CmdID

CmdID / Files

FXSSVC.exe

Fax Service file version info

Program on Windows 5 known copies with hashes 1 Sigma rule names it

Opens CmdID with your command. It is read in your browser and sent nowhere.

Is it the real FXSSVC.exe?

file version info and known copies
Installed inC:\Windows\system32\
Signed byMicrosoft Windows
ProductMicrosoft Windows Operating System, Microsoft Corporation
DescriptionFax Service

5 known copies

10.0.22000.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\FXSSVC.exe · signed by Microsoft Windows

d3dd5446664dc47a3cd0f97a0dcd85a3b7164a48cd9a71644302ee483f6a34de

10.0.19041.804 (WinBuild.160101.0800) · C:\Windows\system32\FXSSVC.exe · signed by Microsoft Windows

f5f1381269a303798d5c879cca0f7f627be5081ab292fe652a86564010cd7e6e

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\system32\FXSSVC.exe · signed by Microsoft Windows

d70cb3598af18e75db858accb6d3e7b4d6f6d8f68e50673bf28a45cea1658701

10.0.18362.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\FXSSVC.exe · signed by Microsoft Windows

0257954d0c8978c7e163c918a79a5d35aa7626d9d5236ba55feaa3eb5a44dbef

10.0.17763.1 (WinBuild.160101.0800) · C:\Windows\system32\FXSSVC.exe · signed by Microsoft Windows

02550c0aad3f86f5c6efb1f5043c358d78c6d847539755d95672935d974d5ae8

From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.

What detects it

Sigma

Sigma names FXSSVC.exe in 1 rule, for every kind of event; none is a process creation rule CmdID evaluates, so none is listed.