splunk-security_content/lookups/hijacklibs_loaded.csv

1	islibrary	library	excludes	ttp	comment
2	TRUE	aclui.dll	*\Windows\System32\*	T1574.002	https://www.hexacorn.com/blog/2016/03/10/beyond-good-ol-run-key-part-36/
3	TRUE	aclui.dll	*\Windows\SysWOW64\*	T1574.002	https://www.hexacorn.com/blog/2016/03/10/beyond-good-ol-run-key-part-36/
4	TRUE	acrodistdll.dll	*\Program Files\Adobe\Acrobat *	T1574.002	https://go.recordedfuture.com/hubfs/reports/cta-2022-1223.pdf
5	TRUE	acrodistdll.dll	*\Acrobat\acrodistdll*	T1574.002	https://go.recordedfuture.com/hubfs/reports/cta-2022-1223.pdf
6	TRUE	activeds.dll	*\Windows\System32\*	T1574.002	https://wietze.github.io/blog/hijacking-dlls-in-windows
7	TRUE	activeds.dll	*\Windows\SysWOW64\*	T1574.002	https://wietze.github.io/blog/hijacking-dlls-in-windows
8	TRUE	adsldpc.dll	*\Windows\System32\*	T1574.002	https://wietze.github.io/blog/hijacking-dlls-in-windows
9	TRUE	adsldpc.dll	*\Windows\SysWOW64\*	T1574.002	https://wietze.github.io/blog/hijacking-dlls-in-windows
10	TRUE	aepic.dll	*\Windows\System32\*	T1574.002	https://wietze.github.io/blog/hijacking-dlls-in-windows
11	TRUE	aepic.dll	*\Windows\SysWOW64\*	T1574.002	https://wietze.github.io/blog/hijacking-dlls-in-windows
12	TRUE	apphelp.dll	*\Windows\System32\*	T1574.001	https://wietze.github.io/blog/hijacking-dlls-in-windows
13	TRUE	apphelp.dll	*\Windows\SysWOW64\*	T1574.001	https://wietze.github.io/blog/hijacking-dlls-in-windows
14	TRUE	applicationframe.dll	*\Windows\System32\*	T1574.007	https://wietze.github.io/blog/save-the-environment-variables
15	TRUE	applicationframe.dll	*\Windows\SysWOW64\*	T1574.007	https://wietze.github.io/blog/save-the-environment-variables
16	TRUE	appvpolicy.dll	*\Windows\System32\*	T1574.002	https://securityintelligence.com/posts/windows-features-dll-sideloading/
17	TRUE	appwiz.cpl	*\Windows\System32\*	T1574.002	https://www.hexacorn.com/blog/2024/01/06/1-little-known-secret-of-fondue-exe/
18	TRUE	appwiz.cpl	*\Windows\SysWOW64\*	T1574.002	https://www.hexacorn.com/blog/2024/01/06/1-little-known-secret-of-fondue-exe/
19	TRUE	appxalluserstore.dll	*\Windows\System32\*	T1574.002	https://wietze.github.io/blog/hijacking-dlls-in-windows
20	TRUE	appxalluserstore.dll	*\Windows\SysWOW64\*	T1574.002	https://wietze.github.io/blog/hijacking-dlls-in-windows
21	TRUE	appxdeploymentclient.dll	*\Windows\System32\*	T1574.002	https://wietze.github.io/blog/hijacking-dlls-in-windows
22	TRUE	appxdeploymentclient.dll	*\Windows\SysWOW64\*	T1574.002	https://wietze.github.io/blog/hijacking-dlls-in-windows
23	TRUE	archiveint.dll	*\Windows\System32\*	T1574.002	https://wietze.github.io/blog/hijacking-dlls-in-windows
24	TRUE	archiveint.dll	*\Windows\SysWOW64\*	T1574.002	https://wietze.github.io/blog/hijacking-dlls-in-windows
25	TRUE	ashldres.dll	*\Program Files\McAfee.com\VSO*	T1574.002	https://www.sophos.com/en-us/medialibrary/PDFs/technical%20papers/sophos-rotten-tomato-campaign.pdf
26	TRUE	atl.dll	*\Windows\System32\*	T1574.002	https://wietze.github.io/blog/hijacking-dlls-in-windows
27	TRUE	atl.dll	*\Windows\SysWOW64\*	T1574.002	https://wietze.github.io/blog/hijacking-dlls-in-windows
28	TRUE	atltracetoolui.dll	*\Program Files\Microsoft Visual Studio 11.0\Common7\Tools*	T1574.002	https://decoded.avast.io/threatintel/apt-treasure-trove-avast-suspects-chinese-apt-group-mustang-panda-is-collecting-data-from-burmese-government-agencies-and-opposition-groups/
29	TRUE	audioses.dll	*\Windows\System32\*	T1574.002	https://wietze.github.io/blog/hijacking-dlls-in-windows
30	TRUE	audioses.dll	*\Windows\SysWOW64\*	T1574.002	https://wietze.github.io/blog/hijacking-dlls-in-windows
31	TRUE	auditpolcore.dll	*\Windows\System32\*	T1574.002	https://wietze.github.io/blog/hijacking-dlls-in-windows
32	TRUE	auditpolcore.dll	*\Windows\SysWOW64\*	T1574.002	https://wietze.github.io/blog/hijacking-dlls-in-windows
33	TRUE	authfwcfg.dll	*\Windows\System32\*	T1574.002	https://wietze.github.io/blog/hijacking-dlls-in-windows
34	TRUE	authfwcfg.dll	*\Windows\SysWOW64\*	T1574.002	https://wietze.github.io/blog/hijacking-dlls-in-windows
35	TRUE	authz.dll	*\Windows\System32\*	T1574.002	https://wietze.github.io/blog/hijacking-dlls-in-windows
36	TRUE	authz.dll	*\Windows\SysWOW64\*	T1574.002	https://wietze.github.io/blog/hijacking-dlls-in-windows
37	TRUE	avrt.dll	*\Windows\System32\*	T1574.002	https://wietze.github.io/blog/hijacking-dlls-in-windows
38	TRUE	avrt.dll	*\Windows\SysWOW64\*	T1574.002	https://wietze.github.io/blog/hijacking-dlls-in-windows
39	TRUE	basicnetutils.dll	*\Appdata\local\Temp\*	T1574.002	https://news.sophos.com/en-us/2023/05/03/doubled-dll-sideloading-dragon-breath/
40	TRUE	basicnetutils.dll	*\Program Files\BAIDU\BAIDUPINYIN\*	T1574.002	https://news.sophos.com/en-us/2023/05/03/doubled-dll-sideloading-dragon-breath/
41	TRUE	batmeter.dll	*\Windows\System32\*	T1574.002	https://securityintelligence.com/posts/windows-features-dll-sideloading/
42	TRUE	batmeter.dll	*\Windows\SysWOW64\*	T1574.002	https://securityintelligence.com/posts/windows-features-dll-sideloading/
43	TRUE	bcd.dll	*\Windows\System32\*	T1574.002	https://wietze.github.io/blog/hijacking-dlls-in-windows
44	TRUE	bcd.dll	*\Windows\SysWOW64\*	T1574.002	https://wietze.github.io/blog/hijacking-dlls-in-windows
45	TRUE	bcp47langs.dll	*\Windows\System32\*	T1574.002	https://wietze.github.io/blog/hijacking-dlls-in-windows
46	TRUE	bcp47langs.dll	*\Windows\SysWOW64\*	T1574.002	https://wietze.github.io/blog/hijacking-dlls-in-windows
47	TRUE	bcp47mrm.dll	*\Windows\System32\*	T1574.002	https://wietze.github.io/blog/hijacking-dlls-in-windows
48	TRUE	bcp47mrm.dll	*\Windows\SysWOW64\*	T1574.002	https://wietze.github.io/blog/hijacking-dlls-in-windows
49	TRUE	bcrypt.dll	*\Windows\System32\*	T1574.007	https://wietze.github.io/blog/save-the-environment-variables
50	TRUE	bcrypt.dll	*\Windows\SysWOW64\*	T1574.007	https://wietze.github.io/blog/save-the-environment-variables
51	TRUE	bderepair.dll	*\Windows\System32\*	T1574.002	https://wietze.github.io/blog/hijacking-dlls-in-windows
52	TRUE	bootmenuux.dll	*\Windows\System32\*	T1574.002	https://wietze.github.io/blog/hijacking-dlls-in-windows
53	TRUE	bootux.dll	*\Windows\System32\*	T1574.002	https://securityintelligence.com/posts/windows-features-dll-sideloading/
54	TRUE	cabinet.dll	*\Windows\System32\*	T1574.002	https://wietze.github.io/blog/hijacking-dlls-in-windows
55	TRUE	cabinet.dll	*\Windows\SysWOW64\*	T1574.002	https://wietze.github.io/blog/hijacking-dlls-in-windows
56	TRUE	cabview.dll	*\Windows\System32\*	T1574.007	https://wietze.github.io/blog/save-the-environment-variables
57	TRUE	cabview.dll	*\Windows\SysWOW64\*	T1574.007	https://wietze.github.io/blog/save-the-environment-variables
58	TRUE	certcli.dll	*\Windows\System32\*	T1574.002	https://securityintelligence.com/posts/windows-features-dll-sideloading/
59	TRUE	certcli.dll	*\Windows\SysWOW64\*	T1574.002	https://securityintelligence.com/posts/windows-features-dll-sideloading/
60	TRUE	certenroll.dll	*\Windows\System32\*	T1574.002	https://wietze.github.io/blog/hijacking-dlls-in-windows
61	TRUE	certenroll.dll	*\Windows\SysWOW64\*	T1574.002	https://wietze.github.io/blog/hijacking-dlls-in-windows
62	TRUE	cfgmgr32.dll	*\Windows\System32\*	T1574.002
63	TRUE	cfgmgr32.dll	*\Windows\SysWOW64\*	T1574.002
64	TRUE	chrome_frame_helper.dll	*\Appdata\local\Google\Chrome\Application*	T1574.002	https://www.hexacorn.com/blog/2016/03/10/beyond-good-ol-run-key-part-36/
65	TRUE	chrome_frame_helper.dll	*\Program Files\Google\Chrome\Application*	T1574.002	https://www.hexacorn.com/blog/2016/03/10/beyond-good-ol-run-key-part-36/
66	TRUE	ciscosparklauncher.dll	*\Appdata\local\CiscoSparkLauncher*	T1574.002	https://news.sophos.com/en-us/2022/11/03/family-tree-dll-sideloading-cases-may-be-related/
67	TRUE	ciscosparklauncher.dll	*\AppData\Local\Programs\Cisco Spark\*	T1574.002	https://news.sophos.com/en-us/2022/11/03/family-tree-dll-sideloading-cases-may-be-related/
68	TRUE	classicexplorer32.dll	*\Program Files\Classic Shell*	T1574.002	https://blogs.blackberry.com/en/2022/12/mustang-panda-uses-the-russian-ukrainian-war-to-attack-europe-and-asia-pacific-targets
69	TRUE	classicexplorer32.dll	*\Program Files\Open-Shell*	T1574.002	https://blogs.blackberry.com/en/2022/12/mustang-panda-uses-the-russian-ukrainian-war-to-attack-europe-and-asia-pacific-targets
70	TRUE	cldapi.dll	*\Windows\System32\*	T1574.002	https://wietze.github.io/blog/hijacking-dlls-in-windows
71	TRUE	cldapi.dll	*\Windows\SysWOW64\*	T1574.002	https://wietze.github.io/blog/hijacking-dlls-in-windows
72	TRUE	clipc.dll	*\Windows\System32\*	T1574.002	https://wietze.github.io/blog/hijacking-dlls-in-windows
73	TRUE	clipc.dll	*\Windows\SysWOW64\*	T1574.002	https://wietze.github.io/blog/hijacking-dlls-in-windows
74	TRUE	clusapi.dll	*\Windows\System32\*	T1574.002	https://wietze.github.io/blog/hijacking-dlls-in-windows
75	TRUE	clusapi.dll	*\Windows\SysWOW64\*	T1574.002	https://wietze.github.io/blog/hijacking-dlls-in-windows
76	TRUE	cmpbk32.dll	*\Windows\System32\*	T1574.002	https://wietze.github.io/blog/hijacking-dlls-in-windows
77	TRUE	cmpbk32.dll	*\Windows\SysWOW64\*	T1574.002	https://wietze.github.io/blog/hijacking-dlls-in-windows
78	TRUE	cmutil.dll	*\Windows\System32\*	T1574.002	https://securityintelligence.com/posts/windows-features-dll-sideloading/
79	TRUE	cmutil.dll	*\Windows\SysWOW64\*	T1574.002	https://securityintelligence.com/posts/windows-features-dll-sideloading/
80	TRUE	coloradapterclient.dll	*\Windows\System32\*	T1574.002	https://wietze.github.io/blog/hijacking-dlls-in-windows
81	TRUE	coloradapterclient.dll	*\Windows\SysWOW64\*	T1574.002	https://wietze.github.io/blog/hijacking-dlls-in-windows
82	TRUE	colorui.dll	*\Windows\System32\*	T1574.002	https://wietze.github.io/blog/hijacking-dlls-in-windows
83	TRUE	colorui.dll	*\Windows\SysWOW64\*	T1574.002	https://wietze.github.io/blog/hijacking-dlls-in-windows
84	TRUE	comdlg32.dll	*\Windows\System32\*	T1574.007	https://wietze.github.io/blog/save-the-environment-variables
85	TRUE	comdlg32.dll	*\Windows\SysWOW64\*	T1574.007	https://wietze.github.io/blog/save-the-environment-variables
86	TRUE	commfunc.dll	*\Program Files\Lenovo\Communications Utility*	T1574.002	https://blog.trendmicro.com/trendlabs-security-intelligence/new-wave-of-plugx-targets-legitimate-apps/
87	TRUE	configmanager2.dll	*\Windows\System32\*	T1574.002	https://securityintelligence.com/posts/windows-features-dll-sideloading/
88	TRUE	connect.dll	*\Windows\System32\*	T1574.007	https://wietze.github.io/blog/save-the-environment-variables
89	TRUE	connect.dll	*\Windows\SysWOW64\*	T1574.007	https://wietze.github.io/blog/save-the-environment-variables
90	TRUE	coredplus.dll	*\Windows\System32\*	T1574.002	https://securityintelligence.com/posts/windows-features-dll-sideloading/
91	TRUE	coremessaging.dll	*\Windows\System32\*	T1574.002	https://wietze.github.io/blog/hijacking-dlls-in-windows
92	TRUE	coremessaging.dll	*\Windows\SysWOW64\*	T1574.002	https://wietze.github.io/blog/hijacking-dlls-in-windows
93	TRUE	coreuicomponents.dll	*\Windows\System32\*	T1574.002	https://securityintelligence.com/posts/windows-features-dll-sideloading/
94	TRUE	coreuicomponents.dll	*\Windows\SysWOW64\*	T1574.002	https://securityintelligence.com/posts/windows-features-dll-sideloading/
95	TRUE	credui.dll	*\Windows\System32\*	T1574.002	https://wietze.github.io/blog/hijacking-dlls-in-windows
96	TRUE	credui.dll	*\Windows\SysWOW64\*	T1574.002	https://wietze.github.io/blog/hijacking-dlls-in-windows
