CIM_ProcessExecutable - A link between a process and a data file indicating that the file participates in the execution of the process. Note: In order to receive all possible instances of this class, the SE_DEBUG

CIM_ProcessExecutable
A link between a process and a data file indicating that the file participates in the execution of the process. Note: In order to receive all possible instances of this class, the SE_DEBUG_PRIVILEGE should be enabled.
NameSpace Path
\ROOT\CIMV2
PROPERTY	SMS_REPORT	CIMTYPE	DESCRIPTION
Antecedent		Reference	The data file participating in the execution of the process.
BaseAddress		UInt64	BaseAddress represents the base address of the module in the address space of the associated process.
Dependent		Reference	The process.
GlobalProcessCount		UInt32	GlobalProcessCount is the current number of processes that have the file loaded in memory.
ModuleInstance		UInt32	ModuleInstance represents the Win32 instance handle.The ModuleInstance property has been deprecated. There is no replacement value and this property is now considered obsolete.
ProcessCount		UInt32	ProcessCount represents the reference count of the file in the associated process.
SAMPLE DATA INSTANCE
[LOCALE(1033): ToInstance Amended] instance of CIM_ProcessExecutable { Antecedent = "\\\\SCCM01\\root\\cimv2:CIM_DataFile.Name=\"C:\\\\WINDOWS\\\\system32\\\\winlogon.exe\""; BaseAddress = "16777216"; Dependent = "\\\\SCCM01\\root\\cimv2:Win32_Process.Handle=\"444\""; ModuleInstance = 16777216; };