Change.exe

Remote Desktop Services MultiUser Change Utility

Execute

Execute an arbitrary executable via trusted system executable.

change.exe user

Once executed, `change.exe` will execute `chgusr.exe` in the same folder. Thus, if `change.exe` is copied to a folder and an arbitrary executable is renamed to `chgusr.exe`, `change.exe` will spawn it. Instead of `user`, it is also possible to use `port` or `logon` as command-line option. — MITRE: T1218 — Privileges: User