CmdID

CmdID / Files

WmiApSrv.exe

WMI Performance Reverse Adapter file version info

Program on Windows 8 known copies with hashes 1 Sigma rule names it

Opens CmdID with your command. It is read in your browser and sent nowhere.

Is it the real WmiApSrv.exe?

file version info and known copies
Installed inC:\Windows\system32\wbem\
Signed byMicrosoft Windows
ProductMicrosoft Windows Operating System, Microsoft Corporation
DescriptionWMI Performance Reverse Adapter

8 known copies

10.0.22000.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\wbem\WmiApSrv.exe · signed by Microsoft Windows

33558e742299d9cbda7be206731dfd90df65da7decae648af8f573ce68fb2e41

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\system32\wbem\WmiApSrv.exe · signed by Microsoft Windows

2a05ea2653ce6ee43e02b1cc26530d3292d314be8d31a4641de333fa6b093cca

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\system32\wbem\WmiApSrv.exe · signed by Microsoft Windows

5d51a62e14be8f6a6894e8184cfd036edafc906d958e162fc9ac48462c6b2248

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\system32\wbem\WmiApSrv.exe · signed by Microsoft Windows

cbf60ed17a5b9cf79523f1493bccd52b3c39632c4c83de1fd49cfd2b70f01530

10.0.18362.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\wbem\WmiApSrv.exe · signed by Microsoft Windows

8a221672e37fd7f30d35b3466ca9f1a473f9a77c27a5a16c6392bceeccafea6f

10.0.17763.1 (WinBuild.160101.0800) · C:\Windows\system32\wbem\WmiApSrv.exe · signed by Microsoft Windows

dba5d56949ba383dab17c3ab95eac8b3f1b693729676d1a5637790f6e7f01abd

10.0.14393.0 (rs1_release.160715-1616) · C:\Windows\system32\wbem\WmiApSrv.exe · signed by Microsoft Windows

501358930c93c66c40a5a865cfb7bbc827a6882d504c2c1a6d8ef22e85631d8f

6.3.9600.16384 (winblue_rtm.130821-1623) · C:\windows\system32\wbem\WmiApSrv.exe · not signed

5a29ebb6da036e303611eb1304192655021405bb05452fd37886dde604ff0d9d

From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.

What detects it

Sigma

Sigma names WmiApSrv.exe in 1 rule, for every kind of event; none is a process creation rule CmdID evaluates, so none is listed.