CmdID

CmdID / Files

WMIADAP.exe

WMI Reverse Performance Adapter Maintenance Utility file version info

Program on Windows 16 known copies with hashes 1 Sigma rule names it

Opens CmdID with your command. It is read in your browser and sent nowhere.

Is it the real WMIADAP.exe?

file version info and known copies
Original namewmicookr.dll in the file’s header: a renamed copy still carries it
Installed inC:\Windows\system32\wbem\
C:\Windows\SysWOW64\wbem\
Signed byMicrosoft Windows
ProductMicrosoft Windows Operating System, Microsoft Corporation
DescriptionWMI Reverse Performance Adapter Maintenance Utility

16 known copies

10.0.22000.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\wbem\WMIADAP.exe · signed by Microsoft Windows

e908196299c6e527e9450debf87308107a0d8aa8eb9f904ea2cbc21c753b0a2f

10.0.22000.1 (WinBuild.160101.0800) · C:\WINDOWS\SysWOW64\wbem\WMIADAP.exe · signed by Microsoft Windows

ecedf979f721786accd9b6238212ce5e0fc2702cea46d25a3f4c7d0a859a44d4

10.0.19041.610 (WinBuild.160101.0800) · C:\Windows\SysWOW64\wbem\WMIADAP.exe · signed by Microsoft Windows

2d484a551751f118ea7609eba1400f29a98206551959abecd464828f72cfa28a

10.0.19041.610 (WinBuild.160101.0800) · C:\Windows\system32\wbem\WMIADAP.exe · signed by Microsoft Windows

9b1f44ed54a0ab6d1a18d113ba3c946d961f4d652ffba0c3f1b2aa89a6cc7d0e

10.0.19041.1320 (WinBuild.160101.0800) · C:\Windows\system32\wbem\WMIADAP.exe · signed by Microsoft Windows

6c51c1968a7ad1b40251ad58f44602114888db2859b1375e0bffc7eb8c2c22e4

10.0.19041.1320 (WinBuild.160101.0800) · C:\Windows\SysWOW64\wbem\WMIADAP.exe · signed by Microsoft Windows

9119da0262826f56eeda0d3c13dc4b5357078ae499b3f224904ff9b8e9e3f99f

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\SysWOW64\wbem\WMIADAP.exe · signed by Microsoft Windows

76243553efd123f8b1cf97120e8d6f0b9aab2cba884045e1ccef34bd71681828

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\system32\wbem\WMIADAP.exe · signed by Microsoft Windows

82e17f81fef57bce805a857c840d96b498c3b8e1394d2b249016b9ceef05d0e6

10.0.18362.1 (WinBuild.160101.0800) · C:\WINDOWS\SysWOW64\wbem\WMIADAP.exe · signed by Microsoft Windows

434ec1213e81c419af6094ab10b883f1ec6a25e5bc8ef55b713e9f86ef6e3c4e

10.0.18362.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\wbem\WMIADAP.exe · signed by Microsoft Windows

db844f69381751fe7aecbb8c8a0c3b5d4e1c59491a203191ef283563c539a887

10.0.17763.1 (WinBuild.160101.0800) · C:\Windows\SysWOW64\wbem\WMIADAP.exe · signed by Microsoft Windows

999113aee6783853d56f3aa40bd524fc567df553aec310c797193704219930d7

10.0.17763.1 (WinBuild.160101.0800) · C:\Windows\system32\wbem\WMIADAP.exe · signed by Microsoft Windows

e2ba31e0f13310fc4becbecefc0253c4f7a7f76463a774ef3b434d46bf559291

10.0.14393.2515 (rs1_release_1.180830-1044) · C:\Windows\SysWOW64\wbem\WMIADAP.exe · signed by Microsoft Windows

15b614d405f175b5ea9e5434bedb1b9e9f5a7826cfcbd67aa1c544ebb0028bd8

10.0.14393.2515 (rs1_release_1.180830-1044) · C:\Windows\system32\wbem\WMIADAP.exe · signed by Microsoft Windows

7f275eceb1695fa7ad42b045b5d7fca9045f274ad27a8d47ba9d152dcb2435e0

6.3.9600.17415 (winblue_r4.141028-1500) · C:\windows\system32\wbem\WMIADAP.exe · not signed

32b07c757e2b96776b7a96d6c2eaa035d6a6177be67868cf5a362d16557fb7d4

6.3.9600.17415 (winblue_r4.141028-1500) · C:\windows\SysWOW64\wbem\WMIADAP.exe · not signed

d7161581baaa04fc2e515bf724cc2cc17c25250a3574717d53a8f9d638e3d30f

From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.

What detects it

Sigma

Sigma names WMIADAP.exe in 1 rule, for every kind of event; none is a process creation rule CmdID evaluates, so none is listed.