---
title: Hunt: signed SiemensSoftwareCenter.exe side-loading archive.dll from AppData (Romulus ClickFix, CVE-2026-110936) | ctxsec
url: https://ctxsec.com/items/hunt-siemens-software-center-sideload-romulus
description: "Hunt for the Romulus ClickFix campaign that side-loads malicious DLLs into a genuine, signed Siemens Software Center binary (CVE-2026-110936)."
status: "hunt idea"
published: 2026-10-19
---

> Hunt for the Romulus ClickFix campaign that side-loads malicious DLLs into a genuine, signed Siemens Software Center binary (CVE-2026-110936).

[← Threat Hunting](/hunting) · [markdown](/items/hunt-siemens-software-center-sideload-romulus.md)

hunt idea

2026-10-19

### Hunt: signed SiemensSoftwareCenter.exe side-loading archive.dll from AppData (Romulus ClickFix, CVE-2026-110936)

Context: [Siemens Software Center exploitation](/news#siemens-software-center-cve-2026-110936-exploited). The Siemens file is genuine and signed, so Siemens says to detect on folder and behaviour, not on its hash.

1. **Process lineage:** `SiemensSoftwareCenter.exe` running from `%LOCALAPPDATA%\Programs\` (look for a `SM Software Provisioning Service` folder) with `msiexec.exe` as parent, especially on PCs with no Siemens engineering software. KQL sketch: `DeviceProcessEvents | where FileName =~ "SiemensSoftwareCenter.exe" and FolderPath has @"\AppData\Local\Programs\" | where InitiatingProcessFileName =~ "msiexec.exe"`.
2. **Side-loaded DLLs:** image loads by that process of DLLs not signed by Siemens, or files next to it named `activate.bak` or `statinfosta.DB`. Known hashes (SHA-256): `AllMyBasic.msi` f4d7c5321bb0d1bda439304a753bcf9b467b98ca53c7e9493b9c2c3451092e4a, `archive.dll` 3fdcc7d7d049a89711fb31fb236940a1c5a09d899143ffd20c3c41fb1f2cf491.
3. **Persistence:** a "Siemens Software Center" Run key / startup entry or scheduled task on machines that never had it installed; a `%LOCALAPPDATA%\FTSuite\ftc.uml` file.
4. **Network:** connections or DNS for `96.62.218[.]59` and `wizardexpensive[.]com` (active C2/payload hosting per Siemens) and historical downloads from `2.27.248[.]127` (inactive distribution host; earlier victims may still be infected).
5. **ClickFix precursor:** RunMRU entries or PowerShell/`mshta`/`msiexec` launched from `explorer.exe` right after browser activity, i.e. a user pasting a command from a fake "I am not a robot" page.
6. **If found:** isolate, kill the process first, then remove the startup entry and task, and reset the user's passwords (Siemens guidance).

Sources: [Siemens ProductCERT blog (IOCs)](https://productcert.siemens.com/news/2026/10/19/active-exploitation-of-cve-2026-110936-in-siemens-software-center/) · [Siemens SSA-580366](https://cert-portal.siemens.com/productcert/html/ssa-580366.html)