Technical Information
- %APPDATA%\svchost.exe
- %TEMP%\zcaxidti.0.cs
- %TEMP%\zcaxidti.cmdline
- %TEMP%\zcaxidti.out
- %TEMP%\csc17df.tmp
- %TEMP%\res17e0.tmp
- %TEMP%\zcaxidti.dll
- %TEMP%\res17e0.tmp
- %TEMP%\csc17df.tmp
- %TEMP%\zcaxidti.out
- %TEMP%\zcaxidti.dll
- %TEMP%\zcaxidti.cmdline
- %TEMP%\zcaxidti.0.cs
- from <Full path to file> to %APPDATA%\<File name>.exe
- '%WINDIR%\microsoft.net\framework\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\zcaxidti.cmdline"' (with hidden window)
- '%WINDIR%\microsoft.net\framework\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES17E0.tmp" "%TEMP%\CSC17DF.tmp"' (with hidden window)
- '%WINDIR%\microsoft.net\framework\v2.0.50727\csc.exe' /noconfig /fullpaths @"%TEMP%\zcaxidti.cmdline"
- '%WINDIR%\microsoft.net\framework\v2.0.50727\cvtres.exe' /NOLOGO /READONLY /MACHINE:IX86 "/OUT:%TEMP%\RES17E0.tmp" "%TEMP%\CSC17DF.tmp"