floxif | 05f99e8813228d9512295a8210ed2734909e56db3f63b54f881e05363a8fa4e1

Analysis

max time kernel
149s
max time network
145s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
09/08/2026, 05:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-09_bd5e45b5c18b3dbf6a5b37d3892d2ae6_bkransomware_darkgate_elex_floxif_maze.exe
Size 26.8MB
Sample260809-fm56dagg59
SHA256 05f99e8813228d9512295a8210ed2734909e56db3f63b54f881e05363a8fa4e1
MD5 bd5e45b5c18b3dbf6a5b37d3892d2ae6
SHA1 a82b2de9fce57026c7300eea399e1a42c6f629fa
SHA512 de85a6a38b1e80da2fb327d1ba022bb5dc95a5b503b90d6f23c35b008d210f30441048e4866e4930a1a2b96e63536db033dea71d4b73d669ac2050a210254429
SSDEEP 786432:vzDKXRZuaQymzhik+/8ZBJGdCCiY5SIiRJ:vzDKBZuFJ1iOCi79J
TLSH
T1E557333276E180B7D83326319ADD736871ADBE718935016722D63E3E1DF0492A53DAA3
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

backdoor defense_evasion discovery floxif ransomware trojan upx

Malware Config

Signatures

Family: Floxif, Floodfix
Floxif aka FloodFix is a file-changing trojan and backdoor written in C++.
backdoor trojan floxif

Detects Floxif payload 1 IoCs

backdoor

resource	yara_rule
behavioral1/files/0x000800000002448e-1.dat	floxif

UPX dump on OEP (original entry point) 7 IoCs

resource	yara_rule
behavioral1/files/0x000800000002448e-1.dat	UPX
behavioral1/memory/4564-4-0x0000000010000000-0x0000000010030000-memory.dmp	UPX
behavioral1/memory/4564-22-0x0000000010000000-0x0000000010030000-memory.dmp	UPX
behavioral1/memory/4564-35-0x0000000010000000-0x0000000010030000-memory.dmp	UPX
behavioral1/memory/4564-52-0x0000000010000000-0x0000000010030000-memory.dmp	UPX
behavioral1/memory/4564-70-0x0000000010000000-0x0000000010030000-memory.dmp	UPX
behavioral1/memory/4564-216-0x0000000010000000-0x0000000010030000-memory.dmp	UPX

ACProtect 1.3x - 1.4x DLL software 1 IoCs

Detects file using ACProtect software.

resource	yara_rule
behavioral1/files/0x000800000002448e-1.dat	acprotect

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\Control Panel\International\Geo\Nation	2026-08-09_bd5e45b5c18b3dbf6a5b37d3892d2ae6_bkransomware_darkgate_elex_floxif_maze.exe

Executes dropped EXE 3 IoCs

pid	Process
4008	InstallationPathWriter.exe
4864	SWMAgent.exe
4816	sAgentSetup.exe

Loads dropped DLL 9 IoCs

pid	Process
4564	2026-08-09_bd5e45b5c18b3dbf6a5b37d3892d2ae6_bkransomware_darkgate_elex_floxif_maze.exe
5104	MsiExec.exe
5104	MsiExec.exe
3764	MsiExec.exe
3764	MsiExec.exe
2564	MsiExec.exe
2564	MsiExec.exe
2564	MsiExec.exe
4564	2026-08-09_bd5e45b5c18b3dbf6a5b37d3892d2ae6_bkransomware_darkgate_elex_floxif_maze.exe

Badlisted process makes network request 6 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
8	3724	msiexec.exe
13	3724	msiexec.exe
15	3724	msiexec.exe
17	3724	msiexec.exe
28	3404	msiexec.exe
29	3404	msiexec.exe

Enumerates connected drives 3 TTPs 47 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\e:	2026-08-09_bd5e45b5c18b3dbf6a5b37d3892d2ae6_bkransomware_darkgate_elex_floxif_maze.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe

UPX packed file 7 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x000800000002448e-1.dat	upx
behavioral1/memory/4564-4-0x0000000010000000-0x0000000010030000-memory.dmp	upx
behavioral1/memory/4564-22-0x0000000010000000-0x0000000010030000-memory.dmp	upx
behavioral1/memory/4564-35-0x0000000010000000-0x0000000010030000-memory.dmp	upx
behavioral1/memory/4564-52-0x0000000010000000-0x0000000010030000-memory.dmp	upx
behavioral1/memory/4564-70-0x0000000010000000-0x0000000010030000-memory.dmp	upx
behavioral1/memory/4564-216-0x0000000010000000-0x0000000010030000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Samsung\SW Update\Help\SW_Update_GRE.chm	msiexec.exe
File opened for modification	C:\Program Files (x86)\Samsung\SW Update\Help\SW_Update_ITA.chm	msiexec.exe
File opened for modification	C:\Program Files (x86)\Samsung\SW Update\Help\SW_Update_MAY.chm	msiexec.exe
File opened for modification	C:\Program Files (x86)\Samsung\SW Update\Help\SW_Update_AZE.chm	msiexec.exe
File opened for modification	C:\Program Files (x86)\Samsung\SW Update\sManager.lang	msiexec.exe
File opened for modification	C:\Program Files (x86)\Samsung\SW Update\SecSWMgrGuide.exe	msiexec.exe
File opened for modification	C:\Program Files (x86)\Samsung\SW Update\Help\SW_Update_CHT-TW.chm	msiexec.exe
File opened for modification	C:\Program Files (x86)\Samsung\SW Update\Help\SW_Update_KOR.chm	msiexec.exe
File opened for modification	C:\Program Files (x86)\Samsung\SW Update\Help\SW_Update_HEB.chm	msiexec.exe
File created	C:\Program Files (x86)\Samsung\SW Update\Help\SW_Update_ENG.chm	msiexec.exe
File created	C:\Program Files (x86)\Samsung\SW Update\Help\SW_Update_VIE.chm	msiexec.exe
File created	C:\Program Files (x86)\Samsung\SW Update\Help\SW_Update_SCC.chm	msiexec.exe
File opened for modification	C:\Program Files (x86)\Samsung\SW Update\Help\SW_Update_SPA.chm	msiexec.exe
File opened for modification	C:\Program Files (x86)\Samsung\SW Update\sManager.ico	msiexec.exe
File opened for modification	C:\Program Files (x86)\Samsung\SW Update\SWM_ChangeShortcutToChinese.exe	msiexec.exe
File opened for modification	C:\Program Files (x86)\Samsung\SW Update\Help\SW_Update_UKR.chm	msiexec.exe
File opened for modification	C:\Program Files (x86)\Samsung\SW Update\Help\SW_Update_SWE.chm	msiexec.exe
File created	C:\Program Files (x86)\Samsung\SW Update\Help\SW_Update_CZE.chm	msiexec.exe
File created	C:\Program Files (x86)\Samsung\SW Update\Help\SW_Update_FIN.chm	msiexec.exe
File created	C:\Program Files (x86)\Samsung\SW Update\Help\SW_Update_BUL.chm	msiexec.exe
File created	C:\Program Files (x86)\Samsung\SW Update\SecSWMgrGuide.exe	msiexec.exe
File created	C:\Program Files (x86)\Samsung\SW Update\Help\SW_Update_KOR.chm	msiexec.exe
File created	C:\Program Files (x86)\Samsung\SW Update\Help\SW_Update_HEB.chm	msiexec.exe
File opened for modification	C:\Program Files (x86)\Samsung\SW Update\Help\SW_Update_POL.chm	msiexec.exe
File opened for modification	C:\Program Files (x86)\Samsung\SW Update\Help\SW_Update_DAN.chm	msiexec.exe
File created	C:\Program Files (x86)\Samsung\SW Update\Help\SW_Update_CHS.chm	msiexec.exe
File opened for modification	C:\Program Files (x86)\Samsung\SW Update\Help\SW_Update_KAZ.chm	msiexec.exe
File opened for modification	C:\Program Files (x86)\Samsung\SW Update\InstallationPathWriter.exe	msiexec.exe
File opened for modification	C:\Program Files (x86)\Samsung\SW Update\Help\SW_Update_SPA-MX.chm	msiexec.exe
File opened for modification	C:\Program Files (x86)\Samsung\SW Update\Help\SW_Update_SLO.chm	msiexec.exe
File opened for modification	C:\Program Files (x86)\Samsung\SW Update\Help\SW_Update_HIN.chm	msiexec.exe
File created	C:\Program Files\Common Files\System\symsrv.dll	2026-08-09_bd5e45b5c18b3dbf6a5b37d3892d2ae6_bkransomware_darkgate_elex_floxif_maze.exe
File created	C:\Program Files (x86)\Samsung\SW Update\Help\SW_Update_MAY.chm	msiexec.exe
File created	C:\Program Files (x86)\Samsung\SW Update\SetupLogCollector.exe	msiexec.exe
File created	C:\Program Files (x86)\Samsung\SW Update\SWM_ChangeShortcutToChinese.exe	msiexec.exe
File created	C:\Program Files (x86)\Samsung\SW Update\Help\SW_Update_RUM.chm	msiexec.exe
File opened for modification	C:\Program Files (x86)\Samsung\SW Update\Help\SW_Update_FRE.chm	msiexec.exe
File opened for modification	C:\Program Files (x86)\Samsung\SW Update\Help\SW_Update_VIE.chm	msiexec.exe
File opened for modification	C:\Program Files (x86)\Samsung\SW Update\Help\SW_Update_SCC.chm	msiexec.exe
File created	C:\Program Files (x86)\Samsung\SW Update\Help\SW_Update_GER.chm	msiexec.exe
File created	C:\Program Files (x86)\Samsung\SW Update\Help\SW_Update_DAN.chm	msiexec.exe
File created	C:\Program Files (x86)\Samsung\SW Update\Help\SW_Update_CHT-TW.chm	msiexec.exe
File opened for modification	C:\Program Files (x86)\Samsung\SW Update\Help\SW_Update_POR.chm	msiexec.exe
File opened for modification	C:\Program Files (x86)\Samsung\SW Update\Help\SW_Update_SCR.chm	msiexec.exe
File created	C:\Program Files (x86)\Samsung\SW Update\Help\SW_Update_TUR.chm	msiexec.exe
File created	C:\Program Files (x86)\Samsung\SW Update\Help\SW_Update_THA.chm	msiexec.exe
File created	C:\Program Files (x86)\Samsung\SW Update\Help\SW_Update_UZB.chm	msiexec.exe
File created	C:\Program Files (x86)\Samsung\SW Update\sManager.exe	msiexec.exe
File opened for modification	C:\Program Files (x86)\Samsung\SW Update\Help\SW_Update_HUN.chm	msiexec.exe
File opened for modification	C:\Program Files (x86)\Samsung\SW Update\Help\SW_Update_UZB.chm	msiexec.exe
File opened for modification	C:\Program Files (x86)\Samsung\SW Update\Help\SW_Update_BUL.chm	msiexec.exe
File opened for modification	C:\Program Files (x86)\Samsung\SW Update\Help\SW_Update_IND.chm	msiexec.exe
File created	C:\Program Files (x86)\Samsung\SW Update\Help\SW_Update_BRA.chm	msiexec.exe
File opened for modification	C:\Program Files (x86)\Samsung\SW Update\Help\SW_Update_GER.chm	msiexec.exe
File opened for modification	C:\Program Files (x86)\Samsung\SW Update\Help\SW_Update_BRA.chm	msiexec.exe
File opened for modification	C:\Program Files (x86)\Samsung\SW Update\License.txt	msiexec.exe
File opened for modification	C:\Program Files (x86)\Samsung\SW Update\Help\SW_Update_CHS.chm	msiexec.exe
File created	C:\Program Files (x86)\Samsung\SW Update\Help\SW_Update_CHT-HK.chm	msiexec.exe
File created	C:\Program Files (x86)\Samsung\SW Update\Help\SW_Update_GRE.chm	msiexec.exe
File created	C:\Program Files (x86)\Samsung\SW Update\Help\SW_Update_ITA.chm	msiexec.exe
File created	C:\Program Files (x86)\Samsung\SW Update\License.txt	msiexec.exe
File opened for modification	C:\Program Files (x86)\Samsung\SW Update\Help\SW_Update_ARA.chm	msiexec.exe
File opened for modification	C:\Program Files (x86)\Samsung\SW Update\sManager.exe	msiexec.exe
File created	C:\Program Files (x86)\Samsung\SW Update\Help\SW_Update_AZE.chm	msiexec.exe

