code.exe
VSCode binary, also portable (CLI) version
Categories: execute
View authoritative reference ↗🪟 CRAWLABLE DATASET INDEX
LOLBAS
Windows binaries, scripts, and libraries with documented Living off the Land use cases, commands, detections, and references.
Use this index to identify documented Windows-native behavior, then review the command, detection notes, and original LOLBAS entry before validating it in an authorized lab.
248 searchable binaries. Open the interactive explorer →
GfxDownloadWrapper.exe
Remote file download used by the Intel Graphics Control Panel, receives as first parameter a URL and a destination file path.
Categories: download
View authoritative reference ↗Powershell.exe
Powershell.exe is a a task-based command-line shell built on .NET.
Categories: execute
View authoritative reference ↗AddinUtil.exe
.NET Tool used for updating cache files for Microsoft Office Add-Ins.
Categories: execute
View authoritative reference ↗AppInstaller.exe
Tool used for installation of AppX/MSIX applications on Windows 10
Categories: download
View authoritative reference ↗Applaunch.exe
Microsoft .NET ClickOnce Launch Utility.
Categories: awl bypass
View authoritative reference ↗Aspnet_Compiler.exe
ASP.NET Compilation Tool
Categories: awl bypass
View authoritative reference ↗At.exe
Schedule periodic tasks
Categories: execute
View authoritative reference ↗Atbroker.exe
Helper binary for Assistive Technology (AT)
Categories: execute
View authoritative reference ↗Bash.exe
File used by Windows subsystem for Linux
Categories: execute, awl bypass
View authoritative reference ↗Bitsadmin.exe
Used for managing background intelligent transfer
Categories: execute, download, copy
View authoritative reference ↗CertOC.exe
Used for installing certificates
Categories: execute, download
View authoritative reference ↗CertReq.exe
Used for requesting and managing certificates
Categories: download, upload
View authoritative reference ↗Certutil.exe
Windows binary used for handling certificates
Categories: download, execute, encode, decode
View authoritative reference ↗Change.exe
Remote Desktop Services MultiUser Change Utility
Categories: execute
View authoritative reference ↗Cipher.exe
File Encryption Utility
Categories: tamper
View authoritative reference ↗Cmd.exe
The command-line interpreter in Windows
Categories: execute, download, upload
View authoritative reference ↗Cmdkey.exe
creates, lists, and deletes stored user names and passwords or credentials.
Categories: credentials
View authoritative reference ↗cmdl32.exe
Microsoft Connection Manager Auto-Download
Categories: download
View authoritative reference ↗Cmstp.exe
Installs or removes a Connection Manager service profile.
Categories: execute, awl bypass
View authoritative reference ↗Colorcpl.exe
Binary that handles color management
Categories: copy
View authoritative reference ↗ComputerDefaults.exe
ComputerDefaults.exe is a Windows system utility for managing default applications for tasks like web browsing, emailing, and media playback.
Categories: uac bypass
View authoritative reference ↗ConfigSecurityPolicy.exe
Binary part of Windows Defender. Used to manage settings in Windows Defender. You can configure different pilot collections for each of the co-management workloads. Being able to use different pilot collections allows you to take a more granular approach when shifting workloads.
Categories: upload, download
View authoritative reference ↗Conhost.exe
Console Window host
Categories: execute
View authoritative reference ↗Control.exe
Binary used to launch controlpanel items in Windows
Categories: execute
View authoritative reference ↗Csc.exe
Binary file used by .NET Framework to compile C# code
Categories: compile
View authoritative reference ↗Cscript.exe
Binary used to execute scripts in Windows
Categories: execute
View authoritative reference ↗CustomShellHost.exe
A host process that is used by custom shells when using Windows in Kiosk mode.
Categories: execute
View authoritative reference ↗DataSvcUtil.exe
DataSvcUtil.exe is a command-line tool provided by WCF Data Services that consumes an Open Data Protocol (OData) feed and generates the client data service classes that are needed to access a data service from a .NET Framework client application.
