systeminfo.exe

systeminfo.exe gathers system configuration into a single report: the OS name, version, and build, the install date and uptime, the hardware and memory, the domain and logon server, network card details, and the list of installed hotfixes by KB number. With /s <host> and credentials it can pull the same report from a remote machine. The genuine binary lives at C:\Windows\System32\systeminfo.exe.

Legitimately, systeminfo is run by administrators and asset-inventory tooling to record what a machine is and how it is configured. It only reads configuration.

systeminfo gives an attacker a fast profile of a host (T1082). The OS build and the hotfix list are the most useful parts: comparing installed KBs against known vulnerabilities points straight at missing patches that may allow privilege escalation. The domain, logon server, and network adapter details also sketch the environment around the host (T1016).

One run during legitimate inventory is normal. systeminfo run by an unexpected parent, or as part of an opening recon sequence with whoami and net, is what separates attacker fingerprinting from administration.