🧰 MSBuild.exe

The items that name it 3

• Google Doc Sidebar Sends Mac and Windows Users Down Different Paths to Malware
  writeupas tools2026-09-15

  Legitimate Windows build tool hollowed by the second and third stage-three payloads to run malicious code while importing only kernel32

• Post-DEF CON Phishing Uses Malicious Google Doc to Deliver Malware
  writeupas affected products2026-08-19It is written here as MsBuild.exe (.NET Framework v4.0.30319).

  Legitimate Microsoft binary used for process hollowing to run payloads two and three

• Inside .NET Loader Analysis: From Malspam to In-Memory Loader
  writeupas affected products2026-06-03

  Hardcoded alternate injection/proxy execution target observed in live telemetry