Registry Run Key Persistence via Misspelled 'Microsoft Coporation' Launching fixmapi.exe

Subhankar H@Andrewsec57

•updated Jul 6, 2026•0•0•3

Detects the creation of a Windows Registry Run key containing a misspelling of 'Microsoft Corporation' (as 'Microsoft Coporation') which is configured to launch 'fixmapi.exe'. This pattern is indicative of a persistence mechanism masquerading as a legitimate Microsoft process.