7acc91e_bkransomware_darkgate_elex_floxif_maze.exe
Token: SeDebugPrivilege	4660	taskkill.exe
Token: SeDebugPrivilege	4652	taskkill.exe
Token: SeShutdownPrivilege	4548	msiexec.exe
Token: SeIncreaseQuotaPrivilege	4548	msiexec.exe
Token: SeSecurityPrivilege	5664	msiexec.exe
Token: SeCreateTokenPrivilege	4548	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	4548	msiexec.exe
Token: SeLockMemoryPrivilege	4548	msiexec.exe
Token: SeIncreaseQuotaPrivilege	4548	msiexec.exe
Token: SeMachineAccountPrivilege	4548	msiexec.exe
Token: SeTcbPrivilege	4548	msiexec.exe
Token: SeSecurityPrivilege	4548	msiexec.exe
Token: SeTakeOwnershipPrivilege	4548	msiexec.exe
Token: SeLoadDriverPrivilege	4548	msiexec.exe
Token: SeSystemProfilePrivilege	4548	msiexec.exe
Token: SeSystemtimePrivilege	4548	msiexec.exe
Token: SeProfSingleProcessPrivilege	4548	msiexec.exe
Token: SeIncBasePriorityPrivilege	4548	msiexec.exe
Token: SeCreatePagefilePrivilege	4548	msiexec.exe
Token: SeCreatePermanentPrivilege	4548	msiexec.exe
Token: SeBackupPrivilege	4548	msiexec.exe
Token: SeRestorePrivilege	4548	msiexec.exe
Token: SeShutdownPrivilege	4548	msiexec.exe
Token: SeDebugPrivilege	4548	msiexec.exe
Token: SeAuditPrivilege	4548	msiexec.exe
Token: SeSystemEnvironmentPrivilege	4548	msiexec.exe
Token: SeChangeNotifyPrivilege	4548	msiexec.exe
Token: SeRemoteShutdownPrivilege	4548	msiexec.exe
Token: SeUndockPrivilege	4548	msiexec.exe
Token: SeSyncAgentPrivilege	4548	msiexec.exe
Token: SeEnableDelegationPrivilege	4548	msiexec.exe
Token: SeManageVolumePrivilege	4548	msiexec.exe
Token: SeImpersonatePrivilege	4548	msiexec.exe
Token: SeCreateGlobalPrivilege	4548	msiexec.exe
Token: SeCreateTokenPrivilege	4548	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	4548	msiexec.exe
Token: SeLockMemoryPrivilege	4548	msiexec.exe
Token: SeIncreaseQuotaPrivilege	4548	msiexec.exe
Token: SeMachineAccountPrivilege	4548	msiexec.exe
Token: SeTcbPrivilege	4548	msiexec.exe
Token: SeSecurityPrivilege	4548	msiexec.exe
Token: SeTakeOwnershipPrivilege	4548	msiexec.exe
Token: SeLoadDriverPrivilege	4548	msiexec.exe
Token: SeSystemProfilePrivilege	4548	msiexec.exe
Token: SeSystemtimePrivilege	4548	msiexec.exe
Token: SeProfSingleProcessPrivilege	4548	msiexec.exe
Token: SeIncBasePriorityPrivilege	4548	msiexec.exe
Token: SeCreatePagefilePrivilege	4548	msiexec.exe
Token: SeCreatePermanentPrivilege	4548	msiexec.exe
Token: SeBackupPrivilege	4548	msiexec.exe
Token: SeRestorePrivilege	4548	msiexec.exe
Token: SeShutdownPrivilege	4548	msiexec.exe
Token: SeDebugPrivilege	4548	msiexec.exe
Token: SeAuditPrivilege	4548	msiexec.exe
Token: SeSystemEnvironmentPrivilege	4548	msiexec.exe
Token: SeChangeNotifyPrivilege	4548	msiexec.exe
Token: SeRemoteShutdownPrivilege	4548	msiexec.exe
Token: SeUndockPrivilege	4548	msiexec.exe
Token: SeSyncAgentPrivilege	4548	msiexec.exe
Token: SeEnableDelegationPrivilege	4548	msiexec.exe
Token: SeManageVolumePrivilege	4548	msiexec.exe
Token: SeImpersonatePrivilege	4548	msiexec.exe
Token: SeCreateGlobalPrivilege	4548	msiexec.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
4548	msiexec.exe
4548	msiexec.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
1556	2026-08-08_f28cbf53a4dbf02c88efdf8ce7acc91e_bkransomware_darkgate_elex_floxif_maze.exe
4548	msiexec.exe
5664	msiexec.exe
5936	MsiExec.exe
4628	MsiExec.exe
3600	MsiExec.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 1556 wrote to memory of 4660	1556	2026-08-08_f28cbf53a4dbf02c88efdf8ce7acc91e_bkransomware_darkgate_elex_floxif_maze.exe	89
PID 1556 wrote to memory of 4652	1556	2026-08-08_f28cbf53a4dbf02c88efdf8ce7acc91e_bkransomware_darkgate_elex_floxif_maze.exe	91
PID 1556 wrote to memory of 4548	1556	2026-08-08_f28cbf53a4dbf02c88efdf8ce7acc91e_bkransomware_darkgate_elex_floxif_maze.exe	93
PID 5664 wrote to memory of 5936	5664	msiexec.exe	96
PID 5664 wrote to memory of 1604	5664	msiexec.exe	102
PID 5664 wrote to memory of 4628	5664	msiexec.exe	104
PID 5664 wrote to memory of 3600	5664	msiexec.exe	105
PID 3600 wrote to memory of 1692	3600	MsiExec.exe	106
PID 3600 wrote to memory of 5140	3600	MsiExec.exe	108
PID 3600 wrote to memory of 1764	3600	MsiExec.exe	110
PID 3600 wrote to memory of 4200	3600	MsiExec.exe	112
PID 3600 wrote to memory of 4820	3600	MsiExec.exe	114
PID 3600 wrote to memory of 3052	3600	MsiExec.exe	116
PID 1556 wrote to memory of 824	1556	2026-08-08_f28cbf53a4dbf02c88efdf8ce7acc91e_bkransomware_darkgate_elex_floxif_maze.exe	119

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-08-08_f28cbf53a4dbf02c88efdf8ce7acc91e_bkransomware_darkgate_elex_floxif_maze.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-08_f28cbf53a4dbf02c88efdf8ce7acc91e_bkransomware_darkgate_elex_floxif_maze.exe"
1⤵
- Loads dropped DLL
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1556
- C:\Windows\SysWOW64\taskkill.exe
  "C:\Windows\System32\taskkill.exe" /F /IM sManager.exe
  2⤵
  - System Location Discovery: System Language Discovery
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:4660
- C:\Windows\SysWOW64\taskkill.exe
  "C:\Windows\System32\taskkill.exe" /F /IM SWMAgent.exe
  2⤵
  - System Location Discovery: System Language Discovery
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:4652
- C:\Windows\SysWOW64\msiexec.exe
  msiexec.exe /i sManagerSetup.msi /norestart
  2⤵
  - Enumerates connected drives
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  PID:4548
- C:\ProgramData\Samsung\SWUpdate\Temp\sAgentSetup.exe
  sAgentSetup.exe /OEMINSTALL
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:824