97	TRUE	cryptbase.dll	*\Windows\System32\*	T1574.002	https://wietze.github.io/blog/hijacking-dlls-in-windows
98	TRUE	cryptbase.dll	*\Windows\SysWOW64\*	T1574.002	https://wietze.github.io/blog/hijacking-dlls-in-windows
99	TRUE	cryptdll.dll	*\Windows\System32\*	T1574.002	https://wietze.github.io/blog/hijacking-dlls-in-windows
100	TRUE	cryptdll.dll	*\Windows\SysWOW64\*	T1574.002	https://wietze.github.io/blog/hijacking-dlls-in-windows
101	TRUE	cryptsp.dll	*\Windows\System32\*	T1574.002	https://securityintelligence.com/posts/windows-features-dll-sideloading/
102	TRUE	cryptsp.dll	*\Windows\SysWOW64\*	T1574.002	https://securityintelligence.com/posts/windows-features-dll-sideloading/
103	TRUE	cryptui.dll	*\Windows\System32\*	T1574.002	https://wietze.github.io/blog/hijacking-dlls-in-windows
104	TRUE	cryptui.dll	*\Windows\SysWOW64\*	T1574.002	https://wietze.github.io/blog/hijacking-dlls-in-windows
105	TRUE	cryptxml.dll	*\Windows\System32\*	T1574.002	https://wietze.github.io/blog/hijacking-dlls-in-windows
106	TRUE	cryptxml.dll	*\Windows\SysWOW64\*	T1574.002	https://wietze.github.io/blog/hijacking-dlls-in-windows
107	TRUE	cscapi.dll	*\Windows\System32\*	T1574.002	https://wietze.github.io/blog/hijacking-dlls-in-windows
108	TRUE	cscapi.dll	*\Windows\SysWOW64\*	T1574.002	https://wietze.github.io/blog/hijacking-dlls-in-windows
109	TRUE	cscobj.dll	*\Windows\System32\*	T1574.007	https://wietze.github.io/blog/save-the-environment-variables
110	TRUE	cscobj.dll	*\Windows\SysWOW64\*	T1574.007	https://wietze.github.io/blog/save-the-environment-variables
111	TRUE	cscui.dll	*\Windows\System32\*	T1574.007	https://wietze.github.io/blog/save-the-environment-variables
112	TRUE	cscui.dll	*\Windows\SysWOW64\*	T1574.007	https://wietze.github.io/blog/save-the-environment-variables
113	TRUE	d2d1.dll	*\Windows\System32\*	T1574.002	https://wietze.github.io/blog/hijacking-dlls-in-windows
114	TRUE	d2d1.dll	*\Windows\SysWOW64\*	T1574.002	https://wietze.github.io/blog/hijacking-dlls-in-windows
115	TRUE	d3d10.dll	*\Windows\System32\*	T1574.002	https://wietze.github.io/blog/hijacking-dlls-in-windows
116	TRUE	d3d10.dll	*\Windows\SysWOW64\*	T1574.002	https://wietze.github.io/blog/hijacking-dlls-in-windows
117	TRUE	d3d10_1.dll	*\Windows\System32\*	T1574.002	https://wietze.github.io/blog/hijacking-dlls-in-windows
118	TRUE	d3d10_1.dll	*\Windows\SysWOW64\*	T1574.002	https://wietze.github.io/blog/hijacking-dlls-in-windows
119	TRUE	d3d10_1core.dll	*\Windows\System32\*	T1574.002	https://wietze.github.io/blog/hijacking-dlls-in-windows
120	TRUE	d3d10_1core.dll	*\Windows\SysWOW64\*	T1574.002	https://wietze.github.io/blog/hijacking-dlls-in-windows
121	TRUE	d3d10core.dll	*\Windows\System32\*	T1574.002	https://wietze.github.io/blog/hijacking-dlls-in-windows
122	TRUE	d3d10core.dll	*\Windows\SysWOW64\*	T1574.002	https://wietze.github.io/blog/hijacking-dlls-in-windows
123	TRUE	d3d10warp.dll	*\Windows\System32\*	T1574.002	https://wietze.github.io/blog/hijacking-dlls-in-windows
124	TRUE	d3d10warp.dll	*\Windows\SysWOW64\*	T1574.002	https://wietze.github.io/blog/hijacking-dlls-in-windows
125	TRUE	d3d11.dll	*\Windows\System32\*	T1574.002	https://wietze.github.io/blog/hijacking-dlls-in-windows
126	TRUE	d3d11.dll	*\Windows\SysWOW64\*	T1574.002	https://wietze.github.io/blog/hijacking-dlls-in-windows
127	TRUE	d3d12.dll	*\Windows\System32\*	T1574.002	https://wietze.github.io/blog/hijacking-dlls-in-windows
128	TRUE	d3d12.dll	*\Windows\SysWOW64\*	T1574.002	https://wietze.github.io/blog/hijacking-dlls-in-windows
129	TRUE	d3d9.dll	*\Windows\System32\*	T1574.002	https://wietze.github.io/blog/hijacking-dlls-in-windows
130	TRUE	d3d9.dll	*\Windows\SysWOW64\*	T1574.002	https://wietze.github.io/blog/hijacking-dlls-in-windows
131	TRUE	d3dcompiler_47.dll	*\Program Files\windows kits\10\bin\*	T1574.002	https://wietze.github.io/blog/hijacking-dlls-in-windows
132	TRUE	d3dcompiler_47.dll	*\Program Files\windows kits\10\bin\*	T1574.002	https://wietze.github.io/blog/hijacking-dlls-in-windows
133	TRUE	d3dcompiler_47.dll	*\Program Files\windows kits\10\redist\d3d\x64*	T1574.002	https://wietze.github.io/blog/hijacking-dlls-in-windows
134	TRUE	d3dcompiler_47.dll	*\Program Files\windows kits\10\redist\d3d\x86*	T1574.002	https://wietze.github.io/blog/hijacking-dlls-in-windows
135	TRUE	d3dcompiler_47.dll	*\Program Files\wireshark*	T1574.002	https://wietze.github.io/blog/hijacking-dlls-in-windows
136	TRUE	d3dcompiler_47.dll	*\Program Files\cisco systems\cisco jabber*	T1574.002	https://wietze.github.io/blog/hijacking-dlls-in-windows
137	TRUE	d3dcompiler_47.dll	*\Program Files\microsoft\edge\application\*	T1574.002	https://wietze.github.io/blog/hijacking-dlls-in-windows
138	TRUE	d3dcompiler_47.dll	*\Program Files\Google\Chrome\Application\*	T1574.002	https://wietze.github.io/blog/hijacking-dlls-in-windows
139	TRUE	d3dcompiler_47.dll	*\Appdata\local\microsoft\teams\stage*	T1574.002	https://wietze.github.io/blog/hijacking-dlls-in-windows
140	TRUE	d3dcompiler_47.dll	*\Windows\System32\*	T1574.002	https://wietze.github.io/blog/hijacking-dlls-in-windows
141	TRUE	d3dcompiler_47.dll	*\Windows\SysWOW64\*	T1574.002	https://wietze.github.io/blog/hijacking-dlls-in-windows
142	TRUE	d3dcompiler_47.dll	*\Microsoft\Teams\*	T1574.002	https://wietze.github.io/blog/hijacking-dlls-in-windows
143	TRUE	d3dx9_43.dll	*\Windows\System32\*	T1574.002	https://news.sophos.com/en-us/2023/05/03/doubled-dll-sideloading-dragon-breath/
144	TRUE	d3dx9_43.dll	*\Windows\SysWOW64\*	T1574.002	https://news.sophos.com/en-us/2023/05/03/doubled-dll-sideloading-dragon-breath/
145	TRUE	dataexchange.dll	*\Windows\System32\*	T1574.007	https://wietze.github.io/blog/save-the-environment-variables
146	TRUE	dataexchange.dll	*\Windows\SysWOW64\*	T1574.007	https://wietze.github.io/blog/save-the-environment-variables
147	TRUE	davclnt.dll	*\Windows\System32\*	T1574.007	https://wietze.github.io/blog/save-the-environment-variables
148	TRUE	davclnt.dll	*\Windows\SysWOW64\*	T1574.007	https://wietze.github.io/blog/save-the-environment-variables
149	TRUE	dbgcore.dll	*\Program Files\windows kits\10\debuggers\arm*	T1574.002	https://wietze.github.io/blog/hijacking-dlls-in-windows
150	TRUE	dbgcore.dll	*\Program Files\windows kits\10\debuggers\arm\srcsrv*	T1574.002	https://wietze.github.io/blog/hijacking-dlls-in-windows
151	TRUE	dbgcore.dll	*\Program Files\windows kits\10\debuggers\arm64*	T1574.002	https://wietze.github.io/blog/hijacking-dlls-in-windows
152	TRUE	dbgcore.dll	*\Program Files\windows kits\10\debuggers\arm64\srcsrv*	T1574.002	https://wietze.github.io/blog/hijacking-dlls-in-windows
153	TRUE	dbgcore.dll	*\Program Files\windows kits\10\debuggers\x64*	T1574.002	https://wietze.github.io/blog/hijacking-dlls-in-windows
154	TRUE	dbgcore.dll	*\Program Files\windows kits\10\debuggers\x64\srcsrv*	T1574.002	https://wietze.github.io/blog/hijacking-dlls-in-windows
155	TRUE	dbgcore.dll	*\Program Files\windows kits\10\debuggers\x86*	T1574.002	https://wietze.github.io/blog/hijacking-dlls-in-windows
156	TRUE	dbgcore.dll	*\Program Files\windows kits\10\debuggers\x86\srcsrv*	T1574.002	https://wietze.github.io/blog/hijacking-dlls-in-windows
157	TRUE	dbgcore.dll	*\Program Files\microsoft office\root\office*	T1574.002	https://wietze.github.io/blog/hijacking-dlls-in-windows
158	TRUE	dbgcore.dll	*\Windows\System32\*	T1574.002	https://wietze.github.io/blog/hijacking-dlls-in-windows
159	TRUE	dbgcore.dll	*\Windows\SysWOW64\*	T1574.002	https://wietze.github.io/blog/hijacking-dlls-in-windows
160	TRUE	dbgeng.dll	*\Program Files\Windows Kits\*	T1574.002	https://twitter.com/mrexodia/status/1630320327967252483
161	TRUE	dbgeng.dll	*\Program Files\Windows Kits\*	T1574.002	https://twitter.com/mrexodia/status/1630320327967252483
162	TRUE	dbgeng.dll	*\Program Files\Windows Kits\*	T1574.002	https://twitter.com/mrexodia/status/1630320327967252483
163	TRUE	dbgeng.dll	*\Program Files\Windows Kits\*	T1574.002	https://twitter.com/mrexodia/status/1630320327967252483
164	TRUE	dbghelp.dll	*\Program Files\windows kits\10\debuggers\arm*	T1574.002	https://wietze.github.io/blog/hijacking-dlls-in-windows
165	TRUE	dbghelp.dll	*\Program Files\windows kits\10\debuggers\arm\srcsrv*	T1574.002	https://wietze.github.io/blog/hijacking-dlls-in-windows
166	TRUE	dbghelp.dll	*\Program Files\windows kits\10\debuggers\arm64*	T1574.002	https://wietze.github.io/blog/hijacking-dlls-in-windows
167	TRUE	dbghelp.dll	*\Program Files\windows kits\10\debuggers\arm64\srcsrv*	T1574.002	https://wietze.github.io/blog/hijacking-dlls-in-windows
168	TRUE	dbghelp.dll	*\Program Files\windows kits\10\debuggers\x64*	T1574.002	https://wietze.github.io/blog/hijacking-dlls-in-windows
169	TRUE	dbghelp.dll	*\Program Files\windows kits\10\debuggers\x64\srcsrv*	T1574.002	https://wietze.github.io/blog/hijacking-dlls-in-windows
170	TRUE	dbghelp.dll	*\Program Files\windows kits\10\debuggers\x86*	T1574.002	https://wietze.github.io/blog/hijacking-dlls-in-windows
171	TRUE	dbghelp.dll	*\Program Files\windows kits\10\debuggers\x86\srcsrv*	T1574.002	https://wietze.github.io/blog/hijacking-dlls-in-windows
172	TRUE	dbghelp.dll	*\Program Files\cisco systems\cisco jabber*	T1574.002	https://wietze.github.io/blog/hijacking-dlls-in-windows
173	TRUE	dbghelp.dll	*\Program Files\microsoft office\root\office*	T1574.002	https://wietze.github.io/blog/hijacking-dlls-in-windows
174	TRUE	dbghelp.dll	*\Program Files\microsoft office\root\vfs\programfilesx86\microsoft analysis services\as oledb\140*	T1574.002	https://wietze.github.io/blog/hijacking-dlls-in-windows
175	TRUE	dbghelp.dll	*\Windows\System32\*	T1574.002	https://wietze.github.io/blog/hijacking-dlls-in-windows
176	TRUE	dbghelp.dll	*\Windows\SysWOW64\*	T1574.002	https://wietze.github.io/blog/hijacking-dlls-in-windows
177	TRUE	dbgmodel.dll	*\Windows\System32\*	T1574.002	https://globetech.biz/index.php/2023/05/19/evading-edr-by-dll-sideloading-in-csharp/
178	TRUE	dbgmodel.dll	*\Windows\SysWOW64\*	T1574.002	https://globetech.biz/index.php/2023/05/19/evading-edr-by-dll-sideloading-in-csharp/
179	TRUE	dbgmodel.dll	*\Program Files\Windows Kits\10\Debuggers\*	T1574.002	https://globetech.biz/index.php/2023/05/19/evading-edr-by-dll-sideloading-in-csharp/
180	TRUE	dcntel.dll	*\Windows\System32\*	T1574.002	https://wietze.github.io/blog/hijacking-dlls-in-windows
181	TRUE	dcomp.dll	*\Windows\System32\*	T1574.002	https://wietze.github.io/blog/hijacking-dlls-in-windows
182	TRUE	dcomp.dll	*\Windows\SysWOW64\*	T1574.002	https://wietze.github.io/blog/hijacking-dlls-in-windows
183	TRUE	defragproxy.dll	*\Windows\System32\*	T1574.007	https://wietze.github.io/blog/save-the-environment-variables
184	TRUE	defragproxy.dll	*\Windows\SysWOW64\*	T1574.007	https://wietze.github.io/blog/save-the-environment-variables
185	TRUE	desktopshellext.dll	*\Windows\System32\*	T1574.007	https://wietze.github.io/blog/save-the-environment-variables
186	TRUE	desktopshellext.dll	*\Windows\SysWOW64\*	T1574.007	https://wietze.github.io/blog/save-the-environment-variables
187	TRUE	deviceassociation.dll	*\Windows\System32\*	T1574.002	https://wietze.github.io/blog/hijacking-dlls-in-windows
188	TRUE	deviceassociation.dll	*\Windows\SysWOW64\*	T1574.002	https://wietze.github.io/blog/hijacking-dlls-in-windows
189	TRUE	devicecredential.dll	*\Windows\System32\*	T1574.002	https://wietze.github.io/blog/hijacking-dlls-in-windows
190	TRUE	devicecredential.dll	*\Windows\SysWOW64\*	T1574.002	https://wietze.github.io/blog/hijacking-dlls-in-windows
