CmdID

CmdID / Files

qprocess.exe

Query Process Utility file version info

Program on Windows 9 known copies with hashes 1 Sigma rule names it Command qprocess

Opens CmdID with your command. It is read in your browser and sent nowhere.

Is it the real qprocess.exe?

file version info and known copies
Installed inC:\Windows\system32\
C:\Windows\SysWOW64\
Signed byMicrosoft Windows
ProductMicrosoft Windows Operating System, Microsoft Corporation
DescriptionQuery Process Utility

9 known copies

10.0.22000.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\qprocess.exe · signed by Microsoft Windows

8d85a115e5d285003790d14cce8d4a48c407c1a77560b803a5056b0b424dfa08

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\system32\qprocess.exe · signed by Microsoft Windows

f71965f45a393e95b8c10b6d8947903bd0f035fc8ca3982d0f1a7d42b23fa315

10.0.18362.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\qprocess.exe · signed by Microsoft Windows

c325df5932fb17d7909b633d11aac31be603bc210dbe3173afc237c22d206703

10.0.17763.1 (WinBuild.160101.0800) · C:\Windows\SysWOW64\qprocess.exe · signed by Microsoft Windows

23e556151bca6472a7885aa78a812ec783b4498d036cb2baae1d22442111cdd9

10.0.17763.1 (WinBuild.160101.0800) · C:\Windows\system32\qprocess.exe · signed by Microsoft Windows

7ee7a6fb1bdd972502d1eb23b7bd471a66cad63ca3b57d787a173fb290808eb6

10.0.14393.0 (rs1_release.160715-1616) · C:\Windows\system32\qprocess.exe · signed by Microsoft Windows

017e9e2914e74a951da7fcb4e281c2be2a1c246ee2942e6d540d612f675586d9

10.0.14393.0 (rs1_release.160715-1616) · C:\Windows\SysWOW64\qprocess.exe · signed by Microsoft Windows

d5b92ab0654819674badd553df707a8e861d35d2565914ea8514d42b20c5b485

6.3.9600.16384 (winblue_rtm.130821-1623) · C:\windows\system32\qprocess.exe · not signed

8c6e84197282f283347d8426e695bbdcfcd24e29eb49b077783f666891a1431d

6.3.9600.16384 (winblue_rtm.130821-1623) · C:\windows\SysWOW64\qprocess.exe · not signed

b9e673f60fd682b29a66ab3e819a8e1100f2a3621bef102ba71af66b072e9600

From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.

What detects it

Sigma process creation rules that name qprocess.exe
highSuspicious Process By Web Server ProcessThomas Patzke, Florian Roth (Nextron Systems), Zach Stanford @svch0st, Tim Shelton, Nasreddine Bencherchali (Nextron Systems)