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5664
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 87E96F331CB6349DCE60F51B23C23E30 C
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:5936
- C:\Windows\system32\srtasks.exe
  C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
  2⤵
  PID:1604
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 7381E67952EF5F421E7BE258F70AEE36
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:4628
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 4FB1B4BBABD40AEF944AA24E2708D83E E Global\MSI0000
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3600
- - C:\Windows\SysWOW64\taskkill.exe
    "C:\Windows\SysWOW64\taskkill.exe" /F /IM SWMAgent.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    PID:1692
- - C:\Windows\SysWOW64\taskkill.exe
    "C:\Windows\SysWOW64\taskkill.exe" /F /IM SWMFileDownloadUtil.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    PID:5140
- - C:\Windows\SysWOW64\taskkill.exe
    "C:\Windows\SysWOW64\taskkill.exe" /F /IM SWUInterfaceLauncher.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    PID:1764
- - C:\Windows\SysWOW64\taskkill.exe
    "C:\Windows\SysWOW64\taskkill.exe" /F /IM SWMLauncher.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    PID:4200
- - C:\Windows\SysWOW64\schtasks.exe
    "C:\Windows\SysWOW64\schtasks.exe" /delete /tn "SWUpdateAgent" /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4820
- - C:\Program Files (x86)\Samsung\SW Update\InstallationPathWriter.exe
    "C:\Program Files (x86)\Samsung\SW Update\InstallationPathWriter.exe" -task="write" -id="20000" -name="sManager.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:3052

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
PID:912

C:\ProgramData\Samsung\SW Update Service\SWMAgent.exe
"C:\ProgramData\Samsung\SW Update Service\SWMAgent.exe" /SERVICE
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2608

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

e59cdb7.rbs

Path C:\Config.Msi\e59cdb7.rbs
Size 20KB
SHA256 23742b6e330f349c524f06f254ad9a3ceb440667b6206d8e3933339756970a83
MD5 0da37822547734d7ee16d899511dba91
SHA1 796c10b99e66fd5899a52613beae5c5fb34efb1b
SHA512 6a3839fa0a82a31a65c8987d4a0a4db88b800f767b614c825795068d3eeeb7ab2bb6e657324386af4bd5a7ba2a7454d3a7a9f562f76eb57729c9aa4311c3d911
SSDEEP 384:XExPeG0rn3Ju9e9b4DADMUrvjMUrve3e82Wm9ckx:XDG0r3Ju9e98DSRj86Fx
TLSH
T184A2FB26F943C2F7F1467A7E9FD83F25232ADE6453D8491D108D663A498258A1F3C8EC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SW_Update_ARA.chm

Path C:\Program Files (x86)\Samsung\SW Update\Help\SW_Update_ARA.chm
Size 12KB
SHA256 98b4b8cf4b84eb22f6f22dda16016212d4fd52cae410dd318872b37656083fb9
MD5 2baa622d25a95071ec6caafa0e0e96d6
SHA1 c9e123c832fa81fbd17ae2474fbf72f91b01610a
SHA512 92580ab7dfeaf66421cf42914f85d3e6b016bfc8a19b6f159ddc1c2b4fece4bef446f9b24440e20873bec834864baaa93a1ffbd76b091debb0907f8cc32c6ca3
SSDEEP 96:XuOryiLaSpPhv7DLa1RCh3LmMrLvB52RvPw8tLh3ggPPacgtDjXIy:XuOrrRhvf2rCl6sNCvPwMLhw4y
TLSH
T15A424DB07355422AD8459076F6CBAA5FA9273E53DE5061E27053F70D36F2E047FA08B2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SW_Update_BRA.chm

Path C:\Program Files (x86)\Samsung\SW Update\Help\SW_Update_BRA.chm
Size 12KB
SHA256 71768e19230842506370a5d71a9441625b76832c3cdbade8bcbe5757c4265e5a
MD5 cd0c1b80574105fa610445fe9118adc9
SHA1 92e26caf9caee4d1bbf13a8bc6090df02300ebe0
SHA512 12868b38309dd66b7cf0359ffaefd29fa937b4d6dbe51d362f0cabd0ae1382e3949306b783249ebe54bb88c8d7f9b40e357e2197289b6dbf42e3aaf694deb8db
SSDEEP 96:RGr+qWSOqm7T2v/XqHcBklDC6iCrr3WI3nX0YXDdZ01Gr2l/:RvNSBkl20rSFEDghl
TLSH
T16A427DF036800126E1BA65B76AC225CA70686EE1EAC5A5CB1328772E2EF210D47F4CD5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SW_Update_BUL.chm

Path C:\Program Files (x86)\Samsung\SW Update\Help\SW_Update_BUL.chm
Size 12KB
SHA256 5cb6af7e957ef77d4817fdfbe726d2b6db13fcaff80a88fe19a3f3a88ccc9863
MD5 02eff87b303728889b5a2936972d3632
SHA1 4e1f6a765c9f42ca0ad3e06f62e3b8874512bc10
SHA512 e3d8b3221dbe158f1bf40816868875af0c5b6d3ed44d83f4bc728f99494e63cef1859c32b194a22e90a88cf05b20d9528553e394973667e2177e845300d27c18
SSDEEP 96:jRwHSob/3IOqQL891Arp5wcLCwX1kNAPJ6opo+bBYTXth7kh86tL6dPc:jRMRr3PUi5rrX1LMXIugzsdPc
TLSH
T132526D3C7B294F20D85A9533BF8424DA7B11BE43BC35866A20257388D9BAD6817E4E49
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SW_Update_CHT-HK.chm

Path C:\Program Files (x86)\Samsung\SW Update\Help\SW_Update_CHT-HK.chm
Size 12KB
SHA256 43934c228d8911033336f67b3000700e001b6602a2c02c1fe440a1108f183605
MD5 03544bf81c3aaa2adcccb7a1ae0c76bf
SHA1 bc80ab03b78cd2202f2e653330c8b3dd0a4adad2
SHA512 6d70d2c264bdcaa1b6a82be9f43d886ff010c61e87868659d7457502475602ea3dcafc93ce9ee2d30ae91ff9ec82fb986be4577928e14bd60e8d40b66f332600
SSDEEP 96:1bXrqekqyWSDAvSy9CI2i+v7DbdTzi7IAeiV7bCVdTck:FXrq7qOf9IkjDbdO7eiV7Gd
TLSH
T1DA427EF43660C332C06531396B6B5099392A7D01BEA78295310A7A2F1CBA73997348D9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SW_Update_CHT-TW.chm

