Skip to content


Windows Management Instrumentation (WMI) is the infrastructure for management data and operations on Windows-based operating systems. It is Microsoft's implementation of Web-Based Enterprise Management (WBEM).

WMI uses the Common Information Model (CIM) to represent classes of information. CIM is developed and maintained by the DMTF (formerly known as the Distributed Management Task Force).

The Managed Object Format (MOF) is the language used to describe Common Information Model (CIM) classes.

The CIM database consists of multiple files (OBJECTS.DATA, MAPPING*.MAP, INDEX.BTR and prior to Windows Vista MAPPING.VER) that are located in the following directories:

"C:\Windows\System32\WBEM\repository\" on Vista+
"C:\Windows\System32\WBEM\repository\FS\" on WinXP/Win2003

There could also be copies of the CIM database files, in the following locations:



Malware and intrusion analysis

Evidence of File Execution