Technical Information
- <Full path to file>:ZONE.identifier
- <SYSTEM32>\msvhost.exe
- <SYSTEM32>\msvhost.exe:ZONE.identifier
- %TEMP%\639720439.xml
- %TEMP%\csrss.exe
- %TEMP%\csrss.exe:ZONE.identifier
- %TEMP%\1127906376.xml
- <SYSTEM32>\msvhost.exe
- %TEMP%\639720439.xml
- '<SYSTEM32>\msvhost.exe'
- '%TEMP%\csrss.exe' -p "<SYSTEM32>\msvhost.exe" 2936 -s
- '<SYSTEM32>\cmd.exe' /c echo [zoneTransfer]ZoneID = 2 > "<Full path to file>":ZONE.identifier & exit
- '<SYSTEM32>\cmd.exe' /c echo [zoneTransfer]ZoneID = 2 > "<SYSTEM32>\msvhost.exe":ZONE.identifier & exit
- '<SYSTEM32>\schtasks.exe' /Create /TN "Update\msvhost.exe" /XML "%TEMP%\639720439.xml"