Path C:\Program Files (x86)\Samsung\SW Update\Help\SW_Update_CHT-TW.chm
Size 12KB
SHA256 f1d0452c39e8fdade53cee23f80a7143aafc0fdf0ff017bece2a080771331452
MD5 b12b5c2d533b5b5d269e6ec985d4c9cd
SHA1 37e3ba24ab55422844049de293639a01e1ef1a6f
SHA512 11b04f0a43ca8f9563bb75ca6d30c1ea8639da1c76b2662344fb82ff42f8229d8230c70b496bcb6828f843d1403e546cde7af24a6c38af0314bb04e909aa3245
SSDEEP 96:1cFmiWea7El1dT9Y1x8fxHZQKQnbU8AhNISIBgjCI0TuFiYgGnPTHc7C:1cFmJI9euf1vQbU8kKWCIrj7
TLSH
T1E1524A3AB7520232C44D9738FEAAB37B69369D159B1001CAA41FB3090A7EF1A6751076
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SW_Update_CZE.chm

Path C:\Program Files (x86)\Samsung\SW Update\Help\SW_Update_CZE.chm
Size 12KB
SHA256 89ffa2573caadca618457b8304f5576cbcdc798d5a7639414137c0ae64607d3a
MD5 3c5162a1115c57b66ae6c9b20bcb7418
SHA1 5541851e393f41327634a8d1246e642d79091b19
SHA512 c300c6b6ab45fbde33025d4dc0029d593816f30feeecac5dae18bd5fb05650352c11097ab93bc31831c5d464c3cb35c1ef5b4b0758c141ebfe9c8d73e5ce998b
SSDEEP 96:9CUaWqWI29hYyJgJGMdpvGN3shd/m03uTcGFY9k5LysH:9HhZYxJZpeim03QUeu
TLSH
T1F0427D52B315C821C14C8134BFC25BACB0D63CD0AF6D99D13218F11C6B7BA2D3BA056E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SW_Update_DAN.chm

Path C:\Program Files (x86)\Samsung\SW Update\Help\SW_Update_DAN.chm
Size 12KB
SHA256 f22a1660fbce1ffd16cc762e6fe4247bf5118f878c97b3c36cb076fadd15fbd4
MD5 ce333b283ff145024a3867be22c8707e
SHA1 2cbf665dd0f2ea6c47c8de2b9bccde0f5382c932
SHA512 fb2b7bd6c1798743de3c166000b63917bd665982ae9967588e23185dcc18e3157e3c513b0c67da5fbbb5de7440a7c1f77376709a6b55994002342ddb21aea79e
SSDEEP 96:SUGWPxdbre9Q9nSt/9iQMkko2i+YOUVZsntp/gtheXjHx6jRjDXvkX:SU1br5ngc/lYO+WrgqHxGDXvk
TLSH
T133424DF1B7708A14D4A74332BA8507CDF2BADDA3AE5412B71014775D25B3E490A385AE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SW_Update_DUT.chm

Path C:\Program Files (x86)\Samsung\SW Update\Help\SW_Update_DUT.chm
Size 12KB
SHA256 d57584717b1d12968cdf165858852f36c3b26e6bb605d247f09d32739356805a
MD5 f1e3392dea3ffa56fe92a6c2ee27c3d0
SHA1 c9a63e3babc0e34843f0244511fbfee5637a96c1
SHA512 25d23f7023966ffdebf4d79e65cfa6a27b0380641f4c1fc48f25e82bc296edabce854d1ee24a961849c20ad51f84181f722a4daabe09136e8f91b34228a485e4
SSDEEP 96:cQGWsn15PNEQNSC2bZT9G+eFPOhTUxSK61FV+P69UyJGeI91:cQ2Pubo+eMVVrnVA6W3
TLSH
T173426DF078100615D45487313BC5255F6AA03D63ECA096977136B73F39F2C0CAB726C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SW_Update_FIN.chm

Path C:\Program Files (x86)\Samsung\SW Update\Help\SW_Update_FIN.chm
Size 12KB
SHA256 29a11cb22438d1a0f0b67066f5615e9896ea481ec41e0847ea1446c30e8878d2
MD5 e9f9020f9a6c79a2e8c265cdeb5a024e
SHA1 59c6d9f1a833c9aa1d0a0d876f273e305b217777
SHA512 b554bd728a01cbf3018c3a65addcb174974e6b6f8650432c643ae9cf9ad4b1e6298af356345a6cfb99b63d5f720b1907b3e9ae215601423b79471ada6cf5c466
SSDEEP 96:esSuWR9N0eL81zbfUsSAo+o2xXwlTrInR31RYLCU0y7q+XEn:edhr8hbetEwl47YLCty7qmo
TLSH
T158424C747263C621ED9499315F35B4CDA150BD41E934A2DF206AFB1E14B5E0D2E209EE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SW_Update_FRE.chm

Path C:\Program Files (x86)\Samsung\SW Update\Help\SW_Update_FRE.chm
Size 12KB
SHA256 cc96740ae9e161323c0a873f75a0c90f5cafb371f5d270b5ff4011ce6014fe7d
MD5 2a765e66267f53c6ff8a3bffdc069f6c
SHA1 883993f9d24068edac04b6d638ecb036ec9132e4
SHA512 f97c69998552aa422d0de5addcedb68e840b02450b3327ce65a4702ed31c679a99df2c7ef6a1dddbd0978e88561c06581ed47e0c870e6047cec0de02de8095ad
SSDEEP 96:R2UTXWGfYwPIDKHtp9L1r/s56S89ceOAR6qIzXHVJlbRA0j:R2UTjgwPX3I56zOA/Iz3f9RZ
TLSH
T148425CD072054024E5D88A73FFB8559922A1FCD2E4B4598720DAFB3F35F9E0C0B14768
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SW_Update_GER.chm

Path C:\Program Files (x86)\Samsung\SW Update\Help\SW_Update_GER.chm
Size 12KB
SHA256 4a1250f21c6645e71341c41d07372c84332733f76553c55acf8fa96651a6d719
MD5 710431b364edd8ddd4305e898c4a7c14
SHA1 5497e3a79dcc5efd7548aa3c51b1a9f41ecb6c5d
SHA512 d2df6b1d6aaa0b0507b5d96324261ee217c4ffa35b8c572c89ec293a9565c2b1f95f777bc0375565954d2dcfb1596fc5261f62cde703ab8ec381f649ec5ffc34
SSDEEP 96:vvQfL/WuBljvu30LCoDpkXcY6sajWyYXcy+BF31LND:vqLFnjvdLz9kXcopXchPx
TLSH
T199427C7476004625C2D18A31EFCB9662753B3CA29E22DB5FC206F12C39F6E0D3739999
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SW_Update_GRE.chm

