General

  • Target

    System32Problems15.zip

  • Size

    13.9MB

  • MD5

    109c21f6c6d32adc8abb09663bacb4db

  • SHA1

    51eec3f02a45799f8314e140d9c5dc1869aa0b61

  • SHA256

    2ef90eb1dcf94955d3d457a9482abcc3a8f87e4d240d5e5cc4e6c3b0795c90f6

  • SHA512

    600fa1b06814532b27a9cde0026940c2c67f1bc6bb7336b75838e3194072b6c34f7d4a0e0543b44302320ad6698f4d9998f3321f9ba59eba6beeb047d8a7f6f5

  • SSDEEP

    393216:8+JjvAZ5SzbBkmvEs6wAYsby60iToToRa0tmou2kHXne3EKN:8+JjvAZGbBkmviBYsbyioNcmFjEj

Score
3/10

Malware Config

Signatures

  • Unsigned PE 90 IoCs

    Checks for missing Authenticode signature.

Files

  • System32Problems15.zip
    .zip
  • ETWCoreUIComponentsResources.dll
    .dll windows:10 windows x86 arch:x86


    Headers

    Sections

  • ETWESEProviderResources.dll
    .dll windows:10 windows x64 arch:x64


    Headers

    Sections

  • EsdSip.dll
    .dll regsvr32 windows:10 windows x64 arch:x64

    ca15c4388d72a0ae9796e6ecf0fe0621


    Headers

    Imports

    Exports

    Sections

  • EthernetMediaManager.dll
    .dll windows:10 windows x64 arch:x64

    f73e95790beff3134809d1b990d97d97


    Headers

    Imports

    Exports

    Sections

  • EtwRundown.dll
    .dll windows:10 windows x64 arch:x64

    d2ab7f62ce046b743b790112f9dca7f9


    Headers

    Imports

    Exports

    Sections

  • EventAggregation.dll
    .dll windows:10 windows x64 arch:x64

    db0346dc60876dfa989edbbb8c5bafff


    Headers

    Imports

    Exports

    Sections

  • ExSMime.dll
    .dll regsvr32 windows:10 windows x64 arch:x64

    bdec343947271a0d51c983b8914101d0


    Headers

    Imports

    Exports

    Sections

  • ExecModelClient.dll
    .dll windows:10 windows x64 arch:x64

    d1dd6feedcc7c7eccd5e7c30aff7ec5b


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • ExplorerFrame.dll
    .dll windows:10 windows x64 arch:x64

    53ab20cf0dacc912bfe6d28a6c2fe41b


    Headers

    Imports

    Exports

    Sections

  • ExtrasXmlParser.dll
    .dll windows:10 windows x64 arch:x64

    a40d8c392081aa3b93f9ab0e1343d83c


    Headers

    Imports

    Exports

    Sections

  • FDResPub.dll
    .dll windows:10 windows x64 arch:x64

    e2d1ac7d73cd0ac7ff419efc30fad79f


    Headers

    Imports

    Exports

    Sections

  • Facilitator.dll
    .dll windows:10 windows x64 arch:x64

    b0c38af283c7669e4659012725f6e8f7


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • Family.Authentication.dll
    .dll windows:10 windows x64 arch:x64

    cf50021a0bc977287defe76a413afbd0


    Headers

    Imports

    Exports

    Sections

  • Family.Cache.dll
    .dll windows:10 windows x64 arch:x64

    0e8d06e79197366fd16ba58a45a4acb6


    Headers

    Imports

    Exports

    Sections

  • Family.Client.dll
    .dll windows:10 windows x64 arch:x64

    611408f85a65743a627134476dee3897


    Headers

    Imports

    Exports

    Sections

  • Family.SyncEngine.dll
    .dll windows:10 windows x64 arch:x64

    3f3518465e7f202fc3a2663d766690af


    Headers

    Imports

    Exports

    Sections

  • FamilySafetyExt.dll
    .dll windows:10 windows x64 arch:x64

    3062d9b37fbb92eb43e0afe02f341cd0


    Headers

    Imports

    Exports

    Sections

  • Faultrep.dll
    .dll windows:10 windows x64 arch:x64

    71606afcd79932726b391d18cf49dc35


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • FaxPrinterInstaller.dll
    .dll windows:10 windows x64 arch:x64

