Dism.exe
- File Path:
C:\WINDOWS\system32\Dism.exe
- Description: Dism Image Servicing Utility
Hashes
| Type |
Hash |
| MD5 |
14E1C2AE72CAA52985169FD51BDEFC97 |
| SHA1 |
9DB97ABA0E47B86E8EB5C22E626642812513C21D |
| SHA256 |
00B01CBE2CA62F9C74835C01B48FEC6DC4ADF9049BAC531D9C3C0DDD9379902A |
| SHA384 |
C109AF30DEB82988137558983CF190E06BD90E1F0A0FCBF9471713B1A778EE1FB1A2D36C8D66E969BE6D794F9AE7773A |
| SHA512 |
9977316A6F68E6E37C2F83B1C4507558741E1FC5B93F7D0030A2C960E1670697B88EBEB77D0DE5ED52473C9BE74FB9C8C63A588370FA566DC4D15BC2306D3DB2 |
| SSDEEP |
6144:exBXqJhvdcxQD1h5gCU3NZbbzHy+W2RfjXjK6Z/5rw:YXqJ5yxG7uDZbHpO6Z/C |
| IMP |
BE4080E73C7B5FD4EC16CA93509F3FAE |
| PESHA1 |
03700C4E704E754AE10519F6D2939479AF969507 |
| PE256 |
348B2C08DDA5AD7B34C40D6F01C69E0F5DBF80633D1699F6A361CD2EFA931C38 |
Runtime Data
Usage (stdout):
Deployment Image Servicing and Management tool
Version: 10.0.22000.1
DISM.exe [dism_options] {Imaging_command} [<Imaging_arguments>]
DISM.exe {/Image:<path_to_offline_image> | /Online} [dism_options]
{servicing_command} [<servicing_arguments>]
DESCRIPTION:
DISM enumerates, installs, uninstalls, configures, and updates features
and packages in Windows images. The commands that are available depend
on the image being serviced and whether the image is offline or running.
FFU COMMANDS:
/Capture-Ffu - Captures a physical disk image into a new FFU file.
/Apply-Ffu - Applies an .ffu image.
/Split-Ffu - Splits an existing .ffu file into multiple read-only
split FFU files.
/Optimize-Ffu - Optimizes a FFU file so that it can be applied to storage
of a different size.
WIM COMMANDS:
/Apply-CustomDataImage - Dehydrates files contained in the custom data image.
/Capture-CustomImage - Captures customizations into a delta WIM file on a
WIMBoot system. Captured directories include all
subfolders and data.
/Get-WIMBootEntry - Displays WIMBoot configuration entries for the
specified disk volume.
/Update-WIMBootEntry - Updates WIMBoot configuration entry for the
specified disk volume.
/List-Image - Displays a list of the files and folders in a
specified image.
/Delete-Image - Deletes the specified volume image from a WIM file
that has multiple volume images.
/Export-Image - Exports a copy of the specified image to another
file.
/Append-Image - Adds another image to a WIM file.
/Capture-Image - Captures an image of a drive into a new WIM file.
Captured directories include all subfolders and
data.
/Get-MountedWimInfo - Displays information about mounted WIM images.
/Get-WimInfo - Displays information about images in a WIM file.
/Commit-Wim - Saves changes to a mounted WIM image.
/Unmount-Wim - Unmounts a mounted WIM image.
/Mount-Wim - Mounts an image from a WIM file.
/Remount-Wim - Recovers an orphaned WIM mount directory.
/Cleanup-Wim - Deletes resources associated with mounted WIM
images that are corrupted.
GENERIC IMAGING COMMANDS:
/Split-Image - Splits an existing .wim file into multiple
read-only split WIM (SWM) files.
/Apply-Image - Applies an image.
/Get-MountedImageInfo - Displays information about mounted WIM and VHD
images.
/Get-ImageInfo - Displays information about images in a WIM, a VHD
or a FFU file.
/Commit-Image - Saves changes to a mounted WIM or VHD image.
/Unmount-Image - Unmounts a mounted WIM or VHD image.
/Mount-Image - Mounts an image from a WIM or VHD file.
/Remount-Image - Recovers an orphaned image mount directory.
/Cleanup-Mountpoints - Deletes resources associated with corrupted
mounted images.
IMAGE SPECIFICATIONS:
/Online - Targets the running operating system.
/Image - Specifies the path to the root directory of an
offline Windows image.
DISM OPTIONS:
/English - Displays command line output in English.
/Format - Specifies the report output format.
/WinDir - Specifies the path to the Windows directory.
/SysDriveDir - Specifies the path to the system-loader file named
BootMgr.
/LogPath - Specifies the logfile path.
/LogLevel - Specifies the output level shown in the log (1-4).
/NoRestart - Suppresses automatic reboots and reboot prompts.
/Quiet - Suppresses all output except for error messages.
/ScratchDir - Specifies the path to a scratch directory.
For more information about these DISM options and their arguments, specify an
option immediately before /?.
Examples:
DISM.exe /Mount-Wim /?
DISM.exe /ScratchDir /?
DISM.exe /Image:C:\test\offline /?
DISM.exe /Online /?
Loaded Modules:
| Path |
| C:\WINDOWS\system32\Dism.exe |
| C:\WINDOWS\System32\KERNEL32.DLL |
| C:\WINDOWS\System32\KERNELBASE.dll |
| C:\WINDOWS\SYSTEM32\ntdll.dll |
Signature
- Status: Signature verified.
- Serial:
33000002ED2C45E4C145CF48440000000002ED
- Thumbprint:
312860D2047EB81F8F58C29FF19ECDB4C634CF6A
- Issuer: CN=Microsoft Windows Production PCA 2011, O=Microsoft Corporation, L=Redmond, S=Washington, C=US
- Subject: CN=Microsoft Windows, O=Microsoft Corporation, L=Redmond, S=Washington, C=US
- Original Filename: DISM.EXE.MUI
- Product Name: Microsoft Windows Operating System
- Company Name: Microsoft Corporation
- File Version: 10.0.22000.1 (WinBuild.160101.0800)
- Product Version: 10.0.22000.1
- Language: English (United States)
- Legal Copyright: Microsoft Corporation. All rights reserved.
- Machine Type: 64-bit
File Scan
- VirusTotal Detections: 0/73
- VirusTotal Link: https://www.virustotal.com/gui/file/00b01cbe2ca62f9c74835c01b48fec6dc4adf9049bac531d9c3c0ddd9379902a/detection
Possible Misuse
The following table contains possible examples of Dism.exe being misused. While Dism.exe is not inherently malicious, its legitimate functionality can be abused for malicious purposes.
MIT License. Copyright (c) 2020-2021 Strontic.