CmdID

CmdID / Files

wimserv.exe

Wimfltr v2 extractor file version info

Program on Windows 10 known copies with hashes 1 Sigma rule names it

Opens CmdID with your command. It is read in your browser and sent nowhere.

Is it the real wimserv.exe?

file version info and known copies
Original nameextractr.exe in the file’s header: a renamed copy still carries it
Installed inC:\Windows\system32\
Signed byMicrosoft Windows
ProductMicrosoft Windows Operating System, Microsoft Corporation
DescriptionWimfltr v2 extractor

10 known copies

10.0.22000.194 (WinBuild.160101.0800) · C:\WINDOWS\system32\wimserv.exe · signed by Microsoft Windows

e8727e2cc66edf54c05b86375779f7b4c6f98989e06e887d9ad0158ae645f2e4

10.0.19041.84 (WinBuild.160101.0800) · C:\Windows\system32\wimserv.exe · signed by Microsoft Windows

b2898f0b6078a4e919c45c67ac4d2793e0e1cae68fa86dd43c3f0667e0fbdd8a

10.0.19041.572 (WinBuild.160101.0800) · C:\Windows\system32\wimserv.exe · signed by Microsoft Windows

39ba7611e151d75d55db784adc001ef23ba88474a4fc223ecea3f21312d15737

10.0.19041.423 (WinBuild.160101.0800) · C:\Windows\system32\wimserv.exe · signed by Microsoft Windows

a1a78be49fcd562b96ab1994046be20b0b2fe2de328e5fdbfb40c17e5a447334

10.0.19041.1202 (WinBuild.160101.0800) · C:\Windows\system32\wimserv.exe · signed by Microsoft Windows

96f67682aff88f597bd00b999a6c62529c456ee72b3cd1f89cb7d319b5bc13e3

10.0.18362.657 (WinBuild.160101.0800) · C:\WINDOWS\system32\wimserv.exe · signed by Microsoft Windows

958419e84b173bf13f68b1e69610fcc89d6703c8a253d5da31d28b85758ab428

10.0.17763.1518 (WinBuild.160101.0800) · C:\Windows\system32\wimserv.exe · signed by Microsoft Windows

ba2b58bc77d665e43c9cec3b8d8b88aebffd67114f38b29a0d1635ae4d7643ea

10.0.17763.1039 (WinBuild.160101.0800) · C:\Windows\system32\wimserv.exe · signed by Microsoft Windows

8be46facf743b74f23e69feb09794c1abb689c9ec7667f7ed83dbee8f88e582d

10.0.14393.3503 (rs1_release.200131-0410) · C:\Windows\system32\wimserv.exe · signed by Microsoft Windows

a8dc3ba17ea1519c2026b91500ddf2979bcef4145cf220ed775825c15fdd00fd

6.3.9600.19622 (winblue_ltsb.200111-0600) · C:\windows\system32\wimserv.exe · not signed

a7dc774c8139d791b75de5e9f2bd44b67e8b1ab906dc41a9294e7c7649832907

From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.

What detects it

Sigma

Sigma names wimserv.exe in 1 rule, for every kind of event; none is a process creation rule CmdID evaluates, so none is listed.