Binary used to launch controlpanel items in Windows

Paths:

C:\Windows\System32\control.exe
C:\Windows\SysWOW64\control.exe

Detection: Control.exe executing files from alternate data streams.

Alternate data streams

Execute evil.dll which is stored in an Alternate Data Stream (ADS).

control.exe c:\windows\tasks\file.txt:evil.dll