proquota.exe

  • File Path: C:\Windows\SysWOW64\proquota.exe
  • Description: ProQuota

Hashes

Type Hash
MD5 224AA81092A51AE0080DEE1E454E11AD
SHA1 F66CE33A20A672D16C6ED7652C88E240A6F10231
SHA256 A5C199413A4800A0D5260AED37F0B923A52C9F1E69A584D153CBE04D58CE5600
SHA384 D867FBEF545781784BD32FC0F948AD57A87D19F069A5E53F8B9323896B3FBA442A3EC02D48D6BF483FB31A28C1FFB59B
SHA512 853AA99417D5A11692E5615320BA4EDCEADBA4FC037E2B480264F0BD15D7CF684AB34A282A8B57EAF80C15F33B77B65DFE2342972434A5687BCBB2E7EEFE7D4D
SSDEEP 768:p/MRrdWqSTk1jGKBLTyQWAWkBPQ3ba2W3TI1Hc6F:JMRrdEAJGQyQxBPt1TI1Hc
IMP ECFCBB08CD09732932D8D88FAE38A065
PESHA1 30B3B7380BB4D355FDFB6F132C142F9EB8F521B3
PE256 2BE12CB55A04A33DC1659524C8B4CE613AE6753A2A03445B76242D769A425B6A

Runtime Data

Loaded Modules:

Path
C:\Windows\SYSTEM32\ntdll.dll
C:\Windows\System32\wow64.dll
C:\Windows\System32\wow64cpu.dll
C:\Windows\System32\wow64win.dll
C:\Windows\SysWOW64\proquota.exe

Signature

  • Status: Signature verified.
  • Serial: 3300000266BD1580EFA75CD6D3000000000266
  • Thumbprint: A4341B9FD50FB9964283220A36A1EF6F6FAA7840
  • Issuer: CN=Microsoft Windows Production PCA 2011, O=Microsoft Corporation, L=Redmond, S=Washington, C=US
  • Subject: CN=Microsoft Windows, O=Microsoft Corporation, L=Redmond, S=Washington, C=US

File Metadata

  • Original Filename: proquota.exe
  • Product Name: Microsoft Windows Operating System
  • Company Name: Microsoft Corporation
  • File Version: 10.0.19041.1 (WinBuild.160101.0800)
  • Product Version: 10.0.19041.1
  • Language: English (United States)
  • Legal Copyright: Microsoft Corporation. All rights reserved.
  • Machine Type: 32-bit

File Scan

  • VirusTotal Detections: 0/75
  • VirusTotal Link: https://www.virustotal.com/gui/file/a5c199413a4800a0d5260aed37f0b923a52c9f1e69a584d153cbe04d58ce5600/detection

Possible Misuse

The following table contains possible examples of proquota.exe being misused. While proquota.exe is not inherently malicious, its legitimate functionality can be abused for malicious purposes.

Source Source File Example License
sigma proc_creation_win_logon_scripts_userinitmprlogonscript_proc.yml - '\proquota.exe' DRL 1.0

MIT License. Copyright (c) 2020-2021 Strontic.