Matt Graham gadgetmg
gadgetmg
/ gist:0f30416c1659fd00db0e
Created
November 12, 2014 02:16
ChefDK Windows 8.1 aeinv.dll activity loop
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| 9:09:23.6832880 PM rundll32.exe 7560 CreateFile C:\ SUCCESS Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Directory, Synchronous IO Non-Alert, Open For Backup, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened | |
| 9:09:23.6833170 PM rundll32.exe 7560 QueryDirectory C:\opscode SUCCESS Filter: opscode, 1: opscode | |
| 9:09:23.6833454 PM rundll32.exe 7560 CloseFile C:\ SUCCESS | |
| 9:09:23.6834414 PM rundll32.exe 7560 CreateFile C:\opscode SUCCESS Desired Access: Read Data/List Directory, Synchronize, Disposition: Open, Options: Directory, Synchronous IO Non-Alert, Open For Backup, Attributes: n/a, ShareMode: Read, Write, Delete, AllocationSize: n/a, OpenResult: Opened | |
| 9:09:23.6834794 PM rundll32.exe 7560 QueryDirectory C:\opscode\chefdk SUCCESS Filter: chefdk, 1: chefdk | |
| 9:09:23.6835138 PM rundll32.exe 7560 CloseFile C:\opscode SUCCESS | |
| 9:09:23.6836418 PM rundll32.exe 7560 CreateFile C:\opscode\chefdk SUCCESS Desired Access: Read Data/List Directory, |