Drops file in Windows directory 14 IoCs

description	ioc	Process
File created	C:\Windows\Installer\{0CAAEAAE-5401-4FFA-88BC-EB6F89947DC4}\_853F67D554F05449430E7E.exe	msiexec.exe
File created	C:\Windows\Installer\{0CAAEAAE-5401-4FFA-88BC-EB6F89947DC4}\_9A897177992B19BE48FA33.exe	msiexec.exe
File opened for modification	C:\Windows\Installer\{0CAAEAAE-5401-4FFA-88BC-EB6F89947DC4}\_9A897177992B19BE48FA33.exe	msiexec.exe
File created	C:\Windows\Installer\e589239.msi	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIC148.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File opened for modification	C:\Windows\Installer\{0CAAEAAE-5401-4FFA-88BC-EB6F89947DC4}\_853F67D554F05449430E7E.exe	msiexec.exe
File created	C:\Windows\Installer\e58923b.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\e589239.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIC05D.tmp	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File created	C:\Windows\Installer\SourceHash{0CAAEAAE-5401-4FFA-88BC-EB6F89947DC4}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIC31E.tmp	msiexec.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 15 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	InstallationPathWriter.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sAgentSetup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-09_bd5e45b5c18b3dbf6a5b37d3892d2ae6_bkransomware_darkgate_elex_floxif_maze.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SWMAgent.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msiexec.exe

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000499bfc0d34bfe76b0000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff000000002701010000080000499bfc0d0000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed35000000ffffffff000000000700010000680900499bfc0d000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff350000000000000005000000ffffffff000000000700010000f8ff1a499bfc0d000000000000f0ff350000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1d499bfc0d000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe

Kills process with taskkill 6 IoCs

defense_evasion

pid	Process
2748	taskkill.exe
1344	taskkill.exe
2372	taskkill.exe
2452	taskkill.exe
3772	taskkill.exe
2696	taskkill.exe

Modifies data under HKEY_USERS 8 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	MsiExec.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	MsiExec.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	MsiExec.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	MsiExec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\27\52C64B7E	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	MsiExec.exe

