CmdID

CmdID / Files

ImagingDevices.exe

Imaging Devices Control Panel file version info

Program on Windows 2 known copies with hashes 2 Sigma rules name it

Opens CmdID with your command. It is read in your browser and sent nowhere.

Is it the real ImagingDevices.exe?

file version info and known copies
Original nameImagingDevices.cpl in the file’s header: a renamed copy still carries it
Installed inC:\Program Files (x86)\Windows Photo Viewer\
C:\Program Files\Windows Photo Viewer\
Signed byMicrosoft Windows
ProductMicrosoft Windows Operating System, Microsoft Corporation
DescriptionImaging Devices Control Panel

2 known copies

10.0.17763.1 (WinBuild.160101.0800) · C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe · signed by Microsoft Windows

a21e5f3a91ffeec54cdf5e8cdef190083c1712ea5181435728b20f48566a7cdc

10.0.17763.1 (WinBuild.160101.0800) · C:\Program Files\Windows Photo Viewer\ImagingDevices.exe · signed by Microsoft Windows

aca461fd070d009740519feff8289fd1be2be3cc09011b28503fd535114adb3c

From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.

What detects it

Sigma process creation rules that name ImagingDevices.exe
highImagingDevices Unusual Parent/Child ProcessesNasreddine Bencherchali (Nextron Systems)

Sigma names ImagingDevices.exe in 2 rules in all, for every kind of event; this is the process creation rule CmdID evaluates.