Categories: upload
View authoritative reference ↗Desktopimgdownldr.exe
Windows binary used to configure lockscreen/desktop image
Categories: download
View authoritative reference ↗DeviceCredentialDeployment.exe
Device Credential Deployment
Categories: conceal
View authoritative reference ↗Dfsvc.exe
ClickOnce engine in Windows used by .NET
Categories: awl bypass
View authoritative reference ↗Diantz.exe
Binary that package existing files into a cabinet (.cab) file
Categories: execute, download
View authoritative reference ↗Diskshadow.exe
Diskshadow.exe is a tool that exposes the functionality offered by the volume shadow copy Service (VSS).
Categories: dump, execute
View authoritative reference ↗Dnscmd.exe
A command-line interface for managing DNS servers
Categories: execute
View authoritative reference ↗Esentutl.exe
Binary for working with Microsoft Joint Engine Technology (JET) database
Categories: copy, execute, download
View authoritative reference ↗Eudcedit.exe
Private Character Editor Windows Utility
Categories: uac bypass
View authoritative reference ↗Eventvwr.exe
Displays Windows Event Logs in a GUI window.
Categories: uac bypass
View authoritative reference ↗Expand.exe
Binary that expands one or more compressed files
Categories: download, copy, execute
View authoritative reference ↗Explorer.exe
Binary used for managing files and system components within Windows
Categories: execute
View authoritative reference ↗Extexport.exe
Load a DLL located in the c:\test folder with a specific name.
Categories: execute
View authoritative reference ↗Extrac32.exe
Extract to ADS, copy or overwrite a file with Extrac32.exe
Categories: execute, download, copy
View authoritative reference ↗Findstr.exe
Write to ADS, discover, or download files with Findstr.exe
Categories: execute, credentials, download
View authoritative reference ↗Finger.exe
Displays information about a user or users on a specified remote computer that is running the Finger service or daemon
Categories: download
View authoritative reference ↗fltMC.exe
Filter Manager Control Program used by Windows
Categories: tamper
View authoritative reference ↗Forfiles.exe
Selects and executes a command on a file or set of files. This command is useful for batch processing.
Categories: execute
View authoritative reference ↗Fsutil.exe
File System Utility
Categories: tamper, execute
View authoritative reference ↗Ftp.exe
A binary designed for connecting to FTP servers
Categories: execute, download
View authoritative reference ↗Gpscript.exe
Used by group policy to process scripts
Categories: execute
View authoritative reference ↗Hh.exe
Binary used for processing chm files in Windows
Categories: download, execute
View authoritative reference ↗IMEWDBLD.exe
Microsoft IME Open Extended Dictionary Module
Categories: download
View authoritative reference ↗Ie4uinit.exe
Executes commands from a specially prepared ie4uinit.inf file.
Categories: execute
View authoritative reference ↗iediagcmd.exe
Diagnostics Utility for Internet Explorer
Categories: execute
View authoritative reference ↗Ieexec.exe
The IEExec.exe application is an undocumented Microsoft .NET Framework application that is included with the .NET Framework. You can use the IEExec.exe application as a host to run other managed applications that you start by using a URL.
Categories: download, execute
View authoritative reference ↗Ilasm.exe
used for compile c# code into dll or exe.
Categories: compile
View authoritative reference ↗Infdefaultinstall.exe
Binary used to perform installation based on content inside inf files
Categories: execute
View authoritative reference ↗Installutil.exe
The Installer tool is a command-line utility that allows you to install and uninstall server resources by executing the installer components in specified assemblies
Categories: awl bypass, execute, download
View authoritative reference ↗iscsicpl.exe
Microsoft iSCSI Initiator Control Panel tool
Categories: uac bypass
View authoritative reference ↗Jsc.exe
Binary file used by .NET to compile JavaScript code to .exe or .dll format
Categories: compile
View authoritative reference ↗Ldifde.exe
Creates, modifies, and deletes LDAP directory objects.