Modifies registry class 23 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\EAAEAAC01045AFF488CBBEF69849D74C\Version = "33685555"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\EAAEAAC01045AFF488CBBEF69849D74C\ProductIcon = "C:\\Windows\\Installer\\{0CAAEAAE-5401-4FFA-88BC-EB6F89947DC4}\\_853F67D554F05449430E7E.exe"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\EAAEAAC01045AFF488CBBEF69849D74C\InstanceType = "0"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\EAAEAAC01045AFF488CBBEF69849D74C\DeploymentFlags = "3"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\EAAEAAC01045AFF488CBBEF69849D74C\SourceList\Media\1 = ";"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\EAAEAAC01045AFF488CBBEF69849D74C	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\EAAEAAC01045AFF488CBBEF69849D74C\ProductName = "Samsung Update"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\EAAEAAC01045AFF488CBBEF69849D74C\AdvertiseFlags = "388"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\BF3805105D8948C4D93B598B404C92A9	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\EAAEAAC01045AFF488CBBEF69849D74C\SourceList	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\EAAEAAC01045AFF488CBBEF69849D74C\SourceList\LastUsedSource = "n;1;C:\\ProgramData\\Samsung\\SWUpdate\\Temp\\"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\EAAEAAC01045AFF488CBBEF69849D74C\DefaultFeature	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\EAAEAAC01045AFF488CBBEF69849D74C\AuthorizedLUAApp = "0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\BF3805105D8948C4D93B598B404C92A9\EAAEAAC01045AFF488CBBEF69849D74C	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\EAAEAAC01045AFF488CBBEF69849D74C\SourceList\PackageName = "sManagerSetup.msi"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\EAAEAAC01045AFF488CBBEF69849D74C\SourceList\Net	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\EAAEAAC01045AFF488CBBEF69849D74C\SourceList\Net\1 = "C:\\ProgramData\\Samsung\\SWUpdate\\Temp\\"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\EAAEAAC01045AFF488CBBEF69849D74C\SourceList\Media	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\EAAEAAC01045AFF488CBBEF69849D74C\Clients = 3a0000000000	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\EAAEAAC01045AFF488CBBEF69849D74C	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\EAAEAAC01045AFF488CBBEF69849D74C\Language = "1033"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\EAAEAAC01045AFF488CBBEF69849D74C\Assignment = "1"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\EAAEAAC01045AFF488CBBEF69849D74C\PackageCode = "C72DF840951E1824DAD1E9D61A3DD7FA"	msiexec.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4564	2026-08-09_bd5e45b5c18b3dbf6a5b37d3892d2ae6_bkransomware_darkgate_elex_floxif_maze.exe
4564	2026-08-09_bd5e45b5c18b3dbf6a5b37d3892d2ae6_bkransomware_darkgate_elex_floxif_maze.exe
3404	msiexec.exe
3404	msiexec.exe
2564	MsiExec.exe
2564	MsiExec.exe
2564	MsiExec.exe
2564	MsiExec.exe
4564	2026-08-09_bd5e45b5c18b3dbf6a5b37d3892d2ae6_bkransomware_darkgate_elex_floxif_maze.exe
4564	2026-08-09_bd5e45b5c18b3dbf6a5b37d3892d2ae6_bkransomware_darkgate_elex_floxif_maze.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	4564	2026-08-09_bd5e45b5c18b3dbf6a5b37d3892d2ae6_bkransomware_darkgate_elex_floxif_maze.exe
Token: SeDebugPrivilege	3772	taskkill.exe
Token: SeDebugPrivilege	2696	taskkill.exe
Token: SeShutdownPrivilege	3724	msiexec.exe
Token: SeIncreaseQuotaPrivilege	3724	msiexec.exe
Token: SeSecurityPrivilege	3404	msiexec.exe
Token: SeCreateTokenPrivilege	3724	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	3724	msiexec.exe
Token: SeLockMemoryPrivilege	3724	msiexec.exe
Token: SeIncreaseQuotaPrivilege	3724	msiexec.exe
Token: SeMachineAccountPrivilege	3724	msiexec.exe
Token: SeTcbPrivilege	3724	msiexec.exe
Token: SeSecurityPrivilege	3724	msiexec.exe
Token: SeTakeOwnershipPrivilege	3724	msiexec.exe
Token: SeLoadDriverPrivilege	3724	msiexec.exe
Token: SeSystemProfilePrivilege	3724	msiexec.exe
Token: SeSystemtimePrivilege	3724	msiexec.exe
Token: SeProfSingleProcessPrivilege	3724	msiexec.exe
Token: SeIncBasePriorityPrivilege	3724	msiexec.exe
Token: SeCreatePagefilePrivilege	3724	msiexec.exe
Token: SeCreatePermanentPrivilege	3724	msiexec.exe
Token: SeBackupPrivilege	3724	msiexec.exe
Token: SeRestorePrivilege	3724	msiexec.exe
Token: SeShutdownPrivilege	3724	msiexec.exe
Token: SeDebugPrivilege	3724	msiexec.exe
Token: SeAuditPrivilege	3724	msiexec.exe
Token: SeSystemEnvironmentPrivilege	3724	msiexec.exe
Token: SeChangeNotifyPrivilege	3724	msiexec.exe
Token: SeRemoteShutdownPrivilege	3724	msiexec.exe
Token: SeUndockPrivilege	3724	msiexec.exe
Token: SeSyncAgentPrivilege	3724	msiexec.exe
Token: SeEnableDelegationPrivilege	3724	msiexec.exe
Token: SeManageVolumePrivilege	3724	msiexec.exe
Token: SeImpersonatePrivilege	3724	msiexec.exe
Token: SeCreateGlobalPrivilege	3724	msiexec.exe
Token: SeCreateTokenPrivilege	3724	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	3724	msiexec.exe
Token: SeLockMemoryPrivilege	3724	msiexec.exe
Token: SeIncreaseQuotaPrivilege	3724	msiexec.exe
Token: SeMachineAccountPrivilege	3724	msiexec.exe
Token: SeTcbPrivilege	3724	msiexec.exe
Token: SeSecurityPrivilege	3724	msiexec.exe
Token: SeTakeOwnershipPrivilege	3724	msiexec.exe
Token: SeLoadDriverPrivilege	3724	msiexec.exe
Token: SeSystemProfilePrivilege	3724	msiexec.exe
Token: SeSystemtimePrivilege	3724	msiexec.exe
Token: SeProfSingleProcessPrivilege	3724	msiexec.exe
Token: SeIncBasePriorityPrivilege	3724	msiexec.exe
Token: SeCreatePagefilePrivilege	3724	msiexec.exe
Token: SeCreatePermanentPrivilege	3724	msiexec.exe
Token: SeBackupPrivilege	3724	msiexec.exe
Token: SeRestorePrivilege	3724	msiexec.exe
Token: SeShutdownPrivilege	3724	msiexec.exe
Token: SeDebugPrivilege	3724	msiexec.exe
Token: SeAuditPrivilege	3724	msiexec.exe
Token: SeSystemEnvironmentPrivilege	3724	msiexec.exe
Token: SeChangeNotifyPrivilege	3724	msiexec.exe
Token: SeRemoteShutdownPrivilege	3724	msiexec.exe
Token: SeUndockPrivilege	3724	msiexec.exe
Token: SeSyncAgentPrivilege	3724	msiexec.exe
Token: SeEnableDelegationPrivilege	3724	msiexec.exe
Token: SeManageVolumePrivilege	3724	msiexec.exe
Token: SeImpersonatePrivilege	3724	msiexec.exe
Token: SeCreateGlobalPrivilege	3724	msiexec.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
3724	msiexec.exe
3724	msiexec.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4564	2026-08-09_bd5e45b5c18b3dbf6a5b37d3892d2ae6_bkransomware_darkgate_elex_floxif_maze.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 4564 wrote to memory of 3772	4564	2026-08-09_bd5e45b5c18b3dbf6a5b37d3892d2ae6_bkransomware_darkgate_elex_floxif_maze.exe	84
PID 4564 wrote to memory of 2696	4564	2026-08-09_bd5e45b5c18b3dbf6a5b37d3892d2ae6_bkransomware_darkgate_elex_floxif_maze.exe	86
PID 4564 wrote to memory of 3724	4564	2026-08-09_bd5e45b5c18b3dbf6a5b37d3892d2ae6_bkransomware_darkgate_elex_floxif_maze.exe	88
PID 3404 wrote to memory of 5104	3404	msiexec.exe	92
PID 3404 wrote to memory of 4876	3404	msiexec.exe	96
PID 3404 wrote to memory of 3764	3404	msiexec.exe	102
PID 3404 wrote to memory of 2564	3404	msiexec.exe	104
PID 2564 wrote to memory of 2748	2564	MsiExec.exe	105
PID 2564 wrote to memory of 1344	2564	MsiExec.exe	107
PID 2564 wrote to memory of 2372	2564	MsiExec.exe	109
PID 2564 wrote to memory of 2452	2564	MsiExec.exe	111
PID 2564 wrote to memory of 2232	2564	MsiExec.exe	115
PID 2564 wrote to memory of 4008	2564	MsiExec.exe	118
PID 4564 wrote to memory of 4816	4564	2026-08-09_bd5e45b5c18b3dbf6a5b37d3892d2ae6_bkransomware_darkgate_elex_floxif_maze.exe	121

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-08-09_bd5e45b5c18b3dbf6a5b37d3892d2ae6_bkransomware_darkgate_elex_floxif_maze.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-09_bd5e45b5c18b3dbf6a5b37d3892d2ae6_bkransomware_darkgate_elex_floxif_maze.exe"
1⤵
- Checks computer location settings
- Loads dropped DLL
- Enumerates connected drives
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4564
- C:\Windows\SysWOW64\taskkill.exe
  "C:\Windows\System32\taskkill.exe" /F /IM sManager.exe
  2⤵
  - System Location Discovery: System Language Discovery
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:3772
- C:\Windows\SysWOW64\taskkill.exe
  "C:\Windows\System32\taskkill.exe" /F /IM SWMAgent.exe
  2⤵
  - System Location Discovery: System Language Discovery
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2696
- C:\Windows\SysWOW64\msiexec.exe
  msiexec.exe /i sManagerSetup.msi /norestart
  2⤵
  - Badlisted process makes network request
  - Enumerates connected drives
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  PID:3724
- C:\ProgramData\Samsung\SWUpdate\Temp\sAgentSetup.exe
  sAgentSetup.exe /OEMINSTALL
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4816

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Badlisted process makes network request
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3404
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding F05511D61090119E6A05B68034DA2918 C
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:5104
- C:\Windows\system32\srtasks.exe
  C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
  2⤵
  PID:4876
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding F3B78A1FE807D321178BEFDF615CBD0C
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:3764
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 8E9F03BC52B3E747199BA0CC6FCC5ECF E Global\MSI0000
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:2564
- - C:\Windows\SysWOW64\taskkill.exe
    "C:\Windows\SysWOW64\taskkill.exe" /F /IM SWMAgent.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    PID:2748
- - C:\Windows\SysWOW64\taskkill.exe
    "C:\Windows\SysWOW64\taskkill.exe" /F /IM SWMFileDownloadUtil.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    PID:1344
- - C:\Windows\SysWOW64\taskkill.exe
    "C:\Windows\SysWOW64\taskkill.exe" /F /IM SWUInterfaceLauncher.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    PID:2372
- - C:\Windows\SysWOW64\taskkill.exe
    "C:\Windows\SysWOW64\taskkill.exe" /F /IM SWMLauncher.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    PID:2452
- - C:\Windows\SysWOW64\schtasks.exe
    "C:\Windows\SysWOW64\schtasks.exe" /delete /tn "SWUpdateAgent" /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2232
- - C:\Program Files (x86)\Samsung\SW Update\InstallationPathWriter.exe
    "C:\Program Files (x86)\Samsung\SW Update\InstallationPathWriter.exe" -task="write" -id="20000" -name="sManager.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:4008

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
PID:3468

C:\ProgramData\Samsung\SW Update Service\SWMAgent.exe
"C:\ProgramData\Samsung\SW Update Service\SWMAgent.exe" /SERVICE
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4864

