home

wmp11-windowsxp-x86-he-il.exe

Windows Media Component Setup Application

Microsoft Corporation

This is a setup and installation application. This is installed with Windows Media Player 11. The file has been seen being downloaded from www.vins.co.il and multiple other hosts.
Publisher:
Microsoft Corporation  (signed and verified)

Product:
Windows Media Component Setup Application

Version:
11.0.5721.5262

MD5:
d10f5dc4a48b6b7642671ff646161049

SHA-1:
f4644faf4d64b52a7560bf40af4eb478a2007753

SHA-256:
c4d4b377a17e6932eaf44009cd13f211a8e450b4fa542da390f51828380100a8

Scanner detections:
0 / 68

Status:
Clean (as of last analysis)
Whitelisted  (by digital signature)

Analysis date:
12/25/2024 11:32:51 PM UTC  (a few moments ago)

File size:
24.5 MB (25,734,272 bytes)

Product version:
11.0.5721.5262

Copyright:
(C) Microsoft Corporation. All rights reserved.

Original file name:
WEXTRACT.EXE

File type:
Executable application (Win32 EXE)

Common path:
C:\users\{user}\downloads\wmp11-windowsxp-x86-he-il.exe

Digital Signature
Signed by:
Microsoft Corporation

Authority:
Microsoft Corporation

Valid from:
1/20/2009 3:58:26 AM

Valid to:
3/20/2010 4:08:26 AM

Subject:
CN=Microsoft Corporation, OU=AOC, O=Microsoft Corporation, L=Redmond, S=Washington, C=US

Issuer:
CN=Microsoft Code Signing PCA, O=Microsoft Corporation, L=Redmond, S=Washington, C=US

Serial number:
6101640F00000000000B

File PE Metadata
Compilation timestamp:
6/6/2000 11:43:56 PM

OS version:
5.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
5.12

CTPH (ssdeep):
393216:aiwHauo7VIejrKxN++sU8/W+hntUOEyMbc9SxUhspzefhQ5gagyw2ZFLuowsyJ:aRVsUsWaGOEyMgkLpCdBgFLt9I

Entry address:
0x2891

Entry point:
55, 8B, EC, 83, EC, 44, 56, FF, 15, DC, 10, 00, 01, 8B, F0, 8A, 06, 3C, 22, 75, 14, 8A, 46, 01, 46, 84, C0, 74, 04, 3C, 22, 75, F4, 80, 3E, 22, 75, 0D, 46, EB, 0A, 3C, 20, 7E, 06, 46, 80, 3E, 20, 7F, FA, 8A, 06, 84, C0, 74, 07, 3C, 20, 7F, 03, 46, EB, F3, 83, 65, E8, 00, 8D, 45, BC, 50, FF, 15, D8, 10, 00, 01, F6, 45, E8, 01, 74, 06, 0F, B7, 45, EC, EB, 03, 6A, 0A, 58, 50, 56, 6A, 00, 6A, 00, FF, 15, 60, 11, 00, 01, 50, E8, 0E, 00, 00, 00, 8B, F0, 56, FF, 15, D0, 10, 00, 01, 8B, C6, 5E, C9, C3, 56, 33, F6...
 
[+]

Entropy:
7.9996

Developed / compiled with:
Microsoft Visual C++

Code size:
34 KB (34,816 bytes)

The file wmp11-windowsxp-x86-he-il.exe has been discovered within the following program.

Windows Media Player 11  by Microsoft Corporation
Windows Media Player 11 was included with Vista with no updates, final release on XP. Windows Media Player is a media player and media library application developed by Microsoft that is used for playing audio, video and viewing images .
windows.microsoft.com/en-US/windows/download-windows-media-player
5% remove it
 
Powered by Should I Remove It?

The file wmp11-windowsxp-x86-he-il.exe has been seen being distributed by the following 3 URLs.

http://www.vins.co.il/.../flight-simulator-x

https://download.microsoft.com/download/e/a/1/.../wmp11-windowsxp-x86-HE-IL.exe

http://download.microsoft.com/download/e/a/1/.../wmp11-windowsxp-x86-HE-IL.exe

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.