191	TRUE	devicepairing.dll	*\Windows\System32\*	T1574.007	https://wietze.github.io/blog/save-the-environment-variables
192	TRUE	devicepairing.dll	*\Windows\SysWOW64\*	T1574.007	https://wietze.github.io/blog/save-the-environment-variables
193	TRUE	devobj.dll	*\Windows\System32\*	T1574.002	https://wietze.github.io/blog/hijacking-dlls-in-windows
194	TRUE	devobj.dll	*\Windows\SysWOW64\*	T1574.002	https://wietze.github.io/blog/hijacking-dlls-in-windows
195	TRUE	devrtl.dll	*\Windows\System32\*	T1574.002	https://wietze.github.io/blog/hijacking-dlls-in-windows
196	TRUE	devrtl.dll	*\Windows\SysWOW64\*	T1574.002	https://wietze.github.io/blog/hijacking-dlls-in-windows
197	TRUE	dhcpcmonitor.dll	*\Windows\System32\*	T1574.002	https://wietze.github.io/blog/hijacking-dlls-in-windows
198	TRUE	dhcpcmonitor.dll	*\Windows\SysWOW64\*	T1574.002	https://wietze.github.io/blog/hijacking-dlls-in-windows
199	TRUE	dhcpcsvc.dll	*\Windows\System32\*	T1574.002	https://wietze.github.io/blog/hijacking-dlls-in-windows
200	TRUE	dhcpcsvc.dll	*\Windows\SysWOW64\*	T1574.002	https://wietze.github.io/blog/hijacking-dlls-in-windows
201	TRUE	dhcpcsvc6.dll	*\Windows\System32\*	T1574.002	https://wietze.github.io/blog/hijacking-dlls-in-windows
202	TRUE	dhcpcsvc6.dll	*\Windows\SysWOW64\*	T1574.002	https://wietze.github.io/blog/hijacking-dlls-in-windows
203	TRUE	directmanipulation.dll	*\Windows\System32\*	T1574.007	https://wietze.github.io/blog/save-the-environment-variables
204	TRUE	directmanipulation.dll	*\Windows\SysWOW64\*	T1574.007	https://wietze.github.io/blog/save-the-environment-variables
205	TRUE	dismapi.dll	*\Windows\System32\*	T1574.002	https://wietze.github.io/blog/hijacking-dlls-in-windows
206	TRUE	dismapi.dll	*\Windows\SysWOW64\*	T1574.002	https://wietze.github.io/blog/hijacking-dlls-in-windows
207	TRUE	dismcore.dll	*\Windows\System32\dism*	T1574.001	https://cofense.com/exploiting-unpatched-vulnerability-ave_maria-malware-not-full-grace/
208	TRUE	dismcore.dll	*\Windows\SysWOW64\dism*	T1574.001	https://cofense.com/exploiting-unpatched-vulnerability-ave_maria-malware-not-full-grace/
209	TRUE	dmcfgutils.dll	*\Windows\System32\*	T1574.002	https://wietze.github.io/blog/hijacking-dlls-in-windows
210	TRUE	dmcfgutils.dll	*\Windows\SysWOW64\*	T1574.002	https://wietze.github.io/blog/hijacking-dlls-in-windows
211	TRUE	dmcmnutils.dll	*\Windows\System32\*	T1574.002	https://wietze.github.io/blog/hijacking-dlls-in-windows
212	TRUE	dmcmnutils.dll	*\Windows\SysWOW64\*	T1574.002	https://wietze.github.io/blog/hijacking-dlls-in-windows
213	TRUE	dmcommandlineutils.dll	*\Windows\System32\*	T1574.002	https://securityintelligence.com/posts/windows-features-dll-sideloading/
214	TRUE	dmcommandlineutils.dll	*\Windows\SysWOW64\*	T1574.002	https://securityintelligence.com/posts/windows-features-dll-sideloading/
215	TRUE	dmenrollengine.dll	*\Windows\System32\*	T1574.002	https://wietze.github.io/blog/hijacking-dlls-in-windows
216	TRUE	dmenrollengine.dll	*\Windows\SysWOW64\*	T1574.002	https://wietze.github.io/blog/hijacking-dlls-in-windows
217	TRUE	dmenterprisediagnostics.dll	*\Windows\System32\*	T1574.002	https://wietze.github.io/blog/hijacking-dlls-in-windows
218	TRUE	dmiso8601utils.dll	*\Windows\System32\*	T1574.002	https://wietze.github.io/blog/hijacking-dlls-in-windows
219	TRUE	dmiso8601utils.dll	*\Windows\SysWOW64\*	T1574.002	https://wietze.github.io/blog/hijacking-dlls-in-windows
220	TRUE	dmoleaututils.dll	*\Windows\System32\*	T1574.002	https://wietze.github.io/blog/hijacking-dlls-in-windows
221	TRUE	dmoleaututils.dll	*\Windows\SysWOW64\*	T1574.002	https://wietze.github.io/blog/hijacking-dlls-in-windows
222	TRUE	dmprocessxmlfiltered.dll	*\Windows\System32\*	T1574.002	https://wietze.github.io/blog/hijacking-dlls-in-windows
223	TRUE	dmprocessxmlfiltered.dll	*\Windows\SysWOW64\*	T1574.002	https://wietze.github.io/blog/hijacking-dlls-in-windows
224	TRUE	dmpushproxy.dll	*\Windows\System32\*	T1574.002	https://wietze.github.io/blog/hijacking-dlls-in-windows
225	TRUE	dmpushproxy.dll	*\Windows\SysWOW64\*	T1574.002	https://wietze.github.io/blog/hijacking-dlls-in-windows
226	TRUE	dmxmlhelputils.dll	*\Windows\System32\*	T1574.002	https://wietze.github.io/blog/hijacking-dlls-in-windows
227	TRUE	dmxmlhelputils.dll	*\Windows\SysWOW64\*	T1574.002	https://wietze.github.io/blog/hijacking-dlls-in-windows
228	TRUE	dnsapi.dll	*\Windows\System32\*	T1574.002	https://wietze.github.io/blog/hijacking-dlls-in-windows
229	TRUE	dnsapi.dll	*\Windows\SysWOW64\*	T1574.002	https://wietze.github.io/blog/hijacking-dlls-in-windows
230	TRUE	dot3api.dll	*\Windows\System32\*	T1574.002	https://wietze.github.io/blog/hijacking-dlls-in-windows
231	TRUE	dot3api.dll	*\Windows\SysWOW64\*	T1574.002	https://wietze.github.io/blog/hijacking-dlls-in-windows
232	TRUE	dot3cfg.dll	*\Windows\System32\*	T1574.002	https://wietze.github.io/blog/hijacking-dlls-in-windows
233	TRUE	dot3cfg.dll	*\Windows\SysWOW64\*	T1574.002	https://wietze.github.io/blog/hijacking-dlls-in-windows
234	TRUE	dpx.dll	*\Windows\System32\*	T1574.002	https://wietze.github.io/blog/hijacking-dlls-in-windows
235	TRUE	dpx.dll	*\Windows\SysWOW64\*	T1574.002	https://wietze.github.io/blog/hijacking-dlls-in-windows
236	TRUE	drprov.dll	*\Windows\System32\*	T1574.007	https://wietze.github.io/blog/save-the-environment-variables
237	TRUE	drprov.dll	*\Windows\SysWOW64\*	T1574.007	https://wietze.github.io/blog/save-the-environment-variables
238	TRUE	drvstore.dll	*\Windows\System32\*	T1574.002	https://securityintelligence.com/posts/windows-features-dll-sideloading/
239	TRUE	drvstore.dll	*\Windows\SysWOW64\*	T1574.002	https://securityintelligence.com/posts/windows-features-dll-sideloading/
240	TRUE	dsclient.dll	*\Windows\System32\*	T1574.002	https://wietze.github.io/blog/hijacking-dlls-in-windows
241	TRUE	dsclient.dll	*\Windows\SysWOW64\*	T1574.002	https://wietze.github.io/blog/hijacking-dlls-in-windows
242	TRUE	dsparse.dll	*\Windows\System32\*	T1574.002	https://wietze.github.io/blog/hijacking-dlls-in-windows
243	TRUE	dsparse.dll	*\Windows\SysWOW64\*	T1574.002	https://wietze.github.io/blog/hijacking-dlls-in-windows
244	TRUE	dsprop.dll	*\Windows\System32\*	T1574.002	https://securityintelligence.com/posts/windows-features-dll-sideloading/
245	TRUE	dsprop.dll	*\Windows\SysWOW64\*	T1574.002	https://securityintelligence.com/posts/windows-features-dll-sideloading/
246	TRUE	dsreg.dll	*\Windows\System32\*	T1574.002	https://wietze.github.io/blog/hijacking-dlls-in-windows
247	TRUE	dsreg.dll	*\Windows\SysWOW64\*	T1574.002	https://wietze.github.io/blog/hijacking-dlls-in-windows
248	TRUE	dsrole.dll	*\Windows\System32\*	T1574.002	https://wietze.github.io/blog/hijacking-dlls-in-windows
249	TRUE	dsrole.dll	*\Windows\SysWOW64\*	T1574.002	https://wietze.github.io/blog/hijacking-dlls-in-windows
250	TRUE	dui70.dll	*\Windows\System32\*	T1574.002	https://wietze.github.io/blog/hijacking-dlls-in-windows
251	TRUE	dui70.dll	*\Windows\SysWOW64\*	T1574.002	https://wietze.github.io/blog/hijacking-dlls-in-windows
252	TRUE	duser.dll	*\Windows\System32\*	T1574.002	https://wietze.github.io/blog/hijacking-dlls-in-windows
253	TRUE	duser.dll	*\Windows\SysWOW64\*	T1574.002	https://wietze.github.io/blog/hijacking-dlls-in-windows
254	TRUE	dusmapi.dll	*\Windows\System32\*	T1574.002	https://wietze.github.io/blog/hijacking-dlls-in-windows
255	TRUE	dusmapi.dll	*\Windows\SysWOW64\*	T1574.002	https://wietze.github.io/blog/hijacking-dlls-in-windows
256	TRUE	dwmapi.dll	*\Windows\System32\*	T1574.002	https://wietze.github.io/blog/hijacking-dlls-in-windows
257	TRUE	dwmapi.dll	*\Windows\SysWOW64\*	T1574.002	https://wietze.github.io/blog/hijacking-dlls-in-windows
258	TRUE	dwmcore.dll	*\Windows\System32\*	T1574.002	https://wietze.github.io/blog/hijacking-dlls-in-windows
259	TRUE	dwrite.dll	*\Windows\System32\*	T1574.002	https://wietze.github.io/blog/hijacking-dlls-in-windows
260	TRUE	dwrite.dll	*\Windows\SysWOW64\*	T1574.002	https://wietze.github.io/blog/hijacking-dlls-in-windows
261	TRUE	dxcore.dll	*\Windows\System32\*	T1574.002	https://securityintelligence.com/posts/windows-features-dll-sideloading/
262	TRUE	dxcore.dll	*\Windows\SysWOW64\*	T1574.002	https://securityintelligence.com/posts/windows-features-dll-sideloading/
263	TRUE	dxgi.dll	*\Windows\System32\*	T1574.002	https://wietze.github.io/blog/hijacking-dlls-in-windows
264	TRUE	dxgi.dll	*\Windows\SysWOW64\*	T1574.002	https://wietze.github.io/blog/hijacking-dlls-in-windows
265	TRUE	dxva2.dll	*\Windows\System32\*	T1574.002	https://wietze.github.io/blog/hijacking-dlls-in-windows
266	TRUE	dxva2.dll	*\Windows\SysWOW64\*	T1574.002	https://wietze.github.io/blog/hijacking-dlls-in-windows
267	TRUE	dynamoapi.dll	*\Windows\System32\*	T1574.002	https://wietze.github.io/blog/hijacking-dlls-in-windows
268	TRUE	eappcfg.dll	*\Windows\System32\*	T1574.002	https://wietze.github.io/blog/hijacking-dlls-in-windows
269	TRUE	eappcfg.dll	*\Windows\SysWOW64\*	T1574.002	https://wietze.github.io/blog/hijacking-dlls-in-windows
270	TRUE	eappprxy.dll	*\Windows\System32\*	T1574.002	https://wietze.github.io/blog/hijacking-dlls-in-windows
271	TRUE	eappprxy.dll	*\Windows\SysWOW64\*	T1574.002	https://wietze.github.io/blog/hijacking-dlls-in-windows
272	TRUE	edgeiso.dll	*\Windows\System32\*	T1574.002	https://securityintelligence.com/posts/windows-features-dll-sideloading/
273	TRUE	edgeiso.dll	*\Windows\SysWOW64\*	T1574.002	https://securityintelligence.com/posts/windows-features-dll-sideloading/
274	TRUE	edputil.dll	*\Windows\System32\*	T1574.002	https://wietze.github.io/blog/hijacking-dlls-in-windows
275	TRUE	edputil.dll	*\Windows\SysWOW64\*	T1574.002	https://wietze.github.io/blog/hijacking-dlls-in-windows
276	TRUE	efsadu.dll	*\Windows\System32\*	T1574.002	https://wietze.github.io/blog/hijacking-dlls-in-windows
277	TRUE	efsadu.dll	*\Windows\SysWOW64\*	T1574.002	https://wietze.github.io/blog/hijacking-dlls-in-windows
278	TRUE	efsutil.dll	*\Windows\System32\*	T1574.002	https://wietze.github.io/blog/hijacking-dlls-in-windows
279	TRUE	efsutil.dll	*\Windows\SysWOW64\*	T1574.002	https://wietze.github.io/blog/hijacking-dlls-in-windows
280	TRUE	esent.dll	*\Windows\System32\*	T1574.002	https://wietze.github.io/blog/hijacking-dlls-in-windows
281	TRUE	esent.dll	*\Windows\SysWOW64\*	T1574.002	https://wietze.github.io/blog/hijacking-dlls-in-windows
282	TRUE	execmodelproxy.dll	*\Windows\System32\*	T1574.007	https://wietze.github.io/blog/save-the-environment-variables
283	TRUE	execmodelproxy.dll	*\Windows\SysWOW64\*	T1574.007	https://wietze.github.io/blog/save-the-environment-variables
284	TRUE	explorerframe.dll	*\Windows\System32\*	T1574.007	https://wietze.github.io/blog/save-the-environment-variables
285	TRUE	explorerframe.dll	*\Windows\SysWOW64\*	T1574.007	https://wietze.github.io/blog/save-the-environment-variables
286	TRUE	facesdk.dll	*\Program Files\luxand\facesdk\bin\win64*	T1574.002	https://decoded.avast.io/threatintel/apt-treasure-trove-avast-suspects-chinese-apt-group-mustang-panda-is-collecting-data-from-burmese-government-agencies-and-opposition-groups/
287	TRUE	fastprox.dll	*\Windows\System32\wbem*	T1574.007	https://wietze.github.io/blog/save-the-environment-variables
288	TRUE	fastprox.dll	*\Windows\SysWOW64\wbem*	T1574.007	https://wietze.github.io/blog/save-the-environment-variables
289	TRUE	faultrep.dll	*\Windows\System32\*	T1574.002	https://wietze.github.io/blog/hijacking-dlls-in-windows
290	TRUE	faultrep.dll	*\Windows\SysWOW64\*	T1574.002	https://wietze.github.io/blog/hijacking-dlls-in-windows
