CatalogLOLBAS

LOL · Library

Zipfldr.dll

2 techniquesWindowsLOLBASGPL-3.0

Execute

ExecutionWindows

Launch an executable payload by calling RouteTheCall.

Use Launch an executable.

rundll32.exe zipfldr.dll,RouteTheCall {PATH:.exe}
Evidence
Upstream reference
Environment
Local host
Context
user
Native
Execute

Execute

ExecutionWindows

Launch an executable payload by calling RouteTheCall (obfuscated).

Use Launch an executable.

rundll32.exe zipfldr.dll,RouteTheCall file://^C^:^/^W^i^n^d^o^w^s^/^s^y^s^t^e^m^3^2^/^c^a^l^c^.^e^x^e
Evidence
Upstream reference
Environment
Local host
Context
user
Native
Execute