Path C:\Program Files (x86)\Samsung\SW Update\Help\SW_Update_GRE.chm
Size 13KB
SHA256 a1c33f3290105ccd733b0da45b0e2683b5ac7f70b6b1b811e22b453b5623a26a
MD5 10b1bed1205fdbb945b8b0aac22deb60
SHA1 19482e6ba4df50b562fc3a4b76b693453a6121e2
SHA512 ae1eb1ab76116d417165b07a82ba939ec2141a2a134c87a6fd481b3efdcf01177a133b68b4a89fe4fe90e93d54a82bc6156ab0903ca5e61772c2e6dd9bf02b20
SSDEEP 96:9VP+5/XCsJnSeL8LFg5GwRhIHNKwLEsJidphsdOq8x7+PHa/Tf54qOPT6qL/T:9VPCXOLFg5XrsNKwn+zsvKN2
TLSH
T145529F38B948511CD0438B3B774622973199FDB68ABC95163206F2799AF16190EBD0CF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SW_Update_HUN.chm

Path C:\Program Files (x86)\Samsung\SW Update\Help\SW_Update_HUN.chm
Size 12KB
SHA256 174b9813d53dbac56107845445e7d8ea3aca59bd69ca81674a7356b01598ba5a
MD5 897c6b651e11df797fb16e2e418ff1ed
SHA1 a2f0c9730cd0fb47262957329494b0331f311f78
SHA512 b7e506a992f04cee34f90817e44e709e0488ced10a3cbca08eb5c72fae7d781a86562c40cc47a9a3ec40248fd932c351cc5512649ce4ce2902db79193dbf3811
SSDEEP 96:uqJ5WLMMHvmIBTdviQWWAWmswGpxO7ofCgQdwZ8+bFdR:uyivmIBBv7wJfp9+vx
TLSH
T11A527D717B9EC260C59D95733FC2814DB532EE011668E3C72256721C6AF0D5C8BBA8FA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SW_Update_IND.chm

Path C:\Program Files (x86)\Samsung\SW Update\Help\SW_Update_IND.chm
Size 12KB
SHA256 46c880077d0130b36b73b5917257c1269373ea8a6aaf267d76a07c502ffecd26
MD5 7f49dfb43f9ae77a3a7d3d8d890a4f56
SHA1 d196f0f8a50e8ad8366c7c8a1b134ab66b8a788c
SHA512 077ca18ad3af7523ec0bf50b72d71aaeb81985594ef95ca37560cf6a7388d44088a2fefb694880971f995e4e12f93d44e2af61a23760230ca37cee71a08a5482
SSDEEP 192:Ca0x2VO+SWEnRNtuZpTPdv8Vs9uU4yNoLl:Crx2VVSxjtCPv84ey
TLSH
T1D8428C213B104303D2B2457227F67266B161BE02FA29E327008BF72824FA67D4B716CE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SW_Update_ITA.chm

Path C:\Program Files (x86)\Samsung\SW Update\Help\SW_Update_ITA.chm
Size 12KB
SHA256 f3ca54e15d56f337376c4c1a6ddf9d58709ebcb11511c9bde90fecca42dd4fbd
MD5 9f2ca3154a8ea91071b9a46c0aea4c1d
SHA1 babb64a1e950d4a054e2ffd0341cc95e4d9b3e53
SHA512 72f0b0eabb7faa0b5f6ac9ae3b54212649fec4fd693939187be2c082b752166cf698873e204db858ca1ebd1024dfc85fde1b870cf1eb0928e12e768d69f989ff
SSDEEP 96:WFFUSZW3GGgkR2tGIND1kfFh3mT7Wrx/SInUw:KKSKUtfp1Oh3mTSN/j
TLSH
T131426CF432904324C24A2333FE549ADE72613D11DD706097B159EBAE6DF9A2C67708AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SW_Update_JPN.chm

Path C:\Program Files (x86)\Samsung\SW Update\Help\SW_Update_JPN.chm
Size 12KB
SHA256 b6bfd4032111c8c707fa7f21756eb81a47ef2b46e44c9683236ea42705a7cd54
MD5 76a81cf425795e6b1cee94710a08c890
SHA1 dbaeff5062c84443e1fdf9346de3acacbfebeb96
SHA512 99ca2e8aa62fe615f1806cc78c1cccfc9955acb047c1e6f559f3dde322f538ea5ea61719f78f6a36a691fce48bb67587784476688673409a5e335e549f567c1e
SSDEEP 96:pQoObkFhRUMhbBLRe1Cz2Su5hSMGPPzJpTvJrv8ojz1S1Rc6n:pQoWAUUBI1Cz2r3j6Pz3tv8ojzyK
TLSH
T1D1423B10FB688803C5284F767FD1905A9E862E91DD740593350BB6AD3DB3E4C6F618EA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SW_Update_KOR.chm

Path C:\Program Files (x86)\Samsung\SW Update\Help\SW_Update_KOR.chm
Size 12KB
SHA256 28a642455efe86daa5c79c53e725bce8c69a52c048bd6d273d6bb1ed405db8a2
MD5 1ab2f957e1770ce0e4eec666efb956e4
SHA1 ef8fce040c3c92233e15caff2b36f1d53bdfaa84
SHA512 35f1cdacf05bdc596160f448c597a65cfde532521a88e407830e72e079f4c98348bbf62a4aa7172dc180b88ba64627a3e249b8e83c27c21e905ed659c42e454e
SSDEEP 96:36cIwvw+bqlDoRXgCPoAyN4ZVurLL44E1bP3vp9wWflQpYR3:36aw+0DoBdP06WLL1EZP33lQp
TLSH
T18A526DB57741C305C0AB4373FE62D65EF4B2DC13E84607A1B144B516267FE292A389B4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SW_Update_NOR.chm

Path C:\Program Files (x86)\Samsung\SW Update\Help\SW_Update_NOR.chm
Size 12KB
SHA256 bde1c85416cf46ce12e45ada973382b48a5a210692a9dda3354df586537f41fc
MD5 96eecca90564af257cd656c136ff9e7b
SHA1 9f09f61d964d3049390ed9f5e91f6b3144e0d3a5
SHA512 0e1f387a7b84119b28da15912fce45800bfc409672abd3e444931839cd929a2f8b5d1d6f59f1f4531ad929a80662f0d771260a2f6466af6e1214070a60d7c1d6
SSDEEP 96:5wnSWWmsdvwb5/IuqwAsKoERv+EsuSlP5p5OjvLRte+fYaEum0:5wnSttwb5/jj2B+6SlRp5EvAI
TLSH
T1AB428E12F770021DE85951762F92924796317C41B678E143712B3B3A3E77E0C5AA09E7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SW_Update_POL.chm

