Compressed Folder library Located at: c:\windows\system32\zipfldr.dll; c:\windows\syswow64\zipfldr.dll.
zipfldrzipfldrSandbox: execFile · Timeout: 30s
security.execution.command Outputs
process.output Command execution output
process_spawn Produces
process.output| Resource | Value |
|---|---|
| CPU | low |
| Memory | 16 MB |
| Network | low |
| Disk I/O | low |
Launch an executable payload by calling RouteTheCall. (Launch an executable.)
rundll32.exe zipfldr.dll,RouteTheCall {PATH:.exe}Launch an executable payload by calling RouteTheCall (obfuscated). (Launch an executable.)
rundll32.exe zipfldr.dll,RouteTheCall file://^C^:^/^W^i^n^d^o^w^s^/^s^y^s^t^e^m^3^2^/^c^a^l^c^.^e^x^ezipfldr is a Windows LOLBin. Compressed Folder library Located at: c:\windows\system32\zipfldr.dll; c:\windows\syswow64\zipfldr.dll.