Coreinfo64.exe

  • File Path: C:\SysinternalsSuite\Coreinfo64.exe
  • Description: Dump information on system CPU and memory topology

Hashes

Type Hash
MD5 62A0D89209585EDCCBCA6EE2A7D73754
SHA1 3C456974119623B3DD3547C02CA04266C18C7290
SHA256 10769865190241890BB0BCD7B9D75DE93474454113E8F485D2486918A2620CF5
SHA384 60593D9822612165A2C7694BE08321BFE470288C8977FFD84D9F7EAE66E275F8C163F9001F395C7F2EF4AADBDB052B2D
SHA512 51A6307994058740B115F1916F9A1AF5A26CFD1F902F5BB4E162CF130DB800E2CA02517CD049C8CA9E410996ABBC9C9A8AC20F8C5F14929637F2F910CA280E99
SSDEEP 3072:nB8PdCXxZcMaH6IbW0i3xlX35TNxoTGjMBRvXE5UFbJB0x5/VuXI1ERC1vg6Sg:nB8PQgMaHda0i3xp3ZqHxb+SlkSg
IMP 4F4C9470FD343A66D07696FBCC55A154
PESHA1 86D3C633EC157E579BD3051BEC727A1D583CF602
PE256 D5C9FF23EF280E9CCBE54CB1AB099F6EA0C888904EA5057E6CEACC10F365320A

Runtime Data

Usage (stdout):


Coreinfo v3.5 - Dump information on system CPU and memory topology
Copyright (C) 2008-2020 Mark Russinovich
Sysinternals - www.sysinternals.com


Intel(R) Core(TM) i7-4700MQ CPU @ 2.40GHz
Intel64 Family 6 Model 60 Stepping 3, GenuineIntel
Microcode signature: FFFFFFFF
HTT       	*	Hyperthreading enabled
HYPERVISOR	*	Hypervisor is present
VMX       	-	Supports Intel hardware-assisted virtualization
SVM       	-	Supports AMD hardware-assisted virtualization
X64       	*	Supports 64-bit mode

SMX       	-	Supports Intel trusted execution
SKINIT    	-	Supports AMD SKINIT

NX        	*	Supports no-execute page protection
SMEP      	*	Supports Supervisor Mode Execution Prevention
SMAP      	-	Supports Supervisor Mode Access Prevention
PAGE1GB   	*	Supports 1 GB large pages
PAE       	*	Supports > 32-bit physical addresses
PAT       	*	Supports Page Attribute Table
PSE       	*	Supports 4 MB pages
PSE36     	*	Supports > 32-bit address 4 MB pages
PGE       	*	Supports global bit in page tables
SS        	*	Supports bus snooping for cache operations
VME       	*	Supports Virtual-8086 mode
RDWRFSGSBASE	*	Supports direct GS/FS base access

FPU       	*	Implements i387 floating point instructions
MMX       	*	Supports MMX instruction set
MMXEXT    	-	Implements AMD MMX extensions
3DNOW     	-	Supports 3DNow! instructions
3DNOWEXT  	-	Supports 3DNow! extension instructions
SSE       	*	Supports Streaming SIMD Extensions
SSE2      	*	Supports Streaming SIMD Extensions 2
SSE3      	*	Supports Streaming SIMD Extensions 3
SSSE3     	*	Supports Supplemental SIMD Extensions 3
SSE4a     	-	Supports Streaming SIMDR Extensions 4a
SSE4.1    	*	Supports Streaming SIMD Extensions 4.1
SSE4.2    	*	Supports Streaming SIMD Extensions 4.2

AES       	*	Supports AES extensions
AVX       	*	Supports AVX instruction extensions
FMA       	*	Supports FMA extensions using YMM state
MSR       	*	Implements RDMSR/WRMSR instructions
MTRR      	*	Supports Memory Type Range Registers
XSAVE     	*	Supports XSAVE/XRSTOR instructions
OSXSAVE   	*	Supports XSETBV/XGETBV instructions
RDRAND    	*	Supports RDRAND instruction
RDSEED    	-	Supports RDSEED instruction

CMOV      	*	Supports CMOVcc instruction
CLFSH     	*	Supports CLFLUSH instruction
CX8       	*	Supports compare and exchange 8-byte instructions
CX16      	*	Supports CMPXCHG16B instruction
BMI1      	*	Supports bit manipulation extensions 1
BMI2      	*	Supports bit manipulation extensions 2
ADX       	-	Supports ADCX/ADOX instructions
DCA       	-	Supports prefetch from memory-mapped device
F16C      	*	Supports half-precision instruction
FXSR      	*	Supports FXSAVE/FXSTOR instructions
FFXSR     	-	Supports optimized FXSAVE/FSRSTOR instruction
MONITOR   	-	Supports MONITOR and MWAIT instructions
MOVBE     	*	Supports MOVBE instruction
ERMSB     	*	Supports Enhanced REP MOVSB/STOSB
PCLMULDQ  	*	Supports PCLMULDQ instruction
POPCNT    	*	Supports POPCNT instruction
LZCNT     	*	Supports LZCNT instruction
SEP       	*	Supports fast system call instructions
LAHF-SAHF 	*	Supports LAHF/SAHF instructions in 64-bit mode
HLE       	-	Supports Hardware Lock Elision instructions
RTM       	-	Supports Restricted Transactional Memory instructions