Path C:\Program Files (x86)\Samsung\SW Update\Help\SW_Update_POL.chm
Size 12KB
SHA256 a5a2ee74b57e0ceaf5ee9f980b5c0962a784d246bdd004b33b315d7d30096ec7
MD5 42bc73c076c7c32a7b21febdc4608075
SHA1 386b838e5b76df2dcb620873e40873c50ff6f68b
SHA512 a2f43784fbbd0ab0c98a30429ea68c76b989e24852d5bf44b2d99ddf6b960a70eafda211dbdeb4208ed0e83a45da2e108dbd0a66ee886a183901e7e496b22f96
SSDEEP 96:AGvWs8Np7IxHZ/hl9zYOY/qZaV38alNO:AG7ANMZ/1YOlZksaT
TLSH
T1EF429D7073259934C5A2873BABCEAF8710447F5987A85512461D373C2DF9719CF70E86
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SW_Update_RUM.chm

Path C:\Program Files (x86)\Samsung\SW Update\Help\SW_Update_RUM.chm
Size 12KB
SHA256 badde0a20b681684154d2e7b58f50b1f695cd3b74f875322e0607961320641ad
MD5 4ffe9b3433fa038278459b4cb385d39d
SHA1 140495cc74beb63910c638d90d8741ae6e335509
SHA512 64390205362f78a22c46eec6e2146e173897ceb684f445270ff362055b6256933d63fb7ea50033484970538a98841cc250e06bf882c8085231fce4d77ba1eaa6
SSDEEP 96:9KyCMDlPF1Io3lqYMMbUfCac0hQYdXttHizs7NOkzdeP1KrB3M:9KyfhPF1IilqYMMbr0qYdttCzs7nqQ
TLSH
T121429E6132368722C9D04E34AFB16B45A3B26D673D3C6B5A723FB71A1AF940887304DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SW_Update_RUS.chm

Path C:\Program Files (x86)\Samsung\SW Update\Help\SW_Update_RUS.chm
Size 12KB
SHA256 8dd28725c67075ae1c2d41406343bd5777a644b2b826831d0b8eb489369a288b
MD5 81b75e63131b1b69bd22affabedd6ee2
SHA1 446efc3ee0183175f1f9e49f7f079dd87a406617
SHA512 8b264180454cff29c99334bb680ebd7620f87dfad851db0c8db9d347dfcb822c9c9dbe878aeeddc9daf6aebac65e89ba0c54917efc094b811f76ac153a97957b
SSDEEP 192:U9bzpGZfJ1GzO7ZzJW9+cVvNCc51AWfHZZRPK:U9bifCaF/c/CuHZZR
TLSH
T1A7529EE237124B32D249D4365AF9A7892C178F9EB7902157314AB74993B5F0637B18C3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SW_Update_SCC.chm

Path C:\Program Files (x86)\Samsung\SW Update\Help\SW_Update_SCC.chm
Size 12KB
SHA256 12b1d0401f1c81a0e251859348d1913d3474f789da451fd630e08a715395950e
MD5 b825941ae2044abf3bd3855a6372c427
SHA1 a7671851159344ab57b07cacfc2f68a747fe5aa6
SHA512 e7e11658e91daaa67ae67109cfe384035d88518f94100d8e0ae355dbe007e78cf4cfa3daf77655844be9b4cd59318e50652865207482b04dc947a994ed426066
SSDEEP 96:Bd8lvWOqkAzqJEvsLsJ0iagZeucb/2OxC+GkoroMYuQ7CG74u7Ql:BWNupvGsJ0oZze/2OwfVY974f
TLSH
T188426DA873485613C4E60B35B3A3A6177A227D04DEA156972009F23FB8F6C1D0FE88DC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SW_Update_SLV.chm

Path C:\Program Files (x86)\Samsung\SW Update\Help\SW_Update_SLV.chm
Size 12KB
SHA256 d28d5e3f3bd15a36af501fe580e3bf159039935fab9644d060e1af616736aa44
MD5 38e0cc1e160cf4a0c70b404351719644
SHA1 ed12b1f084974116fb829561a6fc9b1e184b9c35
SHA512 f1e51f010f4d393c922a517bde97f5dc85b7f53937f7b8530e3ac7299874800a138a284413e2f6d93800a9ee45d28971468c77174aa521b8e18567bd2f28bd71
SSDEEP 96:OEWWdCdmvdWE0TDjKgP9oZ5QosLslFtV+HasbRaMCdvaagNUJ:OEnCyqfDPU4sPtZMCkxUJ
TLSH
T1ED426CF032430335D7644A372F422144A759BDB69AF4565033A27B6E24B3B2EB33519F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SW_Update_SPA.chm

Path C:\Program Files (x86)\Samsung\SW Update\Help\SW_Update_SPA.chm
Size 12KB
SHA256 adf78f2ae5ae0d8eeaf8b4cf1c558ce8190dde3198e1e718102d98797acd2f55
MD5 a5c2183747be4a6cfba2c1359f4d7299
SHA1 0033c5073f7d3d4704b1d86175faea756aceb380
SHA512 fbd5e10ab22b2ee9b0c7840a553fd28944a3a3a9d202a1b9dfb204c352fb5334f58601fb908c29b80293f874529bf2f9fa6ea38d31948e3afea2b96318564e5a
SSDEEP 96:6BXlWfx7q5CMIWYV5AQUEQOoctVMWOn7uUkDbak8x7T5q/Q3hCoEH:6tKAkTWYV5AQUEQOoGVEk4lo
TLSH
T127424BF43A589B21E1948A3BAFCB5503B322BC62F93066177259730C2473F1C5B658D9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SW_Update_SWE.chm

Path C:\Program Files (x86)\Samsung\SW Update\Help\SW_Update_SWE.chm
Size 12KB
SHA256 9dc4e663a8f1eb276727b662f7e12780b705b9eb683addd6f3f3912b9159994a
MD5 f42ddb7f7e4a7cc44b9dbf07f36e8f37
SHA1 05cac8b3508ba1ea111c01077100678b7cfcbce5
SHA512 e033e9cd7e5aeb6bd52e1e1fc2b0da18bdb6e5c93f9f1e5fe39b6a9a0205961f864659acca3708ce159174aa084f7ed869a0e04293153b461750acb200ff97f3
SSDEEP 96:8uZeW0++AO/BGMcRbku5m7RZ44hV5Qk75yUORoHw/v5I9s6T:8uZ2SO/BGnw+m7XRhV5QAFGoQ/W9s
TLSH
T11B424CB427601307C48A6B71AB6A65C270753C07F940878E7163772E6E72D1E4F6C468
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SW_Update_THA.chm