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

e58923a.rbs

Path C:\Config.Msi\e58923a.rbs
Size 20KB
SHA256 4c3b1b882680febe3490125bbfe7009a2910f63f57075ae62021fadb6f87bfc8
MD5 ba7b79592d110b8ac5148c6e19542b4e
SHA1 54ebee03383bc015f8cb0cae5b2dd661a0f2b66d
SHA512 92c11c334e81fbc6bd9e385263670feddb21a80a12c0f367d364f2e945851876bf7086f0cfcda6458f8fe061064707f49abd1e04e5a79428b1a1da8e1917d00a
SSDEEP 384:9Exeec0rn3Ju9e9DGDAVMUEjMUEe3U82Wm9ckx:9Wc0r3Ju9e9SDCiM86Fx
TLSH
T1DEA2FB26F943C2F7F1467A7E9FD83F25232ADE6453D8491D108D663E498258A1F3C8AC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SW_Update_ARA.chm

Path C:\Program Files (x86)\Samsung\SW Update\Help\SW_Update_ARA.chm
Size 12KB
SHA256 98b4b8cf4b84eb22f6f22dda16016212d4fd52cae410dd318872b37656083fb9
MD5 2baa622d25a95071ec6caafa0e0e96d6
SHA1 c9e123c832fa81fbd17ae2474fbf72f91b01610a
SHA512 92580ab7dfeaf66421cf42914f85d3e6b016bfc8a19b6f159ddc1c2b4fece4bef446f9b24440e20873bec834864baaa93a1ffbd76b091debb0907f8cc32c6ca3
SSDEEP 96:XuOryiLaSpPhv7DLa1RCh3LmMrLvB52RvPw8tLh3ggPPacgtDjXIy:XuOrrRhvf2rCl6sNCvPwMLhw4y
TLSH
T15A424DB07355422AD8459076F6CBAA5FA9273E53DE5061E27053F70D36F2E047FA08B2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SW_Update_BRA.chm

Path C:\Program Files (x86)\Samsung\SW Update\Help\SW_Update_BRA.chm
Size 12KB
SHA256 71768e19230842506370a5d71a9441625b76832c3cdbade8bcbe5757c4265e5a
MD5 cd0c1b80574105fa610445fe9118adc9
SHA1 92e26caf9caee4d1bbf13a8bc6090df02300ebe0
SHA512 12868b38309dd66b7cf0359ffaefd29fa937b4d6dbe51d362f0cabd0ae1382e3949306b783249ebe54bb88c8d7f9b40e357e2197289b6dbf42e3aaf694deb8db
SSDEEP 96:RGr+qWSOqm7T2v/XqHcBklDC6iCrr3WI3nX0YXDdZ01Gr2l/:RvNSBkl20rSFEDghl
TLSH
T16A427DF036800126E1BA65B76AC225CA70686EE1EAC5A5CB1328772E2EF210D47F4CD5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SW_Update_BUL.chm

Path C:\Program Files (x86)\Samsung\SW Update\Help\SW_Update_BUL.chm
Size 12KB
SHA256 5cb6af7e957ef77d4817fdfbe726d2b6db13fcaff80a88fe19a3f3a88ccc9863
MD5 02eff87b303728889b5a2936972d3632
SHA1 4e1f6a765c9f42ca0ad3e06f62e3b8874512bc10
SHA512 e3d8b3221dbe158f1bf40816868875af0c5b6d3ed44d83f4bc728f99494e63cef1859c32b194a22e90a88cf05b20d9528553e394973667e2177e845300d27c18
SSDEEP 96:jRwHSob/3IOqQL891Arp5wcLCwX1kNAPJ6opo+bBYTXth7kh86tL6dPc:jRMRr3PUi5rrX1LMXIugzsdPc
TLSH
T132526D3C7B294F20D85A9533BF8424DA7B11BE43BC35866A20257388D9BAD6817E4E49
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SW_Update_CHT-HK.chm

Path C:\Program Files (x86)\Samsung\SW Update\Help\SW_Update_CHT-HK.chm
Size 12KB
SHA256 43934c228d8911033336f67b3000700e001b6602a2c02c1fe440a1108f183605
MD5 03544bf81c3aaa2adcccb7a1ae0c76bf
SHA1 bc80ab03b78cd2202f2e653330c8b3dd0a4adad2
SHA512 6d70d2c264bdcaa1b6a82be9f43d886ff010c61e87868659d7457502475602ea3dcafc93ce9ee2d30ae91ff9ec82fb986be4577928e14bd60e8d40b66f332600
SSDEEP 96:1bXrqekqyWSDAvSy9CI2i+v7DbdTzi7IAeiV7bCVdTck:FXrq7qOf9IkjDbdO7eiV7Gd
TLSH
T1DA427EF43660C332C06531396B6B5099392A7D01BEA78295310A7A2F1CBA73997348D9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SW_Update_CZE.chm

Path C:\Program Files (x86)\Samsung\SW Update\Help\SW_Update_CZE.chm
Size 12KB
SHA256 89ffa2573caadca618457b8304f5576cbcdc798d5a7639414137c0ae64607d3a
MD5 3c5162a1115c57b66ae6c9b20bcb7418
SHA1 5541851e393f41327634a8d1246e642d79091b19
SHA512 c300c6b6ab45fbde33025d4dc0029d593816f30feeecac5dae18bd5fb05650352c11097ab93bc31831c5d464c3cb35c1ef5b4b0758c141ebfe9c8d73e5ce998b
SSDEEP 96:9CUaWqWI29hYyJgJGMdpvGN3shd/m03uTcGFY9k5LysH:9HhZYxJZpeim03QUeu
TLSH
T1F0427D52B315C821C14C8134BFC25BACB0D63CD0AF6D99D13218F11C6B7BA2D3BA056E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SW_Update_DAN.chm

Path C:\Program Files (x86)\Samsung\SW Update\Help\SW_Update_DAN.chm
Size 12KB
SHA256 f22a1660fbce1ffd16cc762e6fe4247bf5118f878c97b3c36cb076fadd15fbd4
MD5 ce333b283ff145024a3867be22c8707e
SHA1 2cbf665dd0f2ea6c47c8de2b9bccde0f5382c932
SHA512 fb2b7bd6c1798743de3c166000b63917bd665982ae9967588e23185dcc18e3157e3c513b0c67da5fbbb5de7440a7c1f77376709a6b55994002342ddb21aea79e
SSDEEP 96:SUGWPxdbre9Q9nSt/9iQMkko2i+YOUVZsntp/gtheXjHx6jRjDXvkX:SU1br5ngc/lYO+WrgqHxGDXvk
TLSH
T133424DF1B7708A14D4A74332BA8507CDF2BADDA3AE5412B71014775D25B3E490A385AE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SW_Update_DUT.chm

Path C:\Program Files (x86)\Samsung\SW Update\Help\SW_Update_DUT.chm
Size 12KB
SHA256 d57584717b1d12968cdf165858852f36c3b26e6bb605d247f09d32739356805a
MD5 f1e3392dea3ffa56fe92a6c2ee27c3d0
SHA1 c9a63e3babc0e34843f0244511fbfee5637a96c1
SHA512 25d23f7023966ffdebf4d79e65cfa6a27b0380641f4c1fc48f25e82bc296edabce854d1ee24a961849c20ad51f84181f722a4daabe09136e8f91b34228a485e4
SSDEEP 96:cQGWsn15PNEQNSC2bZT9G+eFPOhTUxSK61FV+P69UyJGeI91:cQ2Pubo+eMVVrnVA6W3
TLSH
T173426DF078100615D45487313BC5255F6AA03D63ECA096977136B73F39F2C0CAB726C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SW_Update_FIN.chm

Path C:\Program Files (x86)\Samsung\SW Update\Help\SW_Update_FIN.chm
Size 12KB
SHA256 29a11cb22438d1a0f0b67066f5615e9896ea481ec41e0847ea1446c30e8878d2
MD5 e9f9020f9a6c79a2e8c265cdeb5a024e
SHA1 59c6d9f1a833c9aa1d0a0d876f273e305b217777
SHA512 b554bd728a01cbf3018c3a65addcb174974e6b6f8650432c643ae9cf9ad4b1e6298af356345a6cfb99b63d5f720b1907b3e9ae215601423b79471ada6cf5c466
SSDEEP 96:esSuWR9N0eL81zbfUsSAo+o2xXwlTrInR31RYLCU0y7q+XEn:edhr8hbetEwl47YLCty7qmo
TLSH
T158424C747263C621ED9499315F35B4CDA150BD41E934A2DF206AFB1E14B5E0D2E209EE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SW_Update_FRE.chm

Path C:\Program Files (x86)\Samsung\SW Update\Help\SW_Update_FRE.chm
Size 12KB
SHA256 cc96740ae9e161323c0a873f75a0c90f5cafb371f5d270b5ff4011ce6014fe7d
MD5 2a765e66267f53c6ff8a3bffdc069f6c
SHA1 883993f9d24068edac04b6d638ecb036ec9132e4
SHA512 f97c69998552aa422d0de5addcedb68e840b02450b3327ce65a4702ed31c679a99df2c7ef6a1dddbd0978e88561c06581ed47e0c870e6047cec0de02de8095ad
SSDEEP 96:R2UTXWGfYwPIDKHtp9L1r/s56S89ceOAR6qIzXHVJlbRA0j:R2UTjgwPX3I56zOA/Iz3f9RZ
TLSH
T148425CD072054024E5D88A73FFB8559922A1FCD2E4B4598720DAFB3F35F9E0C0B14768
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SW_Update_GER.chm