291	TRUE	fddevquery.dll	*\Windows\System32\*	T1574.007	https://wietze.github.io/blog/save-the-environment-variables
292	TRUE	fddevquery.dll	*\Windows\SysWOW64\*	T1574.007	https://wietze.github.io/blog/save-the-environment-variables
293	TRUE	feclient.dll	*\Windows\System32\*	T1574.002	https://wietze.github.io/blog/hijacking-dlls-in-windows
294	TRUE	feclient.dll	*\Windows\SysWOW64\*	T1574.002	https://wietze.github.io/blog/hijacking-dlls-in-windows
295	TRUE	fhcfg.dll	*\Windows\System32\*	T1574.007	https://wietze.github.io/blog/save-the-environment-variables
296	TRUE	fhcfg.dll	*\Windows\SysWOW64\*	T1574.007	https://wietze.github.io/blog/save-the-environment-variables
297	TRUE	fhsvcctl.dll	*\Windows\System32\*	T1574.002	https://wietze.github.io/blog/hijacking-dlls-in-windows
298	TRUE	firewallapi.dll	*\Windows\System32\*	T1574.002	https://wietze.github.io/blog/hijacking-dlls-in-windows
299	TRUE	firewallapi.dll	*\Windows\SysWOW64\*	T1574.002	https://wietze.github.io/blog/hijacking-dlls-in-windows
300	TRUE	flightsettings.dll	*\Windows\System32\*	T1574.007	https://wietze.github.io/blog/save-the-environment-variables
301	TRUE	flightsettings.dll	*\Windows\SysWOW64\*	T1574.007	https://wietze.github.io/blog/save-the-environment-variables
302	TRUE	fltlib.dll	*\Windows\System32\*	T1574.002	https://wietze.github.io/blog/hijacking-dlls-in-windows
303	TRUE	fltlib.dll	*\Windows\SysWOW64\*	T1574.002	https://wietze.github.io/blog/hijacking-dlls-in-windows
304	TRUE	formdll.dll	*\Program Files\Common Files\Microsoft Shared\NoteSync Forms*	T1574.002	https://any.run/report/d9c7f6d4ec08d961c20dac1b6422b3fbec5c6a8d9dc67d1f604835b36c5f224e/ae068531-92db-497d-b0cb-c0b1af5476f1
305	TRUE	framedynos.dll	*\Windows\System32\*	T1574.002	https://securityintelligence.com/posts/windows-features-dll-sideloading/
306	TRUE	framedynos.dll	*\Windows\SysWOW64\*	T1574.002	https://securityintelligence.com/posts/windows-features-dll-sideloading/
307	TRUE	fveapi.dll	*\Windows\System32\*	T1574.002	https://wietze.github.io/blog/hijacking-dlls-in-windows
308	TRUE	fveapi.dll	*\Windows\SysWOW64\*	T1574.002	https://wietze.github.io/blog/hijacking-dlls-in-windows
309	TRUE	fveskybackup.dll	*\Windows\System32\*	T1574.002	https://securityintelligence.com/posts/windows-features-dll-sideloading/
310	TRUE	fvewiz.dll	*\Windows\System32\*	T1574.002	https://securityintelligence.com/posts/windows-features-dll-sideloading/
311	TRUE	fwbase.dll	*\Windows\System32\*	T1574.002	https://wietze.github.io/blog/hijacking-dlls-in-windows
312	TRUE	fwbase.dll	*\Windows\SysWOW64\*	T1574.002	https://wietze.github.io/blog/hijacking-dlls-in-windows
313	TRUE	fwcfg.dll	*\Windows\System32\*	T1574.002	https://wietze.github.io/blog/hijacking-dlls-in-windows
314	TRUE	fwcfg.dll	*\Windows\SysWOW64\*	T1574.002	https://wietze.github.io/blog/hijacking-dlls-in-windows
315	TRUE	fwpolicyiomgr.dll	*\Windows\System32\*	T1574.002	https://wietze.github.io/blog/hijacking-dlls-in-windows
316	TRUE	fwpolicyiomgr.dll	*\Windows\SysWOW64\*	T1574.002	https://wietze.github.io/blog/hijacking-dlls-in-windows
317	TRUE	fwpuclnt.dll	*\Windows\System32\*	T1574.002	https://wietze.github.io/blog/hijacking-dlls-in-windows
318	TRUE	fwpuclnt.dll	*\Windows\SysWOW64\*	T1574.002	https://wietze.github.io/blog/hijacking-dlls-in-windows
319	TRUE	fxsapi.dll	*\Windows\System32\*	T1574.002	https://wietze.github.io/blog/hijacking-dlls-in-windows
320	TRUE	fxsapi.dll	*\Windows\System32\driverstore\filerepository\prnms002.inf_*	T1574.002	https://wietze.github.io/blog/hijacking-dlls-in-windows
321	TRUE	fxsapi.dll	*\Windows\SysWOW64\*	T1574.002	https://wietze.github.io/blog/hijacking-dlls-in-windows
322	TRUE	fxsst.dll	*\Windows\System32\*	T1574.001	https://www.fireeye.com/blog/threat-research/2011/06/fxsst.html/
323	TRUE	fxstiff.dll	*\Windows\System32\*	T1574.002	https://wietze.github.io/blog/hijacking-dlls-in-windows
324	TRUE	fxstiff.dll	*\Windows\System32\driverstore\filerepository\prnms002.inf_*	T1574.002	https://wietze.github.io/blog/hijacking-dlls-in-windows
325	TRUE	getuname.dll	*\Windows\System32\*	T1574.002	https://wietze.github.io/blog/hijacking-dlls-in-windows
326	TRUE	getuname.dll	*\Windows\SysWOW64\*	T1574.002	https://wietze.github.io/blog/hijacking-dlls-in-windows
327	TRUE	gflagsui.dll	*\Program Files\Windows Kits\10\Debuggers\*	T1574.002	https://globetech.biz/index.php/2023/05/19/evading-edr-by-dll-sideloading-in-csharp/
328	TRUE	glib-2.0.dll	*\Program Files\VMware\VMware Tools*	T1574.002	https://www.sentinelone.com/labs/lockbit-ransomware-side-loads-cobalt-strike-beacon-with-legitimate-vmware-utility/
329	TRUE	glib-2.0.dll	*\Program Files\VMware\VMware Workstation*	T1574.002	https://www.sentinelone.com/labs/lockbit-ransomware-side-loads-cobalt-strike-beacon-with-legitimate-vmware-utility/
330	TRUE	glib-2.0.dll	*\Program Files\VMware\VMware Player*	T1574.002	https://www.sentinelone.com/labs/lockbit-ransomware-side-loads-cobalt-strike-beacon-with-legitimate-vmware-utility/
331	TRUE	gpapi.dll	*\Windows\System32\*	T1574.002	https://securityintelligence.com/posts/windows-features-dll-sideloading/
332	TRUE	gpapi.dll	*\Windows\SysWOW64\*	T1574.002	https://securityintelligence.com/posts/windows-features-dll-sideloading/
333	TRUE	hha.dll	*\Windows\System32\*	T1574.002	https://blog.trendmicro.com/trendlabs-security-intelligence/new-wave-of-plugx-targets-legitimate-apps/
334	TRUE	hha.dll	*\Windows\SysWOW64\*	T1574.002	https://blog.trendmicro.com/trendlabs-security-intelligence/new-wave-of-plugx-targets-legitimate-apps/
335	TRUE	hha.dll	*\Program Files\HTML Help Workshop*	T1574.002	https://blog.trendmicro.com/trendlabs-security-intelligence/new-wave-of-plugx-targets-legitimate-apps/
336	TRUE	hid.dll	*\Windows\System32\*	T1574.001	https://wietze.github.io/blog/hijacking-dlls-in-windows
337	TRUE	hid.dll	*\Windows\SysWOW64\*	T1574.001	https://wietze.github.io/blog/hijacking-dlls-in-windows
338	TRUE	hnetmon.dll	*\Windows\System32\*	T1574.002	https://wietze.github.io/blog/hijacking-dlls-in-windows
339	TRUE	hnetmon.dll	*\Windows\SysWOW64\*	T1574.002	https://wietze.github.io/blog/hijacking-dlls-in-windows
340	TRUE	hpcustpartui.dll	*\Program Files\HP*	T1574.002	https://www.trellix.com/en-us/about/newsroom/stories/research/operation-harvest-a-deep-dive-into-a-long-term-campaign.html
341	TRUE	hpqhvsei.dll	*\Program Files\HP*	T1574.002	https://www.secureworks.com/research/shadowpad-malware-analysis
342	TRUE	httpapi.dll	*\Windows\System32\*	T1574.002	https://wietze.github.io/blog/hijacking-dlls-in-windows
343	TRUE	httpapi.dll	*\Windows\SysWOW64\*	T1574.002	https://wietze.github.io/blog/hijacking-dlls-in-windows
344	TRUE	icmp.dll	*\Windows\System32\*	T1574.002	https://securityintelligence.com/posts/windows-features-dll-sideloading/
345	TRUE	icmp.dll	*\Windows\SysWOW64\*	T1574.002	https://securityintelligence.com/posts/windows-features-dll-sideloading/
346	TRUE	idstore.dll	*\Windows\System32\*	T1574.007	https://wietze.github.io/blog/save-the-environment-variables
347	TRUE	idstore.dll	*\Windows\SysWOW64\*	T1574.007	https://wietze.github.io/blog/save-the-environment-variables
348	TRUE	ieadvpack.dll	*\Windows\System32\*	T1574.002	https://wietze.github.io/blog/hijacking-dlls-in-windows
349	TRUE	ieadvpack.dll	*\Windows\SysWOW64\*	T1574.002	https://wietze.github.io/blog/hijacking-dlls-in-windows
350	TRUE	iedkcs32.dll	*\Windows\System32\*	T1574.002	https://wietze.github.io/blog/hijacking-dlls-in-windows
351	TRUE	iedkcs32.dll	*\Windows\SysWOW64\*	T1574.002	https://wietze.github.io/blog/hijacking-dlls-in-windows
352	TRUE	iernonce.dll	*\Windows\System32\*	T1574.002	https://www.hexacorn.com/blog/2023/12/26/1-little-known-secret-of-runonce-exe-32-bit/
353	TRUE	iernonce.dll	*\Windows\SysWOW64\*	T1574.002	https://www.hexacorn.com/blog/2023/12/26/1-little-known-secret-of-runonce-exe-32-bit/
354	TRUE	iertutil.dll	*\Windows\System32\*	T1574.002	https://wietze.github.io/blog/hijacking-dlls-in-windows
355	TRUE	iertutil.dll	*\Windows\SysWOW64\*	T1574.002	https://wietze.github.io/blog/hijacking-dlls-in-windows
356	TRUE	ifmon.dll	*\Windows\System32\*	T1574.002	https://wietze.github.io/blog/hijacking-dlls-in-windows
357	TRUE	ifmon.dll	*\Windows\SysWOW64\*	T1574.002	https://wietze.github.io/blog/hijacking-dlls-in-windows
358	TRUE	ifsutil.dll	*\Windows\System32\*	T1574.002	https://securityintelligence.com/posts/windows-features-dll-sideloading/
359	TRUE	ifsutil.dll	*\Windows\SysWOW64\*	T1574.002	https://securityintelligence.com/posts/windows-features-dll-sideloading/
360	TRUE	inproclogger.dll	*\Windows\System32\*	T1574.002	https://wietze.github.io/blog/hijacking-dlls-in-windows
361	TRUE	iphlpapi.dll	*\Windows\System32\*	T1574.001	https://wietze.github.io/blog/hijacking-dlls-in-windows
362	TRUE	iphlpapi.dll	*\Windows\SysWOW64\*	T1574.001	https://wietze.github.io/blog/hijacking-dlls-in-windows
363	TRUE	iri.dll	*\Windows\System32\*	T1574.002	https://wietze.github.io/blog/hijacking-dlls-in-windows
364	TRUE	iri.dll	*\Windows\SysWOW64\*	T1574.002	https://wietze.github.io/blog/hijacking-dlls-in-windows
365	TRUE	iscsidsc.dll	*\Windows\System32\*	T1574.002	https://wietze.github.io/blog/hijacking-dlls-in-windows
366	TRUE	iscsidsc.dll	*\Windows\SysWOW64\*	T1574.002	https://wietze.github.io/blog/hijacking-dlls-in-windows
367	TRUE	iscsiexe.dll	*\Windows\System32\*	T1574.001	https://github.com/hackerhouse-opensource/iscsicpl_bypassUAC
368	TRUE	iscsiexe.dll	*\Windows\SysWOW64\*	T1574.001	https://github.com/hackerhouse-opensource/iscsicpl_bypassUAC
369	TRUE	iscsium.dll	*\Windows\System32\*	T1574.002	https://wietze.github.io/blog/hijacking-dlls-in-windows
370	TRUE	iscsium.dll	*\Windows\SysWOW64\*	T1574.002	https://wietze.github.io/blog/hijacking-dlls-in-windows
371	TRUE	isv.exe_rsaenh.dll	*\Windows\System32\*	T1574.007	https://wietze.github.io/blog/save-the-environment-variables
372	TRUE	isv.exe_rsaenh.dll	*\Windows\SysWOW64\*	T1574.007	https://wietze.github.io/blog/save-the-environment-variables
373	TRUE	iumbase.dll	*\Windows\System32\*	T1574.002	https://wietze.github.io/blog/hijacking-dlls-in-windows
374	TRUE	iumsdk.dll	*\Windows\System32\*	T1574.002	https://securityintelligence.com/posts/windows-features-dll-sideloading/
375	TRUE	iviewers.dll	*\Program Files\Windows Kits\10\bin\*	T1574.002	https://www.secureworks.com/research/shadowpad-malware-analysis
376	TRUE	iviewers.dll	*\Program Files\Windows Kits\10\bin\*	T1574.002	https://www.secureworks.com/research/shadowpad-malware-analysis
377	TRUE	iviewers.dll	*\Program Files\Windows Kits\10\bin\*	T1574.002	https://www.secureworks.com/research/shadowpad-malware-analysis
378	TRUE	iviewers.dll	*\Program Files\Windows Kits\10\bin\*	T1574.002	https://www.secureworks.com/research/shadowpad-malware-analysis
379	TRUE	joinutil.dll	*\Windows\System32\*	T1574.002	https://wietze.github.io/blog/hijacking-dlls-in-windows
380	TRUE	joinutil.dll	*\Windows\SysWOW64\*	T1574.002	https://wietze.github.io/blog/hijacking-dlls-in-windows
381	TRUE	kdstub.dll	*\Windows\System32\*	T1574.002	https://wietze.github.io/blog/hijacking-dlls-in-windows
382	TRUE	ksuser.dll	*\Windows\System32\*	T1574.002	https://wietze.github.io/blog/hijacking-dlls-in-windows
383	TRUE	ksuser.dll	*\Windows\SysWOW64\*	T1574.002	https://wietze.github.io/blog/hijacking-dlls-in-windows
384	TRUE	ktmw32.dll	*\Windows\System32\*	T1574.002	https://wietze.github.io/blog/hijacking-dlls-in-windows
385	TRUE	ktmw32.dll	*\Windows\SysWOW64\*	T1574.002	https://wietze.github.io/blog/hijacking-dlls-in-windows