Categories: download
View authoritative reference ↗Makecab.exe
Binary to package existing files into a cabinet (.cab) file
Categories: execute, download
View authoritative reference ↗Mavinject.exe
Used by App-v in Windows
Categories: execute
View authoritative reference ↗Microsoft.Workflow.Compiler.exe
A utility included with .NET that is capable of compiling and executing C# or VB.net code.
Categories: execute, awl bypass
View authoritative reference ↗Mmc.exe
Load snap-ins to locally and remotely manage Windows systems
Categories: execute, uac bypass, download
View authoritative reference ↗Mofcomp.exe
Compiler that parses a file containing MOF statements and adds the classes and class instances defined in the file to the WMI repository. Threat actors can leverage this binary to install malicious MOF scripts
Categories: execute
View authoritative reference ↗MpCmdRun.exe
Binary part of Windows Defender. Used to manage settings in Windows Defender
Categories: download, execute
View authoritative reference ↗Msbuild.exe
Used to compile and execute code
Categories: awl bypass, execute
View authoritative reference ↗Msconfig.exe
MSConfig is a troubleshooting tool which is used to temporarily disable or re-enable software, device drivers or Windows services that run during startup process to help the user determine the cause of a problem with Windows
Categories: execute
View authoritative reference ↗Msdt.exe
Microsoft diagnostics tool
Categories: execute, awl bypass
View authoritative reference ↗Msedge.exe
Microsoft Edge browser
Categories: download, execute
View authoritative reference ↗Mshta.exe
Used by Windows to execute html applications. (.hta)
Categories: execute, download
View authoritative reference ↗Msiexec.exe
Used by Windows to execute msi files
Categories: execute
View authoritative reference ↗msoxmled.exe
Microsoft Office XML Editor, used to handle XML documents in Microsoft Office.
Categories: download
View authoritative reference ↗Netsh.exe
Netsh is a Windows tool used to manipulate network interface settings.
Categories: execute
View authoritative reference ↗Ngen.exe
Microsoft Native Image Generator.
Categories: download
View authoritative reference ↗Odbcconf.exe
Used in Windows for managing ODBC connections
Categories: execute
View authoritative reference ↗OfflineScannerShell.exe
Windows Defender Offline Shell
Categories: execute
View authoritative reference ↗OneDriveStandaloneUpdater.exe
OneDrive Standalone Updater
Categories: download
View authoritative reference ↗Pcalua.exe
Program Compatibility Assistant
Categories: execute
View authoritative reference ↗Pcwrun.exe
Program Compatibility Wizard
Categories: execute
View authoritative reference ↗Pktmon.exe
Capture Network Packets on the windows 10 with October 2018 Update or later.
Categories: recon
View authoritative reference ↗Pnputil.exe
Used for installing drivers
Categories: execute
View authoritative reference ↗Presentationhost.exe
File is used for executing Browser applications
Categories: execute, download
View authoritative reference ↗Print.exe
Used by Windows to send files to the printer
Categories: execute, copy
View authoritative reference ↗PrintBrm.exe
Printer Migration Command-Line Tool
Categories: download, execute
View authoritative reference ↗Provlaunch.exe
Launcher process
Categories: execute
View authoritative reference ↗Psr.exe
Windows Problem Steps Recorder, used to record screen and clicks.
