Identifier / Programs / Windows
replace.exe
Replace existing files in a directory. Windows commands reference
LOLBAS Copy, Download 1 Sigma rule name it 1 ATT&CK technique 2 documented commands 12 known copies with hashes
How replace.exe is abused
Copy T1105 Ingress Tool Transfer
/aAdds new files to the destination directory instead of replacing existing files. Windows commands referenceDownload T1105 Ingress Tool Transfer
/aAdds new files to the destination directory instead of replacing existing files. Windows commands referenceEach abuse is LOLBAS's category and the options and words it uses; the full write-up is on LOLBAS's page for replace.exe.
2 documented commands
Copy T1105 Ingress Tool Transfer User privileges
Copy .cab file to destination
replace.exe {PATH_ABSOLUTE:.cab} {PATH_ABSOLUTE:folder} /ATrips 1 Sigma rule: mediumReplace.exe Usage by frack113
Download T1105 Ingress Tool Transfer User privileges
Download/Copy executable to specified folder
replace.exe {PATH_SMB:.exe} {PATH_ABSOLUTE:folder} /ATrips 1 Sigma rule: mediumReplace.exe Usage by frack113
All 2 commands the identifier reads trip a Sigma process-creation rule. These commands and their descriptions are from LOLBAS’s entry for replace.exe, by Oddvar Moe, at commit 2056cb766250 of 2026-09-26, under the GPL-3.0 and LOLBAS’s notice, with no warranty. Changed: Markdown is shown formatted. The source is in lolbas-gtfobins-commands.json.gz, and the full entry is on LOLBAS’s page for replace.exe. The identifier reads each with LOLBAS’s placeholders filled in: a URL as https://example.com/file, a share as \\192.0.2.10\share\file, a path as C:\Data\file and a command as calc.exe.
What detects it
Is it the real replace.exe?
C:\Windows\system32\C:\Windows\SysWOW64\12 known copies
10.0.22000.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\replace.exe · signed by Microsoft Windows
eb7487c0229b7ddf4b1c29312e5ddfce90d71836b3a1e73acd1aec0ffee301f710.0.22000.1 (WinBuild.160101.0800) · C:\WINDOWS\SysWOW64\replace.exe · signed by Microsoft Windows
ed40b3a050d4063069b11f33d08e7a7b4d787fa2daf14f63d79121168320ef4010.0.19041.1 (WinBuild.160101.0800) · C:\Windows\SysWOW64\replace.exe · signed by Microsoft Windows
855693af7c72bc38b1f0abcba6686e1fe6a9d731d0b0a8bd5208149626d3f78210.0.19041.1 (WinBuild.160101.0800) · C:\Windows\system32\replace.exe · signed by Microsoft Windows
ea3f7fbec756ac2f7cc26659be3f70637ddd892bc67127777b2bcd0605b2ccf110.0.18362.1 (WinBuild.160101.0800) · C:\WINDOWS\SysWOW64\replace.exe · signed by Microsoft Windows
643363cfbf63421e68ea7d108d3fecffcb1aecb27ec5af679a5aa7e95e1c366410.0.18362.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\replace.exe · signed by Microsoft Windows
d66ccd7d5cca8b95910e04c8a7300ed7ac4cf96282e6c35664a980e7a187bc9310.0.17763.1 (WinBuild.160101.0800) · C:\Windows\SysWOW64\replace.exe · signed by Microsoft Windows
084b1740d0afa302d7eb48af224a7346252bedfbc3cd46feaf42f89269f1a1a510.0.17763.1 (WinBuild.160101.0800) · C:\Windows\system32\replace.exe · signed by Microsoft Windows
83e2714735c365c3c01d8d8d56434983c1238a2a806d23ab48f42f59e2df809310.0.14393.0 (rs1_release.160715-1616) · C:\Windows\system32\replace.exe · signed by Microsoft Windows
ce49c1d7dc7cbd541d1b49a868e40fb8a3d4a5e6b2a2387357c3960e01be82b510.0.14393.0 (rs1_release.160715-1616) · C:\Windows\SysWOW64\replace.exe · signed by Microsoft Windows
e6fc8fa07a57a0d5af992b49c67ebf65ce7297d7be8eebce645ee780415808976.3.9600.16384 (winblue_rtm.130821-1623) · C:\windows\SysWOW64\replace.exe · not signed
29d86a492b627f71ffa7e2b7eeea2687a217acb3290783f53cd214848c5383476.3.9600.16384 (winblue_rtm.130821-1623) · C:\windows\system32\replace.exe · not signed
753a788019f5a1050accb74a21e7029451f41477493c74d1bcc21f2d16a3a85bFrom the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.
Everyday use
Replace the destination file with the one from the source directory
replace path\to\file_or_directory path\to\destination_directoryIdentifyAdd files to the destination directory instead of replacing existing files
replace path\to\file_or_directory path\to\destination_directory /aIdentify/aAdds new files to the destination directory instead of replacing existing files. Windows commands referenceTrips 1 Sigma rule: mediumReplace.exe Usage by frack113
Interactively copy multiple files, with a prompt before replacing or adding a destination file
replace path\to\file_or_directory path\to\destination_directory /pIdentify/pPrompts you for confirmation before replacing a destination file or adding a source file. Windows commands referenceOf the 3 examples the identifier reads, 1 matches LOLBAS abuse or trips a Sigma process-creation rule.
Options
Show every option of replace.exe
/aAdds new files to the destination directory instead of replacing existing files./pPrompts you for confirmation before replacing a destination file or adding a source file./rReplaces Read-only and unprotected files./wWaits for you to insert a disk before the search for source files begins./sSearches all subdirectories in the destination directory and replaces matching files./uReplaces only those files on the destination directory that are older than those in the source directory./?Displays help at the command prompt.