386	TRUE	ldvpocx.ocx	*\Program Files\Symantec_Client_Security\Symantec AntiVirus*	T1574.002	https://www.secureworks.com/research/a-peek-into-bronze-unions-toolbox
387	TRUE	ldvpocx.ocx	*\Program Files\Symantec AntiVirus*	T1574.002	https://www.secureworks.com/research/a-peek-into-bronze-unions-toolbox
388	TRUE	libvlc.dll	*\Program Files\VideoLAN\VLC*	T1574.002	https://news.sophos.com/en-us/2022/11/03/family-tree-dll-sideloading-cases-may-be-related/
389	TRUE	licensemanagerapi.dll	*\Windows\System32\*	T1574.002	https://wietze.github.io/blog/hijacking-dlls-in-windows
390	TRUE	licensemanagerapi.dll	*\Windows\SysWOW64\*	T1574.002	https://wietze.github.io/blog/hijacking-dlls-in-windows
391	TRUE	licensingdiagspp.dll	*\Windows\System32\*	T1574.007	https://wietze.github.io/blog/save-the-environment-variables
392	TRUE	licensingdiagspp.dll	*\Windows\SysWOW64\*	T1574.007	https://wietze.github.io/blog/save-the-environment-variables
393	TRUE	linkinfo.dll	*\Windows\System32\*	T1574.002	https://wietze.github.io/blog/hijacking-dlls-in-windows
394	TRUE	linkinfo.dll	*\Windows\SysWOW64\*	T1574.002	https://wietze.github.io/blog/hijacking-dlls-in-windows
395	TRUE	lmiguardiandll.dll	*\Program Files\LogMeIn*	T1574.002	https://twitter.com/StopMalvertisin/status/1610961056163311619
396	TRUE	lmiguardiandll.dll	*\Program Files\LogMeIn\x86*	T1574.002	https://twitter.com/StopMalvertisin/status/1610961056163311619
397	TRUE	lmiguardiandll.dll	*\Program Files\LogMeIn\x64*	T1574.002	https://twitter.com/StopMalvertisin/status/1610961056163311619
398	TRUE	loadperf.dll	*\Windows\System32\*	T1574.002	https://wietze.github.io/blog/hijacking-dlls-in-windows
399	TRUE	loadperf.dll	*\Windows\SysWOW64\*	T1574.002	https://wietze.github.io/blog/hijacking-dlls-in-windows
400	TRUE	lockdown.dll	*\Program Files\McAfee\VirusScan Enterprise*	T1574.002	https://twitter.com/thepacketrat/status/1520878930449817600
401	TRUE	lockhostingframework.dll	*\Windows\System32\*	T1574.002	https://securityintelligence.com/posts/windows-features-dll-sideloading/
402	TRUE	log.dll	*\Program Files\Bitdefender Antivirus Free*	T1574.002	https://www.secureworks.com/research/shadowpad-malware-analysis
403	TRUE	logoncli.dll	*\Windows\System32\*	T1574.002	https://wietze.github.io/blog/hijacking-dlls-in-windows
404	TRUE	logoncli.dll	*\Windows\SysWOW64\*	T1574.002	https://wietze.github.io/blog/hijacking-dlls-in-windows
405	TRUE	logoncontroller.dll	*\Windows\System32\*	T1574.007	https://wietze.github.io/blog/save-the-environment-variables
406	TRUE	logoncontroller.dll	*\Windows\SysWOW64\*	T1574.007	https://wietze.github.io/blog/save-the-environment-variables
407	TRUE	lpksetupproxyserv.dll	*\Windows\System32\*	T1574.007	https://wietze.github.io/blog/save-the-environment-variables
408	TRUE	lpksetupproxyserv.dll	*\Windows\SysWOW64\*	T1574.007	https://wietze.github.io/blog/save-the-environment-variables
409	TRUE	lrwizdll.dll	*\Windows\System32\*	T1574.002	https://securityintelligence.com/posts/windows-features-dll-sideloading/
410	TRUE	magnification.dll	*\Windows\System32\*	T1574.002	https://wietze.github.io/blog/hijacking-dlls-in-windows
411	TRUE	magnification.dll	*\Windows\SysWOW64\*	T1574.002	https://wietze.github.io/blog/hijacking-dlls-in-windows
412	TRUE	maintenanceui.dll	*\Windows\System32\*	T1574.002	https://wietze.github.io/blog/hijacking-dlls-in-windows
413	TRUE	mapistub.dll	*\Windows\System32\*	T1574.002	https://wietze.github.io/blog/hijacking-dlls-in-windows
414	TRUE	mapistub.dll	*\Windows\SysWOW64\*	T1574.002	https://wietze.github.io/blog/hijacking-dlls-in-windows
415	TRUE	mbaexmlparser.dll	*\Windows\System32\*	T1574.002	https://securityintelligence.com/posts/windows-features-dll-sideloading/
416	TRUE	mdmdiagnostics.dll	*\Windows\System32\*	T1574.002	https://wietze.github.io/blog/hijacking-dlls-in-windows
417	TRUE	mfc42u.dll	*\Windows\System32\*	T1574.002	https://securityintelligence.com/posts/windows-features-dll-sideloading/
418	TRUE	mfc42u.dll	*\Windows\SysWOW64\*	T1574.002	https://securityintelligence.com/posts/windows-features-dll-sideloading/
419	TRUE	mfcore.dll	*\Windows\System32\*	T1574.002	https://wietze.github.io/blog/hijacking-dlls-in-windows
420	TRUE	mfcore.dll	*\Windows\SysWOW64\*	T1574.002	https://wietze.github.io/blog/hijacking-dlls-in-windows
421	TRUE	mfplat.dll	*\Windows\System32\*	T1574.002	https://wietze.github.io/blog/hijacking-dlls-in-windows
422	TRUE	mfplat.dll	*\Windows\SysWOW64\*	T1574.002	https://wietze.github.io/blog/hijacking-dlls-in-windows
423	TRUE	mi.dll	*\Windows\System32\*	T1574.002	https://wietze.github.io/blog/hijacking-dlls-in-windows
424	TRUE	mi.dll	*\Windows\SysWOW64\*	T1574.002	https://wietze.github.io/blog/hijacking-dlls-in-windows
425	TRUE	midimap.dll	*\Windows\System32\*	T1574.002	https://wietze.github.io/blog/hijacking-dlls-in-windows
426	TRUE	midimap.dll	*\Windows\SysWOW64\*	T1574.002	https://wietze.github.io/blog/hijacking-dlls-in-windows
427	TRUE	mintdh.dll	*\Windows\System32\*	T1574.002	https://wietze.github.io/blog/hijacking-dlls-in-windows
428	TRUE	miutils.dll	*\Windows\System32\*	T1574.002	https://wietze.github.io/blog/hijacking-dlls-in-windows
429	TRUE	miutils.dll	*\Windows\SysWOW64\*	T1574.002	https://wietze.github.io/blog/hijacking-dlls-in-windows
430	TRUE	mlang.dll	*\Windows\System32\*	T1574.002	https://wietze.github.io/blog/hijacking-dlls-in-windows
431	TRUE	mlang.dll	*\Windows\SysWOW64\*	T1574.002	https://wietze.github.io/blog/hijacking-dlls-in-windows
432	TRUE	mmdevapi.dll	*\Windows\System32\*	T1574.002	https://wietze.github.io/blog/hijacking-dlls-in-windows
433	TRUE	mmdevapi.dll	*\Windows\SysWOW64\*	T1574.002	https://wietze.github.io/blog/hijacking-dlls-in-windows
434	TRUE	mobilenetworking.dll	*\Windows\System32\*	T1574.002	https://wietze.github.io/blog/hijacking-dlls-in-windows
435	TRUE	mobilenetworking.dll	*\Windows\SysWOW64\*	T1574.002	https://wietze.github.io/blog/hijacking-dlls-in-windows
436	TRUE	mozglue.dll	*\Program Files\SeaMonkey*	T1574.002	https://twitter.com/SBousseaden/status/1530595156055011330
437	TRUE	mozglue.dll	*\Program Files\Mozilla Firefox*	T1574.002	https://twitter.com/SBousseaden/status/1530595156055011330
438	TRUE	mozglue.dll	*\Program Files\Mozilla Thunderbird*	T1574.002	https://twitter.com/SBousseaden/status/1530595156055011330
439	TRUE	mozglue.dll	*\AppData\Local\Mozilla Firefox\*	T1574.002	https://twitter.com/SBousseaden/status/1530595156055011330
440	TRUE	mpclient.dll	*\Program Files\Windows Defender*	T1574.002	https://www.sentinelone.com/blog/living-off-windows-defender-lockbit-ransomware-sideloads-cobalt-strike-through-microsoft-security-tool/
441	TRUE	mpclient.dll	*\ProgramData\Microsoft\Windows Defender\Platform\*	T1574.002	https://www.sentinelone.com/blog/living-off-windows-defender-lockbit-ransomware-sideloads-cobalt-strike-through-microsoft-security-tool/
442	TRUE	mpr.dll	*\Windows\System32\*	T1574.002	https://wietze.github.io/blog/save-the-environment-variables
443	TRUE	mpr.dll	*\Windows\SysWOW64\*	T1574.002	https://wietze.github.io/blog/save-the-environment-variables
444	TRUE	mprapi.dll	*\Windows\System32\*	T1574.002	https://wietze.github.io/blog/hijacking-dlls-in-windows
445	TRUE	mprapi.dll	*\Windows\SysWOW64\*	T1574.002	https://wietze.github.io/blog/hijacking-dlls-in-windows
446	TRUE	mpsvc.dll	*\Program Files\Windows Defender\*	T1574.002	https://www.mcafee.com/blogs/other-blogs/mcafee-labs/revil-ransomware-uses-dll-sideloading/
447	TRUE	mpsvc.dll	*\ProgramData\Microsoft\Windows Defender\Platform\*	T1574.002	https://www.mcafee.com/blogs/other-blogs/mcafee-labs/revil-ransomware-uses-dll-sideloading/
448	TRUE	mrmcorer.dll	*\Windows\System32\*	T1574.002	https://wietze.github.io/blog/hijacking-dlls-in-windows
449	TRUE	mrmcorer.dll	*\Windows\SysWOW64\*	T1574.002	https://wietze.github.io/blog/hijacking-dlls-in-windows
450	TRUE	msacm32.dll	*\Windows\System32\*	T1574.002	https://wietze.github.io/blog/hijacking-dlls-in-windows
451	TRUE	msacm32.dll	*\Windows\SysWOW64\*	T1574.002	https://wietze.github.io/blog/hijacking-dlls-in-windows
452	TRUE	mscms.dll	*\Windows\System32\*	T1574.002	https://wietze.github.io/blog/hijacking-dlls-in-windows
453	TRUE	mscms.dll	*\Windows\SysWOW64\*	T1574.002	https://wietze.github.io/blog/hijacking-dlls-in-windows
454	TRUE	mscoree.dll	*\Windows\System32\*	T1574.002	https://wietze.github.io/blog/hijacking-dlls-in-windows
455	TRUE	mscoree.dll	*\Windows\SysWOW64\*	T1574.002	https://wietze.github.io/blog/hijacking-dlls-in-windows
456	TRUE	mscorsvc.dll	*\Windows\Microsoft.NET\Framework\v*	T1574.002	https://decoded.avast.io/threatintel/apt-treasure-trove-avast-suspects-chinese-apt-group-mustang-panda-is-collecting-data-from-burmese-government-agencies-and-opposition-groups/
457	TRUE	mscorsvc.dll	*\Windows\Microsoft.NET\Framework64\v*	T1574.002	https://decoded.avast.io/threatintel/apt-treasure-trove-avast-suspects-chinese-apt-group-mustang-panda-is-collecting-data-from-burmese-government-agencies-and-opposition-groups/
458	TRUE	msctf.dll	*\Windows\System32\*	T1574.007	https://wietze.github.io/blog/save-the-environment-variables
459	TRUE	msctf.dll	*\Windows\SysWOW64\*	T1574.007	https://wietze.github.io/blog/save-the-environment-variables
460	TRUE	msctfmonitor.dll	*\Windows\System32\*	T1574.002	https://wietze.github.io/blog/hijacking-dlls-in-windows
461	TRUE	msctfmonitor.dll	*\Windows\SysWOW64\*	T1574.002	https://wietze.github.io/blog/hijacking-dlls-in-windows
462	TRUE	msdrm.dll	*\Windows\System32\*	T1574.002	https://wietze.github.io/blog/hijacking-dlls-in-windows
463	TRUE	msdrm.dll	*\Windows\SysWOW64\*	T1574.002	https://wietze.github.io/blog/hijacking-dlls-in-windows
464	TRUE	msdtctm.dll	*\Windows\System32\*	T1574.002	https://wietze.github.io/blog/hijacking-dlls-in-windows
465	TRUE	msftedit.dll	*\Windows\System32\*	T1574.002	https://www.hexacorn.com/blog/2015/02/23/beyond-good-ol-run-key-part-28/
466	TRUE	msftedit.dll	*\Windows\SysWOW64\*	T1574.002	https://www.hexacorn.com/blog/2015/02/23/beyond-good-ol-run-key-part-28/
467	TRUE	msi.dll	*\Windows\System32\*	T1574.002	https://wietze.github.io/blog/hijacking-dlls-in-windows
468	TRUE	msi.dll	*\Windows\SysWOW64\*	T1574.002	https://wietze.github.io/blog/hijacking-dlls-in-windows
469	TRUE	msiso.dll	*\Windows\System32\*	T1574.002	https://securityintelligence.com/posts/windows-features-dll-sideloading/
470	TRUE	msiso.dll	*\Windows\SysWOW64\*	T1574.002	https://securityintelligence.com/posts/windows-features-dll-sideloading/
471	TRUE	msutb.dll	*\Windows\System32\*	T1574.002	https://wietze.github.io/blog/hijacking-dlls-in-windows
472	TRUE	msutb.dll	*\Windows\SysWOW64\*	T1574.002	https://wietze.github.io/blog/hijacking-dlls-in-windows
473	TRUE	msvcp110_win.dll	*\Windows\System32\*	T1574.002	https://securityintelligence.com/posts/windows-features-dll-sideloading/
474	TRUE	msvcp110_win.dll	*\Windows\SysWOW64\*	T1574.002	https://securityintelligence.com/posts/windows-features-dll-sideloading/
475	TRUE	msvcr100.dll	*\Windows\System32\*	T1574.002	https://twitter.com/SBousseaden/status/1530595156055011330
476	TRUE	msvcr100.dll	*\Windows\SysWOW64\*	T1574.002	https://twitter.com/SBousseaden/status/1530595156055011330
477	TRUE	mswb7.dll	*\Windows\System32\*	T1574.007	https://wietze.github.io/blog/save-the-environment-variables
478	TRUE	mswb7.dll	*\Windows\SysWOW64\*	T1574.007	https://wietze.github.io/blog/save-the-environment-variables
479	TRUE	mswsock.dll	*\Windows\System32\*	T1574.002	https://wietze.github.io/blog/save-the-environment-variables
