Is cmimageworker.exe a malware or Windows process?

After completing a successful CU KB4512941 this morning, I ran the Reliability Monitor to check for any issues. I noticed an entry that C:\Windows\System32\cmimageworker.exe had stopped working.

I wasn't familiar with cmimageworker.exe so I did a quick google search and found results ranging from it being a virus/malware, to discussions about it mentioned as being a bug in a windows process causing large CPU usage (8 to 10 months ago). I did see one mention that it was part of WDAG.

File Property/Details provided NO information.

A search here at TenForums gave ZERO results. Any info would be appreciated. Thanks, Jeff

Odd, I don't have cmimageworker.exe on any of my 1903 machines. But by deduction I think it may be an item that is added if you enable the optional Sandbox or Application Guard features in 1903. These two create large folders in C:\ProgramData\Microsoft\Windows\Containers\BaseImages that can be difficult to remove if you then turn them off, see my post #43 in this thread.

What is this large folder?

From the command line shown in the images here...

Cmimageworker.exe on Windows 10 19H1 Build using high CPU is a bug, not a virus, Says Microsoft

...it appears cmimageworker's purpose is to clean up these base image folders.

Hi Bree, thanks for the reply.

I've been investigating most of the morning and I've come to basically the same conclusion.

I've noticed since my original post...

This happened on my desktop, (my main computer). Neither of my 2 laptops have it in Windows\System32, however, it does appear (or some reference to it) in multiple Windows\WinXsX and Windows\Servicing\LCU folders on all 3 computers.I guessing the CM in cmimageworker... is Container Management.

Also, cmimageworker stopped working at 6:31 this morning which was the same time that KB4512941 finished installing.

I have checked the file with both WD and MBAM in and neither report an issue with it.

You may be correct about it being Sandbox related because the desktop is the only one that I've attempted to install/enable Sandbox.

Also, I had already checked in 'Turn Windows features on or off' for WDAG, and that option is NOT there currently. Interesting. I have no idea if it was there before before this last update/indecent.

BTW... I had read the TECHDOWS article earlier, but it wasn't as definitive as I was hoping for. It was however the only thing that came even close to an answer.

Thanks again for the input.

rjeff said:

Neither of my 2 laptops have it in Windows\System32, however, it does appear (or some reference to it) in multiple Windows\WinXsX and Windows\Servicing\LCU folders on all 3 computers.

That makes sense. WinSxS is the Component Store, from which features will be installed when you add them in 'Turn Windows features on or off'.