    c449049348e26c4c9cc2435dac6e7949


    Headers

    Imports

    Exports

    Sections

  • FdDevQuery.dll
    .dll windows:10 windows x64 arch:x64

    edba09902b7fd7396d09a6b8bb672d49


    Headers

    Imports

    Exports

    Sections

  • FileAppxStreamingDataSource.dll
    .dll windows:10 windows x64 arch:x64

    7f221edc20887b66d051c74c2dbc1a7f


    Headers

    Imports

    Exports

    Sections

  • FilterDS.dll
    .dll windows:10 windows x64 arch:x64

    aab95556257b2a86681ee194481af49f


    Headers

    Imports

    Exports

    Sections

  • FirewallAPI.dll
    .dll regsvr32 windows:10 windows x64 arch:x64

    2058ce3451d2ab2c67a4cc88f143b6f0


    Headers

    Imports

    Exports

    Sections

  • FirewallControlPanel.dll
    .dll regsvr32 windows:10 windows x64 arch:x64

    ad91f41700d53756aa4be9f54680f530


    Headers

    Imports

    Exports

    Sections

  • FirewallUX.dll
    .dll windows:10 windows x64 arch:x64

    be3c93ff792962215e2417d4212a16a8


    Headers

    Imports

    Exports

    Sections

  • FirmwareAttestationServerProxyStub.dll
    .dll windows:10 windows x64 arch:x64

    8b4a45dd471a39b2a468846ac6c0ae67


    Headers

    Imports

    Exports

    Sections

  • FlightSettings.dll
    .dll windows:10 windows x64 arch:x64

    b547a184c25cf8f85db201712c8b8049


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • FluencyDS.dll
    .dll windows:10 windows x64 arch:x64

    6c2d4930e23b88e0290a44a34262ed97


    Headers

    Imports

    Exports

    Sections

  • FntCache.dll
    .dll windows:10 windows x64 arch:x64

    38e358bcfe96b9f53daf7c3a581d8e17


    Headers

    Imports

    Exports

    Sections

  • FontGlyphAnimator.dll
    .dll windows:10 windows x64 arch:x64

    0a22cd387eb8faf5f2be3339261ebb97


    Headers

    Imports

    Exports

    Sections

  • FontProvider.dll
    .dll windows:10 windows x64 arch:x64

    6636a738c96c29c37d8578807ef2d250


    Headers

    Imports

    Exports

    Sections

  • FrameServer.dll
    .dll windows:10 windows x64 arch:x64

    fb48f74b2eaae5379178fb03a508cf41


    Headers

    Imports

    Exports

    Sections

  • FrameServerClient.dll
    .dll regsvr32 windows:10 windows x64 arch:x64

    1559b8333bebe80b7f868b0c89885035


    Headers

    Imports

    Exports

    Sections

  • FrameServerMonitor.dll
    .dll windows:10 windows x64 arch:x64

    3aa6d04088ba868569ad241582cf943c


    Headers

    Imports

    Exports

    Sections

  • FrameServerMonitorClient.dll
    .dll regsvr32 windows:10 windows x64 arch:x64

    1e2cfc6aa89f24d9efd0a6d8884e9732


    Headers

    Imports

    Exports

    Sections

  • FsNVSDeviceSource.dll
    .dll windows:10 windows x64 arch:x64

    8a2538f759f5d6f4cf2c29907de4fa5c


    Headers

    Imports

    Exports

    Sections

  • eShims.dll
    .dll windows:10 windows x64 arch:x64

    2cc5df11709c692a9c6355076bc311a7


    Headers

    Imports

    Exports

    Sections

  • eUICCsCSP.dll
    .dll windows:10 windows x64 arch:x64

    e1efd337992f3343973d308dbcf0df74


    Headers

    Imports

    Exports

    Sections

  • esent.dll
    .dll regsvr32 windows:10 windows x64 arch:x64

    b24ff7866552a6b9769133201a264c27


    Headers

    Imports

    Exports

    Sections

  • esentprf.dll
    .dll windows:10 windows x64 arch:x64

    3bf2e5ad015e66e21a11ab9795ac3dcd


    Headers

    Imports

    Exports

    Sections

  • esevss.dll
    .dll windows:10 windows x64 arch:x64

    7954ca5576aefd644cd0b7ee48815eda


    Headers

    Imports

    Exports

    Sections

  • eventcls.dll
    .dll regsvr32 windows:10 windows x64 arch:x64

    dd6ec004ac2563065bb68f84f0e860f8


    Headers

    Imports

    Exports

    Sections

  • evr.dll
    .dll regsvr32 windows:10 windows x64 arch:x64

    7b989a8696496f6c0e9ec255840a1fc4


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • execmodelproxy.dll
    .dll windows:10 windows x64 arch:x64

    8954ab433db3de3d4ecc70f66fdd2d3a


    Headers

    Imports

    Exports

    Sections

  • f1db7d81-95be-4911-935a-8ab71629112a_HyperV-IsolatedVM.dll
    .dll windows:10 windows x64 arch:x64


    Code Sign

    Headers

    Sections

  • f3ahvoas.dll
    .dll windows:10 windows x64 arch:x64

    ce89c7409de0e634da69add27856afe7


    Headers

    Imports

    Exports

    Sections

  • f989b52d-f928-44a3-9bf1-bf0c1da6a0d6_HyperV-DeviceVirtualization.dll
    .dll windows:10 windows x64 arch:x64


