Configure-SMRemoting.exe

File Path: C:\Windows\system32\Configure-SMRemoting.exe
Description: Configure-SMRemoting

Hashes

Type	Hash
MD5	`01B26A8919A84F68E836BD7F43AE646E`
SHA1	`423CC045915C20424A54C8BC01C5AFA0EEBF38DC`
SHA256	`C42B1CDBA6020D3858CE47C6A0D279045A741F21263BB417742371D0C04AE79A`
SHA384	`1F6796B57389D37C696EA4871184894B102E673AC54DA6A10BBBDAE79C919F801F5DFF123BE24E57EFE82004307B8EE0`
SHA512	`630A66C6F75931A68BCA8DCD81893874D90DB4C777837281C4F307E8AD4226EB3829E56FFDB735D305122A8B8668C74979B4D8D3037B05998120C06431904851`
SSDEEP	`768:HcDIGqtaELu1Sbx9XxH8/QTmD3J+aPW6a8EkiHT45IdEgWDJbkYLEzXQbJcRmIld:c39c9XxHcQW5zHEkWT45SWD2FT7`
IMP	`403E36D730F1BA1D4A5AF9FE98AB6A3C`
PESHA1	`4BCBB9B4364A7A893EA273E4DCD761DB98A6F77A`
PE256	`42AA80348E8EF4460F99A3D11A2FCCF48763B5F627138D94717696AD292E96F2`

Runtime Data

Usage (stderr):

Configure-SMRemoting.exe -GET | -ENABLE | -DISABLE

Loaded Modules:

Path
C:\Windows\System32\ADVAPI32.dll
C:\Windows\System32\bcryptPrimitives.dll
C:\Windows\System32\combase.dll
C:\Windows\system32\Configure-SMRemoting.exe
C:\Windows\System32\GDI32.dll
C:\Windows\System32\gdi32full.dll
C:\Windows\System32\KERNEL32.DLL
C:\Windows\System32\KERNELBASE.dll
C:\Windows\System32\msvcp_win.dll
C:\Windows\System32\msvcrt.dll
C:\Windows\SYSTEM32\ntdll.dll
C:\Windows\System32\ole32.dll
C:\Windows\System32\OLEAUT32.dll
C:\Windows\System32\RPCRT4.dll
C:\Windows\System32\sechost.dll
C:\Windows\System32\ucrtbase.dll
C:\Windows\System32\USER32.dll
C:\Windows\System32\win32u.dll
C:\Windows\system32\XmlLite.dll

Signature

Status: Signature verified.
Serial: 33000001C422B2F79B793DACB20000000001C4
Thumbprint: AE9C1AE54763822EEC42474983D8B635116C8452
Issuer: CN=Microsoft Windows Production PCA 2011, O=Microsoft Corporation, L=Redmond, S=Washington, C=US
Subject: CN=Microsoft Windows, O=Microsoft Corporation, L=Redmond, S=Washington, C=US

File Metadata

Original Filename: Configure-SMRemoting.EXE.MUI
Product Name: Microsoft Windows Operating System
Company Name: Microsoft Corporation
File Version: 10.0.17763.1 (WinBuild.160101.0800)
Product Version: 10.0.17763.1
Language: English (United States)
Legal Copyright: Microsoft Corporation. All rights reserved.
Machine Type: 64-bit

File Scan

VirusTotal Detections: 0/69
VirusTotal Link: https://www.virustotal.com/gui/file/c42b1cdba6020d3858ce47c6a0d279045a741f21263bb417742371d0c04ae79a/detection/

File Similarity (ssdeep match)

File	Score
C:\Windows\system32\Configure-SMRemoting.exe	29
C:\windows\system32\Configure-SMRemoting.exe	21

Possible Misuse

The following table contains possible examples of Configure-SMRemoting.exe being misused. While Configure-SMRemoting.exe is not inherently malicious, its legitimate functionality can be abused for malicious purposes.

Source	Source File	Example	License
sigma	image_load_wsman_provider_image_load.yml	`- 'C:\Windows\System32\Configure-SMRemoting.exe'`	DRL 1.0