LOLBAS
Living off the land binaries, scripts and libraries for Windows
- AccCheckConsole.exeVerifies UI accessibility requirements
- AddinUtil.exe.NET Tool used for updating cache files for Microsoft Office Add-Ins.
- adplus.exeDebugging tool included with Windows Debugging Tools
- Advpack.dllUtility for installing software and drivers with rundll32.exe
- AgentExecutor.exeIntune Management Extension included on Intune Managed Devices
- AppCert.exeWindows App Certification Kit command-line tool.
- AppInstaller.exeTool used for installation of AppX/MSIX applications on Windows 10
- Applaunch.exeMicrosoft .NET ClickOnce Launch Utility.
- AppLauncher.exeUser Experience Virtualization tool that launches applications under monitoring to capture and synchronize user settings.
- Appvlp.exeApplication Virtualization Utility Included with Microsoft Office 2016
- Aspnet_Compiler.exeASP.NET Compilation Tool
- At.exeSchedule periodic tasks
- Atbroker.exeHelper binary for Assistive Technology (AT)
- Bash.exeFile used by Windows subsystem for Linux
- Bcp.exeMicrosoft SQL Server Bulk Copy Program utility for importing and exporting data between SQL Server instances and data files.
- Bginfo.exeBackground Information Utility included with SysInternals Suite
- Bitsadmin.exeUsed for managing background intelligent transfer
- Cdb.exeDebugging tool included with Windows Debugging Tools.
- CertOC.exeUsed for installing certificates
- CertReq.exeUsed for requesting and managing certificates
- Certutil.exeWindows binary used for handling certificates
- Change.exeRemote Desktop Services MultiUser Change Utility
- Cipher.exeFile Encryption Utility
- CL_Invocation.ps1Aero diagnostics script
- CL_LoadAssembly.ps1PowerShell Diagnostic Script
- CL_Mutexverifiers.ps1Proxy execution with CL_Mutexverifiers.ps1
- Cmd.exeThe command-line interpreter in Windows
- Cmdkey.execreates, lists, and deletes stored user names and passwords or credentials.
- cmdl32.exeMicrosoft Connection Manager Auto-Download
- Cmstp.exeInstalls or removes a Connection Manager service profile.
- code.exeVSCode binary, also portable (CLI) version
- Colorcpl.exeBinary that handles color management
- ComputerDefaults.exeComputerDefaults.exe is a Windows system utility for managing default applications for tasks like web browsing, emailing, and media playback.
- Comsvcs.dllCOM+ Services
- ConfigSecurityPolicy.exeBinary part of Windows Defender. Used to manage settings in Windows Defender. You can configure different pilot collections for each of the co-management …
- Conhost.exeConsole Window host
- Control.exeBinary used to launch controlpanel items in Windows
- coregen.exeBinary coregen.exe (Microsoft CoreCLR Native Image Generator) loads exported function GetCLRRuntimeHost from coreclr.dll or from .DLL in arbitrary path. Coregen …
- Createdump.exeMicrosoft .NET Runtime Crash Dump Generator (included in .NET Core)
- Csc.exeBinary file used by .NET Framework to compile C# code
- Cscript.exeBinary used to execute scripts in Windows
- csi.exeCommand line interface included with Visual Studio.
- CustomShellHost.exeA host process that is used by custom shells when using Windows in Kiosk mode.
- DataSvcUtil.exeDataSvcUtil.exe is a command-line tool provided by WCF Data Services that consumes an Open Data Protocol (OData) feed and generates the client data service …
- DbgSrv.exeA process server included with Debugging Tools for Windows for remote user-mode debugging.
- DefaultPack.EXEThis binary can be downloaded along side multiple software downloads on the Microsoft website. It gets downloaded when the user forgets to uncheck the option to …
- Desk.cplDesktop Settings Control Panel
- Desktopimgdownldr.exeWindows binary used to configure lockscreen/desktop image
- DeviceCredentialDeployment.exeDevice Credential Deployment
- Devinit.exeVisual Studio 2019 tool
- Devtoolslauncher.exeBinary will execute specified binary. Part of VS/VScode installation.
- devtunnel.exeBinary to enable forwarded ports on windows operating systems.
- Dfshim.dllClickOnce engine in Windows used by .NET
- Dfsvc.exeClickOnce engine in Windows used by .NET
- Diantz.exeBinary that package existing files into a cabinet (.cab) file
- Diskshadow.exeDiskshadow.exe is a tool that exposes the functionality offered by the volume shadow copy Service (VSS).
- Dnscmd.exeA command-line interface for managing DNS servers
- dnx.exe.NET Execution environment file included with .NET.
- dotnet-counters.exe.NET diagnostic tool for monitoring performance counters of .NET applications in real-time. Installed via 'dotnet tool install --global dotnet-counters' (.NET …
- dotnet-trace.exe.NET diagnostic tool for collecting runtime traces from .NET applications. Installed via 'dotnet tool install --global dotnet-trace' (.NET SDK required).