Path C:\Program Files (x86)\Samsung\SW Update\Help\SW_Update_THA.chm
Size 12KB
SHA256 3b531362244dd1ab03cb32f2d19969dbdbb142fc1283fa80269791d420b7e721
MD5 0bcadde3239017157a34fae425d0499a
SHA1 adc8dbf0e323c7656eb65aa51f9fb280df77ef86
SHA512 29db62795ddba65d495817d48948fd24a85bb50e981aad89c05b65186186a37dbebbfec752f56a2e29ff04e85a6391f6803c3e8c2532a21c97ba6676a173ada5
SSDEEP 96:oivn6g9evzQrBE+TDRb+C3gGPnmdc1whjW4H9XpUZGToWjIjf0Ja:oi/6i/rBrN+hGjdm9XpfToEeMc
TLSH
T13A424C50324D8214C1D48D3A3ECD734E70226D91DB70A24B112DEB68E8B7B1D9B45AEF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SW_Update_TUR.chm

Path C:\Program Files (x86)\Samsung\SW Update\Help\SW_Update_TUR.chm
Size 12KB
SHA256 9ebeda2cffc1b3eb4ccfd4ccd0b26e725705405f94b5189ca758d5b18b62ceb3
MD5 aabf2533183d94d809586cfdd4f1624a
SHA1 a509bd048023344ef0209065203d0038b0b39532
SHA512 7bf880605d6513fc46ab09fe806be6f6cce51cf5500fe7839d69286c5781fddc925a8f985f0c5b9bb380db67e3cb525216c7b712a4eea82b192b1cec442ea4ca
SSDEEP 96:ej5SjOWK042M4b+hwKourMeuVQ4c6xGixpHaegpK2F0NoD/Z9/YeRTyhUd:eNczm4b+hlDkNxp6hZrWha
TLSH
T1E0426EE437164369E444657F1FDB750E66157F42CBA4A0088160FB2F157AD0C4BBEED1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SW_Update_UKR.chm

Path C:\Program Files (x86)\Samsung\SW Update\Help\SW_Update_UKR.chm
Size 13KB
SHA256 f14f22fb50bfdcc0925177f838708e7512ed7df8387dfc12179541cef15d9445
MD5 950c0228cdd5b7e77fb9c4652b42ddf5
SHA1 cdf32bb93006f0ea08b1c87977ecda9ae3dc27e2
SHA512 d1c702cdb3e69cb894af5767bd787acde1ca630d82d180d20e7ecedbf0a312cf588cfc6849473378e3f04638496838788decf85432810a16399ab98febca54df
SSDEEP 96:LKJ2ySWbWVrXFtIBCm56lQTiNlgVV+ND2Q0HYltDYVG5ZjM0w2kI7WpJU:LKJW4WdX/IB/klQTs12Q0mt8VKL7W
TLSH
T19A525BB5308E4605D67050BBBF4DF6C52431FD82FEA28A0E704EB77A3478A1C63219A6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SW_Update_UZB.chm

Path C:\Program Files (x86)\Samsung\SW Update\Help\SW_Update_UZB.chm
Size 12KB
SHA256 ef4f4946f59708cfb39a95ddc94d3ecc65b188a0660e7f0d8268585ba8bfcce3
MD5 409772699f707ff40ab616eb091a143c
SHA1 e172c11214336c320f91a226e1d82ad12688b1b7
SHA512 e0d1926e6839cb44246b4705a40750ed371d6415ba28239c439b8a2d516ee628a2f720e764391ed2042659975356e90967c7074c0d532293dcad5b14f84e7298
SSDEEP 96:pLCZGWqGX8g1HQYMMwZSZBROplixQzTDZameA3knxfH9n:pe8Gv6nMlxQHVaEEph
TLSH
T14A426D7972748212C43ED3360BF396CA56B27C41566851CA31097E5DA4BBD0F1F3F929
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

InstallationPathWriter.exe

Path C:\Program Files (x86)\Samsung\SW Update\InstallationPathWriter.exe
Size 75KB
SHA256 5a615f3fc99eba65f204b4e3fc612e980e2d2a8a49458c42d2b5a21d68a01f4f
MD5 e9fea2b6eec45d9bc0469706a8e8c4f8
SHA1 7dc4d6331f2158a0cf17d3c3a066ab17d8918884
SHA512 090af2d4a33146736ecdae722fd3cdcf2b4c4c835c08490f2403945043a69b23094cc7c141f7f047b7ce0151efc8c9801623bd26140b8cc3b1e4974492e96895
SSDEEP 1536:aQ0RGh9LUCU1+m7KTXbkk3/pMfPdsaORZOR4t:a3REREUX/pMfPdsfRsR4t
TLSH
T1A8737C237AA0C077E493093049B4C2666E3F797257B984CB779803BA5FE17C01A7936B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

License.txt

Path C:\Program Files (x86)\Samsung\SW Update\License.txt
Size 50KB
SHA256 9760f0ffaaae399a23bc81f8d6fa1daa97d48b811ef7eafbe0d14629521c06a3
MD5 006571f77bb55a73d2f9c63b25b87572
SHA1 b0857791fc8552bbb979cd7785584013d5bdc5b2
SHA512 575044f65ed45e71daafc194d769034e5c5447621334107e57c1485a8e91f3731da251d50dda38f97026553e761f3a71efb1efb76f29aa0b9df7c6ab7767631b
SSDEEP 768:3pNQNZFOUet4bYfRY26WgruJaCK4caF7Vwe/8f7DHWnkN5Y39BDImkPrXQfXA:3EIUet4bYfjT5pC/hvzQfXA
TLSH
T1C1333651A3FE5608F6FB3F546AB556684A37BC96AD3DC24C1198105E0BB3E80CD60B73
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SWMSetupCustomAction.dll

Path C:\Program Files (x86)\Samsung\SW Update\SWMSetupCustomAction.dll
Size 1.8MB
SHA256 6729e1ce26ecfe2d85b87eefb8609ad2618bfb15bbbfe3e89cf63eae9be79a06
MD5 e1e0468d5b444b9de062f1bcaf26c41d
SHA1 0d19c151081c28731d5df1c2b0564e4585d81e59
SHA512 0de85c184e418d01d587d1cd5527fa85bafb18b2dcd172a8985d20ade106bdfbc85a0457d77d9a954e5a954de95aef85879f7f457502abe0f01faea0370180ad
SSDEEP 49152:plM9YhoYw1hh69F0GLVCnicVWXSFo2qMc4cxr53/NITWlCl3:pyYhoYwnh80GLGiuWX+AFXxt3/NIS0
TLSH
T1B3959D2379C5807FC56B0331991DB72C62EEA5B00A39D28766E9DF3D6D70842E638763
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SWM_ChangeShortcutToChinese.exe