DE        	*	Supports I/O breakpoints including CR4.DE
DTES64    	-	Can write history of 64-bit branch addresses
DS        	-	Implements memory-resident debug buffer
DS-CPL    	-	Supports Debug Store feature with CPL
PCID      	*	Supports PCIDs and settable CR4.PCIDE
INVPCID   	*	Supports INVPCID instruction
PDCM      	*	Supports Performance Capabilities MSR
RDTSCP    	*	Supports RDTSCP instruction
TSC       	*	Supports RDTSC instruction
TSC-DEADLINE	-	Local APIC supports one-shot deadline timer
TSC-INVARIANT	-	TSC runs at constant rate
xTPR      	-	Supports disabling task priority messages

EIST      	-	Supports Enhanced Intel Speedstep
ACPI      	-	Implements MSR for power management
TM        	-	Implements thermal monitor circuitry
TM2       	-	Implements Thermal Monitor 2 control
APIC      	*	Implements software-accessible local APIC
x2APIC    	-	Supports x2APIC

CNXT-ID   	-	L1 data cache mode adaptive or BIOS

MCE       	*	Supports Machine Check, INT18 and CR4.MCE
MCA       	*	Implements Machine Check Architecture
PBE       	-	Supports use of FERR#/PBE# pin

PSN       	-	Implements 96-bit processor serial number

PREFETCHW 	*	Supports PREFETCHW instruction

Maximum implemented CPUID leaves: 0000000D (Basic), 80000008 (Extended).
Maximum implemented address width: 48 bits (virtual), 39 bits (physical).

Processor signature: 000306C3

Logical to Physical Processor Map:
**------  Physical Processor 0 (Hyperthreaded)
--**----  Physical Processor 1 (Hyperthreaded)
----**--  Physical Processor 2 (Hyperthreaded)
------**  Physical Processor 3 (Hyperthreaded)

Logical Processor to Socket Map:
********  Socket 0

Logical Processor to NUMA Node Map:
********  NUMA Node 0

No NUMA nodes.

Logical Processor to Cache Map:
**------  Data Cache          0, Level 1,   32 KB, Assoc   8, LineSize  64
**------  Instruction Cache   0, Level 1,   32 KB, Assoc   8, LineSize  64
**------  Unified Cache       0, Level 2,  256 KB, Assoc   8, LineSize  64
********  Unified Cache       1, Level 3,    6 MB, Assoc  12, LineSize  64
--**----  Data Cache          1, Level 1,   32 KB, Assoc   8, LineSize  64
--**----  Instruction Cache   1, Level 1,   32 KB, Assoc   8, LineSize  64
--**----  Unified Cache       2, Level 2,  256 KB, Assoc   8, LineSize  64
----**--  Data Cache          2, Level 1,   32 KB, Assoc   8, LineSize  64
----**--  Instruction Cache   2, Level 1,   32 KB, Assoc   8, LineSize  64
----**--  Unified Cache       3, Level 2,  256 KB, Assoc   8, LineSize  64
------**  Data Cache          3, Level 1,   32 KB, Assoc   8, LineSize  64
------**  Instruction Cache   3, Level 1,   32 KB, Assoc   8, LineSize  64
------**  Unified Cache       4, Level 2,  256 KB, Assoc   8, LineSize  64

Logical Processor to Group Map:
********  Group 0

Loaded Modules:

Path
C:\SysinternalsSuite\Coreinfo64.exe
C:\Windows\System32\KERNEL32.DLL
C:\Windows\System32\KERNELBASE.dll
C:\Windows\SYSTEM32\ntdll.dll

Signature

  • Status: Signature verified.
  • Serial: 3300000187721772155940C709000000000187
  • Thumbprint: 2485A7AFA98E178CB8F30C9838346B514AEA4769
  • Issuer: CN=Microsoft Code Signing PCA 2011, O=Microsoft Corporation, L=Redmond, S=Washington, C=US
  • Subject: CN=Microsoft Corporation, O=Microsoft Corporation, L=Redmond, S=Washington, C=US

File Metadata

  • Original Filename: coreinfo
  • Product Name: coreinfo
  • Company Name: Sysinternals - www.sysinternals.com
  • File Version: 3.5
  • Product Version: 3.5
  • Language: English (United States)
  • Legal Copyright: Copyright (C) 2008-2020 Mark Russinovich
  • Machine Type: 64-bit

File Scan

  • VirusTotal Detections: 0/67
  • VirusTotal Link: https://www.virustotal.com/gui/file/10769865190241890bb0bcd7b9d75de93474454113e8f485d2486918a2620cf5/detection/

Possible Misuse

The following table contains possible examples of Coreinfo64.exe being misused. While Coreinfo64.exe is not inherently malicious, its legitimate functionality can be abused for malicious purposes.

Source Source File Example License
sigma proc_creation_win_false_sysinternalsuite.yml - '\Coreinfo64.exe' DRL 1.0

MIT License. Copyright (c) 2020-2021 Strontic.