CmdID

CmdID / Files

wmplayer.exe

Windows Media Player file version info

Program on Windows 6 known copies with hashes 1 Sigma rule names it Command wmplayer

Opens CmdID with your command. It is read in your browser and sent nowhere.

Is it the real wmplayer.exe?

file version info and known copies
Installed inC:\Program Files (x86)\Windows Media Player\
C:\Program Files\Windows Media Player\
Signed byMicrosoft Windows
ProductMicrosoft Windows Operating System, Microsoft Corporation
DescriptionWindows Media Player

6 known copies

12.0.19041.1 (WinBuild.160101.0800) · C:\Program Files (x86)\Windows Media Player\wmplayer.exe · signed by Microsoft Windows

6cee4877b6663fc93e94ecc0489834379d2fae6c363eb36035d863733ab7c304

12.0.19041.1 (WinBuild.160101.0800) · C:\Program Files (x86)\Windows Media Player\wmplayer.exe · signed by Microsoft Windows

90d10cc4636741f5b8a9daddb43b22561cf4ca647d2ac7197621c124bf0eb53f

12.0.19041.1 (WinBuild.160101.0800) · C:\Program Files\Windows Media Player\wmplayer.exe · signed by Microsoft Windows

ad4463f1737ce4bb445663515a0cb24a9ea50929e46be81c803972d326fa7e10

12.0.19041.1 (WinBuild.160101.0800) · C:\Program Files\Windows Media Player\wmplayer.exe · signed by Microsoft Windows

c3252a14845280b1a938b4def08f04690ea36e4454d0bebeecc4e31a9c30d742

12.0.17763.1 (WinBuild.160101.0800) · C:\Program Files\Windows Media Player\wmplayer.exe · signed by Microsoft Windows

b3958d6fad71fa64227f2b41f57dbf9bab434746ba0d249e226408199c218f48

12.0.17763.1 (WinBuild.160101.0800) · C:\Program Files (x86)\Windows Media Player\wmplayer.exe · signed by Microsoft Windows

e38036765fdda1e24bc2dbbd83e3fe7726cd3bda85fca555cae25520a200918c

From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.

What detects it

Sigma process creation rules that name wmplayer.exe
criticalWinnti Malware HK University CampaignFlorian Roth (Nextron Systems), Markus Neis