Path C:\Program Files (x86)\Samsung\SW Update\Help\SW_Update_GER.chm
Size 12KB
SHA256 4a1250f21c6645e71341c41d07372c84332733f76553c55acf8fa96651a6d719
MD5 710431b364edd8ddd4305e898c4a7c14
SHA1 5497e3a79dcc5efd7548aa3c51b1a9f41ecb6c5d
SHA512 d2df6b1d6aaa0b0507b5d96324261ee217c4ffa35b8c572c89ec293a9565c2b1f95f777bc0375565954d2dcfb1596fc5261f62cde703ab8ec381f649ec5ffc34
SSDEEP 96:vvQfL/WuBljvu30LCoDpkXcY6sajWyYXcy+BF31LND:vqLFnjvdLz9kXcopXchPx
TLSH
T199427C7476004625C2D18A31EFCB9662753B3CA29E22DB5FC206F12C39F6E0D3739999
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SW_Update_GRE.chm

Path C:\Program Files (x86)\Samsung\SW Update\Help\SW_Update_GRE.chm
Size 13KB
SHA256 a1c33f3290105ccd733b0da45b0e2683b5ac7f70b6b1b811e22b453b5623a26a
MD5 10b1bed1205fdbb945b8b0aac22deb60
SHA1 19482e6ba4df50b562fc3a4b76b693453a6121e2
SHA512 ae1eb1ab76116d417165b07a82ba939ec2141a2a134c87a6fd481b3efdcf01177a133b68b4a89fe4fe90e93d54a82bc6156ab0903ca5e61772c2e6dd9bf02b20
SSDEEP 96:9VP+5/XCsJnSeL8LFg5GwRhIHNKwLEsJidphsdOq8x7+PHa/Tf54qOPT6qL/T:9VPCXOLFg5XrsNKwn+zsvKN2
TLSH
T145529F38B948511CD0438B3B774622973199FDB68ABC95163206F2799AF16190EBD0CF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SW_Update_HUN.chm

Path C:\Program Files (x86)\Samsung\SW Update\Help\SW_Update_HUN.chm
Size 12KB
SHA256 174b9813d53dbac56107845445e7d8ea3aca59bd69ca81674a7356b01598ba5a
MD5 897c6b651e11df797fb16e2e418ff1ed
SHA1 a2f0c9730cd0fb47262957329494b0331f311f78
SHA512 b7e506a992f04cee34f90817e44e709e0488ced10a3cbca08eb5c72fae7d781a86562c40cc47a9a3ec40248fd932c351cc5512649ce4ce2902db79193dbf3811
SSDEEP 96:uqJ5WLMMHvmIBTdviQWWAWmswGpxO7ofCgQdwZ8+bFdR:uyivmIBBv7wJfp9+vx
TLSH
T11A527D717B9EC260C59D95733FC2814DB532EE011668E3C72256721C6AF0D5C8BBA8FA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SW_Update_IND.chm

Path C:\Program Files (x86)\Samsung\SW Update\Help\SW_Update_IND.chm
Size 12KB
SHA256 46c880077d0130b36b73b5917257c1269373ea8a6aaf267d76a07c502ffecd26
MD5 7f49dfb43f9ae77a3a7d3d8d890a4f56
SHA1 d196f0f8a50e8ad8366c7c8a1b134ab66b8a788c
SHA512 077ca18ad3af7523ec0bf50b72d71aaeb81985594ef95ca37560cf6a7388d44088a2fefb694880971f995e4e12f93d44e2af61a23760230ca37cee71a08a5482
SSDEEP 192:Ca0x2VO+SWEnRNtuZpTPdv8Vs9uU4yNoLl:Crx2VVSxjtCPv84ey
TLSH
T1D8428C213B104303D2B2457227F67266B161BE02FA29E327008BF72824FA67D4B716CE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SW_Update_ITA.chm

Path C:\Program Files (x86)\Samsung\SW Update\Help\SW_Update_ITA.chm
Size 12KB
SHA256 f3ca54e15d56f337376c4c1a6ddf9d58709ebcb11511c9bde90fecca42dd4fbd
MD5 9f2ca3154a8ea91071b9a46c0aea4c1d
SHA1 babb64a1e950d4a054e2ffd0341cc95e4d9b3e53
SHA512 72f0b0eabb7faa0b5f6ac9ae3b54212649fec4fd693939187be2c082b752166cf698873e204db858ca1ebd1024dfc85fde1b870cf1eb0928e12e768d69f989ff
SSDEEP 96:WFFUSZW3GGgkR2tGIND1kfFh3mT7Wrx/SInUw:KKSKUtfp1Oh3mTSN/j
TLSH
T131426CF432904324C24A2333FE549ADE72613D11DD706097B159EBAE6DF9A2C67708AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SW_Update_JPN.chm

Path C:\Program Files (x86)\Samsung\SW Update\Help\SW_Update_JPN.chm
Size 12KB
SHA256 b6bfd4032111c8c707fa7f21756eb81a47ef2b46e44c9683236ea42705a7cd54
MD5 76a81cf425795e6b1cee94710a08c890
SHA1 dbaeff5062c84443e1fdf9346de3acacbfebeb96
SHA512 99ca2e8aa62fe615f1806cc78c1cccfc9955acb047c1e6f559f3dde322f538ea5ea61719f78f6a36a691fce48bb67587784476688673409a5e335e549f567c1e
SSDEEP 96:pQoObkFhRUMhbBLRe1Cz2Su5hSMGPPzJpTvJrv8ojz1S1Rc6n:pQoWAUUBI1Cz2r3j6Pz3tv8ojzyK
TLSH
T1D1423B10FB688803C5284F767FD1905A9E862E91DD740593350BB6AD3DB3E4C6F618EA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SW_Update_NOR.chm

Path C:\Program Files (x86)\Samsung\SW Update\Help\SW_Update_NOR.chm
Size 12KB
SHA256 bde1c85416cf46ce12e45ada973382b48a5a210692a9dda3354df586537f41fc
MD5 96eecca90564af257cd656c136ff9e7b
SHA1 9f09f61d964d3049390ed9f5e91f6b3144e0d3a5
SHA512 0e1f387a7b84119b28da15912fce45800bfc409672abd3e444931839cd929a2f8b5d1d6f59f1f4531ad929a80662f0d771260a2f6466af6e1214070a60d7c1d6
SSDEEP 96:5wnSWWmsdvwb5/IuqwAsKoERv+EsuSlP5p5OjvLRte+fYaEum0:5wnSttwb5/jj2B+6SlRp5EvAI
TLSH
T1AB428E12F770021DE85951762F92924796317C41B678E143712B3B3A3E77E0C5AA09E7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SW_Update_POL.chm

Path C:\Program Files (x86)\Samsung\SW Update\Help\SW_Update_POL.chm
Size 12KB
SHA256 a5a2ee74b57e0ceaf5ee9f980b5c0962a784d246bdd004b33b315d7d30096ec7
MD5 42bc73c076c7c32a7b21febdc4608075
SHA1 386b838e5b76df2dcb620873e40873c50ff6f68b
SHA512 a2f43784fbbd0ab0c98a30429ea68c76b989e24852d5bf44b2d99ddf6b960a70eafda211dbdeb4208ed0e83a45da2e108dbd0a66ee886a183901e7e496b22f96
SSDEEP 96:AGvWs8Np7IxHZ/hl9zYOY/qZaV38alNO:AG7ANMZ/1YOlZksaT
TLSH
T1EF429D7073259934C5A2873BABCEAF8710447F5987A85512461D373C2DF9719CF70E86
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SW_Update_RUM.chm

Path C:\Program Files (x86)\Samsung\SW Update\Help\SW_Update_RUM.chm
Size 12KB
SHA256 badde0a20b681684154d2e7b58f50b1f695cd3b74f875322e0607961320641ad
MD5 4ffe9b3433fa038278459b4cb385d39d
SHA1 140495cc74beb63910c638d90d8741ae6e335509
SHA512 64390205362f78a22c46eec6e2146e173897ceb684f445270ff362055b6256933d63fb7ea50033484970538a98841cc250e06bf882c8085231fce4d77ba1eaa6
SSDEEP 96:9KyCMDlPF1Io3lqYMMbUfCac0hQYdXttHizs7NOkzdeP1KrB3M:9KyfhPF1IilqYMMbr0qYdttCzs7nqQ
TLSH
T121429E6132368722C9D04E34AFB16B45A3B26D673D3C6B5A723FB71A1AF940887304DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SW_Update_RUS.chm

Path C:\Program Files (x86)\Samsung\SW Update\Help\SW_Update_RUS.chm
Size 12KB
SHA256 8dd28725c67075ae1c2d41406343bd5777a644b2b826831d0b8eb489369a288b
MD5 81b75e63131b1b69bd22affabedd6ee2
SHA1 446efc3ee0183175f1f9e49f7f079dd87a406617
SHA512 8b264180454cff29c99334bb680ebd7620f87dfad851db0c8db9d347dfcb822c9c9dbe878aeeddc9daf6aebac65e89ba0c54917efc094b811f76ac153a97957b
SSDEEP 192:U9bzpGZfJ1GzO7ZzJW9+cVvNCc51AWfHZZRPK:U9bifCaF/c/CuHZZR
TLSH
T1A7529EE237124B32D249D4365AF9A7892C178F9EB7902157314AB74993B5F0637B18C3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SW_Update_SLV.chm

