change.exe

  • File Path: C:\Windows\system32\change.exe
  • Description: Remote Desktop Services Change Utility

Hashes

Type Hash
MD5 B5A2475E90B9970F16C50D392B9A16BB
SHA1 0FC5EAAFBB93C2D1816F0FED0E1D5B2A3AE57373
SHA256 D2DF044B73E57CB2FFAB4BEAE33355301B124B7CA45861C683B97D376019D717
SHA384 9D521667F05AA8D2E975441A3B1FA7E0560A0F2C82116D68A58EE38433D69AD0DB43C2C709C347EF3994562E7C8D7324
SHA512 C2AFC2FF49A578C67921290D598BFF0E5AA0149731B4732D6ECDB3A44E71C3AA20C734E6E63E4ECAEB668F49C168BB1CF2A72D6F711332457B05B7D1FC65B9BE
SSDEEP 192:/YOS4SwveEAMuDzEAk3ZsThGdgo8jJIbO4kvByIhwxxth2GcDK71gmfWOLW:/YOQ1M/Kg7y2bzGlOxth20hFfWOLW
IMP CCC9DA4A55E90DFE34CBCDB066D6A6B3
PESHA1 2FDB2069AD91D71D2C54D9F31D0727A0C67BB3CC
PE256 B016F29FDB4D388B233A121EB106BEBD6F1BAAD823727F4F3E7CFB578E25F619

Runtime Data

Usage (stdout):

CHANGE { LOGON | PORT | USER }

Usage (stderr):

Invalid parameter(s)
CHANGE { LOGON | PORT | USER }

Loaded Modules:

Path
C:\Windows\system32\change.exe
C:\Windows\System32\KERNEL32.DLL
C:\Windows\System32\KERNELBASE.dll
C:\Windows\SYSTEM32\ntdll.dll

Signature

  • Status: Signature verified.
  • Serial: 330000023241FB59996DCC4DFF000000000232
  • Thumbprint: FF82BC38E1DA5E596DF374C53E3617F7EDA36B06
  • Issuer: CN=Microsoft Windows Production PCA 2011, O=Microsoft Corporation, L=Redmond, S=Washington, C=US
  • Subject: CN=Microsoft Windows, O=Microsoft Corporation, L=Redmond, S=Washington, C=US

File Metadata

  • Original Filename: change.exe.mui
  • Product Name: Microsoft Windows Operating System
  • Company Name: Microsoft Corporation
  • File Version: 10.0.19041.1 (WinBuild.160101.0800)
  • Product Version: 10.0.19041.1
  • Language: English (United States)
  • Legal Copyright: Microsoft Corporation. All rights reserved.
  • Machine Type: 64-bit

File Scan

  • VirusTotal Detections: 0/75
  • VirusTotal Link: https://www.virustotal.com/gui/file/d2df044b73e57cb2ffab4beae33355301b124b7ca45861c683b97d376019d717/detection

File Similarity (ssdeep match)

File Score
C:\Windows\system32\query.exe 83
C:\Windows\system32\reset.exe 75

Additional Info*

*The information below is copied from MicrosoftDocs, which is maintained by Microsoft. Available under CC BY 4.0 license.

change

Applies to: Windows Server 2022, Windows Server 2019, Windows Server 2016, Windows Server 2012 R2, Windows Server 2012

Changes Remote Desktop Session Host server settings for logons, COM port mappings, and install mode.

[!NOTE] To find out what’s new in the latest version, see What’s New in Remote Desktop Services in Windows Server.

Syntax

 change logon
 change port
 change user

Parameters

Parameter Description
change logon command Enables or disables logons from client sessions on an Remote Desktop Session Host server, or displays current logon status.
change port command Lists or changes the COM port mappings to be compatible with MS-DOS applications.
change user command Changes the install mode for the Remote Desktop Session Host server.

Additional References

MIT License. Copyright (c) 2020-2021 Strontic.