sdchange.exe

  • File Path: C:\Windows\system32\sdchange.exe
  • Description: Windows Remote Assistance SD Server

Hashes

Type Hash
MD5 7C801E3D4A13B5F1047B6843B76800A8
SHA1 5B31F95D088CF2B8ECFE82F30B02C4B8E882C8C6
SHA256 B5DD0952E1B8DAC257B6AF7E3C0674585E834A4B8EF280D730057252592F9879
SHA384 D5D1467F731B4C273D11214C8A6AA6A8D12B90860125D9806C7A4EF573FD56E36F0A747AB95B4C1AC1EEE790F30FF079
SHA512 6DDDF0F3B54F4B02F5919ACCD69A8A1913773818F2A4A7C4A7706F234D875BCA1CD7D185E3D17DA149CAEAF08EA5C430705D67D8EAF90D6803C1B5C4A995D18A
SSDEEP 1536:0ZayPR1zuZlyF40iNEIHeLSF+Bhkb8X6XwE85di:0NPRxu2O0i2E+BLmwB5di
IMP 66292039E97668307DE2282308C3E6DF
PESHA1 0DB3BB037C25F647984D9EC677CB849A9F18F5D7
PE256 1339D26C95C74E66E96C5ED45C3879BA74A1A2870942AC3D0075A3B70F82CC9E

Runtime Data

Open Handles:

Path Type
(R-D) C:\Windows\System32\en-US\sdchange.exe.mui File
(RW-) C:\Users\user File
\BaseNamedObjects__ComCatalogCache__ Section
\BaseNamedObjects\C:*ProgramData*Microsoft*Windows*Caches*{6AF0698E-D558-4F6E-9B3C-3716689AF493}.2.ver0x0000000000000002.db Section
\BaseNamedObjects\C:*ProgramData*Microsoft*Windows*Caches*{DDF571F2-BE98-426D-8288-1A9A39C3FDA2}.2.ver0x0000000000000002.db Section
\BaseNamedObjects\C:*ProgramData*Microsoft*Windows*Caches*cversions.2 Section
\BaseNamedObjects\NLS_CodePage_1252_3_2_0_0 Section
\BaseNamedObjects\NLS_CodePage_437_3_2_0_0 Section

Loaded Modules:

Path
C:\Windows\System32\ADVAPI32.dll
C:\Windows\System32\combase.dll
C:\Windows\System32\GDI32.dll
C:\Windows\System32\gdi32full.dll
C:\Windows\System32\KERNEL32.DLL
C:\Windows\System32\KERNELBASE.dll
C:\Windows\System32\msvcp_win.dll
C:\Windows\System32\msvcrt.dll
C:\Windows\SYSTEM32\ntdll.dll
C:\Windows\System32\OLEAUT32.dll
C:\Windows\System32\RPCRT4.dll
C:\Windows\system32\sdchange.exe
C:\Windows\System32\sechost.dll
C:\Windows\System32\ucrtbase.dll
C:\Windows\System32\USER32.dll
C:\Windows\System32\win32u.dll

Signature

  • Status: Signature verified.
  • Serial: 3300000266BD1580EFA75CD6D3000000000266
  • Thumbprint: A4341B9FD50FB9964283220A36A1EF6F6FAA7840
  • Issuer: CN=Microsoft Windows Production PCA 2011, O=Microsoft Corporation, L=Redmond, S=Washington, C=US
  • Subject: CN=Microsoft Windows, O=Microsoft Corporation, L=Redmond, S=Washington, C=US

File Metadata

  • Original Filename: sdchange.exe.mui
  • Product Name: Microsoft Windows Operating System
  • Company Name: Microsoft Corporation
  • File Version: 10.0.19041.1 (WinBuild.160101.0800)
  • Product Version: 10.0.19041.1
  • Language: English (United States)
  • Legal Copyright: Microsoft Corporation. All rights reserved.
  • Machine Type: 64-bit

File Scan

  • VirusTotal Detections: 0/75
  • VirusTotal Link: https://www.virustotal.com/gui/file/b5dd0952e1b8dac257b6af7e3c0674585e834a4b8ef280d730057252592f9879/detection

MIT License. Copyright (c) 2020-2021 Strontic.