CmdID

CmdID / Files

perfmon.exe

Resource and Performance Monitor file version info

Program on Windows 12 known copies with hashes 2 Sigma rules name it Command perfmon

Opens CmdID with your command. It is read in your browser and sent nowhere.

Is it the real perfmon.exe?

file version info and known copies
Installed inC:\Windows\system32\
C:\Windows\SysWOW64\
Signed byMicrosoft Windows
ProductMicrosoft Windows Operating System, Microsoft Corporation
DescriptionResource and Performance Monitor

12 known copies

10.00 · C:\WINDOWS\SysWOW64\perfmon.exe · signed by Microsoft Windows

1654f042147eaf85200e27a5218536188e0124064463c03a6f7053ff0a28ff13

10.00 · C:\WINDOWS\system32\perfmon.exe · signed by Microsoft Windows

39da579a57b33bacdaa9eeca732b060f1dab2624c7ee1e2469e3e2a40961151e

10.00 · C:\Windows\SysWOW64\perfmon.exe · signed by Microsoft Windows

3fa716b87491bdc9a01ec636f0010a028552d224eec64334f7669206c69cfff2

10.00 · C:\Windows\SysWOW64\perfmon.exe · signed by Microsoft Windows

4a58628abfa58dcd4e683ebef43018b663228cb562c27716a799257a7434b6a5

10.00 · C:\Windows\SysWOW64\perfmon.exe · signed by Microsoft Windows

5d4c3ef49bb510b7fbb943acf60bd6b74fc6d295b9cc93933155cbaf535f03eb

10.00 · C:\Windows\system32\perfmon.exe · signed by Microsoft Windows

5f041cff346fb37e5c5c9dab3c1272c76f8b5f579205170e97d2248d04a4ea0c

10.00 · C:\Windows\system32\perfmon.exe · signed by Microsoft Windows

71fefcf8b3882c305875888f52e7253674d7f4f0323633480fea51eb630aedba

10.00 · C:\WINDOWS\SysWOW64\perfmon.exe · signed by Microsoft Windows

7551915d48416381616480acf03a94cc3ab493682935389c5357bcc2912eab15

10.00 · C:\WINDOWS\system32\perfmon.exe · signed by Microsoft Windows

76396d7c9650a86a425fd68f9851d0c06ddf3eb808a548fcf0c02fad6253399f

10.00 · C:\Windows\system32\perfmon.exe · signed by Microsoft Windows

94e0eceb1a5db9d3c32fc83015ac0cc58db8a5b3e2d3a190631607a0e6736e1b

6.3.9600.16384 (winblue_rtm.130821-1623) · C:\windows\system32\perfmon.exe · not signed

5898266df2c54e2f0555d97cc11fbf4707afe2e991b1a86c1ee7f14f9ca5fa4d

6.3.9600.16384 (winblue_rtm.130821-1623) · C:\windows\SysWOW64\perfmon.exe · not signed

7b2cf6e56fe262686ce9afdabb260854ee92b257ad95d577e9ada6a4eccfb9f1

From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.

What detects it

Sigma

Sigma names perfmon.exe in 2 rules, for every kind of event; none is a process creation rule CmdID evaluates, so none is listed.