Path C:\Program Files (x86)\Samsung\SW Update\Help\SW_Update_SLV.chm
Size 12KB
SHA256 d28d5e3f3bd15a36af501fe580e3bf159039935fab9644d060e1af616736aa44
MD5 38e0cc1e160cf4a0c70b404351719644
SHA1 ed12b1f084974116fb829561a6fc9b1e184b9c35
SHA512 f1e51f010f4d393c922a517bde97f5dc85b7f53937f7b8530e3ac7299874800a138a284413e2f6d93800a9ee45d28971468c77174aa521b8e18567bd2f28bd71
SSDEEP 96:OEWWdCdmvdWE0TDjKgP9oZ5QosLslFtV+HasbRaMCdvaagNUJ:OEnCyqfDPU4sPtZMCkxUJ
TLSH
T1ED426CF032430335D7644A372F422144A759BDB69AF4565033A27B6E24B3B2EB33519F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SW_Update_SPA.chm

Path C:\Program Files (x86)\Samsung\SW Update\Help\SW_Update_SPA.chm
Size 12KB
SHA256 adf78f2ae5ae0d8eeaf8b4cf1c558ce8190dde3198e1e718102d98797acd2f55
MD5 a5c2183747be4a6cfba2c1359f4d7299
SHA1 0033c5073f7d3d4704b1d86175faea756aceb380
SHA512 fbd5e10ab22b2ee9b0c7840a553fd28944a3a3a9d202a1b9dfb204c352fb5334f58601fb908c29b80293f874529bf2f9fa6ea38d31948e3afea2b96318564e5a
SSDEEP 96:6BXlWfx7q5CMIWYV5AQUEQOoctVMWOn7uUkDbak8x7T5q/Q3hCoEH:6tKAkTWYV5AQUEQOoGVEk4lo
TLSH
T127424BF43A589B21E1948A3BAFCB5503B322BC62F93066177259730C2473F1C5B658D9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SW_Update_THA.chm

Path C:\Program Files (x86)\Samsung\SW Update\Help\SW_Update_THA.chm
Size 12KB
SHA256 3b531362244dd1ab03cb32f2d19969dbdbb142fc1283fa80269791d420b7e721
MD5 0bcadde3239017157a34fae425d0499a
SHA1 adc8dbf0e323c7656eb65aa51f9fb280df77ef86
SHA512 29db62795ddba65d495817d48948fd24a85bb50e981aad89c05b65186186a37dbebbfec752f56a2e29ff04e85a6391f6803c3e8c2532a21c97ba6676a173ada5
SSDEEP 96:oivn6g9evzQrBE+TDRb+C3gGPnmdc1whjW4H9XpUZGToWjIjf0Ja:oi/6i/rBrN+hGjdm9XpfToEeMc
TLSH
T13A424C50324D8214C1D48D3A3ECD734E70226D91DB70A24B112DEB68E8B7B1D9B45AEF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SW_Update_TUR.chm

Path C:\Program Files (x86)\Samsung\SW Update\Help\SW_Update_TUR.chm
Size 12KB
SHA256 9ebeda2cffc1b3eb4ccfd4ccd0b26e725705405f94b5189ca758d5b18b62ceb3
MD5 aabf2533183d94d809586cfdd4f1624a
SHA1 a509bd048023344ef0209065203d0038b0b39532
SHA512 7bf880605d6513fc46ab09fe806be6f6cce51cf5500fe7839d69286c5781fddc925a8f985f0c5b9bb380db67e3cb525216c7b712a4eea82b192b1cec442ea4ca
SSDEEP 96:ej5SjOWK042M4b+hwKourMeuVQ4c6xGixpHaegpK2F0NoD/Z9/YeRTyhUd:eNczm4b+hlDkNxp6hZrWha
TLSH
T1E0426EE437164369E444657F1FDB750E66157F42CBA4A0088160FB2F157AD0C4BBEED1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SW_Update_UKR.chm

Path C:\Program Files (x86)\Samsung\SW Update\Help\SW_Update_UKR.chm
Size 13KB
SHA256 f14f22fb50bfdcc0925177f838708e7512ed7df8387dfc12179541cef15d9445
MD5 950c0228cdd5b7e77fb9c4652b42ddf5
SHA1 cdf32bb93006f0ea08b1c87977ecda9ae3dc27e2
SHA512 d1c702cdb3e69cb894af5767bd787acde1ca630d82d180d20e7ecedbf0a312cf588cfc6849473378e3f04638496838788decf85432810a16399ab98febca54df
SSDEEP 96:LKJ2ySWbWVrXFtIBCm56lQTiNlgVV+ND2Q0HYltDYVG5ZjM0w2kI7WpJU:LKJW4WdX/IB/klQTs12Q0mt8VKL7W
TLSH
T19A525BB5308E4605D67050BBBF4DF6C52431FD82FEA28A0E704EB77A3478A1C63219A6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SW_Update_UZB.chm

Path C:\Program Files (x86)\Samsung\SW Update\Help\SW_Update_UZB.chm
Size 12KB
SHA256 ef4f4946f59708cfb39a95ddc94d3ecc65b188a0660e7f0d8268585ba8bfcce3
MD5 409772699f707ff40ab616eb091a143c
SHA1 e172c11214336c320f91a226e1d82ad12688b1b7
SHA512 e0d1926e6839cb44246b4705a40750ed371d6415ba28239c439b8a2d516ee628a2f720e764391ed2042659975356e90967c7074c0d532293dcad5b14f84e7298
SSDEEP 96:pLCZGWqGX8g1HQYMMwZSZBROplixQzTDZameA3knxfH9n:pe8Gv6nMlxQHVaEEph
TLSH
T14A426D7972748212C43ED3360BF396CA56B27C41566851CA31097E5DA4BBD0F1F3F929
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

InstallationPathWriter.exe

Path C:\Program Files (x86)\Samsung\SW Update\InstallationPathWriter.exe
Size 75KB
SHA256 5a615f3fc99eba65f204b4e3fc612e980e2d2a8a49458c42d2b5a21d68a01f4f
MD5 e9fea2b6eec45d9bc0469706a8e8c4f8
SHA1 7dc4d6331f2158a0cf17d3c3a066ab17d8918884
SHA512 090af2d4a33146736ecdae722fd3cdcf2b4c4c835c08490f2403945043a69b23094cc7c141f7f047b7ce0151efc8c9801623bd26140b8cc3b1e4974492e96895
SSDEEP 1536:aQ0RGh9LUCU1+m7KTXbkk3/pMfPdsaORZOR4t:a3REREUX/pMfPdsfRsR4t
TLSH
T1A8737C237AA0C077E493093049B4C2666E3F797257B984CB779803BA5FE17C01A7936B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SWMSetupCustomAction.dll

Path C:\Program Files (x86)\Samsung\SW Update\SWMSetupCustomAction.dll
Size 1.8MB
SHA256 6729e1ce26ecfe2d85b87eefb8609ad2618bfb15bbbfe3e89cf63eae9be79a06
MD5 e1e0468d5b444b9de062f1bcaf26c41d
SHA1 0d19c151081c28731d5df1c2b0564e4585d81e59
SHA512 0de85c184e418d01d587d1cd5527fa85bafb18b2dcd172a8985d20ade106bdfbc85a0457d77d9a954e5a954de95aef85879f7f457502abe0f01faea0370180ad
SSDEEP 49152:plM9YhoYw1hh69F0GLVCnicVWXSFo2qMc4cxr53/NITWlCl3:pyYhoYwnh80GLGiuWX+AFXxt3/NIS0
TLSH
T1B3959D2379C5807FC56B0331991DB72C62EEA5B00A39D28766E9DF3D6D70842E638763
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SWM_ChangeShortcutToChinese.exe

Path C:\Program Files (x86)\Samsung\SW Update\SWM_ChangeShortcutToChinese.exe
Size 1.9MB
SHA256 5776cc80708252224fecb256b8f7ca0f70d900f1ca3e5793327d4b2798ba9e19
MD5 71084c704237e66d952487a7380dd224
SHA1 1cce7f1e06959180cf2da187ab5bb61dd5fa743c
SHA512 c6f8889f2fc629d132988b2ae131e582df13d2b1c086efdb416a6d88af53bb36ded37faf619c30690575c45050c5a7cf157f55fa7ef223d4f74467b7d0ab4bd3
SSDEEP 49152:o19w9GlCCq5pZRSYj4+MOvhY3NFo5ShMJxx4Je9IcOEmY+LqT:oEQCC0pZRSYUPOaXo5SuJxx0e9IcOEH
TLSH
T1C5959F3235D29077D67327318A8D7368A2ADB7704B35425723E91F2D2DB0582EE39A73
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SetupLogCollector.exe