Path C:\Program Files (x86)\Samsung\SW Update\SWM_ChangeShortcutToChinese.exe
Size 1.9MB
SHA256 5776cc80708252224fecb256b8f7ca0f70d900f1ca3e5793327d4b2798ba9e19
MD5 71084c704237e66d952487a7380dd224
SHA1 1cce7f1e06959180cf2da187ab5bb61dd5fa743c
SHA512 c6f8889f2fc629d132988b2ae131e582df13d2b1c086efdb416a6d88af53bb36ded37faf619c30690575c45050c5a7cf157f55fa7ef223d4f74467b7d0ab4bd3
SSDEEP 49152:o19w9GlCCq5pZRSYj4+MOvhY3NFo5ShMJxx4Je9IcOEmY+LqT:oEQCC0pZRSYUPOaXo5SuJxx0e9IcOEH
TLSH
T1C5959F3235D29077D67327318A8D7368A2ADB7704B35425723E91F2D2DB0582EE39A73
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SecSWMgrGuide.exe

Path C:\Program Files (x86)\Samsung\SW Update\SecSWMgrGuide.exe
Size 2.7MB
SHA256 0345439e6ef25c0b36eff736ee8060b723d56869e1c612b4efb7b01b137599c1
MD5 38f36d0b7526f61b5ea927b7f642a8d7
SHA1 9e6f568b8693f6c929308f75ab794a65e122e1bc
SHA512 41142b137cb2362b696657ee0d5a13f40aa61dfaec38af8339335de3692074451aa8b9a541934ff8c08a6f1a359e0cee9b0244cfff46a70db794d87cf7e89962
SSDEEP 49152:KZ066M4+AF1Y1YPpGDaeHRjBBp4AxcN6YxASzf3fcknCRcKdlZDnOYfbD19:m8n+AF1YYpheHRjBb4AxcNBzfvcknCrp
TLSH
T140D58E1337E54069F5B33B3449F992B4977BBD609939815F02E02A6E28F09539B383B7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SetupLogCollector.exe

Path C:\Program Files (x86)\Samsung\SW Update\SetupLogCollector.exe
Size 1.8MB
SHA256 668c64459beb663916fe5e940b4b6f1a2c916df5446c7487ca34eb233a269d48
MD5 20dafb917e63c4ff7ed8ce4ebb11dcad
SHA1 79b67f3eab5f9c8e778d5657ca2eae0236b05d87
SHA512 947774900204c760241e90c6ce38d09f6883caa47208e316fd93b3a7f27aa18c62895ca1ece7b9cfb971ba1261ea4755b7a1299970c6937dd83810c7a8f530eb
SSDEEP 49152:ELKpF8udK0IqsIrLl/4I6ssTQrdEw8HzDMBEiopWVcU:zwu80IgrLlwI6sKCdEw8HzDMBEiopWD
TLSH
T1BD959D32F9D0D076C92303359A4EB32DB6EDF6B11B36524722951E7D2D70492AB386B3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sManager.ico

Path C:\Program Files (x86)\Samsung\SW Update\sManager.ico
Size 269KB
SHA256 b3b02831d15640c83efb7a20e045deacb55a0573609f7ffb18b50b2e7083cd89
MD5 de8871fd5f27e83cb255da1ae3f84c01
SHA1 a4cb1157df8314e1d1f9b19c4c1d6298762b86a1
SHA512 cda4a5bd25424bc62417f47a8942ee464f00cc9b80c32fbe54e188fc638f3963af7ddec83a9f82cd5bd9299c15668877bddf32a2bcf1d8940a974f5716398fdc
SSDEEP 6144:ITtDdn9zN/ev4H34chKVEPGA1P1k43zlERGfKzzVAcj:ybn9JT3CW19kgGNXVAq
TLSH
T18644BF22B0068012D9D8E7F4458EDF7361549DBDEA803C0E35E9BB5E2CF1B6786295CE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sManager.lang

Path C:\Program Files (x86)\Samsung\SW Update\sManager.lang
Size 1.5MB
SHA256 f413cca2b7ba07f3ee8df64bcc2fc5da4893ab05ec65dc37519fb37f128c1b32
MD5 8a517e617a27414d2dbba24af2869683
SHA1 a3f15da9efdaab524c6c36a6f9cc0eac3466f9d1
SHA512 7c4121918c11e24808c9b17899784a3cd3f1eb72b9c17d658c10bebad92e6f567b4973606324e63125993a8650656f4b06a1691932da877c598a8064e47ac7ca
SSDEEP 3072:BdXFZNlVnTWKdCTQKV+LjKrIaygmkneBsJw14gZJ9S94ncHaDkrHMfHSlz+S1ymG:hvK1945N32q/5rBxFZrty2wL48aXxpbF
TLSH
T17C658A0272FD6029B6B37B51DFB8C5B94727BDE4A97ACE5F0191104B09E0950BB623B3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

symsrv.dll

Path C:\Program Files\Common Files\System\symsrv.dll
Size 67KB
SHA256 de055a89de246e629a8694bde18af2b1605e4b9b493c7e4aef669dd67acf5085
MD5 7574cf2c64f35161ab1292e2f532aabf
SHA1 14ba3fa927a06224dfe587014299e834def4644f
SHA512 4db19f2d8d5bc1c7bbb812d3fa9c43b80fa22140b346d2760f090b73aed8a5177edb4bddc647a6ebd5a2db8565be5a1a36a602b0d759e38540d9a584ba5896ab
SSDEEP 1536:YjV8y93KQpFQmPLRk7G50zy/riF12jvRyo0hQk7ZL:c8y93KQjy7G55riF1cMo03V
TLSH
T17863F1372AB5807DDD210D37949F835AB771E5A76C20643FC25907D988B8DD0E3239AE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SWMAgent.exe

Path C:\ProgramData\Samsung\SW Update Service\SWMAgent.exe
Size 3.1MB
SHA256 2a0077d8369d45f906080935cfe9bfc40980c349ff3da02d9d3e67ed502f8a2d
MD5 e4eeafe4b5f3d852f2fa43a6274d47cc
SHA1 7f2076f1b4e275d35b5276107589506509ae7ebe
SHA512 345abffe0a27a4c33fb79ec98d5548d52374ba7159215b8e8c6fde4ef5a33d1467791117b3638240698883320f5fe608d2255fd75c858394e49d785a31062180
SSDEEP 98304:d+72cDUDooz/Jod3B6iDE+CUg1tKV8zCBIGVSU:c72PnaEvm8zCBISSU
TLSH
T1FCE5BF2276C48037D56303324ABCB3AA65BDBB70273991DB52D91E5C1E704D2AA39F73
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SWMFileDownloadUtil.exe

