Desktop Settings Control Panel Located at: C:\Windows\System32\desk.cpl; C:\Windows\SysWOW64\desk.cpl.
deskdeskSandbox: execFile · Timeout: 30s
security.execution.command Outputs
process.output Command execution output
process_spawn Produces
process.output| Resource | Value |
|---|---|
| CPU | low |
| Memory | 16 MB |
| Network | low |
| Disk I/O | low |
Launch an executable with a .scr extension by calling the InstallScreenSaver function. (Launch any executable payload, as long as it uses the .scr extension.)
rundll32.exe desk.cpl,InstallScreenSaver {PATH_ABSOLUTE:.scr}Launch a remote executable with a .scr extension, located on an SMB share, by calling the InstallScreenSaver function. (Launch any executable payload, as long as it uses the .scr extension.)
rundll32.exe desk.cpl,InstallScreenSaver {PATH_SMB:.scr}desk is a Windows LOLBin. Desktop Settings Control Panel Located at: C:\Windows\System32\desk.cpl; C:\Windows\SysWOW64\desk.cpl.