WinMgmt.exe
- File Path:
C:\Windows\system32\wbem\WinMgmt.exe
- Description: WMI Service Control Utility
Hashes
| Type |
Hash |
| MD5 |
C484B6FDECA3277FE586925BBBA5EF7E |
| SHA1 |
14FCD00883CAF6052053B9F52E60CBE3D407DF98 |
| SHA256 |
FBFB47D271B109973E3E7678D83D2FC20448775C26374DBCFFFAE445C932C592 |
| SHA384 |
A2E59065B09FF15E362A459632DD541B12FC4A8906569B81CE9D0269225F1B8B972155A1280C9E9811CDCA7D8B5C818A |
| SHA512 |
6794244C933DE3787828F996A8CD8299341A3D9517674DAB6705BA8A23C9AAF2ACA6E550A0135C0595A8E5F77D95BCEF457A82805E97021072E515F3F27C7EC4 |
| SSDEEP |
1536:E6/vNRQsuQNmv2vdShIPoANJLlAXuSXv+qSFEAeOFT:js2vshIPFJRAhP2EAeG |
| IMP |
798ACA9C42114FEEB9FA9A5FD82CBA43 |
| PESHA1 |
EE461250E5F1113F53CE078D7BD1DAC4EF878E6A |
| PE256 |
B8F3D905D5354D6862E89BDFEB86ED784261E8BAA8D67A5630696F78D3E36994 |
Runtime Data
Usage (stdout):
Invalid parameter
Windows Management Instrumentation
Usage: winmgmt [/backup <filename>] [/restore <filename> <flag>]
[/resyncperf] [/standalonehost [<level>]] [/sharedhost]
[/verifyrepository [<path>]] [/salvagerepository]
[/resetrepository]
/backup <filename>
Causes WMI to back up the repository to the specified file name. The
filename argument should contain the full path to the file location.
This process requires a write lock on the repository so that write
operations to the repository are suspended until the backup process is
completed.
/restore <filename> <flag>
Manually restores the WMI repository from the specified backup file.
The filename argument should contain the full path to the backup file
location. To perform the restore operation, WMI saves the existing
repository to write back if the operation fails. Then the repository is
restored from the backup file that is specified in the filename
argument. If exclusive access to the repository cannot be achieved,
existing clients are disconnected from WMI. The flag argument must be a
1 (force - disconnect users and restore) or 0 (default - restore if no
users connected) and specifies the restore mode.
/resyncperf
Registers the system performance libraries with WMI.
/standalonehost [<level>]
Moves the Winmgmt service to a standalone Svchost process that has a
fixed DCOM endpoint. The default endpoint is "ncacn_ip_tcp.0.24158".
However, the endpoint may be changed by running Dcomcnfg.exe. The level
argument is the authentication level for the Svchost process. If level
is not specified, the default is 4 (RPC_C_AUTHN_LEVEL_PKT).
/sharedhost
Moves the Winmgmt service into the shared Svchost process.
/verifyrepository [<path>]
Performs a consistency check on the WMI repository. When you add the
/verifyrepository switch without the <path> argument, then the live
repository currently used by WMI is verified. When you specify the path
argument, you can verify any saved copy of the repository. In this
case, the path argument should contain the full path to the saved
repository copy. The saved repository should be a copy of the entire
repository folder.
/salvagerepository
Performs a consistency check on the WMI repository, and if an
inconsistency is detected, rebuilds the repository. The content of the
inconsistent repository is merged into the rebuilt repository, if it
can be read. The salvage operation always works with the repository
that the WMI service is currently using. MOF files that contain the
#pragma autorecover preprocessor statement are restored to the
repository.
/resetrepository
The repository is reset to the initial state when the operating system
is first installed. MOF files that contain the #pragma autorecover
preprocessor statement are restored to the repository.
Loaded Modules:
| Path |
| C:\Windows\System32\KERNEL32.DLL |
| C:\Windows\System32\KERNELBASE.dll |
| C:\Windows\SYSTEM32\ntdll.dll |
| C:\Windows\system32\wbem\WinMgmt.exe |
Signature
- Status: Signature verified.
- Serial:
33000002EC6579AD1E670890130000000002EC
- Thumbprint:
F7C2F2C96A328C13CDA8CDB57B715BDEA2CBD1D9
- Issuer: CN=Microsoft Windows Production PCA 2011, O=Microsoft Corporation, L=Redmond, S=Washington, C=US
- Subject: CN=Microsoft Windows, O=Microsoft Corporation, L=Redmond, S=Washington, C=US
- Original Filename: winmgmt.exe.mui
- Product Name: Microsoft Windows Operating System
- Company Name: Microsoft Corporation
- File Version: 10.0.19041.1 (WinBuild.160101.0800)
- Product Version: 10.0.19041.1
- Language: English (United States)
- Legal Copyright: Microsoft Corporation. All rights reserved.
- Machine Type: 64-bit
File Scan
- VirusTotal Detections: 0/73
- VirusTotal Link: https://www.virustotal.com/gui/file/fbfb47d271b109973e3e7678d83d2fc20448775c26374dbcfffae445c932c592/detection
File Similarity (ssdeep match)
MIT License. Copyright (c) 2020-2021 Strontic.