wmiapsrv.exe
Summary
WMI Performance Adapter (wmiapsrv.exe) translates performance counter data into WMI classes, making Windows performance data available through WMI queries. It acts as a bridge between the Windows Performance Counter infrastructure and WMI.
wmiapsrv.exe is the 18th most commonly executed Windows program in EchoTrail's dataset, observed 3,723,284 times across enterprise environments. It typically runs from C:\Windows\System32\wbem and it is most often launched by services.exe.
Behavior
Top Paths
- C:\Windows\System32\wbem100%
Top Hashes (SHA256)
- cbf60ed17a5b9cf79523f1493bccd52b3c39632c4c83de1fd49cfd2b70f0153036%
- d7697f75eb9caa5924cf7227a46bc5a0f1bdd3fa14d384ed5b669c1fb512b31d21.3%
- 5a29ebb6da036e303611eb1304192655021405bb05452fd37886dde604ff0d9d11.88%
- 1ac267ac73670bea5f3785c9ad9db146f8e993a862c843742b21fdb90d102b2a9.32%
- b6c9a96801e12ca6714ced663b7c85d0422f4f78cb667c729c4813609f3b5b507.68%
- 4b5e41eef2cd86b36b702ce00f6b8f97f9aa483fc0d91538df5e2ca421b69e3b2.97%
- 8a221672e37fd7f30d35b3466ca9f1a473f9a77c27a5a16c6392bceeccafea6f2.5%
- 3c4f864655cff786b33333e643aa929b2d2b01ecd56eeeeade7ceab38249da3b1.42%
- f6f09145e9461eb17172988d26749fcf36920a1a683459334d04a6d072b31a921.19%
- c1580315758fec14d209f7c232e6d70bccd375d68cb5967da055acc5a52a20f00.92%
Process Ancestry
Top Grandparents
- wininit.exe100%
Top Parents
- services.exe100%
Top Children
- WerFault.exe100%
Rare or environment-specific process names are omitted from ancestry tables. Percentages are of all observed relationships.
Security Analysis
What does wmiapsrv.exe normally do?
Located in C:\Windows\System32\wbem. Always launched by services.exe (runs as a service). Single instance.
When is wmiapsrv.exe suspicious?
Parent process other than services.exe. Running from outside the wbem directory. Spawning child processes.
How do attackers abuse wmiapsrv.exe?
Not commonly abused.
Detection guidance
Low priority. Validate parent and path.
False positive notes
Normal background process.
Related Processes
Ask Rocky about wmiapsrv.exe
Rocky answers questions about wmiapsrv.exe grounded in this same dataset — free, no account needed.
Need this data programmatically? The Rocky API includes 500 free lookups a month. Or just ask Rocky.
Data from EchoTrail's dataset of ~346M Windows process executions. Last extracted 2026-08-04.