Categories: recon
View authoritative reference ↗Query.exe
Remote Desktop Services MultiUser Query Utility
Categories: execute
View authoritative reference ↗Rasautou.exe
Windows Remote Access Dialer
Categories: execute
View authoritative reference ↗rdrleakdiag.exe
Microsoft Windows resource leak diagnostic tool
Categories: dump
View authoritative reference ↗Reg.exe
Used to manipulate the registry
Categories: execute, credentials
View authoritative reference ↗Regasm.exe
Part of .NET
Categories: awl bypass, execute
View authoritative reference ↗Regedit.exe
Used by Windows to manipulate registry
Categories: execute
View authoritative reference ↗Regini.exe
Used to manipulate the registry
Categories: execute
View authoritative reference ↗Register-cimprovider.exe
Used to register new wmi providers
Categories: execute
View authoritative reference ↗Regsvcs.exe
Regsvcs and Regasm are Windows command-line utilities that are used to register .NET Component Object Model (COM) assemblies
Categories: execute, awl bypass
View authoritative reference ↗Regsvr32.exe
Used by Windows to register dlls
Categories: awl bypass, execute
View authoritative reference ↗Replace.exe
Used to replace file with another file
Categories: copy, download
View authoritative reference ↗Reset.exe
Remote Desktop Services Reset Utility
Categories: execute
View authoritative reference ↗Rpcping.exe
Used to verify rpc connection
Categories: credentials
View authoritative reference ↗Rundll32.exe
Used by Windows to execute dll files
Categories: execute
View authoritative reference ↗Runexehelper.exe
Launcher process
Categories: execute
View authoritative reference ↗Runonce.exe
Executes a Run Once Task that has been configured in the registry
Categories: execute
View authoritative reference ↗Runscripthelper.exe
Execute target PowerShell script
Categories: execute
View authoritative reference ↗Sc.exe
Used by Windows to manage services
Categories: execute
View authoritative reference ↗Schtasks.exe
Schedule periodic tasks
Categories: execute
View authoritative reference ↗scp.exe
Used for uploading or downloading files over SSH.
Categories: execute
View authoritative reference ↗Scriptrunner.exe
Execute binary through proxy binary to evade defensive counter measures
Categories: execute
View authoritative reference ↗Setres.exe
Configures display settings
Categories: execute
View authoritative reference ↗SettingSyncHost.exe
Host Process for Setting Synchronization
Categories: execute
View authoritative reference ↗Sftp.exe
sftp.exe is a Windows command-line utility that uses the Secure File Transfer Protocol (SFTP) to securely transfer files between a local machine and a remote server.
Categories: execute
View authoritative reference ↗Sigverif.exe
File Signature Verification utility to verify digital signatures of files
Categories: execute
View authoritative reference ↗ssh.exe
Ssh.exe is the OpenSSH compatible client can be used to connect to Windows 10 (build 1809 and later) and Windows Server 2019 devices.
Categories: execute
View authoritative reference ↗Stordiag.exe
Storage diagnostic tool
Categories: execute
View authoritative reference ↗SyncAppvPublishingServer.exe
Used by App-v to get App-v server lists
Categories: execute
View authoritative reference ↗Tar.exe
Used by Windows to extract and create archives.
Categories: execute, copy
View authoritative reference ↗Ttdinject.exe
Used by Windows 1809 and newer to Debug Time Travel (Underlying call of tttracer.exe)
Categories: execute
View authoritative reference ↗Tttracer.exe
Used by Windows 1809 and newer to Debug Time Travel
Categories: execute, dump
View authoritative reference ↗Unregmp2.exe
Microsoft Windows Media Player Setup Utility
Categories: execute
View authoritative reference ↗vbc.exe
Binary file used for compile vbs code
Categories: compile
View authoritative reference ↗Verclsid.exe
Used to verify a COM object before it is instantiated by Windows Explorer
Categories: execute
View authoritative reference ↗Vssadmin.exe
Volume Shadow Copy Service administrative command-line tool
Categories: tamper
View authoritative reference ↗Wab.exe
Windows address book manager
Categories: execute
View authoritative reference ↗wbadmin.exe
Windows Backup Administration utility
Categories: dump
View authoritative reference ↗wbemtest.exe
WMI/WBEM Test Binary
Categories: execute
View authoritative reference ↗winget.exe
Windows Package Manager tool
Categories: execute, download, awl bypass
View authoritative reference ↗Wlrmdr.exe
Windows Logon Reminder executable
Categories: execute
View authoritative reference ↗Wmic.exe
The WMI command-line (WMIC) utility provides a command-line interface for WMI
Categories: execute, copy
View authoritative reference ↗WorkFolders.exe
Work Folders
Categories: execute
View authoritative reference ↗Wscript.exe
Used by Windows to execute scripts
Categories: execute
View authoritative reference ↗Wsreset.exe
Used to reset Windows Store settings according to its manifest file
Categories: uac bypass
View authoritative reference ↗wuauclt.exe
Windows Update Client
Categories: execute
View authoritative reference ↗Xwizard.exe
Execute custom class that has been added to the registry or download a file with Xwizard.exe
Categories: execute, download
View authoritative reference ↗msedge_proxy.exe
Microsoft Edge Browser
Categories: download, execute
View authoritative reference ↗msedgewebview2.exe
msedgewebview2.exe is the executable file for Microsoft Edge WebView2, which is a web browser control used by applications to display web content.
