Shell Doc Object and Control Library. Located at: c:\windows\system32\shdocvw.dll; c:\windows\syswow64\shdocvw.dll.
shdocvwshdocvwSandbox: execFile · Timeout: 30s
security.execution.command Outputs
process.output Command execution output
process_spawn Produces
process.output| Resource | Value |
|---|---|
| CPU | low |
| Memory | 16 MB |
| Network | low |
| Disk I/O | low |
Launch an executable payload via proxy through a URL (information) file by calling OpenURL. (Load an executable payload by calling a .url file with or without quotes. The .url file extension can be renamed.)
rundll32.exe shdocvw.dll,OpenURL {PATH_ABSOLUTE:.url}shdocvw is a Windows LOLBin. Shell Doc Object and Control Library. Located at: c:\windows\system32\shdocvw.dll; c:\windows\syswow64\shdocvw.dll.