which windows API called when execute this command

wmic qfe get hotfixid



A lot of APIs are called in this case. wmic is an executable. If you're asking because you want to replace such a command the updates installed on the machine are listed under Software\Microsoft\Windows\CurrentVersion\Component Based servicing\Packages. WMI has its own datastores which are probably less useful to you.


When you execute command wmic qfe get hotfixid from commandline it first execute windows API function CreateProcessW with parameters of command and fill path of wmic.exe

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.