Path C:\Program Files (x86)\Samsung\SW Update\SetupLogCollector.exe
Size 1.8MB
SHA256 668c64459beb663916fe5e940b4b6f1a2c916df5446c7487ca34eb233a269d48
MD5 20dafb917e63c4ff7ed8ce4ebb11dcad
SHA1 79b67f3eab5f9c8e778d5657ca2eae0236b05d87
SHA512 947774900204c760241e90c6ce38d09f6883caa47208e316fd93b3a7f27aa18c62895ca1ece7b9cfb971ba1261ea4755b7a1299970c6937dd83810c7a8f530eb
SSDEEP 49152:ELKpF8udK0IqsIrLl/4I6ssTQrdEw8HzDMBEiopWVcU:zwu80IgrLlwI6sKCdEw8HzDMBEiopWD
TLSH
T1BD959D32F9D0D076C92303359A4EB32DB6EDF6B11B36524722951E7D2D70492AB386B3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sManager.ico

Path C:\Program Files (x86)\Samsung\SW Update\sManager.ico
Size 269KB
SHA256 b3b02831d15640c83efb7a20e045deacb55a0573609f7ffb18b50b2e7083cd89
MD5 de8871fd5f27e83cb255da1ae3f84c01
SHA1 a4cb1157df8314e1d1f9b19c4c1d6298762b86a1
SHA512 cda4a5bd25424bc62417f47a8942ee464f00cc9b80c32fbe54e188fc638f3963af7ddec83a9f82cd5bd9299c15668877bddf32a2bcf1d8940a974f5716398fdc
SSDEEP 6144:ITtDdn9zN/ev4H34chKVEPGA1P1k43zlERGfKzzVAcj:ybn9JT3CW19kgGNXVAq
TLSH
T18644BF22B0068012D9D8E7F4458EDF7361549DBDEA803C0E35E9BB5E2CF1B6786295CE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sManager.lang

Path C:\Program Files (x86)\Samsung\SW Update\sManager.lang
Size 1.5MB
SHA256 f413cca2b7ba07f3ee8df64bcc2fc5da4893ab05ec65dc37519fb37f128c1b32
MD5 8a517e617a27414d2dbba24af2869683
SHA1 a3f15da9efdaab524c6c36a6f9cc0eac3466f9d1
SHA512 7c4121918c11e24808c9b17899784a3cd3f1eb72b9c17d658c10bebad92e6f567b4973606324e63125993a8650656f4b06a1691932da877c598a8064e47ac7ca
SSDEEP 3072:BdXFZNlVnTWKdCTQKV+LjKrIaygmkneBsJw14gZJ9S94ncHaDkrHMfHSlz+S1ymG:hvK1945N32q/5rBxFZrty2wL48aXxpbF
TLSH
T17C658A0272FD6029B6B37B51DFB8C5B94727BDE4A97ACE5F0191104B09E0950BB623B3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

symsrv.dll

Path C:\Program Files\Common Files\System\symsrv.dll
Size 67KB
SHA256 de055a89de246e629a8694bde18af2b1605e4b9b493c7e4aef669dd67acf5085
MD5 7574cf2c64f35161ab1292e2f532aabf
SHA1 14ba3fa927a06224dfe587014299e834def4644f
SHA512 4db19f2d8d5bc1c7bbb812d3fa9c43b80fa22140b346d2760f090b73aed8a5177edb4bddc647a6ebd5a2db8565be5a1a36a602b0d759e38540d9a584ba5896ab
SSDEEP 1536:YjV8y93KQpFQmPLRk7G50zy/riF12jvRyo0hQk7ZL:c8y93KQjy7G55riF1cMo03V
TLSH
T17863F1372AB5807DDD210D37949F835AB771E5A76C20643FC25907D988B8DD0E3239AE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

symsrv.dll.000

Path C:\Program Files\Common Files\System\symsrv.dll.000
Size 114B
SHA256 aefc503b1ed462d7b6280228a7b5b710792273b78934426f88325341ac5b5a92
MD5 e609411db8aa6775d0344c75c23ae79b
SHA1 1d2ff6194bf159ce36cd0461cd3da29486d1e97d
SHA512 6884ff5c07bc687132c965a59cb8c5a898a25da74c6c846c1d6089ddca8007cb7e4d2f8520bdce9fbcf6e2f9c9e5c28d8c8d6d049d3522470bdc7d38bbfa0ad0
TLSH
T1FFB09262AA2791EAE1AA224505A0248C1ED0B62AB48638002EBA5A4E93256A85916147
MD5 SHA1 SHA512 TLSH

Submit Download

SWMAgent.exe

Path C:\ProgramData\Samsung\SW Update Service\SWMAgent.exe
Size 3.1MB
SHA256 2a0077d8369d45f906080935cfe9bfc40980c349ff3da02d9d3e67ed502f8a2d
MD5 e4eeafe4b5f3d852f2fa43a6274d47cc
SHA1 7f2076f1b4e275d35b5276107589506509ae7ebe
SHA512 345abffe0a27a4c33fb79ec98d5548d52374ba7159215b8e8c6fde4ef5a33d1467791117b3638240698883320f5fe608d2255fd75c858394e49d785a31062180
SSDEEP 98304:d+72cDUDooz/Jod3B6iDE+CUg1tKV8zCBIGVSU:c72PnaEvm8zCBISSU
TLSH
T1FCE5BF2276C48037D56303324ABCB3AA65BDBB70273991DB52D91E5C1E704D2AA39F73
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SWMFileDownloadUtil.exe

Path C:\ProgramData\Samsung\SW Update Service\SWMFileDownloadUtil.exe
Size 1.8MB
SHA256 214bcb4419438cb04298e54fad3fad44f21ce105667bb2d6ae27140d2814c0c7
MD5 338008a767e8030e0c74439a625bf4bb
SHA1 7f02eb0e845565a793d82a97c82145107caf7b15
SHA512 403a6b351df04852ac92d1f0d5c2ef1021b8d1811e5eef3a1cd8a33915bb748fed3f11bb433c0517670daf17616b12e72b168dd4cf64348e338c090e49c00f88
SSDEEP 49152:Sa8nXrl9cjFAhkHD1v6ieV90U1npwnwSdZTeTx5Em8jZpmvxP:SxXrrcjehK1v9eV9JlqwmZTeTx5Em8jZ
TLSH
T13F858D32F6A190BAC53313719F5D7328B6ADB7704A36525733D91E3D2EB04836A2C663
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SWMLauncher.exe

Path C:\ProgramData\Samsung\SW Update Service\SWMLauncher.exe
Size 22KB
SHA256 86660c0d5d128cead911ded09e85331d51fcab1321691377e9c651ba0a11b201
MD5 6663ae167cfe964c86ccb05118f45b22
SHA1 2bdf757ba39695170d04ee8f4c620d82d59ac808
SHA512 7ce528f58e806f791338f4d20d9442ad66d0e82af51816f95a97fdbb6dbd50f9abf52bea2a627cf6362e4727550cd26d8f087a809945ab8960884e402c63eef3
SSDEEP 384:W0zQSoF0tNWGiEpDqCzEE9nYPLZ41U3RkI9vTiR41U3RfPy0expM:ElF0tNWGipCzEE91ORkI9eKORoxy
TLSH
T171B24CC72F1A6063FBC3CC7165E5D21A9D76B2E1EBA818D774A892411ED07D12E7D00E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SWUInterfaceLauncher.exe

Path C:\ProgramData\Samsung\SW Update Service\SWUInterfaceLauncher.exe
Size 2.1MB
SHA256 783a00ee4745afec6c3f2c8e3c3d19239c5b4f7fde16ab122c9a04fbe1223814
MD5 30cb01817c1a2e2332729d865143b73a
SHA1 f89fcfefb99db137d75fddcc5a880f9e4f38170f
SHA512 1882326672cabdff5f895fd7fb1ac1d989090cc252be95bedd09f2099f7177bb382932e0783e78135afb850098a59df4ae145eb8bcd501c82bb82b4a50908908
SSDEEP 49152:kkqlIVvyS2o6d2qj4fT3pokyxu/bXRxzoy3jEiP1HDnOof1A+:7xVvP2o6d2qj47pokyGbXRxzoy3jEiPj
TLSH
T160A5AE32F4A09076C52317309B4EB768B2BDBF705A75225723D43F2D6DB0493A62C6A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SWUpdateIF.dll

Path C:\ProgramData\Samsung\SW Update Service\SWUpdateIF.dll
Size 3.0MB
SHA256 4efbe1b0b77d091eed584f0a555111a382dbeea19f331e57c5bcc8b71079849e
MD5 3e8b699c83b386d1ad17e57d5d51da87
SHA1 952ac4b3844461530a73c70696fe16bde9596de8
SHA512 1bc66bd000e5818d302419e3ff153bd93add4474fad892695bea9530e05fa81118a5346e18ebf33d1802e8f2383c3ccc7d1f391e78791197fc0a42b3bfdbdc40
SSDEEP 98304:0TS1Qp9YPEnmScnCVwKh4FFd5cyHnVcZ9W3Lt:0TSUmf97znVcZ9W
TLSH
T115E58D3276D48036F0AB1231AA7DB36D62BEB6B1573545CB62C81E5D2E704C2B635F23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ShortcutResource.dll