    Code Sign

    Headers

    Sections

  • facecredentialprovider.dll
    .dll windows:10 windows x64 arch:x64

    d1fe88e87e9be9faf20ec8c7fd11026f


    Headers

    Imports

    Exports

    Sections

  • fcon.dll
    .dll windows:10 windows x64 arch:x64

    0199764d0abd4e434fa6138fd8148c02


    Headers

    Imports

    Exports

    Sections

  • fdBth.dll
    .dll windows:10 windows x64 arch:x64

    b183a8ad8346c563ffd9c59652cb1a6d


    Headers

    Imports

    Exports

    Sections

  • fdBthProxy.dll
    .dll regsvr32 windows:10 windows x64 arch:x64

    d4fa54fa14409e6b3c8dc85c6fe8377f


    Headers

    Imports

    Exports

    Sections

  • fdPHost.dll
    .dll windows:10 windows x64 arch:x64

    4eec7b420a686c8d7b456b966d2e8561


    Headers

    Imports

    Exports

    Sections

  • fdPnp.dll
    .dll windows:10 windows x64 arch:x64

    d0d5f020c8c137a8126038fcd1711ba8


    Headers

    Imports

    Exports

    Sections

  • fdProxy.dll
    .dll regsvr32 windows:10 windows x64 arch:x64

    dab9beb092fc40522dc098a919b65ccc


    Headers

    Imports

    Exports

    Sections

  • fdSSDP.dll
    .dll regsvr32 windows:10 windows x64 arch:x64

    bc44eca56f492569776fa5aced1eb72a


    Headers

    Imports

    Exports

    Sections

  • fdWCN.dll
    .dll windows:10 windows x64 arch:x64

    50dd9fa8b7dadaa5a9e8a8c2d895bf3b


    Headers

    Imports

    Exports

    Sections

  • fdWNet.dll
    .dll regsvr32 windows:10 windows x64 arch:x64

    8af4b24979ad9d07896c5b12350649f7


    Headers

    Imports

    Exports

    Sections

  • fdWSD.dll
    .dll regsvr32 windows:10 windows x64 arch:x64

    c9e4ae34c932486b0d60b59a592071fd


    Headers

    Imports

    Exports

    Sections

  • fde.dll
    .dll windows:10 windows x64 arch:x64

    3678fde9ef3a969b5cf64e8fb8c24891


    Headers

    Imports

    Exports

    Sections

  • fdeploy.dll
    .dll windows:10 windows x64 arch:x64

    dbde29f412132706ad08300dc3ead2e3


    Headers

    Imports

    Exports

    Sections

  • fdprint.dll
    .dll regsvr32 windows:10 windows x64 arch:x64

    bc7ed435f1afc07270fc3a90a4c8a117


    Headers

    Imports

    Exports

    Sections

  • feclient.dll
    .dll windows:10 windows x64 arch:x64

    a84e4a981b9ede99b0850076a114bf63


    Headers

    Imports

    Exports

    Sections

  • ffbroker.dll
    .dll windows:10 windows x64 arch:x64

    15ff7e56d2379d0a82d5ca05f0cf5557


    Headers

    Imports

    Exports

    Sections

  • fhcat.dll
    .dll regsvr32 windows:10 windows x64 arch:x64

    2372fc4ae8830500bab065af75f75828


    Headers

    Imports

    Exports

    Sections

  • fhcfg.dll
    .dll regsvr32 windows:10 windows x64 arch:x64

    c84c0f9e871f979be5437841132fc7a6


    Headers

    Imports

    Exports

    Sections

  • fhcleanup.dll
    .dll regsvr32 windows:10 windows x64 arch:x64

    3fbe5ad755e47f8f69e71d3f1fcf541c


    Headers

    Imports

    Exports

    Sections

  • fhcpl.dll
    .dll regsvr32 windows:10 windows x64 arch:x64

    ecd6ba95fb73144bbaa0708ffd6a458c


    Headers

    Imports

    Exports

    Sections

  • fhengine.dll
    .dll regsvr32 windows:10 windows x64 arch:x64

    5a291c5d1b0474d0a9e9ff3447c760fc


    Headers

    Imports

    Exports

    Sections

  • fhevents.dll
    .dll windows:10 windows x64 arch:x64

    fb76bfa082ce0bdadd7a1ed3030f517b


    Headers

    Imports

    Exports

    Sections

  • fhsettingsprovider.dll
    .dll windows:10 windows x64 arch:x64

    7db328d3383b64d1d50b25ce09dae504


    Headers

    Imports

    Exports

    Sections

  • fhshl.dll
    .dll regsvr32 windows:10 windows x64 arch:x64

    643d59caf7c947ead3e5eb5d12998a50


    Headers

    Imports

    Exports

    Sections

  • fhsrchapi.dll
    .dll regsvr32 windows:10 windows x64 arch:x64

    b1dfcae981f0599431b210390b5595ca


    Headers

    Imports

