Control.exe

Binary used to launch controlpanel items in Windows

ADS

Can be used to evade defensive countermeasures or to hide as a persistence mechanism

control.exe {PATH_ABSOLUTE}:evil.dll

Execute evil.dll which is stored in an Alternate Data Stream (ADS). — MITRE: T1218.002 — Privileges: User

Execute

Use to execute code and bypass application whitelisting

control.exe {PATH_ABSOLUTE:.cpl}

Execute .cpl file. A CPL is a DLL file with CPlApplet export function) — MITRE: T1218.002 — Privileges: User