Path C:\ProgramData\Samsung\SW Update Service\ShortcutResource.dll
Size 1.8MB
SHA256 dbfe99b74f67463f169600fa47d1b45ebf1d29330931671fa904605591f93d9c
MD5 1d69ced149937958d5c868e0f8d8aece
SHA1 95df58a55d851daaa8a9a638c51e7efb153e7273
SHA512 370e8b27856a4cb5d357e5fb3da8499dfd364e36477f2445643ddb8d1e4d3c25954e5b0555168f9cb529ab79151a4666dc229a5fe375ea719489cc7573214978
SSDEEP 24576:6DnzCorw+mCAiKbpQzE188BrGk0R+v7qDyC5ScUbiBRTPVT1UZUH:6DnOofmCATezrUrGZq7GJJUbszVpXH
TLSH
T18D958C1EB0068053C998A7F4094ADB7252665D7CE9C0780E35DDBBFE28B1A378D3A5CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sManagerSetup.msi

Path C:\ProgramData\Samsung\SWUpdate\Temp\sManagerSetup.msi
Size 17.2MB
SHA256 14df2c25345461f450bdc1c05f7f59c226d1176b7877a30066a4af1ad6c5fcaf
MD5 94ea788e50d50b87ca7c23d85cee08d8
SHA1 5f9a09911d7c310b41ace676076e01238d1329ea
SHA512 377258813e81c77ffbaa500879cb6497164aebcdd0a1f6fb099d857bc2974c5b0996d77fbaf9a1b933b9c94f7309f9e4b08d9c151f94b95093666c8e1d10aaff
SSDEEP 393216:uToT8E71MBUb9igdAMclcVrYXmmU9hWDV0gIoCP0YJrqD/sK7bsKa7yb:uU4BUb91d5KcC4Yrs1+/f7TaW
TLSH
T12507332234498137E4D657B205AFE73556BE3CB0DC601C0F2295BB5E38B26D2AA385DF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

40C68D5626484A90937F0752C8B950AB

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\40C68D5626484A90937F0752C8B950AB
Size 834B
SHA256 e852a91e3a5c2e2ccb590d261ffb7e96364ce2d23b2227e1a7e7a1478063869d
MD5 ae5a16dd582afe70c9d0a93d886be511
SHA1 936b7792ddcb54faba1ea23e2b37a87441354a6b
SHA512 e002aaf8a89c8aae6eb04700b39057af86dfe326d03e18ffbe0f884e258b60a39bb6d2f8baff13b53a9abf8db6ce4c6d760b2e728878b706136126aa4df4fe97
TLSH
T11F01129680183061F8895F21D649ECABC9B4B30D0FD9B005A5E8C6AA5813FD45B525AE
MD5 SHA1 SHA512 TLSH

Submit Download

EA618097E393409AFA316F0F87E2C202_140032FAB8260A0E8E7CE13AA53D3C07

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\EA618097E393409AFA316F0F87E2C202_140032FAB8260A0E8E7CE13AA53D3C07
Size 5B
SHA256 bebe2853a3485d1c2e5c5be4249183e0ddaff9f87de71652371700a89d937128
MD5 5bfa51f3a417b98e7443eca90fc94703
SHA1 8c015d80b8a23f780bdd215dc842b0f5551f63bd
SHA512 4cd03686254bb28754cbaa635ae1264723e2be80ce1dd0f78d1ab7aee72232f5b285f79e488e9c5c49ff343015bd07bb8433d6cee08ae3cea8c317303e3ac399
MD5 SHA1 SHA512

Submit Download

40C68D5626484A90937F0752C8B950AB

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\40C68D5626484A90937F0752C8B950AB
Size 180B
SHA256 e90e97e39c289f8a23b3da662b5ae9fc4d15679f1fc75059b64caaaad23b7cf2
MD5 c03700571bcd351c2f12df4519b7d632
SHA1 a90370a8dcc9e4240bb46ab6c7a7ec5faaadece3
SHA512 48bc1c309f68795d86b661c26e988f4496bc4c88cafc34e4146264bcc3036b206f0e91270a3545067e20ca8e194244634dd9f58b70f5ce576b83c24120283d47
TLSH
T18AC02B102FDC03C0FC15093D44015A64CE249300CB05D3472F362004461AB220C73D09
MD5 SHA1 SHA512 TLSH

Submit Download

EA618097E393409AFA316F0F87E2C202_140032FAB8260A0E8E7CE13AA53D3C07

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\EA618097E393409AFA316F0F87E2C202_140032FAB8260A0E8E7CE13AA53D3C07
Size 402B
SHA256 fac9c3260db819f1d5b732f8740eeb7b619a443b02163e74b5b64f2758497816
MD5 2c0f9dc49b2a257e432248bb11b3ff25
SHA1 fa1a61c4689ffd09f0fceb89356080457fd95ee5
SHA512 36ee3f7e02ddae9176a4b52bbd3a550a932ddccc6baca95f52565b677d73d3206be78e9fb1fca05d00c5505b6c50f22c61236a13136fe271e53c4d3c2d8ba9aa
TLSH
T1B2E07D0909FEC01DF132DE7EDEE535322C5AF122080502B908A44709FF07F10BCB2920
MD5 SHA1 SHA512 TLSH

Submit Download

MSI58BA.tmp

Path C:\Users\Admin\AppData\Local\Temp\MSI58BA.tmp
Size 305KB
SHA256 adf737e044c8125286b7f0c2907597d840ca6f3dc92e8cb56a5bc20243c723d4
MD5 79a1dc3e058699630f44eaef8736d637
SHA1 cdaa694b65dd49d726e2ef676749351adf97165a
SHA512 16db5d41c07e568c7cba18d5dc2cf2f566b0f1059256574cec69b00796850fc2e5a8c12e5b27e0547817b204db5a9532f893f42ab4f3c5c165a2e654e17a0605
SSDEEP 6144:0yLkWwBZipXl1P0oQf5uHfkmcn7RIUFKaEmTOMIC8PhmzeKN3sqt:L4xEXlQUAZKaEmTO9sDb
TLSH
T113647D1176B4C433F4B3067115B9A6263A7DB4306E70CE8F2394267A6D712D1BB28B7B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata-2

Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
Size 24.1MB
SHA256 bf2ea7d624b758f93f73452a0ced4c4cf588e6a6e5c33e4f8291b7754ac5200a
MD5 79023f09e779f5d8c736b2c46620e112
SHA1 7ce99762ff978964f45d1653e98bceade18af2bd
SHA512 ae8cb8208f5f5cb3ae1a231ade2e441d0b898af1d191ec224620c0b5768f9d61702b5c367714cb0056b3fef5b6f263a2c86161cf35dc78d5abf91b5ef35b273b
SSDEEP 24576:Mu8m+1zPdoO/vvTL7W6u/maObDkzylKSGM2NIFb1ykqredzHIvlzicRRv:4
TLSH
T1EE47B22477F92210E7F79E3CA8F06A234D3A7D5B9C259E8D45411B4E0921FB0E872F5A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{e06bb59f-add2-4938-973f-3bfb04e64a7c}_OnDiskSnapshotProp

Path \??\Volume{0dfc9b49-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{e06bb59f-add2-4938-973f-3bfb04e64a7c}_OnDiskSnapshotProp
Size 6KB
SHA256 dcec196cb246e42bcfd88bf804f88c3fdc0f1a03cc25540eb7fdb5645d0cfe0d
MD5 a463d44308e66da142aa8115ce172fc2
SHA1 968a69302b4176abf55d8c29c697e66f28f7b435
SHA512 6a4a862813ad3856d957dc2f6955fa22d1f73b0f879e6a60ae717ca368e4a380414e94b6943fe48e921adb561e4f8ce6f6a105ec395f184fb32f8658380a9749
SSDEEP 96:F7XJVGPGtvc8DD84LTHzbOHXOHBlBRQ88Sc9XE56tOSVQpu:JzGPGnb++ZVm
TLSH
T182D19A085AE54711E2B3AB7129F14557A877B911FF33CB8E0198638E2670A10F835F5F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4564-70-0x0000000010000000-0x0000000010030000-memory.dmp

Download

memory/4564-35-0x0000000010000000-0x0000000010030000-memory.dmp

Download

memory/4564-20-0x0000000000620000-0x00000000020DF000-memory.dmp

Download

memory/4564-22-0x0000000010000000-0x0000000010030000-memory.dmp

Download

memory/4564-52-0x0000000010000000-0x0000000010030000-memory.dmp

Download

memory/4564-4-0x0000000010000000-0x0000000010030000-memory.dmp

Download

memory/4564-216-0x0000000010000000-0x0000000010030000-memory.dmp

Download

memory/4564-214-0x0000000000620000-0x00000000020DF000-memory.dmp

Download

memory/4864-217-0x0000000000C60000-0x0000000000F8F000-memory.dmp

Download