Categories: execute
View authoritative reference ↗odbcad32.exe
ODBC Data Source Administrator to manage User/System DSNs and ODBC drivers.
Categories: uac bypass
View authoritative reference ↗setupugc.exe
Setup Unattend Generic Command Processor used during Windows deployment.
Categories: execute
View authoritative reference ↗write.exe
Windows Write
Categories: execute
View authoritative reference ↗wt.exe
Windows Terminal
Categories: execute
View authoritative reference ↗Advpack.dll
Utility for installing software and drivers with rundll32.exe
Categories: awl bypass, execute
View authoritative reference ↗Desk.cpl
Desktop Settings Control Panel
Categories: execute
View authoritative reference ↗Dfshim.dll
ClickOnce engine in Windows used by .NET
Categories: awl bypass
View authoritative reference ↗Ieadvpack.dll
INF installer for Internet Explorer. Has much of the same functionality as advpack.dll.
Categories: awl bypass, execute
View authoritative reference ↗Ieframe.dll
Internet Browser DLL for translating HTML code.
Categories: execute
View authoritative reference ↗Mshtml.dll
Microsoft HTML Viewer
Categories: execute
View authoritative reference ↗Pcwutl.dll
Microsoft HTML Viewer
Categories: execute
View authoritative reference ↗PhotoViewer.dll
Windows Photo Viewer
Categories: download
View authoritative reference ↗Scrobj.dll
Windows Script Component Runtime
Categories: download
View authoritative reference ↗Setupapi.dll
Windows Setup Application Programming Interface
Categories: awl bypass, execute
View authoritative reference ↗Shdocvw.dll
Shell Doc Object and Control Library.
Categories: execute
View authoritative reference ↗Shell32.dll
Windows Shell Common Dll
Categories: execute
View authoritative reference ↗Shimgvw.dll
Photo Gallery Viewer
Categories: download
View authoritative reference ↗Syssetup.dll
Windows NT System Setup
Categories: awl bypass, execute
View authoritative reference ↗Url.dll
Internet Shortcut Shell Extension DLL.
