CmdID

CmdID / Files

fixmapi.exe

FIXMAPI 1.0 MAPI Repair Tool file version info

Program on Windows 14 known copies with hashes 1 Sigma rule names it

Opens CmdID with your command. It is read in your browser and sent nowhere.

Is it the real fixmapi.exe?

file version info and known copies
Installed inC:\Windows\system32\
C:\Windows\SysWOW64\
Signed byMicrosoft Windows
ProductMicrosoft Windows Operating System, Microsoft Corporation
DescriptionFIXMAPI 1.0 MAPI Repair Tool

14 known copies

10.0.22000.184 (WinBuild.160101.0800) · C:\WINDOWS\SysWOW64\fixmapi.exe · signed by Microsoft Windows

9c3db21659e9b0705103f874ccfb2a4d4affd757cffa403643ba8f4f35fcf80d

10.0.22000.184 (WinBuild.160101.0800) · C:\WINDOWS\system32\fixmapi.exe · signed by Microsoft Windows

f2f31b015f5b4d57d7cc49df13a9cbfa209ecfc182d775fd6f30a1792b36444d

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\SysWOW64\fixmapi.exe · signed by Microsoft Windows

0d4c73f2f21db31d9a1a0b4513072c48823e42a77354cab2042078ce82aec667

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\SysWOW64\fixmapi.exe · signed by Microsoft Windows

1ad59ae610d513f1d85e54c2a791d48ae71960f78bb1a214a36718f57c838e85

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\system32\fixmapi.exe · signed by Microsoft Windows

ca566b6cc49a1fc5a1ff2d426446977576858f696d8e8a45c00eebb052c96ad9

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\system32\fixmapi.exe · signed by Microsoft Windows

e77c39972273ce22af4fb971fd08108fb6f6c02f97c92260f4eb9d31cdbe39c0

10.0.18362.1 (WinBuild.160101.0800) · C:\WINDOWS\SysWOW64\fixmapi.exe · signed by Microsoft Windows

10e0212bf023c7684e36d300e7c502f3893756b62b082af5a1ca317c0928f0dd

10.0.18362.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\fixmapi.exe · signed by Microsoft Windows

721a3d4e13380b11ced36cbd86d94c10fe4dee8f82d605c900e816739c200d4e

10.0.17763.1 (WinBuild.160101.0800) · C:\Windows\SysWOW64\fixmapi.exe · signed by Microsoft Windows

9abf9dc2cd723d9c8bc68d16bc8c175c4f5445e18c0b7b5628329c750c4dfc73

10.0.17763.1 (WinBuild.160101.0800) · C:\Windows\system32\fixmapi.exe · signed by Microsoft Windows

e8731bd8598b3021f209aea528b8baea94b6c11b893247132bb8cad16a018e7a

10.0.14393.0 (rs1_release.160715-1616) · C:\Windows\SysWOW64\fixmapi.exe · signed by Microsoft Windows

0495267c4a3af4b59c453ca4f336bb64b17a9906095853bcc9f2e2d9116decef

10.0.14393.0 (rs1_release.160715-1616) · C:\Windows\system32\fixmapi.exe · signed by Microsoft Windows

51a468c99de946a0fdda997aee7d49c330a7ef531bd44f6bdc5bef5361501fad

6.3.9600.16384 (winblue_rtm.130821-1623) · C:\windows\system32\fixmapi.exe · not signed

7b3e78f4e193ba091eb599ee45dfd6bf62adf62d4a32cf9961923866f9c518e9

6.3.9600.16384 (winblue_rtm.130821-1623) · C:\windows\SysWOW64\fixmapi.exe · not signed

d4b4bd2f8a3db7de1b5f0f88b5ede076fa9614d9de657e6dd6cf9305d0d86cff

From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.

What detects it

Sigma

Sigma names fixmapi.exe in 1 rule, for every kind of event; none is a process creation rule CmdID evaluates, so none is listed.