CmdID

CmdID / Files

qwinsta.exe

Query Session Utility file version info

Program on Windows 9 known copies with hashes 2 Sigma rules name it Command qwinsta

Opens CmdID with your command. It is read in your browser and sent nowhere.

Is it the real qwinsta.exe?

file version info and known copies
Installed inC:\Windows\system32\
C:\Windows\SysWOW64\
Signed byMicrosoft Windows
ProductMicrosoft Windows Operating System, Microsoft Corporation
DescriptionQuery Session Utility

9 known copies

10.0.22000.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\qwinsta.exe · signed by Microsoft Windows

98d422b44483766acea1131fc7fec85476ba3942bfd969b6b4ed81326296010e

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\system32\qwinsta.exe · signed by Microsoft Windows

08ac265f1888731d6ff54d762fa08b06b172a9424b66ce113afcefef9759c37b

10.0.18362.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\qwinsta.exe · signed by Microsoft Windows

09f2cddfeb76fd6a758edc6f2abc9147e2f3d1a11afecaf28b69f2abe71b0bef

10.0.17763.1 (WinBuild.160101.0800) · C:\Windows\SysWOW64\qwinsta.exe · signed by Microsoft Windows

1644b3f0cde757edd7100243b5fbddde0a15f73041f5e666d11089ba07e9ed86

10.0.17763.1 (WinBuild.160101.0800) · C:\Windows\system32\qwinsta.exe · signed by Microsoft Windows

e1ae2ec83fec0c8cf01b9e4c3da910be61abf3071e56eda834590c405e8e4e69

10.0.14393.0 (rs1_release.160715-1616) · C:\Windows\system32\qwinsta.exe · signed by Microsoft Windows

4e4f3651c108bb2d3b660dc1fe492373eac23bc9d4c79b2d65521d03732797c0

10.0.14393.0 (rs1_release.160715-1616) · C:\Windows\SysWOW64\qwinsta.exe · signed by Microsoft Windows

d292a447b82b1ee408b3fee4aa092b9e437866e2c2631087b4a698426592dc76

6.3.9600.16384 (winblue_rtm.130821-1623) · C:\windows\SysWOW64\qwinsta.exe · not signed

33e0694012804397159c9e4634dd749d497de5a47c6ddc805510edb2e7f222dc

6.3.9600.16384 (winblue_rtm.130821-1623) · C:\windows\system32\qwinsta.exe · not signed

56272afae873484043bf272dded0de04fbd4c23704a129550663c425b134ebc2

From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.

What detects it

Sigma process creation rules that name qwinsta.exe
highSuspicious Process By Web Server ProcessThomas Patzke, Florian Roth (Nextron Systems), Zach Stanford @svch0st, Tim Shelton, Nasreddine Bencherchali (Nextron Systems)
lowLocal Accounts DiscoveryTimur Zinniatullin, Daniil Yugoslavskiy, oscd.community