Categories: execute
View authoritative reference ↗Zipfldr.dll
Compressed Folder library
Categories: execute
View authoritative reference ↗Comsvcs.dll
COM+ Services
Categories: dump
View authoritative reference ↗CL_LoadAssembly.ps1
PowerShell Diagnostic Script
Categories: execute
View authoritative reference ↗CL_Mutexverifiers.ps1
Proxy execution with CL_Mutexverifiers.ps1
Categories: execute
View authoritative reference ↗CL_Invocation.ps1
Aero diagnostics script
Categories: execute
View authoritative reference ↗Launch-VsDevShell.ps1
Locates and imports a Developer PowerShell module and calls the Enter-VsDevShell cmdlet
Categories: execute
View authoritative reference ↗Manage-bde.wsf
Script for managing BitLocker
Categories: execute
View authoritative reference ↗Pubprn.vbs
Proxy execution with Pubprn.vbs
Categories: execute
View authoritative reference ↗Syncappvpublishingserver.vbs
Script used related to app-v and publishing server
Categories: execute
View authoritative reference ↗UtilityFunctions.ps1
PowerShell Diagnostic Script
Categories: execute
View authoritative reference ↗winrm.vbs
Script used for manage Windows RM settings
Categories: execute, awl bypass
View authoritative reference ↗Pester.bat
Used as part of the Powershell pester
Categories: execute
View authoritative reference ↗AccCheckConsole.exe
Verifies UI accessibility requirements
Categories: execute, awl bypass
View authoritative reference ↗adplus.exe
Debugging tool included with Windows Debugging Tools
Categories: dump, execute
View authoritative reference ↗AgentExecutor.exe
Intune Management Extension included on Intune Managed Devices
Categories: execute
View authoritative reference ↗AppLauncher.exe
User Experience Virtualization tool that launches applications under monitoring to capture and synchronize user settings.
Categories: execute
View authoritative reference ↗AppCert.exe
Windows App Certification Kit command-line tool.
Categories: execute
View authoritative reference ↗Appvlp.exe
Application Virtualization Utility Included with Microsoft Office 2016
Categories: execute
View authoritative reference ↗Bcp.exe
Microsoft SQL Server Bulk Copy Program utility for importing and exporting data between SQL Server instances and data files.
Categories: download
View authoritative reference ↗Bginfo.exe
Background Information Utility included with SysInternals Suite
Categories: execute, awl bypass
View authoritative reference ↗Cdb.exe
Debugging tool included with Windows Debugging Tools.
Categories: execute
View authoritative reference ↗coregen.exe
Binary coregen.exe (Microsoft CoreCLR Native Image Generator) loads exported function GetCLRRuntimeHost from coreclr.dll or from .DLL in arbitrary path. Coregen is located within "C:\Program Files (x86)\Microsoft Silverlight\5.1.50918.0\" or another version of Silverlight. Coregen is signed by Microsoft and bundled with Microsoft Silverlight.
Categories: execute, awl bypass
View authoritative reference ↗Createdump.exe
Microsoft .NET Runtime Crash Dump Generator (included in .NET Core)
Categories: dump
View authoritative reference ↗csi.exe
Command line interface included with Visual Studio.
Categories: execute
View authoritative reference ↗DbgSrv.exe
A process server included with Debugging Tools for Windows for remote user-mode debugging.
Categories: execute
View authoritative reference ↗DefaultPack.EXE
This binary can be downloaded along side multiple software downloads on the Microsoft website. It gets downloaded when the user forgets to uncheck the option to set Bing as the default search provider.
Categories: execute
View authoritative reference ↗Devinit.exe
Visual Studio 2019 tool
Categories: execute
View authoritative reference ↗Devtoolslauncher.exe
Binary will execute specified binary. Part of VS/VScode installation.
Categories: execute
View authoritative reference ↗dnx.exe
.NET Execution environment file included with .NET.
Categories: execute
View authoritative reference ↗Dotnet.exe
dotnet.exe comes with .NET Framework
Categories: awl bypass, execute
View authoritative reference ↗dsdbutil.exe
Dsdbutil is a command-line tool that is built into Windows Server. It is available if you have the AD LDS server role installed. Can be used as a command line utility to export Active Directory.
Categories: dump
View authoritative reference ↗dtutil.exe
Microsoft command line utility used to manage SQL Server Integration Services packages.
Categories: copy
View authoritative reference ↗Dump64.exe
Memory dump tool that comes with Microsoft Visual Studio
Categories: dump
View authoritative reference ↗DumpMinitool.exe
Dump tool part Visual Studio 2022
Categories: dump
View authoritative reference ↗Dxcap.exe
DirectX diagnostics/debugger included with Visual Studio.
Categories: execute
View authoritative reference ↗ECMangen.exe
Command-line tool for managing certificates in Microsoft Exchange Server.
