Compressed Folder library

Paths:

c:\windows\system32\zipfldr.dll
c:\windows\syswow64\zipfldr.dll

Detection:

Execute

Launch an executable payload by calling RouteTheCall.

rundll32.exe zipfldr.dll,RouteTheCall calc.exe

Launch an executable payload by calling RouteTheCall (obfuscated).

rundll32.exe zipfldr.dll,RouteTheCall file://^C^:^/^W^i^n^d^o^w^s^/^s^y^s^t^e^m^3^2^/^c^a^l^c^.^e^x^e