    Exports

    Sections

  • fhsrchph.dll
    .dll regsvr32 windows:10 windows x64 arch:x64

    319446ddcbf3206d37a2d8e433e8a171


    Headers

    Imports

    Exports

    Sections

  • fhsvc.dll
    .dll windows:10 windows x64 arch:x64

    fbb025a9f3fd1823e7aaae044460d352


    Headers

    Imports

    Exports

    Sections

  • fhsvcctl.dll
    .dll windows:10 windows x64 arch:x64

    191c62ab425ccb57a455aa046df4cb86


    Headers

    Imports

    Exports

    Sections

  • fhtask.dll
    .dll regsvr32 windows:10 windows x64 arch:x64

    a9d9184323a4f502c8235bb12b174675


    Headers

    Imports

    Exports

    Sections

  • fhuxadapter.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • fhuxapi.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • fhuxcommon.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • fhuxgraphics.dll
    .dll windows:10 windows x64 arch:x64

    91991bdf67d2baf803923b1e80a3b7c2


    Headers

    Imports

    Sections

  • fhuxpresentation.dll
    .dll windows:4 windows x86 arch:x86

    dae02f32a21e03ce65412f6e56942daa


    Headers

    Imports

    Sections

  • fidocredprov.dll
    .dll windows:10 windows x64 arch:x64

    7ea7439f95cdf1dbf804dd776df23d81


    Headers

    Imports

    Exports

    Sections

  • filemgmt.dll
    .dll regsvr32 windows:10 windows x64 arch:x64

    ea4ada27b637179496eabb2119af4256


    Headers

    Imports

    Exports

    Sections

  • findnetprinters.dll
    .dll regsvr32 windows:10 windows x64 arch:x64

    48d092899c34ee5c736d0a163369f4e7


    Headers

    Imports

    Exports

    Sections

  • fingerprintcredential.dll
    .dll windows:10 windows x64 arch:x64

    44702307a33e4d0bcfe6599cc7314ade


    Headers

    Imports

    Exports

    Sections

  • fltLib.dll
    .dll windows:10 windows x64 arch:x64

    a2e518fe01113dc26ecd0b434e4fd20d


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • fmapi.dll
    .dll windows:10 windows x64 arch:x64

    263c10c599fece235fd961ae69617c3f


    Headers

    Imports

    Exports

    Sections

  • fmifs.dll
    .dll windows:10 windows x64 arch:x64

    a0ad85b30697340de9c15c2769126dd1


    Code Sign

    Headers

    Imports

    Exports

    Sections

  • fms.dll
    .dll windows:10 windows x64 arch:x64

    d1a8126525bd04b99a608bd2972d9fa4


    Headers

    Imports

    Exports

    Sections

  • fontext.dll
    .dll windows:10 windows x64 arch:x64

    4dc3812959807b4b5ed7cb2d1229cae5


    Headers

    Imports

    Exports

    Sections

  • fontgroupsoverride.dll
    .dll windows:10 windows x64 arch:x64

    934a8180cf993111a93de86421469ae6


    Headers

    Imports

    Exports

    Sections

  • fontsub.dll
    .dll windows:10 windows x64 arch:x64

    3afaaefbff467ddd4361bbf68b53f93a


    Headers

    Imports

    Exports

    Sections

  • fphc.dll
    .dll regsvr32 windows:10 windows x64 arch:x64

    f141447386e22cdd8e1beab6f1468c74


    Headers

    Imports

    Exports

    Sections

  • framedyn.dll
    .dll windows:10 windows x64 arch:x64

    d3cb325902233fc77d38f1ca3745d21e


    Headers

    Imports

    Exports

    Sections

  • framedynos.dll
    .dll windows:10 windows x64 arch:x64

    7194401a59d515830daa2118cc1d831d


    Headers

    Imports

    Exports

    Sections

  • frprov.dll
    .dll regsvr32 windows:10 windows x64 arch:x64

    904b1d7339a2f50b5e7277d532b4558c


    Headers

    Imports

    Exports

    Sections

  • fsutilext.dll
    .dll windows:10 windows x64 arch:x64

    6fb820210ab2ccd98a14ab8e379a1722


    Headers

    Imports

    Exports

    Sections

  • fthsvc.dll
    .dll windows:10 windows x64 arch:x64

    0fc60524567178847eaf42af2d112eda


    Headers

    Imports

    Exports

    Sections

  • fundisc.dll
    .dll windows:10 windows x64 arch:x64

    f154e35f18bfc2ab553942d1dda8ed50


    Headers

    Imports

    Exports

    Sections