• File Path: C:\WINDOWS\system32\wbem\WinMgmt.exe
  • Description: WMI Service Control Utility


Type Hash
MD5 2DF88907278A31C8110899B49F314176
SHA1 AA33106BE3293FC41D893411A538825D193D748F
SHA256 9B9B92EB2F7D0EE54BAD71B4D91627362DD8A14489CFA962E5A4F15547B1E9ED
SHA384 8D523BE3F7DB49151C7EE14E99DAFDADC93F7AC3798306637E056862FF33D4D413C62459ECF501D400DBDA3856743C2F
SHA512 36CE38578BAEF184A3A186AFEE7339949121C4F33A5465BB42657A1F1959F68214D6133822E538B5F2296AFD775038DC295349A5762B96156E3E178D52D5D1BD
SSDEEP 1536:r4lW6oPfSwSz2v8vdShIPoANJLlAXuSXv+qSFEAeOF5:rcp68vshIPFJRAhP2EAeQ
IMP 718C6F5529DBFF57B3E65F5A78FB2F26
PESHA1 8196331CBDF44A377852D0807740F53C6FF1340B
PE256 E29A415A4661515A84F6E04BE69003209048DBF477C462D59978263FAB1D1FDE

Runtime Data

Usage (stdout):

Invalid parameter

Windows Management Instrumentation

Usage:  winmgmt	[/backup <filename>] [/restore <filename> <flag>]
		[/resyncperf] [/standalonehost [<level>]] [/sharedhost]
		[/verifyrepository [<path>]] [/salvagerepository]

/backup <filename>
	Causes WMI to back up the repository to the specified file name. The
	filename argument should contain the full path to the file location.
	This process requires a write lock on the repository so that write
	operations to the repository are suspended until the backup process is

/restore <filename> <flag>
	Manually restores the WMI repository from the specified backup file.
	The filename argument should contain the full path to the backup file
	location. To perform the restore operation, WMI saves the existing
	repository to write back if the operation fails. Then the repository is
	restored from the backup file that is specified in the filename
	argument. If exclusive access to the repository cannot be achieved,
	existing clients are disconnected from WMI. The flag argument must be a
	1 (force - disconnect users and restore) or 0 (default - restore if no
	users connected) and specifies the restore mode.

	Registers the system performance libraries with WMI.

/standalonehost [<level>]
	Moves the Winmgmt service to a standalone Svchost process that has a
	fixed DCOM endpoint. The default endpoint is "ncacn_ip_tcp.0.24158".
	However, the endpoint may be changed by running Dcomcnfg.exe. The level
	argument is the authentication level for the Svchost process. If level
	is not specified, the default is 4 (RPC_C_AUTHN_LEVEL_PKT).

	Moves the Winmgmt service into the shared Svchost process.

/verifyrepository [<path>]
	Performs a consistency check on the WMI repository. When you add the
	/verifyrepository switch without the <path> argument, then the live
	repository currently used by WMI is verified. When you specify the path
	argument, you can verify any saved copy of the repository. In this
	case, the path argument should contain the full path to the saved
	repository copy. The saved repository should be a copy of the entire
	repository folder.

	Performs a consistency check on the WMI repository, and if an
	inconsistency is detected, rebuilds the repository.  The content of the
	inconsistent repository is merged into the rebuilt repository, if it
	can be read. The salvage operation always works with the repository
	that the WMI service is currently using. MOF files that contain the
	#pragma autorecover preprocessor statement are restored to the

	The repository is reset to the initial state when the operating system
	is first installed. MOF files that contain the #pragma autorecover
	preprocessor statement are restored to the repository.

Loaded Modules:



  • Status: Signature verified.
  • Serial: 33000002ED2C45E4C145CF48440000000002ED
  • Thumbprint: 312860D2047EB81F8F58C29FF19ECDB4C634CF6A
  • Issuer: CN=Microsoft Windows Production PCA 2011, O=Microsoft Corporation, L=Redmond, S=Washington, C=US
  • Subject: CN=Microsoft Windows, O=Microsoft Corporation, L=Redmond, S=Washington, C=US

File Metadata

  • Original Filename: winmgmt.exe.mui
  • Product Name: Microsoft Windows Operating System
  • Company Name: Microsoft Corporation
  • File Version: 10.0.22000.1 (WinBuild.160101.0800)
  • Product Version: 10.0.22000.1
  • Language: English (United States)
  • Legal Copyright: Microsoft Corporation. All rights reserved.
  • Machine Type: 64-bit

File Scan

  • VirusTotal Detections: 0/74
  • VirusTotal Link:

File Similarity (ssdeep match)

File Score
C:\Windows\system32\wbem\wbemtest.exe 44
C:\Windows\system32\wbem\wbemtest.exe 47
C:\windows\system32\wbem\wbemtest.exe 49
C:\WINDOWS\system32\wbem\wbemtest.exe 38
C:\Windows\system32\wbem\wbemtest.exe 35
C:\windows\system32\wbem\WinMgmt.exe 75
C:\Windows\system32\wbem\WinMgmt.exe 82
C:\Windows\system32\wbem\WinMgmt.exe 75
C:\Windows\system32\wbem\WinMgmt.exe 72
C:\WINDOWS\system32\wbem\WinMgmt.exe 79
C:\Windows\system32\wbem\WinMgmt.exe 71
C:\Windows\system32\wbem\WinMgmt.exe 75
C:\Windows\system32\wbem\WinMgmt.exe 75
C:\Windows\SysWOW64\wbem\wbemcntl.dll 36
C:\Windows\SysWOW64\wbem\WinMgmt.exe 74
C:\WINDOWS\SysWOW64\wbem\WinMgmt.exe 75
C:\Windows\SysWOW64\wbem\WinMgmt.exe 74
C:\WINDOWS\SysWOW64\wbem\WinMgmt.exe 65
C:\windows\SysWOW64\wbem\WinMgmt.exe 69
C:\Windows\SysWOW64\wbem\WinMgmt.exe 65

MIT License. Copyright (c) 2020-2021 Strontic.