rdpshell.exe

  • File Path: C:\Windows\system32\rdpshell.exe
  • Description: RemoteApp Shell

Hashes

Type Hash
MD5 FE617CBE8C91741FC09CF6F16FF34D8C
SHA1 4A5D7A1BFE7A7870678A0BEE70473853E9F49ADA
SHA256 F198566032C3BA7F8FBCF88A55A0153855F8AA5D2EFAEB1D0B8C077FD973A995
SHA384 8D833DC8D1FC39ABE2295051A6D8B664F1D5A06B300BAF8CDACD00AB78794B466D894A5EB5DD8A1FA52711526E110801
SHA512 BC73E00FB05A2BA30C6E29D8BA1B24AFE9C1A17577EA7DFFB4EAE101C5CC86AA222B6172FF18CB0600FEE97F0085DD7CE5A70396627222BD7248B8310E4A882C
SSDEEP 6144:LQO4sIYcDofOaXoECHz+2rzmk5trop0OrNxOJredVbv9/IEt:LQOZnfOaNCHfzV9oprNxOEdFv9/

Runtime Data

Loaded Modules:

Path
C:\Windows\System32\combase.dll
C:\Windows\System32\GDI32.dll
C:\Windows\System32\KERNEL32.DLL
C:\Windows\System32\KERNELBASE.dll
C:\Windows\System32\msvcrt.dll
C:\Windows\SYSTEM32\ntdll.dll
C:\Windows\System32\OLE32.dll
C:\Windows\system32\rdpshell.exe
C:\Windows\System32\RPCRT4.dll
C:\Windows\System32\ucrtbase.dll

Signature

  • Status: Signature verified.
  • Serial: 3300000266BD1580EFA75CD6D3000000000266
  • Thumbprint: A4341B9FD50FB9964283220A36A1EF6F6FAA7840
  • Issuer: CN=Microsoft Windows Production PCA 2011, O=Microsoft Corporation, L=Redmond, S=Washington, C=US
  • Subject: CN=Microsoft Windows, O=Microsoft Corporation, L=Redmond, S=Washington, C=US

File Metadata

  • Original Filename: rdpshell.exe.mui
  • Product Name: Microsoft Windows Operating System
  • Company Name: Microsoft Corporation
  • File Version: 10.0.19041.1 (WinBuild.160101.0800)
  • Product Version: 10.0.19041.1
  • Language: English (United States)
  • Legal Copyright: Microsoft Corporation. All rights reserved.

File Similarity (ssdeep match)

File Score
C:\Windows\system32\rdpshell.exe 80
C:\Windows\system32\rdpshell.exe 99

MIT License. Copyright (c) 2020-2021 Strontic.