CmdID / Files

FXST30.dll

Microsoft Fax T30 Protocol Service Provider file version info

Library on Windows 1 known copy with hashes 1 Sigma rule names it

Is it the real FXST30.dll?

file version info and known copies

Installed inC:\Windows\system32\

Signed byMicrosoft Windows

ProductMicrosoft Windows Operating System, Microsoft Corporation

DescriptionMicrosoft Fax T30 Protocol Service Provider

1 known copy

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\system32\FXST30.dll · signed by Microsoft Windows

SHA-25660ecf442c2155a179df1e1a1b6f365bdc4343cb69c51fdfb5dadd07308123009SHA-183d76e04e488268eff68fe372744316684377eb9MD5a4d603913dc89791eee2e1b1f690957f

From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<hash>".whatis() says which known copy an MD5, SHA-1 or SHA-256 is.

What detects it

Sigma rules that name FXST30.dll

In the registry

highChange the Fax Dllfrack113

CmdID evaluates Sigma’s process creation rules against a command line. These watch what a command line does not show: a library or a driver loading, a file written, the registry, another process opened, event logs. They are listed as Sigma has them, at SigmaHQ.