Categories: download
View authoritative reference ↗Excel.exe
Microsoft Office binary
Categories: download
View authoritative reference ↗Fsi.exe
64-bit FSharp (F#) Interpreter included with Visual Studio and DotNet Core SDK.
Categories: awl bypass
View authoritative reference ↗FsiAnyCpu.exe
32/64-bit FSharp (F#) Interpreter included with Visual Studio.
Categories: awl bypass
View authoritative reference ↗IntelliTrace.exe
Visual Studio command-line tool for collecting and managing diagnostic trace files.
Categories: execute
View authoritative reference ↗Logger.exe
A logging configuration tool from the Windows Kits used to start and manage process logging.
Categories: execute
View authoritative reference ↗Mftrace.exe
Trace log generation tool for Media Foundation Tools.
Categories: execute
View authoritative reference ↗Microsoft.NodejsTools.PressAnyKey.exe
Part of the NodeJS Visual Studio tools.
Categories: execute
View authoritative reference ↗Mpiexec.exe
Command-line tool for running Message Passing Interface (MPI) applications.
Categories: execute
View authoritative reference ↗MSAccess.exe
Microsoft Office component
Categories: download
View authoritative reference ↗Mscopilot.exe
Microsoft Copilot app
Categories: execute
View authoritative reference ↗Mscopilot_proxy.exe
Microsoft Copilot proxy launcher
Categories: execute
View authoritative reference ↗Msdeploy.exe
Microsoft tool used to deploy Web Applications.
Categories: execute, awl bypass, copy
View authoritative reference ↗MsoHtmEd.exe
Microsoft Office component
Categories: download
View authoritative reference ↗Mspub.exe
Microsoft Publisher
Categories: download
View authoritative reference ↗msxsl.exe
Command line utility used to perform XSL transformations.
Categories: execute, awl bypass, download
View authoritative reference ↗Nmcap.exe
Command-line packet capture utility from Microsoft Network Monitor 3.x.
Categories: recon
View authoritative reference ↗ntdsutil.exe
Command line utility used to export Active Directory.
Categories: dump
View authoritative reference ↗Ntsd.exe
Symbolic Debugger for Windows.
Categories: execute
View authoritative reference ↗OpenConsole.exe
Console Window host for Windows Terminal
Categories: execute
View authoritative reference ↗Outlook.exe
Microsoft Office component
Categories: download
View authoritative reference ↗Pixtool.exe
Command line utility for taking and analyzing PIX GPU captures.
Categories: execute
View authoritative reference ↗Powerpnt.exe
Microsoft Office binary.
Categories: download
View authoritative reference ↗Procdump.exe
SysInternals Memory Dump Tool
Categories: execute
View authoritative reference ↗ProtocolHandler.exe
Microsoft Office binary
Categories: download
View authoritative reference ↗rcsi.exe
Non-Interactive command line inerface included with Visual Studio.
Categories: execute, awl bypass
View authoritative reference ↗Remote.exe
Debugging tool included with Windows Debugging Tools
Categories: awl bypass, execute
View authoritative reference ↗Sqldumper.exe
Debugging utility included with Microsoft SQL.
Categories: dump
View authoritative reference ↗Sqlps.exe
Tool included with Microsoft SQL Server that loads SQL Server cmdlets. Microsoft SQL Server\100 and 110 are Powershell v2. Microsoft SQL Server\120 and 130 are Powershell version 4. Replaced by SQLToolsPS.exe in SQL Server 2016, but will be included with installation for compatability reasons.
Categories: execute
View authoritative reference ↗SQLToolsPS.exe
Tool included with Microsoft SQL that loads SQL Server cmdlts. A replacement for sqlps.exe. Successor to sqlps.exe in SQL Server 2016+.
Categories: execute
View authoritative reference ↗Squirrel.exe
Binary to update the existing installed Nuget/squirrel package. Part of Microsoft Teams installation.
