CmdID

CmdID / Files

poqexec.exe

Primitive Operations Queue Executor file version info

Program on Windows 20 known copies with hashes 8 Sigma rules name it

Opens CmdID with your command. It is read in your browser and sent nowhere.

Is it the real poqexec.exe?

file version info and known copies
Installed inC:\Windows\system32\
C:\Windows\SysWOW64\
Signed byMicrosoft Windows
ProductMicrosoft Windows Operating System, Microsoft Corporation
DescriptionPrimitive Operations Queue Executor

20 known copies

10.0.22000.280 (WinBuild.160101.0800) · C:\WINDOWS\SysWOW64\poqexec.exe · signed by Microsoft Windows

44c2533656f31e342fbe8e6b0df8098f85bc227cb72b6267a56d189f2c93ae66

10.0.22000.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\poqexec.exe · signed by Microsoft Windows

6b40de3e54fd9e7595a390fc4f53797a37c8f483a931767dbca4920a43278ef8

10.0.19041.680 (WinBuild.160101.0800) · C:\Windows\SysWOW64\poqexec.exe · not signed

431631601a6646d711632d93cfa768bd522f125320bd8bfadcb2d18b67a61303

10.0.19041.504 (WinBuild.160101.0800) · C:\Windows\SysWOW64\poqexec.exe · not signed

5679910005c1a1df6705bdf6fd034a9ec023cd73981333c0f1cc621175a1f1e5

10.0.19041.441 (WinBuild.160101.0800) · C:\Windows\SysWOW64\poqexec.exe · not signed

bfae94c2fc5642b7b165dd35ae78f61d84533c2f9757b7d72017d761bc7f27fe

10.0.19041.329 (WinBuild.160101.0800) · C:\Windows\SysWOW64\poqexec.exe · signed by Microsoft Windows

15d8b726fd2371c094af15d320421ef061d53ef6869ae27c7e9575f06bbb192f

10.0.19041.1310 (WinBuild.160101.0800) · C:\Windows\SysWOW64\poqexec.exe · not signed

38dd837216199f9b58a55b52f6d96b7eb8602036acb2fe888988e69cf1e8a033

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\system32\poqexec.exe · not signed

05f6277b91d780d5ec7bde8fd12a93003efdae030f6194a7c91502b13aa55aab

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\system32\poqexec.exe · signed by Microsoft Windows

6d688e25dcc43b36ed7889c81ea46216928ce90ec56ec30d0110f20c1161ba39

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\system32\poqexec.exe · not signed

719a2f4960e8fd9bb340f9182749e561e0da3f9f0464d022ac597a3b4b4a350c

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\system32\poqexec.exe · not signed

b47e181b9aca9ede316cae1ca6c50ce0abd623994e4eb0deecadc7c044f7e6a3

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\system32\poqexec.exe · not signed

c0c8ffc51f4bf8dd4154bca0a55839ba360364b7d50377ce06564b24cbc6f09c

10.0.18362.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\poqexec.exe · signed by Microsoft Windows

030618fbf96393c100b56d97afe01c0ea752c657fd982e29653de9ea4d7074ee

10.0.18362.1 (WinBuild.160101.0800) · C:\WINDOWS\SysWOW64\poqexec.exe · signed by Microsoft Windows

fa7bb9d8c35ff3a1da80fe16c3c7fdcc18a8d10b2619715dd3c598f6efb7f725

10.0.17763.1 (WinBuild.160101.0800) · C:\Windows\system32\poqexec.exe · signed by Microsoft Windows

164bc59090dc8fc229eb3f62d1c549c8f2496f31c3499a36a7359d1cd9768ae9

10.0.17763.1 (WinBuild.160101.0800) · C:\Windows\SysWOW64\poqexec.exe · signed by Microsoft Windows

ed38d575d3ce8e16710182c17afc86181ffa23b9023156938c2c14141279867f

10.0.14393.3622 (rs1_release.200311-1737) · C:\Windows\SysWOW64\poqexec.exe · signed by Microsoft Windows

0a38019d8c0f7f3c5e429bc393859576bcb9031e6ebe255bb19f15fcd30395ce

10.0.14393.0 (rs1_release.160715-1616) · C:\Windows\system32\poqexec.exe · signed by Microsoft Windows

d376b08ccddd00755aa49da2d1645af0a7af938bca65284de1e4e7ca0d5da80a

6.3.9600.19651 (winblue_ltsb_escrow.200212-1700) · C:\windows\SysWOW64\poqexec.exe · not signed

c4038aa119b24360b20e4f93d91e643a79017b352f3742071ffa352ec3cdf246

6.3.9600.16384 (winblue_rtm.130821-1623) · C:\windows\system32\poqexec.exe · not signed

6b9bca26dabf6e4e87e23f135e447aae7caf42b9cbf350737affafbe312d07da

From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.

What detects it

Sigma

Sigma names poqexec.exe in 8 rules, for every kind of event; none is a process creation rule CmdID evaluates, so none is listed.