- Dotnet.exedotnet.exe comes with .NET Framework
- dsdbutil.exeDsdbutil is a command-line tool that is built into Windows Server. It is available if you have the AD LDS server role installed. Can be used as a command line …
- dtutil.exeMicrosoft command line utility used to manage SQL Server Integration Services packages.
- Dump64.exeMemory dump tool that comes with Microsoft Visual Studio
- DumpMinitool.exeDump tool part Visual Studio 2022
- Dxcap.exeDirectX diagnostics/debugger included with Visual Studio.
- ECMangen.exeCommand-line tool for managing certificates in Microsoft Exchange Server.
- Esentutl.exeBinary for working with Microsoft Joint Engine Technology (JET) database
- Eudcedit.exePrivate Character Editor Windows Utility
- Eventvwr.exeDisplays Windows Event Logs in a GUI window.
- Excel.exeMicrosoft Office binary
- Expand.exeBinary that expands one or more compressed files
- Explorer.exeBinary used for managing files and system components within Windows
- Extexport.exeLoad a DLL located in the c:\test folder with a specific name.
- Extrac32.exeExtract to ADS, copy or overwrite a file with Extrac32.exe
- Findstr.exeWrite to ADS, discover, or download files with Findstr.exe
- Finger.exeDisplays information about a user or users on a specified remote computer that is running the Finger service or daemon
- fltMC.exeFilter Manager Control Program used by Windows
- Forfiles.exeSelects and executes a command on a file or set of files. This command is useful for batch processing.
- Fsi.exe64-bit FSharp (F#) Interpreter included with Visual Studio and DotNet Core SDK.
- FsiAnyCpu.exe32/64-bit FSharp (F#) Interpreter included with Visual Studio.
- Fsutil.exeFile System Utility
- Ftp.exeA binary designed for connecting to FTP servers
- GfxDownloadWrapper.exeRemote file download used by the Intel Graphics Control Panel, receives as first parameter a URL and a destination file path.
- Gpscript.exeUsed by group policy to process scripts
- Hh.exeBinary used for processing chm files in Windows
- Ie4uinit.exeExecutes commands from a specially prepared ie4uinit.inf file.
- Ieadvpack.dllINF installer for Internet Explorer. Has much of the same functionality as advpack.dll.
- iediagcmd.exeDiagnostics Utility for Internet Explorer
- Ieexec.exeThe IEExec.exe application is an undocumented Microsoft .NET Framework application that is included with the .NET Framework. You can use the IEExec.exe …
- Ieframe.dllInternet Browser DLL for translating HTML code.
- Ilasm.exeused for compile c# code into dll or exe.
- IMEWDBLD.exeMicrosoft IME Open Extended Dictionary Module
- Infdefaultinstall.exeBinary used to perform installation based on content inside inf files
- Installutil.exeThe Installer tool is a command-line utility that allows you to install and uninstall server resources by executing the installer components in specified …
- IntelliTrace.exeVisual Studio command-line tool for collecting and managing diagnostic trace files.
- iscsicpl.exeMicrosoft iSCSI Initiator Control Panel tool
- Jsc.exeBinary file used by .NET to compile JavaScript code to .exe or .dll format
- Launch-VsDevShell.ps1Locates and imports a Developer PowerShell module and calls the Enter-VsDevShell cmdlet
- Ldifde.exeCreates, modifies, and deletes LDAP directory objects.
- Logger.exeA logging configuration tool from the Windows Kits used to start and manage process logging.
- Makecab.exeBinary to package existing files into a cabinet (.cab) file
- Manage-bde.wsfScript for managing BitLocker
- Mavinject.exeUsed by App-v in Windows
- Mftrace.exeTrace log generation tool for Media Foundation Tools.
- Microsoft.NodejsTools.PressAnyKey.exePart of the NodeJS Visual Studio tools.
- Microsoft.Workflow.Compiler.exeA utility included with .NET that is capable of compiling and executing C# or VB.net code.
- Mmc.exeLoad snap-ins to locally and remotely manage Windows systems
- Mofcomp.exeCompiler that parses a file containing MOF statements and adds the classes and class instances defined in the file to the WMI repository. Threat actors can …
- MpCmdRun.exeBinary part of Windows Defender. Used to manage settings in Windows Defender
- Mpiexec.exeCommand-line tool for running Message Passing Interface (MPI) applications.
- MSAccess.exeMicrosoft Office component
- Msbuild.exeUsed to compile and execute code
- Msconfig.exeMSConfig is a troubleshooting tool which is used to temporarily disable or re-enable software, device drivers or Windows services that run during startup …
- Mscopilot_proxy.exeMicrosoft Copilot proxy launcher
- Mscopilot.exeMicrosoft Copilot app
- Msdeploy.exeMicrosoft tool used to deploy Web Applications.
