Shell Doc Object and Control Library.

Paths:

c:\windows\system32\shdocvw.dll
c:\windows\syswow64\shdocvw.dll

Detection:

Execute

Launch an executable payload via proxy through a(n) URL (information) file by calling OpenURL.

rundll32.exe shdocvw.dll,OpenURL "C:\test\calc.url"