control.exe

control.exe launches Control Panel and, given a .cpl file, the specific Control Panel applet it represents. A .cpl is a DLL with a control-panel entry point, so opening one loads and executes that DLL. control.exe is the front door for this, and double-clicking a .cpl routes through it. The genuine binary lives at C:\Windows\System32\control.exe.

Legitimately, control.exe runs whenever someone opens a Control Panel item, so the process itself is ordinary. The .cpl it loads and where that file came from are what give an instance meaning.

control.exe is a system-binary proxy through Control Panel files (T1218.002). Because a .cpl is a DLL, an attacker delivers one (often renamed to look like a document) and has control.exe load and run it under a trusted, signed Microsoft process, bypassing application-control rules that allow control.exe. Malicious .cpl files have been a recurring malware delivery format for exactly this reason.

Since loading a legitimate applet is normal, the context is what matters: a .cpl from a temp or download folder, a parent like an Office application, or control.exe spawning a shell, mark it as abuse rather than someone opening a settings page.