- Msdt.exeMicrosoft diagnostics tool
- msedge_proxy.exeMicrosoft Edge Browser
- Msedge.exeMicrosoft Edge browser
- msedgewebview2.exemsedgewebview2.exe is the executable file for Microsoft Edge WebView2, which is a web browser control used by applications to display web content.
- Mshta.exeUsed by Windows to execute html applications. (.hta)
- Mshtml.dllMicrosoft HTML Viewer
- Msiexec.exeUsed by Windows to execute msi files
- MsoHtmEd.exeMicrosoft Office component
- msoxmled.exeMicrosoft Office XML Editor, used to handle XML documents in Microsoft Office.
- Mspub.exeMicrosoft Publisher
- msxsl.exeCommand line utility used to perform XSL transformations.
- Netsh.exeNetsh is a Windows tool used to manipulate network interface settings.
- Ngen.exeMicrosoft Native Image Generator.
- Nmcap.exeCommand-line packet capture utility from Microsoft Network Monitor 3.x.
- ntdsutil.exeCommand line utility used to export Active Directory.
- Ntsd.exeSymbolic Debugger for Windows.
- odbcad32.exeODBC Data Source Administrator to manage User/System DSNs and ODBC drivers.
- Odbcconf.exeUsed in Windows for managing ODBC connections
- OfflineScannerShell.exeWindows Defender Offline Shell
- OneDriveStandaloneUpdater.exeOneDrive Standalone Updater
- OpenConsole.exeConsole Window host for Windows Terminal
- Outlook.exeMicrosoft Office component
- Pcalua.exeProgram Compatibility Assistant
- Pcwrun.exeProgram Compatibility Wizard
- Pcwutl.dllMicrosoft HTML Viewer
- Pester.batUsed as part of the Powershell pester
- PhotoViewer.dllWindows Photo Viewer
- Pixtool.exeCommand line utility for taking and analyzing PIX GPU captures.
- Pktmon.exeCapture Network Packets on the windows 10 with October 2018 Update or later.
- Pnputil.exeUsed for installing drivers
- Powerpnt.exeMicrosoft Office binary.
- Powershell.exePowershell.exe is a a task-based command-line shell built on .NET.
- Presentationhost.exeFile is used for executing Browser applications
- Print.exeUsed by Windows to send files to the printer
- PrintBrm.exePrinter Migration Command-Line Tool
- Procdump.exeSysInternals Memory Dump Tool
- ProtocolHandler.exeMicrosoft Office binary
- Provlaunch.exeLauncher process
- Psr.exeWindows Problem Steps Recorder, used to record screen and clicks.
- Pubprn.vbsProxy execution with Pubprn.vbs
- Query.exeRemote Desktop Services MultiUser Query Utility
- Rasautou.exeWindows Remote Access Dialer
- rcsi.exeNon-Interactive command line inerface included with Visual Studio.
- rdrleakdiag.exeMicrosoft Windows resource leak diagnostic tool
- Reg.exeUsed to manipulate the registry
- Regasm.exePart of .NET
- Regedit.exeUsed by Windows to manipulate registry
- Regini.exeUsed to manipulate the registry
- Register-cimprovider.exeUsed to register new wmi providers
- Regsvcs.exeRegsvcs and Regasm are Windows command-line utilities that are used to register .NET Component Object Model (COM) assemblies
- Regsvr32.exeUsed by Windows to register dlls
- Remote.exeDebugging tool included with Windows Debugging Tools
- Replace.exeUsed to replace file with another file
- Reset.exeRemote Desktop Services Reset Utility
- Rpcping.exeUsed to verify rpc connection
- Rundll32.exeUsed by Windows to execute dll files
- Runexehelper.exeLauncher process
- Runonce.exeExecutes a Run Once Task that has been configured in the registry
- Runscripthelper.exeExecute target PowerShell script
- Sc.exeUsed by Windows to manage services
- Schtasks.exeSchedule periodic tasks
- scp.exeUsed for uploading or downloading files over SSH.
- Scriptrunner.exeExecute binary through proxy binary to evade defensive counter measures
- Scrobj.dllWindows Script Component Runtime
- Setres.exeConfigures display settings
- SettingSyncHost.exeHost Process for Setting Synchronization
- Setupapi.dllWindows Setup Application Programming Interface
- setupugc.exeSetup Unattend Generic Command Processor used during Windows deployment.
- Sftp.exesftp.exe is a Windows command-line utility that uses the Secure File Transfer Protocol (SFTP) to securely transfer files between a local machine and a remote …
- Shdocvw.dllShell Doc Object and Control Library.
