CmdID

CmdID / Files

aitstatic.exe

Application Impact Telemetry Static Analyzer file version info

Program on Windows 10 known copies with hashes 1 Sigma rule names it

Opens CmdID with your command. It is read in your browser and sent nowhere.

Is it the real aitstatic.exe?

file version info and known copies
Installed inC:\Windows\system32\
C:\Program Files (x86)\Windows Kits\10\App Certification Kit\
Signed byMicrosoft Windows
ProductMicrosoft Windows Operating System, Microsoft Corporation
DescriptionApplication Impact Telemetry Static Analyzer

10 known copies

10.0.22000.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\aitstatic.exe · signed by Microsoft Windows

49d7b3a4b80957ad4db69ab0ef082c56d576fc2e38823f16f0b7ad708d7657f7

10.0.19645.1046 (WinBuild.160101.0800) · C:\Windows\system32\aitstatic.exe · signed by Microsoft Windows

6c21c0c38032da60fcb777cd1706d3630ec541a61d63bcc4c7a28a7008da16d4

10.0.19645.1016 (WinBuild.160101.0800) · C:\Windows\system32\aitstatic.exe · signed by Microsoft Windows

6d20f18cf10653b7324ab41b1a3f633ccc1ce48a737949616b336071f4277924

10.0.19645.1016 (WinBuild.160101.0800) · C:\Windows\system32\aitstatic.exe · signed by Microsoft Windows

fa0f83dca7a4ee0b2aab762ee381fa1a259e552bdac1e302f53cc7f50ee44c13

10.0.19041.1 (WinBuild.160101.0800) · C:\Program Files (x86)\Windows Kits\10\App Certification Kit\aitstatic.exe · signed by Microsoft Corporation

9668475a74fd17695929d2882c35c0c29dfeac4bdbe09b264be69931bc2f1216

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\system32\aitstatic.exe · signed by Microsoft Windows

f8714ef296f22edb81a0b231da4e4cb63764de9e5de99acdd59e756bfc2b199e

10.0.18362.1035 (WinBuild.160101.0800) · C:\Windows\system32\aitstatic.exe · signed by Microsoft Windows

19d82dcd19879f157fcdf7fa2380b90a89b8eb09b8abc732f911032efee29fde

10.0.18362.1035 (WinBuild.160101.0800) · C:\Windows\system32\aitstatic.exe · signed by Microsoft Windows

469dea7f28d302ff01b2d305c97888dce298a738c9b1d8dd6b2c7d705c7e262b

10.0.18362.1035 (WinBuild.160101.0800) · C:\WINDOWS\system32\aitstatic.exe · signed by Microsoft Windows

800b3cd8ee7946c49d6a69a5446662ffc894737aefb195014c73c21acaeaccef

10.0.18362.1023 (WinBuild.160101.0800) · C:\windows\system32\aitstatic.exe · not signed

3de4cf894e3099d16c7243820c3d2029366b35b0137ecdb3801e171f6a66826d

From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.

What detects it

Sigma

Sigma names aitstatic.exe in 1 rule, for every kind of event; none is a process creation rule CmdID evaluates, so none is listed.