CmdID

CmdID / Files

wmprph.exe

Windows Media Player Rich Preview Handler file version info

Program on Windows 6 known copies with hashes 1 Sigma rule names it

Opens CmdID with your command. It is read in your browser and sent nowhere.

Is it the real wmprph.exe?

file version info and known copies
Installed inC:\Program Files (x86)\Windows Media Player\
C:\Program Files\Windows Media Player\
Signed byMicrosoft Windows
ProductMicrosoft Windows Operating System, Microsoft Corporation
DescriptionWindows Media Player Rich Preview Handler

6 known copies

12.0.19041.329 (WinBuild.160101.0800) · C:\Program Files (x86)\Windows Media Player\wmprph.exe · signed by Microsoft Windows

a31fcfbec695bd29f2763ac52c7bcdb22e95cea9334e5841fa0bb379c5b35f8b

12.0.19041.329 (WinBuild.160101.0800) · C:\Program Files\Windows Media Player\wmprph.exe · signed by Microsoft Windows

ab81411a2fcd8c9dd2d62d95e54854795405ed6d10450c56a8ed9e988ec9d254

12.0.19041.1266 (WinBuild.160101.0800) · C:\Program Files\Windows Media Player\wmprph.exe · signed by Microsoft Windows

0263d4511b01c6d55f7adeb41848dd70559e447969b3eb1769b4f20cc819418b

12.0.19041.1266 (WinBuild.160101.0800) · C:\Program Files (x86)\Windows Media Player\wmprph.exe · signed by Microsoft Windows

d4bede88fe092e6df954ec32a6e88215c36cfadaf0957dd789e6ba4700ad91c1

12.0.17763.1282 (WinBuild.160101.0800) · C:\Program Files\Windows Media Player\wmprph.exe · signed by Microsoft Windows

89fddd93453d186fbd474a6ecf28cc4963f53650c7b45ccb239c64c69a87974b

12.0.17763.1282 (WinBuild.160101.0800) · C:\Program Files (x86)\Windows Media Player\wmprph.exe · signed by Microsoft Windows

e881d9f2bf10c20f7b8869c09c0f0e7ee082b924ae1a5bbce676556400fe5384

From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.

What detects it

Sigma

Sigma names wmprph.exe in 1 rule, for every kind of event; none is a process creation rule CmdID evaluates, so none is listed.