Categories: download, awl bypass, execute
View authoritative reference ↗te.exe
Testing tool included with Microsoft Test Authoring and Execution Framework (TAEF).
Categories: execute
View authoritative reference ↗Teams.exe
Electron runtime binary which runs the Teams application
Categories: execute
View authoritative reference ↗TestWindowRemoteAgent.exe
TestWindowRemoteAgent.exe is the command-line tool to establish RPC
Categories: upload
View authoritative reference ↗Tracker.exe
Tool included with Microsoft .Net Framework.
Categories: execute, awl bypass
View authoritative reference ↗Update.exe
Binary to update the existing installed Nuget/squirrel package. Part of Microsoft Teams installation.
Categories: download, awl bypass, execute
View authoritative reference ↗VSDiagnostics.exe
Command-line tool used for performing diagnostics.
Categories: execute
View authoritative reference ↗VSIISExeLauncher.exe
Binary will execute specified binary. Part of VS/VScode installation.
Categories: execute
View authoritative reference ↗Visio.exe
Microsoft Visio Executable
Categories: download
View authoritative reference ↗VisualUiaVerifyNative.exe
A Windows SDK binary for manual and automated testing of Microsoft UI Automation implementation and controls.
Categories: awl bypass
View authoritative reference ↗VSLaunchBrowser.exe
Microsoft Visual Studio browser launcher tool for web applications debugging
Categories: download, execute
View authoritative reference ↗Vshadow.exe
VShadow is a command-line tool that can be used to create and manage volume shadow copies.
Categories: execute
View authoritative reference ↗vsjitdebugger.exe
Just-In-Time (JIT) debugger included with Visual Studio
Categories: execute
View authoritative reference ↗WFMFormat.exe
Command-line tool used for pretty-print a dump file generated by Message Farm Analyzer tool.
Categories: execute
View authoritative reference ↗Wfc.exe
The Workflow Command-line Compiler tool is included with the Windows Software Development Kit (SDK).
Categories: awl bypass
View authoritative reference ↗WinDbg.exe
Windows Debugger for advanced user-mode and kernel-mode debugging.
Categories: execute
View authoritative reference ↗WinProj.exe
Microsoft Project Executable
Categories: download
View authoritative reference ↗Winword.exe
Microsoft Office binary
Categories: download
View authoritative reference ↗wsb.exe
Windows Sandbox command-line interface. Creates, lists, controls, and executes commands inside Windows Sandbox sessions from the host CLI.
Categories: execute
View authoritative reference ↗Wsl.exe
Windows subsystem for Linux executable
Categories: execute, download
View authoritative reference ↗XBootMgr.exe
Windows Performance Toolkit binary used to start performance traces.
Categories: execute
View authoritative reference ↗XBootMgrSleep.exe
Windows Performance Toolkit binary used for tracing and analyzing system performance during sleep and resume transitions.
Categories: execute
View authoritative reference ↗devtunnel.exe
Binary to enable forwarded ports on windows operating systems.
Categories: download
View authoritative reference ↗dotnet-counters.exe
.NET diagnostic tool for monitoring performance counters of .NET applications in real-time. Installed via 'dotnet tool install --global dotnet-counters' (.NET SDK required).
Categories: execute
View authoritative reference ↗dotnet-trace.exe
.NET diagnostic tool for collecting runtime traces from .NET applications. Installed via 'dotnet tool install --global dotnet-trace' (.NET SDK required).
Categories: execute
View authoritative reference ↗vsls-agent.exe
Agent for Visual Studio Live Share (Code Collaboration)
Categories: execute
View authoritative reference ↗vstest.console.exe
VSTest.Console.exe is the command-line tool to run tests
Categories: awl bypass
View authoritative reference ↗winfile.exe
Windows File Manager executable
Categories: execute
View authoritative reference ↗xsd.exe
XML Schema Definition Tool included with the Windows Software Development Kit (SDK).
Categories: download
View authoritative reference ↗