// REFERENCE

WIM (Windows Imaging) signature

Signature (hex): 4D 53 57 49 4D (MSWIM)

A Windows WIM image starts with 4D 53 57 49 4D (MSWIM). It's the Windows deployment format (the install.wim in an ISO). It's also used to smuggle malware via email.

Related tools

Work with this in:

Related

Signatures verifiable with CyberEscudo's magic-bytes identifier. Educational content.