.. /Zipfldr.dll
Compressed Folder library
Paths:
- c:\windows\system32\zipfldr.dll
- c:\windows\syswow64\zipfldr.dll
Resources:
Execute
Launch an executable payload by calling RouteTheCall.
rundll32.exe zipfldr.dll,RouteTheCall calc.exe
Usecase: Launch an executable.
Privileges required: User
OS: Windows 10, Windows 11
MITRE ATT&CK®: T1218.011
Launch an executable payload by calling RouteTheCall (obfuscated).
rundll32.exe zipfldr.dll,RouteTheCall file://^C^:^/^W^i^n^d^o^w^s^/^s^y^s^t^e^m^3^2^/^c^a^l^c^.^e^x^e
Usecase: Launch an executable.
Privileges required: User
OS: Windows 10, Windows 11
MITRE ATT&CK®: T1218.011