Path C:\ProgramData\Samsung\SW Update Service\SWMFileDownloadUtil.exe
Size 1.8MB
SHA256 214bcb4419438cb04298e54fad3fad44f21ce105667bb2d6ae27140d2814c0c7
MD5 338008a767e8030e0c74439a625bf4bb
SHA1 7f02eb0e845565a793d82a97c82145107caf7b15
SHA512 403a6b351df04852ac92d1f0d5c2ef1021b8d1811e5eef3a1cd8a33915bb748fed3f11bb433c0517670daf17616b12e72b168dd4cf64348e338c090e49c00f88
SSDEEP 49152:Sa8nXrl9cjFAhkHD1v6ieV90U1npwnwSdZTeTx5Em8jZpmvxP:SxXrrcjehK1v9eV9JlqwmZTeTx5Em8jZ
TLSH
T13F858D32F6A190BAC53313719F5D7328B6ADB7704A36525733D91E3D2EB04836A2C663
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SWMLauncher.exe

Path C:\ProgramData\Samsung\SW Update Service\SWMLauncher.exe
Size 22KB
SHA256 86660c0d5d128cead911ded09e85331d51fcab1321691377e9c651ba0a11b201
MD5 6663ae167cfe964c86ccb05118f45b22
SHA1 2bdf757ba39695170d04ee8f4c620d82d59ac808
SHA512 7ce528f58e806f791338f4d20d9442ad66d0e82af51816f95a97fdbb6dbd50f9abf52bea2a627cf6362e4727550cd26d8f087a809945ab8960884e402c63eef3
SSDEEP 384:W0zQSoF0tNWGiEpDqCzEE9nYPLZ41U3RkI9vTiR41U3RfPy0expM:ElF0tNWGipCzEE91ORkI9eKORoxy
TLSH
T171B24CC72F1A6063FBC3CC7165E5D21A9D76B2E1EBA818D774A892411ED07D12E7D00E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SWUInterfaceLauncher.exe

Path C:\ProgramData\Samsung\SW Update Service\SWUInterfaceLauncher.exe
Size 2.1MB
SHA256 783a00ee4745afec6c3f2c8e3c3d19239c5b4f7fde16ab122c9a04fbe1223814
MD5 30cb01817c1a2e2332729d865143b73a
SHA1 f89fcfefb99db137d75fddcc5a880f9e4f38170f
SHA512 1882326672cabdff5f895fd7fb1ac1d989090cc252be95bedd09f2099f7177bb382932e0783e78135afb850098a59df4ae145eb8bcd501c82bb82b4a50908908
SSDEEP 49152:kkqlIVvyS2o6d2qj4fT3pokyxu/bXRxzoy3jEiP1HDnOof1A+:7xVvP2o6d2qj47pokyGbXRxzoy3jEiPj
TLSH
T160A5AE32F4A09076C52317309B4EB768B2BDBF705A75225723D43F2D6DB0493A62C6A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SWUpdateIF.dll

Path C:\ProgramData\Samsung\SW Update Service\SWUpdateIF.dll
Size 3.0MB
SHA256 4efbe1b0b77d091eed584f0a555111a382dbeea19f331e57c5bcc8b71079849e
MD5 3e8b699c83b386d1ad17e57d5d51da87
SHA1 952ac4b3844461530a73c70696fe16bde9596de8
SHA512 1bc66bd000e5818d302419e3ff153bd93add4474fad892695bea9530e05fa81118a5346e18ebf33d1802e8f2383c3ccc7d1f391e78791197fc0a42b3bfdbdc40
SSDEEP 98304:0TS1Qp9YPEnmScnCVwKh4FFd5cyHnVcZ9W3Lt:0TSUmf97znVcZ9W
TLSH
T115E58D3276D48036F0AB1231AA7DB36D62BEB6B1573545CB62C81E5D2E704C2B635F23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ShortcutResource.dll

Path C:\ProgramData\Samsung\SW Update Service\ShortcutResource.dll
Size 1.8MB
SHA256 dbfe99b74f67463f169600fa47d1b45ebf1d29330931671fa904605591f93d9c
MD5 1d69ced149937958d5c868e0f8d8aece
SHA1 95df58a55d851daaa8a9a638c51e7efb153e7273
SHA512 370e8b27856a4cb5d357e5fb3da8499dfd364e36477f2445643ddb8d1e4d3c25954e5b0555168f9cb529ab79151a4666dc229a5fe375ea719489cc7573214978
SSDEEP 24576:6DnzCorw+mCAiKbpQzE188BrGk0R+v7qDyC5ScUbiBRTPVT1UZUH:6DnOofmCATezrUrGZq7GJJUbszVpXH
TLSH
T18D958C1EB0068053C998A7F4094ADB7252665D7CE9C0780E35DDBBFE28B1A378D3A5CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sManagerSetup.msi

Path C:\ProgramData\Samsung\SWUpdate\Temp\sManagerSetup.msi
Size 17.2MB
SHA256 14df2c25345461f450bdc1c05f7f59c226d1176b7877a30066a4af1ad6c5fcaf
MD5 94ea788e50d50b87ca7c23d85cee08d8
SHA1 5f9a09911d7c310b41ace676076e01238d1329ea
SHA512 377258813e81c77ffbaa500879cb6497164aebcdd0a1f6fb099d857bc2974c5b0996d77fbaf9a1b933b9c94f7309f9e4b08d9c151f94b95093666c8e1d10aaff
SSDEEP 393216:uToT8E71MBUb9igdAMclcVrYXmmU9hWDV0gIoCP0YJrqD/sK7bsKa7yb:uU4BUb91d5KcC4Yrs1+/f7TaW
TLSH
T12507332234498137E4D657B205AFE73556BE3CB0DC601C0F2295BB5E38B26D2AA385DF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSI6807.tmp

Path C:\Users\Admin\AppData\Local\Temp\MSI6807.tmp
Size 305KB
SHA256 adf737e044c8125286b7f0c2907597d840ca6f3dc92e8cb56a5bc20243c723d4
MD5 79a1dc3e058699630f44eaef8736d637
SHA1 cdaa694b65dd49d726e2ef676749351adf97165a
SHA512 16db5d41c07e568c7cba18d5dc2cf2f566b0f1059256574cec69b00796850fc2e5a8c12e5b27e0547817b204db5a9532f893f42ab4f3c5c165a2e654e17a0605
SSDEEP 6144:0yLkWwBZipXl1P0oQf5uHfkmcn7RIUFKaEmTOMIC8PhmzeKN3sqt:L4xEXlQUAZKaEmTO9sDb
TLSH
T113647D1176B4C433F4B3067115B9A6263A7DB4306E70CE8F2394267A6D712D1BB28B7B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1556-22-0x0000000010000000-0x0000000010030000-memory.dmp

Download

memory/1556-21-0x0000000000C00000-0x00000000026BF000-memory.dmp

Download

memory/1556-4-0x0000000010000000-0x0000000010030000-memory.dmp

Download

memory/1556-189-0x0000000010000000-0x0000000010030000-memory.dmp

Download

memory/1556-188-0x0000000000C00000-0x00000000026BF000-memory.dmp

Download