msinfo32.exe

  • File Path: C:\WINDOWS\SysWOW64\msinfo32.exe
  • Description: System Information

Screenshot

msinfo32.exe

Hashes

Type Hash
MD5 4A695CCD0B9FAD7D22BC66EA38CDF6CE
SHA1 F6F656F8CE2DBB9E3EA0BAFF6A171B22419307F7
SHA256 F14E711B23C0AEEA051B4C6D468CA01D23DFAA8EE4175C9D3B0EE1486BC44E71
SHA384 C89D753C60EDA22CE84C56266D6582088E9992B3BA1D83F845C1B836E68B1433FC22E2EA83914943465E38BE33E4EC08
SHA512 602725B34ED4BF395EAEE13FBB548C4FFDDF571B0B5D413D7980CE839CA0E465836DA2A1955220FB00A1367136FFE81408E092D000B5434F4ADAC223E8F58BD0
SSDEEP 6144:X/M1AfculUhs34Jp5Idld19l9QD6ZEOHHrpm1XUZLxheP:X/M1AfQWIn5Idld19l97tLpm1E92
IMP 6D9CF46ED92B3429FD278DA0928EF505
PESHA1 242225484E423FCC19423F0EC59455BC64233A25
PE256 6AE62A7FE3B2C3E3883081E79D8621A0A96137834345672B6251CED5BA374785

Runtime Data

Window Title:

System Information

Open Handles:

Path Type
(R-D) C:\Windows\Fonts\StaticCache.dat File
(R-D) C:\Windows\System32\en-US\MFC42u.dll.mui File
(R-D) C:\Windows\System32\en-US\msinfo32.exe.mui File
(R-D) C:\Windows\System32\en-US\propsys.dll.mui File
(R-D) C:\Windows\System32\en-US\winnlsres.dll.mui File
(R-D) C:\Windows\SysWOW64\en-US\user32.dll.mui File
(RW-) C:\Windows File
(RW-) C:\Windows\SysWOW64 File
(RW-) C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.22000.120_none_e541a94fcce8ed6d File
\BaseNamedObjects__ComCatalogCache__ Section
\BaseNamedObjects\C:*ProgramData*Microsoft*Windows*Caches*{6AF0698E-D558-4F6E-9B3C-3716689AF493}.2.ver0x0000000000000001.db Section
\BaseNamedObjects\C:*ProgramData*Microsoft*Windows*Caches*{DDF571F2-BE98-426D-8288-1A9A39C3FDA2}.2.ver0x0000000000000001.db Section
\BaseNamedObjects\C:*ProgramData*Microsoft*Windows*Caches*cversions.2.ro Section
\Sessions\2\BaseNamedObjects\NLS_CodePage_1252_3_2_0_0 Section
\Sessions\2\BaseNamedObjects\NLS_CodePage_437_3_2_0_0 Section
\Sessions\2\Windows\Theme1077709572 Section
\Windows\Theme3461253685 Section

Loaded Modules:

Path
C:\WINDOWS\SYSTEM32\ntdll.dll
C:\WINDOWS\System32\wow64.dll
C:\WINDOWS\System32\wow64base.dll
C:\WINDOWS\System32\wow64con.dll
C:\WINDOWS\System32\wow64cpu.dll
C:\WINDOWS\System32\wow64win.dll
C:\WINDOWS\SysWOW64\msinfo32.exe

Signature

  • Status: Signature verified.
  • Serial: 33000002ED2C45E4C145CF48440000000002ED
  • Thumbprint: 312860D2047EB81F8F58C29FF19ECDB4C634CF6A
  • Issuer: CN=Microsoft Windows Production PCA 2011, O=Microsoft Corporation, L=Redmond, S=Washington, C=US
  • Subject: CN=Microsoft Windows, O=Microsoft Corporation, L=Redmond, S=Washington, C=US

File Metadata

  • Original Filename: msinfo.dll
  • Product Name: Microsoft Windows Operating System
  • Company Name: Microsoft Corporation
  • File Version: 10.0.22000.71 (WinBuild.160101.0800)
  • Product Version: 10.0.22000.71
  • Language: English (United States)
  • Legal Copyright: Microsoft Corporation. All rights reserved.
  • Machine Type: 32-bit