480	TRUE	mswsock.dll	*\Windows\SysWOW64\*	T1574.002	https://wietze.github.io/blog/save-the-environment-variables
481	TRUE	msxml3.dll	*\Windows\System32\*	T1574.007	https://wietze.github.io/blog/save-the-environment-variables
482	TRUE	msxml3.dll	*\Windows\SysWOW64\*	T1574.007	https://wietze.github.io/blog/save-the-environment-variables
483	TRUE	mtxclu.dll	*\Windows\System32\*	T1574.002	https://wietze.github.io/blog/hijacking-dlls-in-windows
484	TRUE	mtxclu.dll	*\Windows\SysWOW64\*	T1574.002	https://wietze.github.io/blog/hijacking-dlls-in-windows
485	TRUE	napinsp.dll	*\Windows\System32\*	T1574.007	https://wietze.github.io/blog/save-the-environment-variables
486	TRUE	napinsp.dll	*\Windows\SysWOW64\*	T1574.007	https://wietze.github.io/blog/save-the-environment-variables
487	TRUE	ncrypt.dll	*\Windows\System32\*	T1574.002	https://wietze.github.io/blog/save-the-environment-variables
488	TRUE	ncrypt.dll	*\Windows\SysWOW64\*	T1574.002	https://wietze.github.io/blog/save-the-environment-variables
489	TRUE	ndfapi.dll	*\Windows\System32\*	T1574.002	https://wietze.github.io/blog/hijacking-dlls-in-windows
490	TRUE	ndfapi.dll	*\Windows\SysWOW64\*	T1574.002	https://wietze.github.io/blog/hijacking-dlls-in-windows
491	TRUE	netapi32.dll	*\Windows\System32\*	T1574.002	https://securityintelligence.com/posts/windows-features-dll-sideloading/
492	TRUE	netapi32.dll	*\Windows\SysWOW64\*	T1574.002	https://securityintelligence.com/posts/windows-features-dll-sideloading/
493	TRUE	netid.dll	*\Windows\System32\*	T1574.002	https://wietze.github.io/blog/hijacking-dlls-in-windows
494	TRUE	netid.dll	*\Windows\SysWOW64\*	T1574.002	https://wietze.github.io/blog/hijacking-dlls-in-windows
495	TRUE	netiohlp.dll	*\Windows\System32\*	T1574.002	https://wietze.github.io/blog/hijacking-dlls-in-windows
496	TRUE	netiohlp.dll	*\Windows\SysWOW64\*	T1574.002	https://wietze.github.io/blog/hijacking-dlls-in-windows
497	TRUE	netjoin.dll	*\Windows\System32\*	T1574.002	https://securityintelligence.com/posts/windows-features-dll-sideloading/
498	TRUE	netjoin.dll	*\Windows\SysWOW64\*	T1574.002	https://securityintelligence.com/posts/windows-features-dll-sideloading/
499	TRUE	netplwiz.dll	*\Windows\System32\*	T1574.002	https://wietze.github.io/blog/hijacking-dlls-in-windows
500	TRUE	netplwiz.dll	*\Windows\SysWOW64\*	T1574.002	https://wietze.github.io/blog/hijacking-dlls-in-windows
501	TRUE	netprofm.dll	*\Windows\System32\*	T1574.007	https://wietze.github.io/blog/save-the-environment-variables
502	TRUE	netprofm.dll	*\Windows\SysWOW64\*	T1574.007	https://wietze.github.io/blog/save-the-environment-variables
503	TRUE	netprovfw.dll	*\Windows\System32\*	T1574.002	https://securityintelligence.com/posts/windows-features-dll-sideloading/
504	TRUE	netprovfw.dll	*\Windows\SysWOW64\*	T1574.002	https://securityintelligence.com/posts/windows-features-dll-sideloading/
505	TRUE	netsetupapi.dll	*\Windows\System32\*	T1574.007	https://wietze.github.io/blog/save-the-environment-variables
506	TRUE	netsetupapi.dll	*\Windows\SysWOW64\*	T1574.007	https://wietze.github.io/blog/save-the-environment-variables
507	TRUE	netshell.dll	*\Windows\System32\*	T1574.002	https://wietze.github.io/blog/hijacking-dlls-in-windows
508	TRUE	netshell.dll	*\Windows\SysWOW64\*	T1574.002	https://wietze.github.io/blog/hijacking-dlls-in-windows
509	TRUE	nettrace.dll	*\Windows\System32\*	T1574.002	https://wietze.github.io/blog/hijacking-dlls-in-windows
510	TRUE	netutils.dll	*\Windows\System32\*	T1574.002	https://wietze.github.io/blog/hijacking-dlls-in-windows
511	TRUE	netutils.dll	*\Windows\SysWOW64\*	T1574.002	https://wietze.github.io/blog/hijacking-dlls-in-windows
512	TRUE	networkexplorer.dll	*\Windows\System32\*	T1574.007	https://wietze.github.io/blog/save-the-environment-variables
513	TRUE	networkexplorer.dll	*\Windows\SysWOW64\*	T1574.007	https://wietze.github.io/blog/save-the-environment-variables
514	TRUE	newdev.dll	*\Windows\System32\*	T1574.002	https://wietze.github.io/blog/hijacking-dlls-in-windows
515	TRUE	newdev.dll	*\Windows\SysWOW64\*	T1574.002	https://wietze.github.io/blog/hijacking-dlls-in-windows
516	TRUE	ninput.dll	*\Windows\System32\*	T1574.002	https://wietze.github.io/blog/hijacking-dlls-in-windows
517	TRUE	ninput.dll	*\Windows\SysWOW64\*	T1574.002	https://wietze.github.io/blog/hijacking-dlls-in-windows
518	TRUE	nlaapi.dll	*\Windows\System32\*	T1574.002	https://wietze.github.io/blog/hijacking-dlls-in-windows
519	TRUE	nlaapi.dll	*\Windows\SysWOW64\*	T1574.002	https://wietze.github.io/blog/hijacking-dlls-in-windows
520	TRUE	nlansp_c.dll	*\Windows\System32\*	T1574.007	https://wietze.github.io/blog/save-the-environment-variables
521	TRUE	nlansp_c.dll	*\Windows\SysWOW64\*	T1574.007	https://wietze.github.io/blog/save-the-environment-variables
522	TRUE	npmproxy.dll	*\Windows\System32\*	T1574.007	https://wietze.github.io/blog/save-the-environment-variables
523	TRUE	npmproxy.dll	*\Windows\SysWOW64\*	T1574.007	https://wietze.github.io/blog/save-the-environment-variables
524	TRUE	nshhttp.dll	*\Windows\System32\*	T1574.002	https://wietze.github.io/blog/hijacking-dlls-in-windows
525	TRUE	nshhttp.dll	*\Windows\SysWOW64\*	T1574.002	https://wietze.github.io/blog/hijacking-dlls-in-windows
526	TRUE	nshipsec.dll	*\Windows\System32\*	T1574.002	https://wietze.github.io/blog/hijacking-dlls-in-windows
527	TRUE	nshipsec.dll	*\Windows\SysWOW64\*	T1574.002	https://wietze.github.io/blog/hijacking-dlls-in-windows
528	TRUE	nshwfp.dll	*\Windows\System32\*	T1574.002	https://wietze.github.io/blog/hijacking-dlls-in-windows
529	TRUE	nshwfp.dll	*\Windows\SysWOW64\*	T1574.002	https://wietze.github.io/blog/hijacking-dlls-in-windows
530	TRUE	ntdsapi.dll	*\Windows\System32\*	T1574.002	https://wietze.github.io/blog/hijacking-dlls-in-windows
531	TRUE	ntdsapi.dll	*\Windows\SysWOW64\*	T1574.002	https://wietze.github.io/blog/hijacking-dlls-in-windows
532	TRUE	ntlanman.dll	*\Windows\System32\*	T1574.007	https://wietze.github.io/blog/save-the-environment-variables
533	TRUE	ntlanman.dll	*\Windows\SysWOW64\*	T1574.007	https://wietze.github.io/blog/save-the-environment-variables
534	TRUE	ntlmshared.dll	*\Windows\System32\*	T1574.002	https://wietze.github.io/blog/hijacking-dlls-in-windows
535	TRUE	ntlmshared.dll	*\Windows\SysWOW64\*	T1574.002	https://wietze.github.io/blog/hijacking-dlls-in-windows
536	TRUE	ntmarta.dll	*\Windows\System32\*	T1574.002	https://wietze.github.io/blog/save-the-environment-variables
537	TRUE	ntmarta.dll	*\Windows\SysWOW64\*	T1574.002	https://wietze.github.io/blog/save-the-environment-variables
538	TRUE	ntshrui.dll	*\Windows\System32\*	T1574.007	https://wietze.github.io/blog/save-the-environment-variables
539	TRUE	ntshrui.dll	*\Windows\SysWOW64\*	T1574.007	https://wietze.github.io/blog/save-the-environment-variables
540	TRUE	nvsmartmax.dll	*\Program Files\NVIDIA Corporation\Display*	T1574.002	https://www.cybereason.com/blog/research/deadringer-exposing-chinese-threat-actors-targeting-major-telcos
541	TRUE	oleacc.dll	*\Windows\System32\*	T1574.002	https://wietze.github.io/blog/hijacking-dlls-in-windows
542	TRUE	oleacc.dll	*\Windows\SysWOW64\*	T1574.002	https://wietze.github.io/blog/hijacking-dlls-in-windows
543	TRUE	omadmapi.dll	*\Windows\System32\*	T1574.002	https://wietze.github.io/blog/hijacking-dlls-in-windows
544	TRUE	omadmapi.dll	*\Windows\SysWOW64\*	T1574.002	https://wietze.github.io/blog/hijacking-dlls-in-windows
545	TRUE	onex.dll	*\Windows\System32\*	T1574.002	https://wietze.github.io/blog/hijacking-dlls-in-windows
546	TRUE	onex.dll	*\Windows\SysWOW64\*	T1574.002	https://wietze.github.io/blog/hijacking-dlls-in-windows
547	TRUE	opcservices.dll	*\Windows\System32\*	T1574.002	https://securityintelligence.com/posts/windows-features-dll-sideloading/
548	TRUE	opcservices.dll	*\Windows\SysWOW64\*	T1574.002	https://securityintelligence.com/posts/windows-features-dll-sideloading/
549	TRUE	opera_elf.dll	*\Appdata\local\programs\opera\*	T1574.002	https://twitter.com/ShitSecure/status/1566127363389329412
550	TRUE	osbaseln.dll	*\Windows\System32\*	T1574.002	https://wietze.github.io/blog/hijacking-dlls-in-windows
551	TRUE	osbaseln.dll	*\Windows\SysWOW64\*	T1574.002	https://wietze.github.io/blog/hijacking-dlls-in-windows
552	TRUE	osksupport.dll	*\Windows\System32\*	T1574.002	https://wietze.github.io/blog/hijacking-dlls-in-windows
553	TRUE	osuninst.dll	*\Windows\System32\*	T1574.002	https://wietze.github.io/blog/hijacking-dlls-in-windows
554	TRUE	osuninst.dll	*\Windows\SysWOW64\*	T1574.002	https://wietze.github.io/blog/hijacking-dlls-in-windows
555	TRUE	outllib.dll	*\Program Files\Microsoft Office\OFFICE*	T1574.002	https://medium.com/insomniacs/analysis-walkthrough-fun-clientrun-part-1-b2509344ebe6
556	TRUE	outllib.dll	*\Program Files\Microsoft Office\Root\OFFICE*	T1574.002	https://medium.com/insomniacs/analysis-walkthrough-fun-clientrun-part-1-b2509344ebe6
557	TRUE	p2p.dll	*\Windows\System32\*	T1574.002	https://wietze.github.io/blog/hijacking-dlls-in-windows
558	TRUE	p2p.dll	*\Windows\SysWOW64\*	T1574.002	https://wietze.github.io/blog/hijacking-dlls-in-windows
559	TRUE	p2pnetsh.dll	*\Windows\System32\*	T1574.002	https://wietze.github.io/blog/hijacking-dlls-in-windows
560	TRUE	p2pnetsh.dll	*\Windows\SysWOW64\*	T1574.002	https://wietze.github.io/blog/hijacking-dlls-in-windows
561	TRUE	p9np.dll	*\Windows\System32\*	T1574.007	https://wietze.github.io/blog/save-the-environment-variables
562	TRUE	p9np.dll	*\Windows\SysWOW64\*	T1574.007	https://wietze.github.io/blog/save-the-environment-variables
563	TRUE	pcaui.dll	*\Windows\System32\*	T1574.002	https://wietze.github.io/blog/hijacking-dlls-in-windows
564	TRUE	pcaui.dll	*\Windows\SysWOW64\*	T1574.002	https://wietze.github.io/blog/hijacking-dlls-in-windows
565	TRUE	pdh.dll	*\Windows\System32\*	T1574.002	https://wietze.github.io/blog/hijacking-dlls-in-windows
566	TRUE	pdh.dll	*\Windows\SysWOW64\*	T1574.002	https://wietze.github.io/blog/hijacking-dlls-in-windows
567	TRUE	peerdistsh.dll	*\Windows\System32\*	T1574.002	https://wietze.github.io/blog/hijacking-dlls-in-windows
568	TRUE	peerdistsh.dll	*\Windows\SysWOW64\*	T1574.002	https://wietze.github.io/blog/hijacking-dlls-in-windows
569	TRUE	pkeyhelper.dll	*\Windows\System32\*	T1574.002	https://securityintelligence.com/posts/windows-features-dll-sideloading/
570	TRUE	pla.dll	*\Windows\System32\*	T1574.007	https://wietze.github.io/blog/save-the-environment-variables
571	TRUE	pla.dll	*\Windows\SysWOW64\*	T1574.007	https://wietze.github.io/blog/save-the-environment-variables
572	TRUE	playsndsrv.dll	*\Windows\System32\*	T1574.002	https://securityintelligence.com/posts/windows-features-dll-sideloading/
573	TRUE	playsndsrv.dll	*\Windows\SysWOW64\*	T1574.002	https://securityintelligence.com/posts/windows-features-dll-sideloading/
574	TRUE	pnrpnsp.dll	*\Windows\System32\*	T1574.007	https://wietze.github.io/blog/save-the-environment-variables
575	TRUE	pnrpnsp.dll	*\Windows\SysWOW64\*	T1574.007	https://wietze.github.io/blog/save-the-environment-variables
576	TRUE	policymanager.dll	*\Windows\System32\*	T1574.002	https://wietze.github.io/blog/hijacking-dlls-in-windows
577	TRUE	policymanager.dll	*\Windows\SysWOW64\*	T1574.002	https://wietze.github.io/blog/hijacking-dlls-in-windows
578	TRUE	polstore.dll	*\Windows\System32\*	T1574.002	https://wietze.github.io/blog/hijacking-dlls-in-windows
579	TRUE	polstore.dll	*\Windows\SysWOW64\*	T1574.002	https://wietze.github.io/blog/hijacking-dlls-in-windows
