openfiles.exe

  • File Path: C:\WINDOWS\SysWOW64\openfiles.exe
  • Description: Displays the current open files list

Hashes

Type Hash
MD5 49891AC0AD16536C25BB166ABFF2A218
SHA1 C32C5C739374F9C1B634FB527D71E5680A40BC40
SHA256 0BC4EB1731E746DFF639479CA848DEA6CB420907FC7DF297A06DBAD610E0E189
SHA384 D05E94B5355C411FAFBE28B6647B43A508F5D8EE7182B88047135C2349AB3576F589E0C1F589248960A4C53F18520965
SHA512 49014872F7F932BDF8FC7367380965B54E39B673BA2F2BB840BF3F3F446E421E3BF25CE15B25B3AAE33B2529F5DF0A79AC0498CDE2AA02E3D3999B8F70865C47
SSDEEP 1536:ceRfzyr9l0L6WWium5PxzcVTc4Nafo8Vx4Lm:Sl0L6w6VTc4x8Vxv
IMP 38CD96D0D1AF0958C911A15071FCF5B2
PESHA1 4EAD0AE2940687F49A1B1666C5B97792D4338078
PE256 B62C7DE08A9DF46C25302F91C3F5D4989A7E4ADEB70FD6D7AAE2BCB54FEA44E5

Runtime Data

Usage (stderr):

ERROR: The target system must be running a 32 bit OS.

Loaded Modules:

Path
C:\WINDOWS\SYSTEM32\ntdll.dll
C:\WINDOWS\System32\wow64.dll
C:\WINDOWS\System32\wow64base.dll
C:\WINDOWS\System32\wow64con.dll
C:\WINDOWS\System32\wow64cpu.dll
C:\WINDOWS\System32\wow64win.dll
C:\WINDOWS\SysWOW64\openfiles.exe

Signature

  • Status: Signature verified.
  • Serial: 33000002ED2C45E4C145CF48440000000002ED
  • Thumbprint: 312860D2047EB81F8F58C29FF19ECDB4C634CF6A
  • Issuer: CN=Microsoft Windows Production PCA 2011, O=Microsoft Corporation, L=Redmond, S=Washington, C=US
  • Subject: CN=Microsoft Windows, O=Microsoft Corporation, L=Redmond, S=Washington, C=US

File Metadata

  • Original Filename: opnfiles.exe
  • Product Name: Microsoft Windows Operating System
  • Company Name: Microsoft Corporation
  • File Version: 10.0.22000.1 (WinBuild.160101.0800)
  • Product Version: 10.0.22000.1
  • Language: English (United States)
  • Legal Copyright: Microsoft Corporation. All rights reserved.
  • Machine Type: 32-bit

File Scan

  • VirusTotal Detections: 0/73
  • VirusTotal Link: https://www.virustotal.com/gui/file/0bc4eb1731e746dff639479ca848dea6cb420907fc7df297a06dbad610e0e189/detection

Additional Info*

*The information below is copied from MicrosoftDocs, which is maintained by Microsoft. Available under CC BY 4.0 license.


openfiles

Enables an administrator to query, display, or disconnect files and directories that have been opened on a system. This command also enables or disables the system Maintain Objects List global flag.

openfiles /disconnect

Enables an administrator to disconnect files and folders that have been opened remotely through a shared folder.

Syntax

openfiles /disconnect [/s <system> [/u [<domain>\]<username> [/p [<password>]]]] {[/id <openfileID>] | [/a <accessedby>] | [/o {read | write | read/write}]} [/op <openfile>]
Parameters
Parameter Description
/s <system> Specifies the remote system to connect to (by name or IP address). Don’t use backslashes. If you don’t use the /s option, the command is run on the local computer by default. This parameter applies to all files and folders that are specified in the command.
/u [<domain>\]<username> Runs the command using the permissions of the specified user account. If you don’t use the /u option, system permissions are used by default.
/p [<password>] Specifies the password of the user account that is specified in the /u option. If you don’t use the /p option, a password prompt appears when the command is run.
/id <openfileID> Disconnects open files by the specified file ID. You can use the wildcard character (*) with this parameter.<p>Note: You can use the openfiles /query command to find the file ID.
/a <accessedby> Disconnects all open files associated with the user name specified in the accessedby parameter. You can use the wildcard character (*) with this parameter.
/o {read | write | read/write} Disconnects all open files with the specified open mode value. Valid values are Read, Write, or Read/Write. You can use the wildcard character (*) with this parameter.
/op <openfile> Disconnects all open file connections that are created by a specific open file name. You can use the wildcard character (*) with this parameter.
/? Displays help at the command prompt.

