qappsrv.exe

File Path: C:\Windows\SysWOW64\qappsrv.exe
Description: Query Remote Desktop Session Host Server Utility

Hashes

Type	Hash
MD5	`D8C8828C9204592955566C8BEDAD419A`
SHA1	`32EC1EEEB0A2F61423AE47B19F7306F227526A82`
SHA256	`FE90F56D6830C6A908B113BBA48BF4101F14B54AE7423801AE499050605FC350`
SHA384	`B4FE56E8DE99F4BEE5C84FD124D544AF408DCE2B338C0CBE65E1823035A881A20E917DA605FBEC40039BC91C7AA61135`
SHA512	`F5E92D5A3913C3C30C7715F5B05E22576B2C90B414376F08D5187333B7CCC5F4854ED64C1BC56CF40658762B2D2326EFEC350B71EFDF7F710FFC14B89795864C`
SSDEEP	`384:8ZpTvaEfkbGhoLwP33/koPHS/UFdt8Hq9zW2oOdWLaWUeh:8Zp+ocGhoK/qn2Fm/`
IMP	`1A15C5ED7BC4BF3801523763FB69275D`
PESHA1	`D5408E96D5A0C8903AF2D1CCEA13E1212473CF62`
PE256	`E948351D3756F6EC6BD7CE6F1AEA4232565DB4E6DB5172C37E6E2DD80609B22C`

Runtime Data

Usage (stdout):

Displays the available Remote Desktop Session Host servers on the network.

QUERY TERMSERVER [servername] [/DOMAIN:domain] [/ADDRESS] [/CONTINUE]

  servername      Identifies a Remote Desktop Session Host server.
  /DOMAIN:domain  Displays information for the specified domain (defaults 
                  to the current domain).
  /ADDRESS        Displays network and node addresses.
  /CONTINUE       Does not pause after each screen of information.

Usage (stderr):

Invalid parameter(s)
Displays the available Remote Desktop Session Host servers on the network.

QUERY TERMSERVER [servername] [/DOMAIN:domain] [/ADDRESS] [/CONTINUE]

  servername      Identifies a Remote Desktop Session Host server.
  /DOMAIN:domain  Displays information for the specified domain (defaults 
                  to the current domain).
  /ADDRESS        Displays network and node addresses.
  /CONTINUE       Does not pause after each screen of information.

Child Processes:

conhost.exe

Open Handles:

Path	Type
(R-D) C:\Windows\SysWOW64\en-US\qappsrv.exe.mui	File
(RW-) C:\Users\user	File
(RW-) C:\Windows	File
\BaseNamedObjects\C:ProgramDataMicrosoftWindowsCaches*{6AF0698E-D558-4F6E-9B3C-3716689AF493}.2.ver0x0000000000000004.db	Section
\BaseNamedObjects\C:ProgramDataMicrosoftWindowsCaches*{DDF571F2-BE98-426D-8288-1A9A39C3FDA2}.2.ver0x0000000000000004.db	Section
\BaseNamedObjects\C:ProgramDataMicrosoftWindowsCaches*cversions.2.ro	Section
\BaseNamedObjects\NLS_CodePage_1252_3_2_0_0	Section
\BaseNamedObjects\NLS_CodePage_437_3_2_0_0	Section

Loaded Modules:

Path
C:\Windows\SYSTEM32\ntdll.dll
C:\Windows\System32\wow64.dll
C:\Windows\System32\wow64cpu.dll
C:\Windows\System32\wow64win.dll
C:\Windows\SysWOW64\qappsrv.exe

Signature

Status: Signature verified.
Serial: 33000001C422B2F79B793DACB20000000001C4
Thumbprint: AE9C1AE54763822EEC42474983D8B635116C8452
Issuer: CN=Microsoft Windows Production PCA 2011, O=Microsoft Corporation, L=Redmond, S=Washington, C=US
Subject: CN=Microsoft Windows, O=Microsoft Corporation, L=Redmond, S=Washington, C=US

File Metadata

Original Filename: qappsrv.exe.mui
Product Name: Microsoft Windows Operating System
Company Name: Microsoft Corporation
File Version: 10.0.17763.1 (WinBuild.160101.0800)
Product Version: 10.0.17763.1
Language: English (United States)
Legal Copyright: Microsoft Corporation. All rights reserved.
Machine Type: 32-bit

File Scan

VirusTotal Detections: 0/68
VirusTotal Link: https://www.virustotal.com/gui/file/fe90f56d6830c6a908b113bba48bf4101f14b54ae7423801ae499050605fc350/detection/

Additional Info*

*The information below is copied from MicrosoftDocs, which is maintained by Microsoft. Available under CC BY 4.0 license.

qappsrv

Applies to: Windows Server 2022, Windows Server 2019, Windows Server 2016, Windows Server 2012 R2, Windows Server 2012

Displays a list of all Remote Desktop Session Host servers on the network. To find out what’s new in the latest version, see What’s New in Remote Desktop Services in Windows Server.

[!NOTE] This command is the same as the query termserver command.