580	TRUE	powrprof.dll	*\Windows\System32\*	T1574.002	https://securityintelligence.com/posts/windows-features-dll-sideloading/
581	TRUE	powrprof.dll	*\Windows\SysWOW64\*	T1574.002	https://securityintelligence.com/posts/windows-features-dll-sideloading/
582	TRUE	printui.dll	*\Windows\System32\*	T1574.002	https://wietze.github.io/blog/hijacking-dlls-in-windows
583	TRUE	printui.dll	*\Windows\SysWOW64\*	T1574.002	https://wietze.github.io/blog/hijacking-dlls-in-windows
584	TRUE	prntvpt.dll	*\Windows\System32\*	T1574.002	https://securityintelligence.com/posts/windows-features-dll-sideloading/
585	TRUE	prntvpt.dll	*\Windows\SysWOW64\*	T1574.002	https://securityintelligence.com/posts/windows-features-dll-sideloading/
586	TRUE	profapi.dll	*\Windows\System32\*	T1574.002	https://securityintelligence.com/posts/windows-features-dll-sideloading/
587	TRUE	profapi.dll	*\Windows\SysWOW64\*	T1574.002	https://securityintelligence.com/posts/windows-features-dll-sideloading/
588	TRUE	propsys.dll	*\Windows\System32\*	T1574.002	https://wietze.github.io/blog/hijacking-dlls-in-windows
589	TRUE	propsys.dll	*\Windows\SysWOW64\*	T1574.002	https://wietze.github.io/blog/hijacking-dlls-in-windows
590	TRUE	proximitycommon.dll	*\Windows\System32\*	T1574.002	https://securityintelligence.com/posts/windows-features-dll-sideloading/
591	TRUE	proximitycommon.dll	*\Windows\SysWOW64\*	T1574.002	https://securityintelligence.com/posts/windows-features-dll-sideloading/
592	TRUE	proximityservicepal.dll	*\Windows\System32\*	T1574.002	https://securityintelligence.com/posts/windows-features-dll-sideloading/
593	TRUE	prvdmofcomp.dll	*\Windows\System32\*	T1574.002	https://wietze.github.io/blog/hijacking-dlls-in-windows
594	TRUE	prvdmofcomp.dll	*\Windows\SysWOW64\*	T1574.002	https://wietze.github.io/blog/hijacking-dlls-in-windows
595	TRUE	puiapi.dll	*\Windows\System32\*	T1574.002	https://wietze.github.io/blog/hijacking-dlls-in-windows
596	TRUE	puiapi.dll	*\Windows\SysWOW64\*	T1574.002	https://wietze.github.io/blog/hijacking-dlls-in-windows
597	TRUE	python39.dll	*\Program Files\Python39*	T1574.002	https://twitter.com/SBousseaden/status/1530595156055011330
598	TRUE	python39.dll	*\Appdata\local\Temp\*	T1574.002	https://twitter.com/SBousseaden/status/1530595156055011330
599	TRUE	python39.dll	*\Program Files\Microsoft Visual Studio\2022\Community\Common7\IDE\CommonExtensions\Microsoft\VC\SecurityIssueAnalysis\python*	T1574.002	https://twitter.com/SBousseaden/status/1530595156055011330
600	TRUE	python39.dll	*\Users\anaconda3*	T1574.002	https://twitter.com/SBousseaden/status/1530595156055011330
601	TRUE	qrt.dll	*\Program Files\F-Secure\Anti-Virus*	T1574.002	https://www.welivesecurity.com/2022/04/27/lookback-ta410-umbrella-cyberespionage-ttps-activity/
602	TRUE	radcui.dll	*\Windows\System32\*	T1574.002	https://wietze.github.io/blog/hijacking-dlls-in-windows
603	TRUE	radcui.dll	*\Windows\SysWOW64\*	T1574.002	https://wietze.github.io/blog/hijacking-dlls-in-windows
604	TRUE	rasapi32.dll	*\Windows\System32\*	T1574.002	https://wietze.github.io/blog/hijacking-dlls-in-windows
605	TRUE	rasapi32.dll	*\Windows\SysWOW64\*	T1574.002	https://wietze.github.io/blog/hijacking-dlls-in-windows
606	TRUE	rasdlg.dll	*\Windows\System32\*	T1574.002	https://securityintelligence.com/posts/windows-features-dll-sideloading/
607	TRUE	rasdlg.dll	*\Windows\SysWOW64\*	T1574.002	https://securityintelligence.com/posts/windows-features-dll-sideloading/
608	TRUE	rasgcw.dll	*\Windows\System32\*	T1574.007	https://wietze.github.io/blog/save-the-environment-variables
609	TRUE	rasgcw.dll	*\Windows\SysWOW64\*	T1574.007	https://wietze.github.io/blog/save-the-environment-variables
610	TRUE	rasman.dll	*\Windows\System32\*	T1574.002	https://wietze.github.io/blog/hijacking-dlls-in-windows
611	TRUE	rasman.dll	*\Windows\SysWOW64\*	T1574.002	https://wietze.github.io/blog/hijacking-dlls-in-windows
612	TRUE	rasmontr.dll	*\Windows\System32\*	T1574.002	https://wietze.github.io/blog/hijacking-dlls-in-windows
613	TRUE	rasmontr.dll	*\Windows\SysWOW64\*	T1574.002	https://wietze.github.io/blog/hijacking-dlls-in-windows
614	TRUE	rastls.dll	*\Program Files\Symantec\Network Connected Devices Auto Setup*	T1574.002	https://st.drweb.com/static/new-www/news/2020/october/Study_of_the_ShadowPad_APT_backdoor_and_its_relation_to_PlugX_en.pdf
615	TRUE	rcdll.dll	*\Program Files\Windows Kits\10\bin\*	T1574.002	https://globetech.biz/index.php/2023/05/19/evading-edr-by-dll-sideloading-in-csharp/
616	TRUE	reagent.dll	*\Windows\System32\*	T1574.002	https://wietze.github.io/blog/hijacking-dlls-in-windows
617	TRUE	reagent.dll	*\Windows\SysWOW64\*	T1574.002	https://wietze.github.io/blog/hijacking-dlls-in-windows
618	TRUE	regapi.dll	*\Windows\System32\*	T1574.002	https://wietze.github.io/blog/hijacking-dlls-in-windows
619	TRUE	regapi.dll	*\Windows\SysWOW64\*	T1574.002	https://wietze.github.io/blog/hijacking-dlls-in-windows
620	TRUE	reseteng.dll	*\Windows\System32\*	T1574.002	https://wietze.github.io/blog/hijacking-dlls-in-windows
621	TRUE	resetengine.dll	*\Windows\System32\*	T1574.002	https://wietze.github.io/blog/hijacking-dlls-in-windows
622	TRUE	resutils.dll	*\Windows\System32\*	T1574.002	https://wietze.github.io/blog/hijacking-dlls-in-windows
623	TRUE	resutils.dll	*\Windows\SysWOW64\*	T1574.002	https://wietze.github.io/blog/hijacking-dlls-in-windows
624	TRUE	rjvplatform.dll	*\Windows\System32\SystemResetPlatform*	T1574.002	https://twitter.com/0gtweet/status/1666716511988330499
625	TRUE	rjvplatform.dll	*\Windows\SysWOW64\SystemResetPlatform*	T1574.002	https://twitter.com/0gtweet/status/1666716511988330499
626	TRUE	rmclient.dll	*\Windows\System32\*	T1574.002	https://wietze.github.io/blog/hijacking-dlls-in-windows
627	TRUE	rmclient.dll	*\Windows\SysWOW64\*	T1574.002	https://wietze.github.io/blog/hijacking-dlls-in-windows
628	TRUE	rpcnsh.dll	*\Windows\System32\*	T1574.002	https://wietze.github.io/blog/hijacking-dlls-in-windows
629	TRUE	rpcnsh.dll	*\Windows\SysWOW64\*	T1574.002	https://wietze.github.io/blog/hijacking-dlls-in-windows
630	TRUE	rsaenh.dll	*\Windows\System32\*	T1574.007	https://wietze.github.io/blog/save-the-environment-variables
631	TRUE	rsaenh.dll	*\Windows\SysWOW64\*	T1574.007	https://wietze.github.io/blog/save-the-environment-variables
632	TRUE	rtutils.dll	*\Windows\System32\*	T1574.002	https://wietze.github.io/blog/hijacking-dlls-in-windows
633	TRUE	rtutils.dll	*\Windows\SysWOW64\*	T1574.002	https://wietze.github.io/blog/hijacking-dlls-in-windows
634	TRUE	rtworkq.dll	*\Windows\System32\*	T1574.002	https://wietze.github.io/blog/hijacking-dlls-in-windows
635	TRUE	rtworkq.dll	*\Windows\SysWOW64\*	T1574.002	https://wietze.github.io/blog/hijacking-dlls-in-windows
636	TRUE	rzlog4cpp_logger.dll	*\Appdata\local\razer\InGameEngine\cache\RzFpsApplet*	T1574.002	https://www.mandiant.com/resources/blog/china-nexus-espionage-southeast-asia
637	TRUE	safestore32.dll	*\Program Files\Sophos\Sophos Anti-Virus*	T1574.002	https://symantec.broadcom.com/hubfs/Attacks-Against-Government-Sector.pdf
638	TRUE	samcli.dll	*\Windows\System32\*	T1574.002	https://wietze.github.io/blog/hijacking-dlls-in-windows
639	TRUE	samcli.dll	*\Windows\SysWOW64\*	T1574.002	https://wietze.github.io/blog/hijacking-dlls-in-windows
640	TRUE	samlib.dll	*\Windows\System32\*	T1574.002	https://wietze.github.io/blog/hijacking-dlls-in-windows
641	TRUE	samlib.dll	*\Windows\SysWOW64\*	T1574.002	https://wietze.github.io/blog/hijacking-dlls-in-windows
642	TRUE	sapi_onecore.dll	*\Windows\System32\*	T1574.007	https://wietze.github.io/blog/save-the-environment-variables
643	TRUE	sapi_onecore.dll	*\Windows\SysWOW64\*	T1574.007	https://wietze.github.io/blog/save-the-environment-variables
644	TRUE	sas.dll	*\Windows\System32\*	T1574.002	https://wietze.github.io/blog/hijacking-dlls-in-windows
645	TRUE	sas.dll	*\Windows\SysWOW64\*	T1574.002	https://wietze.github.io/blog/hijacking-dlls-in-windows
646	TRUE	scansetting.dll	*\Windows\System32\*	T1574.002	https://wietze.github.io/blog/hijacking-dlls-in-windows
647	TRUE	scansetting.dll	*\Windows\SysWOW64\*	T1574.002	https://wietze.github.io/blog/hijacking-dlls-in-windows
648	TRUE	scecli.dll	*\Windows\System32\*	T1574.002	https://wietze.github.io/blog/hijacking-dlls-in-windows
649	TRUE	scecli.dll	*\Windows\SysWOW64\*	T1574.002	https://wietze.github.io/blog/hijacking-dlls-in-windows
650	TRUE	schedcli.dll	*\Windows\System32\*	T1574.002	https://wietze.github.io/blog/hijacking-dlls-in-windows
651	TRUE	schedcli.dll	*\Windows\SysWOW64\*	T1574.002	https://wietze.github.io/blog/hijacking-dlls-in-windows
652	TRUE	secur32.dll	*\Windows\System32\*	T1574.001	https://wietze.github.io/blog/hijacking-dlls-in-windows
653	TRUE	secur32.dll	*\Windows\SysWOW64\*	T1574.001	https://wietze.github.io/blog/hijacking-dlls-in-windows
654	TRUE	security.dll	*\Windows\System32\*	T1574.002	https://securityintelligence.com/posts/windows-features-dll-sideloading/
655	TRUE	security.dll	*\Windows\SysWOW64\*	T1574.002	https://securityintelligence.com/posts/windows-features-dll-sideloading/
656	TRUE	sensapi.dll	*\Windows\System32\*	T1574.002	https://twitter.com/AndrewOliveau/status/1682185200862625792
657	TRUE	sensapi.dll	*\Windows\SysWOW64\*	T1574.002	https://twitter.com/AndrewOliveau/status/1682185200862625792
658	TRUE	shell32.dll	*\Windows\System32\*	T1574.007	https://wietze.github.io/blog/save-the-environment-variables
659	TRUE	shell32.dll	*\Windows\SysWOW64\*	T1574.007	https://wietze.github.io/blog/save-the-environment-variables
660	TRUE	shfolder.dll	*\Windows\System32\*	T1574.002	https://twitter.com/dissectmalware/status/978017957480628226
661	TRUE	shfolder.dll	*\Windows\SysWOW64\*	T1574.002	https://twitter.com/dissectmalware/status/978017957480628226
662	TRUE	siteadv.dll	*\Program Files\SiteAdvisor\*	T1574.002	https://www.nortonlifelock.com/sites/default/files/2021-10/OPERATION%20EXORCIST%20White%20Paper.pdf
663	TRUE	slc.dll	*\Windows\System32\*	T1574.002	https://wietze.github.io/blog/hijacking-dlls-in-windows
664	TRUE	slc.dll	*\Windows\SysWOW64\*	T1574.002	https://wietze.github.io/blog/hijacking-dlls-in-windows
665	TRUE	smadhook32c.dll	*\Program Files\Smadav*	T1574.002	https://decoded.avast.io/threatintel/apt-treasure-trove-avast-suspects-chinese-apt-group-mustang-panda-is-collecting-data-from-burmese-government-agencies-and-opposition-groups/
666	TRUE	snmpapi.dll	*\Windows\System32\*	T1574.002	https://wietze.github.io/blog/hijacking-dlls-in-windows
667	TRUE	snmpapi.dll	*\Windows\SysWOW64\*	T1574.002	https://wietze.github.io/blog/hijacking-dlls-in-windows
668	TRUE	spectrumsyncclient.dll	*\Windows\System32\*	T1574.002	https://wietze.github.io/blog/hijacking-dlls-in-windows
669	TRUE	spp.dll	*\Windows\System32\*	T1574.002	https://wietze.github.io/blog/hijacking-dlls-in-windows
670	TRUE	spp.dll	*\Windows\SysWOW64\*	T1574.002	https://wietze.github.io/blog/hijacking-dlls-in-windows
671	TRUE	sppc.dll	*\Windows\System32\*	T1574.002	https://wietze.github.io/blog/hijacking-dlls-in-windows
672	TRUE	sppc.dll	*\Windows\SysWOW64\*	T1574.002	https://wietze.github.io/blog/hijacking-dlls-in-windows
673	TRUE	sppcext.dll	*\Windows\System32\*	T1574.002	https://securityintelligence.com/posts/windows-features-dll-sideloading/
674	TRUE	sppcext.dll	*\Windows\SysWOW64\*	T1574.002	https://securityintelligence.com/posts/windows-features-dll-sideloading/
675	TRUE	srclient.dll	*\Windows\System32\*	T1574.002	https://wietze.github.io/blog/hijacking-dlls-in-windows