- Shell32.dllWindows Shell Common Dll
- Shimgvw.dllPhoto Gallery Viewer
- Sigverif.exeFile Signature Verification utility to verify digital signatures of files
- Sqldumper.exeDebugging utility included with Microsoft SQL.
- Sqlps.exeTool included with Microsoft SQL Server that loads SQL Server cmdlets. Microsoft SQL Server\100 and 110 are Powershell v2. Microsoft SQL Server\120 and 130 are …
- SQLToolsPS.exeTool included with Microsoft SQL that loads SQL Server cmdlts. A replacement for sqlps.exe. Successor to sqlps.exe in SQL Server 2016+.
- Squirrel.exeBinary to update the existing installed Nuget/squirrel package. Part of Microsoft Teams installation.
- ssh.exeSsh.exe is the OpenSSH compatible client can be used to connect to Windows 10 (build 1809 and later) and Windows Server 2019 devices.
- Stordiag.exeStorage diagnostic tool
- SyncAppvPublishingServer.exeUsed by App-v to get App-v server lists
- Syncappvpublishingserver.vbsScript used related to app-v and publishing server
- Syssetup.dllWindows NT System Setup
- Tar.exeUsed by Windows to extract and create archives.
- te.exeTesting tool included with Microsoft Test Authoring and Execution Framework (TAEF).
- Teams.exeElectron runtime binary which runs the Teams application
- TestWindowRemoteAgent.exeTestWindowRemoteAgent.exe is the command-line tool to establish RPC
- Tracker.exeTool included with Microsoft .Net Framework.
- Ttdinject.exeUsed by Windows 1809 and newer to Debug Time Travel (Underlying call of tttracer.exe)
- Tttracer.exeUsed by Windows 1809 and newer to Debug Time Travel
- Unregmp2.exeMicrosoft Windows Media Player Setup Utility
- Update.exeBinary to update the existing installed Nuget/squirrel package. Part of Microsoft Teams installation.
- Url.dllInternet Shortcut Shell Extension DLL.
- UtilityFunctions.ps1PowerShell Diagnostic Script
- vbc.exeBinary file used for compile vbs code
- Verclsid.exeUsed to verify a COM object before it is instantiated by Windows Explorer
- Visio.exeMicrosoft Visio Executable
- VisualUiaVerifyNative.exeA Windows SDK binary for manual and automated testing of Microsoft UI Automation implementation and controls.
- VSDiagnostics.exeCommand-line tool used for performing diagnostics.
- Vshadow.exeVShadow is a command-line tool that can be used to create and manage volume shadow copies.
- VSIISExeLauncher.exeBinary will execute specified binary. Part of VS/VScode installation.
- vsjitdebugger.exeJust-In-Time (JIT) debugger included with Visual Studio
- VSLaunchBrowser.exeMicrosoft Visual Studio browser launcher tool for web applications debugging
- vsls-agent.exeAgent for Visual Studio Live Share (Code Collaboration)
- Vssadmin.exeVolume Shadow Copy Service administrative command-line tool
- vstest.console.exeVSTest.Console.exe is the command-line tool to run tests
- Wab.exeWindows address book manager
- wbadmin.exeWindows Backup Administration utility
- wbemtest.exeWMI/WBEM Test Binary
- Wfc.exeThe Workflow Command-line Compiler tool is included with the Windows Software Development Kit (SDK).
- WFMFormat.exeCommand-line tool used for pretty-print a dump file generated by Message Farm Analyzer tool.
- WinDbg.exeWindows Debugger for advanced user-mode and kernel-mode debugging.
- winfile.exeWindows File Manager executable
- winget.exeWindows Package Manager tool
- WinProj.exeMicrosoft Project Executable
- winrm.vbsScript used for manage Windows RM settings
- Winword.exeMicrosoft Office binary
- Wlrmdr.exeWindows Logon Reminder executable
- Wmic.exeThe WMI command-line (WMIC) utility provides a command-line interface for WMI
- WorkFolders.exeWork Folders
- write.exeWindows Write
- wsb.exeWindows Sandbox command-line interface. Creates, lists, controls, and executes commands inside Windows Sandbox sessions from the host CLI.
- Wscript.exeUsed by Windows to execute scripts
- Wsl.exeWindows subsystem for Linux executable
- Wsreset.exeUsed to reset Windows Store settings according to its manifest file
- wt.exeWindows Terminal
- wuauclt.exeWindows Update Client
- XBootMgr.exeWindows Performance Toolkit binary used to start performance traces.
- XBootMgrSleep.exeWindows Performance Toolkit binary used for tracing and analyzing system performance during sleep and resume transitions.
- xsd.exeXML Schema Definition Tool included with the Windows Software Development Kit (SDK).
- Xwizard.exeExecute custom class that has been added to the registry or download a file with Xwizard.exe
- Zipfldr.dllCompressed Folder library
no matches