qappsrv.exe

File Path: C:\WINDOWS\system32\qappsrv.exe
Description: Query Remote Desktop Session Host Server Utility

Hashes

Type	Hash
MD5	`CD837CD96739A7C28ADF231B3113E215`
SHA1	`3750F6A824EC26F86E9D3C16A2A0D593D94BE226`
SHA256	`4180949BB3EF6E913A8DA36B1745EA481043F6A7B8A2DE15701B5FB0E8E5CBFD`
SHA384	`BC9A488CD923A6FA7840EF240CADBA3CE4BEE2C285269300471601A86259EF5F1529B1ED5832DA7CC6D5FD143BF0373E`
SHA512	`E6EEAED387A088B2EF3DBEAE4C0C84906EDE6F3E53E53EEE86D532DFB60973287355550CF6004C54E37C141157750945F67F939F3C12A3B7D57C1BD96D9553AB`
SSDEEP	`768:oTmkgdZK9vQJCtk07diY4Y6pZmYN25fFey:YmldZniSU6zN7y`
IMP	`868BFA1AAB4C99A8643F150421706BD1`
PESHA1	`918D6102C7688684EF350B2AAA3E34ED0525C028`
PE256	`8F1AAEAB56B3923CE75F38C102EE8F4CE05E3B010C3926535F13953A31711D05`

Runtime Data

Usage (stdout):

Displays the available Remote Desktop Session Host servers on the network.

QUERY TERMSERVER [servername] [/DOMAIN:domain] [/ADDRESS] [/CONTINUE]

  servername      Identifies a Remote Desktop Session Host server.
  /DOMAIN:domain  Displays information for the specified domain (defaults 
                  to the current domain).
  /ADDRESS        Displays network and node addresses.
  /CONTINUE       Does not pause after each screen of information.

Usage (stderr):

Invalid parameter(s)
Displays the available Remote Desktop Session Host servers on the network.

QUERY TERMSERVER [servername] [/DOMAIN:domain] [/ADDRESS] [/CONTINUE]

  servername      Identifies a Remote Desktop Session Host server.
  /DOMAIN:domain  Displays information for the specified domain (defaults 
                  to the current domain).
  /ADDRESS        Displays network and node addresses.
  /CONTINUE       Does not pause after each screen of information.

Child Processes:

conhost.exe

Open Handles:

Path	Type
(R-D) C:\Windows\System32\en-US\qappsrv.exe.mui	File
(RW-) C:\Windows\System32	File
\BaseNamedObjects\C:ProgramDataMicrosoftWindowsCaches*{6AF0698E-D558-4F6E-9B3C-3716689AF493}.2.ver0x0000000000000001.db	Section
\BaseNamedObjects\C:ProgramDataMicrosoftWindowsCaches*{DDF571F2-BE98-426D-8288-1A9A39C3FDA2}.2.ver0x0000000000000001.db	Section
\BaseNamedObjects\C:ProgramDataMicrosoftWindowsCaches*cversions.2.ro	Section
\Sessions\2\BaseNamedObjects\NLS_CodePage_1252_3_2_0_0	Section
\Sessions\2\BaseNamedObjects\NLS_CodePage_437_3_2_0_0	Section

Loaded Modules:

Path
C:\WINDOWS\System32\KERNEL32.DLL
C:\WINDOWS\System32\KERNELBASE.dll
C:\WINDOWS\SYSTEM32\ntdll.dll
C:\WINDOWS\system32\qappsrv.exe

Signature

Status: Signature verified.
Serial: 33000002ED2C45E4C145CF48440000000002ED
Thumbprint: 312860D2047EB81F8F58C29FF19ECDB4C634CF6A
Issuer: CN=Microsoft Windows Production PCA 2011, O=Microsoft Corporation, L=Redmond, S=Washington, C=US
Subject: CN=Microsoft Windows, O=Microsoft Corporation, L=Redmond, S=Washington, C=US

File Metadata

Original Filename: qappsrv.exe.mui
Product Name: Microsoft Windows Operating System
Company Name: Microsoft Corporation
File Version: 10.0.22000.1 (WinBuild.160101.0800)
Product Version: 10.0.22000.1
Language: English (United States)
Legal Copyright: Microsoft Corporation. All rights reserved.
Machine Type: 64-bit

File Scan

VirusTotal Detections: 0/73
VirusTotal Link: https://www.virustotal.com/gui/file/4180949bb3ef6e913a8da36b1745ea481043f6a7b8a2de15701b5fb0e8e5cbfd/detection

Additional Info*

*The information below is copied from MicrosoftDocs, which is maintained by Microsoft. Available under CC BY 4.0 license.

qappsrv

Applies to: Windows Server 2022, Windows Server 2019, Windows Server 2016, Windows Server 2012 R2, Windows Server 2012

Displays a list of all Remote Desktop Session Host servers on the network. To find out what’s new in the latest version, see What’s New in Remote Desktop Services in Windows Server.

[!NOTE] This command is the same as the query termserver command.