CmdID

CmdID / Files

proquota.exe

ProQuota file version info

Program on Windows 12 known copies with hashes 1 Sigma rule names it

Opens CmdID with your command. It is read in your browser and sent nowhere.

Is it the real proquota.exe?

file version info and known copies
Installed inC:\Windows\system32\
C:\Windows\SysWOW64\
Signed byMicrosoft Windows
ProductMicrosoft Windows Operating System, Microsoft Corporation
DescriptionProQuota

12 known copies

10.0.22000.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\proquota.exe · signed by Microsoft Windows

a3c2045176ac87766d80d1fbb7cf2517313157283c0607eae642fa0fed9dd03c

10.0.22000.1 (WinBuild.160101.0800) · C:\WINDOWS\SysWOW64\proquota.exe · signed by Microsoft Windows

cab826ac0d9ad191c1a8181f5c1d92da0edabdf724c6953a44be5c5526e5f7fb

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\system32\proquota.exe · signed by Microsoft Windows

817ed06c7bec832cd3b574491d149cec61d3d33f86af93607893f76d349bc38f

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\SysWOW64\proquota.exe · signed by Microsoft Windows

a5c199413a4800a0d5260aed37f0b923a52c9f1e69a584d153cbe04d58ce5600

10.0.18362.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\proquota.exe · signed by Microsoft Windows

c3f52b893578a49c36af3c0c15a2a5ed4e44f1f8669136712f607ebb28acf268

10.0.18362.1 (WinBuild.160101.0800) · C:\WINDOWS\SysWOW64\proquota.exe · signed by Microsoft Windows

edb9cf9b6559f09865260c78561defdfb1a8df9ab7e019e6f7a7791d5b4ed7ab

10.0.17763.1 (WinBuild.160101.0800) · C:\Windows\system32\proquota.exe · signed by Microsoft Windows

5cfd021b0e2d250f6396cf7d63fddf0d126ec3ffe4e99304e63df6868f0bf491

10.0.17763.1 (WinBuild.160101.0800) · C:\Windows\SysWOW64\proquota.exe · signed by Microsoft Windows

cd0f437d9658f06e19fe93809270e2906148807314703475457c70c59d54c354

10.0.14393.0 (rs1_release.160715-1616) · C:\Windows\SysWOW64\proquota.exe · signed by Microsoft Windows

5e73fe417a3655a5e730b28748f1b5389f038f7896a17022e53eb2a14c064e96

10.0.14393.0 (rs1_release.160715-1616) · C:\Windows\system32\proquota.exe · signed by Microsoft Windows

ffcc77959a2bb841d3b51b66535008964f0a28674dc0b449a510a5d9a7b70a27

6.3.9600.16384 (winblue_rtm.130821-1623) · C:\windows\system32\proquota.exe · not signed

947f2686eebfac23e7fb788f4fe5731178fb6bc4257e38568205541ce426e9f3

6.3.9600.16384 (winblue_rtm.130821-1623) · C:\windows\SysWOW64\proquota.exe · not signed

d9fedcacbed1184c3d492063bec05e3293bfbdcabfd097f711b01275bf2720b1

From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.

What detects it

Sigma process creation rules that name proquota.exe
highUncommon Userinit Child ProcessTom Ueltschi (@c_APT_ure), Tim Shelton