File Scan

  • VirusTotal Detections: 0/72
  • VirusTotal Link: https://www.virustotal.com/gui/file/f14e711b23c0aeea051b4c6d468ca01d23dfaa8ee4175c9d3b0ee1486bc44e71/detection

File Similarity (ssdeep match)

File Score
C:\Program Files (x86)\Common Files\Microsoft Shared\MSInfo\msinfo32.exe 38
C:\Program Files (x86)\Common Files\Microsoft Shared\MSInfo\msinfo32.exe 41
C:\Program Files (x86)\Common Files\microsoft shared\MSInfo\msinfo32.exe 38
C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe 35
C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe 36
C:\Program Files\Common Files\microsoft shared\MSInfo\msinfo32.exe 41
C:\Windows\system32\msinfo32.exe 35
C:\Windows\system32\msinfo32.exe 36
C:\Windows\system32\msinfo32.exe 41
C:\WINDOWS\system32\msinfo32.exe 43
C:\windows\system32\msinfo32.exe 40
C:\WINDOWS\system32\msinfo32.exe 36
C:\Windows\system32\msinfo32.exe 41
C:\Windows\SysWOW64\msinfo32.exe 35
C:\windows\SysWOW64\msinfo32.exe 40
C:\Windows\SysWOW64\msinfo32.exe 38
C:\WINDOWS\SysWOW64\msinfo32.exe 38
C:\Windows\SysWOW64\msinfo32.exe 41
C:\Windows\SysWOW64\msinfo32.exe 38

Additional Info*

*The information below is copied from MicrosoftDocs, which is maintained by Microsoft. Available under CC BY 4.0 license.

msinfo32

Applies to: Windows Server 2022, Windows Server 2019, Windows Server 2016, Windows Server 2012 R2, Windows Server 2012

Opens the System Information tool to display a comprehensive view of the hardware, system components, and software environment on the local computer.

Some System Information categories contain large amounts of data. You can use the start /wait command to optimize reporting performance for these categories. For more information, see System Information.

Syntax

msinfo32 [/pch] [/nfo <path>] [/report <path>] [/computer <computername>] [/showcategories] [/category <categoryID>] [/categories {+<categoryID>(+<categoryID>)|+all(-<categoryID>)}]

Parameters

Parameter Description
<path> Specifies the file to be opened in the format C:\Folder1\File1.xxx, where C is the drive letter, Folder1 is the folder, File1 is the file name, and xxx is the file name extension.<p>This file can be an .nfo, .xml, .txt, or .cab file.
<computername> Specifies the name of the target or local computer. This can be a UNC name, an IP address, or a full computer name.
<categoryID> Specifies the ID of the category item. You can obtain the category ID by using /showcategories.
/pch Displays the System History view in the System Information tool.
/nfo Saves the exported file as an .nfo file. If the file name that is specified in path does not end in an .nfo extension, the .nfo extension is automatically appended to the file name.
/report Saves the file in path as a text file. The file name is saved exactly as it appears in path. The .txt extension is not appended to the file unless it is specified in path.
/computer Starts the System Information tool for the specified remote computer. You must have the appropriate permissions to access the remote computer.
/showcategories Starts the System Information tool with all available category IDs displayed, rather than displaying the friendly or localized names. For example, the Software Environment category is displayed as the SWEnv category.
/category Starts System Information with the specified category selected. Use /showcategories to display a list of available category IDs.
/categories Starts System Information with only the specified category or categories displayed. It also limits the output to the selected category or categories. Use /showcategories to display a list of available category IDs.
/? Displays help at the command prompt.

Examples

To list the available category IDs, type:

msinfo32 /showcategories

To start the System Information tool with all available information displayed, except Loaded Modules, type:

msinfo32 /categories +all -loadedmodules

To display System Summary information and to create an .nfo file called syssum.nfo, which contains information in the System Summary category, type:

msinfo32 /nfo syssum.nfo /categories +systemsummary

To display resource conflict information and to create an .nfo file called conflicts.nfo, which contains information about resource conflicts, type:

msinfo32 /nfo conflicts.nfo /categories +componentsproblemdevices+resourcesconflicts+resourcesforcedhardware

Additional References

MIT License. Copyright (c) 2020-2021 Strontic.