Zipfldr on LOLBAS
Archived: 2026-04-05 22:57:36 UTC
Launch an executable payload by calling RouteTheCall (obfuscated).
rundll32.exe zipfldr.dll,RouteTheCall file://^C^:^/^W^i^n^d^o^w^s^/^s^y^s^t^e^m^3^2^/^c^a^l^c^.^e^x^e
Use case
Launch an executable.
Privileges required
User
Operating systems
Windows 10, Windows 11
ATT&CK® technique
T1218.011: Rundll32
Tags
Execute: EXE
Source: https://lolbas-project.github.io/lolbas/Libraries/Zipfldr/
https://lolbas-project.github.io/lolbas/Libraries/Zipfldr/
Page 1 of 1