Examples

To disconnect all open files with the file ID 26843578, type:

openfiles /disconnect /id 26843578

To disconnect all open files and directories accessed by the user hiropln, type:

openfiles /disconnect /a hiropln

To disconnect all open files and directories with read/write mode, type:

openfiles /disconnect /o read/write

To disconnect the directory with the open file name *C:\testshare*, regardless of who is accessing it, type:

openfiles /disconnect /a * /op c:\testshare\

To disconnect all open files on the remote computer srvmain that are being accessed by the user hiropln, regardless of their ID, type:

openfiles /disconnect /s srvmain /u maindom\hiropln /id *

openfiles /query

Queries and displays all open files.

Syntax

openfiles /query [/s <system> [/u [<domain>\]<username> [/p [<password>]]]] [/fo {TABLE | LIST | CSV}] [/nh] [/v]
Parameters
Parameter Description
/s <system> Specifies the remote system to connect to (by name or IP address). Don’t use backslashes. If you don’t use the /s option, the command is run on the local computer by default. This parameter applies to all files and folders that are specified in the command.
/u [<domain>\]<username> Runs the command using the permissions of the specified user account. If you don’t use the /u option, system permissions are used by default.
/p [<password>] Specifies the password of the user account that is specified in the /u option. If you don’t use the /p option, a password prompt appears when the command is run.
[/fo {TABLE | LIST | CSV}] Displays the output in the specified format. Valid values include:<ul><li>TABLE - Displays output in a table.</li><li>LIST - Displays output in a list.</li><li>CSV - Displays output in Comma Separated Values (CSV) format.</li></ul>
/nh Suppresses column headers in the output. Valid only when the /fo parameter is set to TABLE or CSV.
/v Specifies that detailed (verbose) information be displayed in the output.
/? Displays help at the command prompt.

Examples

To query and display all open files, type:

openfiles /query

To query and display all open files in table format without headers, type:

openfiles /query /fo table /nh

To query and display all open files in list format with detailed information, type:

openfiles /query /fo list /v

To query and display all open files on the remote system srvmain by using the credentials for the user hiropln on the maindom domain, type:

openfiles /query /s srvmain /u maindom\hiropln /p p@ssW23

[!NOTE] In this example, the password is supplied on the command line. To prevent displaying the password, leave out the /p option. You’ll be prompted for the password, which won’t be echoed to the screen.

openfiles /local

Enables or disables the system Maintain Objects List global flag. If used without parameters, openfiles /local displays the current status of the Maintain Objects List global flag.

[!NOTE] Changes made by using the on or off option don’t take effect until you restart the system. Enabling the Maintain Objects List global flag might slow down your system.

Syntax

openfiles /local [on | off]
Parameters
Parameter Description
[on | off] Enables or disables the system Maintain Objects List global flag, which tracks local file handles.
/? Displays help at the command prompt.

Examples

To check the current status of the Maintain Objects List global flag, type:

openfiles /local

By default, the Maintain Objects List global flag is disabled, and the following message appears, INFO: The system global flag 'maintain objects list' is currently disabled.

To enable the Maintain Objects List global flag, type:

openfiles /local on

The following message appears when the global flag is enabled, SUCCESS: The system global flag 'maintain objects list' is enabled. This will take effect after the system is restarted.

To disable the Maintain Objects List global flag, type:

openfiles /local off

Additional References


MIT License. Copyright (c) 2020-2021 Strontic.