676	TRUE	srclient.dll	*\Windows\SysWOW64\*	T1574.002	https://wietze.github.io/blog/hijacking-dlls-in-windows
677	TRUE	srcore.dll	*\Windows\System32\*	T1574.002	https://wietze.github.io/blog/hijacking-dlls-in-windows
678	TRUE	srmtrace.dll	*\Windows\System32\*	T1574.002	https://securityintelligence.com/posts/windows-features-dll-sideloading/
679	TRUE	srmtrace.dll	*\Windows\SysWOW64\*	T1574.002	https://securityintelligence.com/posts/windows-features-dll-sideloading/
680	TRUE	srpapi.dll	*\Windows\System32\*	T1574.002	https://wietze.github.io/blog/hijacking-dlls-in-windows
681	TRUE	srpapi.dll	*\Windows\SysWOW64\*	T1574.002	https://wietze.github.io/blog/hijacking-dlls-in-windows
682	TRUE	srvcli.dll	*\Windows\System32\*	T1574.002	https://wietze.github.io/blog/hijacking-dlls-in-windows
683	TRUE	srvcli.dll	*\Windows\SysWOW64\*	T1574.002	https://wietze.github.io/blog/hijacking-dlls-in-windows
684	TRUE	ssp.exe_rsaenh.dll	*\Windows\System32\*	T1574.007	https://wietze.github.io/blog/save-the-environment-variables
685	TRUE	ssp.exe_rsaenh.dll	*\Windows\SysWOW64\*	T1574.007	https://wietze.github.io/blog/save-the-environment-variables
686	TRUE	ssp_isv.exe_rsaenh.dll	*\Windows\System32\*	T1574.007	https://wietze.github.io/blog/save-the-environment-variables
687	TRUE	ssp_isv.exe_rsaenh.dll	*\Windows\SysWOW64\*	T1574.007	https://wietze.github.io/blog/save-the-environment-variables
688	TRUE	sspicli.dll	*\Windows\System32\*	T1574.002	https://wietze.github.io/blog/hijacking-dlls-in-windows
689	TRUE	sspicli.dll	*\Windows\SysWOW64\*	T1574.002	https://wietze.github.io/blog/hijacking-dlls-in-windows
690	TRUE	ssshim.dll	*\Windows\System32\*	T1574.002	https://twitter.com/0gtweet/status/1363107343018385410
691	TRUE	ssshim.dll	*\Windows\SysWOW64\*	T1574.002	https://twitter.com/0gtweet/status/1363107343018385410
692	TRUE	staterepository.core.dll	*\Windows\System32\*	T1574.002	https://wietze.github.io/blog/hijacking-dlls-in-windows
693	TRUE	staterepository.core.dll	*\Windows\SysWOW64\*	T1574.002	https://wietze.github.io/blog/hijacking-dlls-in-windows
694	TRUE	structuredquery.dll	*\Windows\System32\*	T1574.007	https://wietze.github.io/blog/save-the-environment-variables
695	TRUE	structuredquery.dll	*\Windows\SysWOW64\*	T1574.007	https://wietze.github.io/blog/save-the-environment-variables
696	TRUE	sxshared.dll	*\Windows\System32\*	T1574.002	https://wietze.github.io/blog/hijacking-dlls-in-windows
697	TRUE	sxshared.dll	*\Windows\SysWOW64\*	T1574.002	https://wietze.github.io/blog/hijacking-dlls-in-windows
698	TRUE	symsrv.dll	*\Program Files\Windows Kits\10\Debuggers\*	T1574.002	https://globetech.biz/index.php/2023/05/19/evading-edr-by-dll-sideloading-in-csharp/
699	TRUE	systemsettingsthresholdadminflowui.dll	*\Windows\System32\*	T1574.002	https://wietze.github.io/blog/hijacking-dlls-in-windows
700	TRUE	tapi32.dll	*\Windows\System32\*	T1574.002	https://wietze.github.io/blog/hijacking-dlls-in-windows
701	TRUE	tapi32.dll	*\Windows\SysWOW64\*	T1574.002	https://wietze.github.io/blog/hijacking-dlls-in-windows
702	TRUE	tbs.dll	*\Windows\System32\*	T1574.002	https://wietze.github.io/blog/hijacking-dlls-in-windows
703	TRUE	tbs.dll	*\Windows\SysWOW64\*	T1574.002	https://wietze.github.io/blog/hijacking-dlls-in-windows
704	TRUE	tdh.dll	*\Windows\System32\*	T1574.002	https://wietze.github.io/blog/hijacking-dlls-in-windows
705	TRUE	tdh.dll	*\Windows\SysWOW64\*	T1574.002	https://wietze.github.io/blog/hijacking-dlls-in-windows
706	TRUE	textshaping.dll	*\Windows\System32\*	T1574.002	https://globetech.biz/index.php/2023/05/19/evading-edr-by-dll-sideloading-in-csharp/
707	TRUE	textshaping.dll	*\Windows\SysWOW64\*	T1574.002	https://globetech.biz/index.php/2023/05/19/evading-edr-by-dll-sideloading-in-csharp/
708	TRUE	timesync.dll	*\Windows\System32\*	T1574.002	https://wietze.github.io/blog/hijacking-dlls-in-windows
709	TRUE	tmdbglog.dll	*\Program Files\Trend Micro\Titanium*	T1574.002	https://www.ptsecurity.com/ww-en/analytics/pt-esc-threat-intelligence/space-pirates-tools-and-connections/
710	TRUE	tosbtkbd.dll	*\Program Files\Toshiba\Bluetooth Toshiba Stack*	T1574.002	https://www.secureworks.com/research/shadowpad-malware-analysis
711	TRUE	tpmcoreprovisioning.dll	*\Windows\System32\*	T1574.002	https://securityintelligence.com/posts/windows-features-dll-sideloading/
712	TRUE	tpmcoreprovisioning.dll	*\Windows\SysWOW64\*	T1574.002	https://securityintelligence.com/posts/windows-features-dll-sideloading/
713	TRUE	tquery.dll	*\Windows\System32\*	T1574.002	https://wietze.github.io/blog/hijacking-dlls-in-windows
714	TRUE	tquery.dll	*\Windows\SysWOW64\*	T1574.002	https://wietze.github.io/blog/hijacking-dlls-in-windows
715	TRUE	tsworkspace.dll	*\Windows\System32\*	T1574.002	https://wietze.github.io/blog/hijacking-dlls-in-windows
716	TRUE	tsworkspace.dll	*\Windows\SysWOW64\*	T1574.002	https://wietze.github.io/blog/hijacking-dlls-in-windows
717	TRUE	ttdrecord.dll	*\Windows\System32\*	T1574.002	https://wietze.github.io/blog/hijacking-dlls-in-windows
718	TRUE	ttdrecord.dll	*\Windows\SysWOW64\*	T1574.002	https://wietze.github.io/blog/hijacking-dlls-in-windows
719	TRUE	twext.dll	*\Windows\System32\*	T1574.007	https://wietze.github.io/blog/save-the-environment-variables
720	TRUE	twext.dll	*\Windows\SysWOW64\*	T1574.007	https://wietze.github.io/blog/save-the-environment-variables
721	TRUE	twinapi.dll	*\Windows\System32\*	T1574.002	https://wietze.github.io/blog/save-the-environment-variables
722	TRUE	twinapi.dll	*\Windows\SysWOW64\*	T1574.002	https://wietze.github.io/blog/save-the-environment-variables
723	TRUE	twinui.appcore.dll	*\Windows\System32\*	T1574.007	https://wietze.github.io/blog/save-the-environment-variables
724	TRUE	twinui.appcore.dll	*\Windows\SysWOW64\*	T1574.007	https://wietze.github.io/blog/save-the-environment-variables
725	TRUE	uianimation.dll	*\Windows\System32\*	T1574.007	https://wietze.github.io/blog/save-the-environment-variables
726	TRUE	uianimation.dll	*\Windows\SysWOW64\*	T1574.007	https://wietze.github.io/blog/save-the-environment-variables
727	TRUE	uiautomationcore.dll	*\Windows\System32\*	T1574.002	https://wietze.github.io/blog/hijacking-dlls-in-windows
728	TRUE	uiautomationcore.dll	*\Windows\SysWOW64\*	T1574.002	https://wietze.github.io/blog/hijacking-dlls-in-windows
729	TRUE	uireng.dll	*\Windows\System32\*	T1574.002	https://wietze.github.io/blog/hijacking-dlls-in-windows
730	TRUE	uireng.dll	*\Windows\SysWOW64\*	T1574.002	https://wietze.github.io/blog/hijacking-dlls-in-windows
731	TRUE	uiribbon.dll	*\Windows\System32\*	T1574.007	https://wietze.github.io/blog/save-the-environment-variables
732	TRUE	uiribbon.dll	*\Windows\SysWOW64\*	T1574.007	https://wietze.github.io/blog/save-the-environment-variables
733	TRUE	umpdc.dll	*\Windows\System32\*	T1574.002	https://securityintelligence.com/posts/windows-features-dll-sideloading/
734	TRUE	umpdc.dll	*\Windows\SysWOW64\*	T1574.002	https://securityintelligence.com/posts/windows-features-dll-sideloading/
735	TRUE	unattend.dll	*\Windows\System32\*	T1574.002	https://securityintelligence.com/posts/windows-features-dll-sideloading/
736	TRUE	unityplayer.dll	*\Appdata\local\Temp\*	T1574.002	https://news.sophos.com/en-us/2023/05/03/doubled-dll-sideloading-dragon-breath/
737	TRUE	updatepolicy.dll	*\Windows\System32\*	T1574.002	https://wietze.github.io/blog/hijacking-dlls-in-windows
738	TRUE	updatepolicy.dll	*\Windows\SysWOW64\*	T1574.002	https://wietze.github.io/blog/hijacking-dlls-in-windows
739	TRUE	upshared.dll	*\Windows\System32\*	T1574.002	https://wietze.github.io/blog/hijacking-dlls-in-windows
740	TRUE	urlmon.dll	*\Windows\System32\*	T1574.002	https://securityintelligence.com/posts/windows-features-dll-sideloading/
741	TRUE	urlmon.dll	*\Windows\SysWOW64\*	T1574.002	https://securityintelligence.com/posts/windows-features-dll-sideloading/
742	TRUE	userenv.dll	*\Windows\System32\*	T1574.002	https://wietze.github.io/blog/hijacking-dlls-in-windows
743	TRUE	userenv.dll	*\Windows\SysWOW64\*	T1574.002	https://wietze.github.io/blog/hijacking-dlls-in-windows
744	TRUE	utildll.dll	*\Windows\System32\*	T1574.002	https://wietze.github.io/blog/hijacking-dlls-in-windows
745	TRUE	utildll.dll	*\Windows\SysWOW64\*	T1574.002	https://wietze.github.io/blog/hijacking-dlls-in-windows
746	TRUE	uxinit.dll	*\Windows\System32\*	T1574.002	https://wietze.github.io/blog/hijacking-dlls-in-windows
747	TRUE	uxinit.dll	*\Windows\SysWOW64\*	T1574.002	https://wietze.github.io/blog/hijacking-dlls-in-windows
748	TRUE	uxtheme.dll	*\Windows\System32\*	T1574.001	https://wietze.github.io/blog/hijacking-dlls-in-windows
749	TRUE	uxtheme.dll	*\Windows\SysWOW64\*	T1574.001	https://wietze.github.io/blog/hijacking-dlls-in-windows
750	TRUE	vaultcli.dll	*\Windows\System32\*	T1574.002	https://wietze.github.io/blog/hijacking-dlls-in-windows
751	TRUE	vaultcli.dll	*\Windows\SysWOW64\*	T1574.002	https://wietze.github.io/blog/hijacking-dlls-in-windows
752	TRUE	vdsutil.dll	*\Windows\System32\*	T1574.002	https://securityintelligence.com/posts/windows-features-dll-sideloading/
753	TRUE	vdsutil.dll	*\Windows\SysWOW64\*	T1574.002	https://securityintelligence.com/posts/windows-features-dll-sideloading/
754	TRUE	vender.dll	*\Program Files\ASUS\GPU TweakII*	T1574.002	https://decoded.avast.io/threatintel/apt-treasure-trove-avast-suspects-chinese-apt-group-mustang-panda-is-collecting-data-from-burmese-government-agencies-and-opposition-groups/
755	TRUE	vender.dll	*\Program Files\ASUS\VGA COM\*	T1574.002	https://decoded.avast.io/threatintel/apt-treasure-trove-avast-suspects-chinese-apt-group-mustang-panda-is-collecting-data-from-burmese-government-agencies-and-opposition-groups/
756	TRUE	version.dll	*\Windows\System32\*	T1574.002	https://securityintelligence.com/posts/windows-features-dll-sideloading/
757	TRUE	version.dll	*\Windows\SysWOW64\*	T1574.002	https://securityintelligence.com/posts/windows-features-dll-sideloading/
758	TRUE	vftrace.dll	*\Program Files\CyberArk\Endpoint Privilege Manager\Agent\x32*	T1574.002	https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/budworm-espionage-us-state?web_view=true
759	TRUE	vftrace.dll	*\Program Files\CyberArk\Endpoint Privilege Manager\Agent\x64*	T1574.002	https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/budworm-espionage-us-state?web_view=true
760	TRUE	vftrace.dll	*\Program Files\CyberArk\Endpoint Privilege Manager\Agent*	T1574.002	https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/budworm-espionage-us-state?web_view=true
761	TRUE	virtdisk.dll	*\Windows\System32\*	T1574.002	https://wietze.github.io/blog/hijacking-dlls-in-windows
762	TRUE	virtdisk.dll	*\Windows\SysWOW64\*	T1574.002	https://wietze.github.io/blog/hijacking-dlls-in-windows
763	TRUE	vivaldi_elf.dll	*\Appdata\local\Vivaldi\Application*	T1574.002	https://securityintelligence.com/posts/vizom-malware-targets-brazilian-bank-customers-remote-overlay/
764	TRUE	vivaldi_elf.dll	*\Appdata\local\Vivaldi\Application\*	T1574.002	https://securityintelligence.com/posts/vizom-malware-targets-brazilian-bank-customers-remote-overlay/
765	TRUE	vntfxf32.dll	*\Program Files\Venta\VentaFax & Voice*	T1574.002	https://decoded.avast.io/threatintel/apt-treasure-trove-avast-suspects-chinese-apt-group-mustang-panda-is-collecting-data-from-burmese-government-agencies-and-opposition-groups/
766	TRUE	vsodscpl.dll	*\Program Files\McAfee\VirusScan Enterprise*	T1574.002	https://eiploader.wordpress.com/2011/03/28/digitally-signed-malware-without-stealing-certificates/
767	TRUE	vssapi.dll	*\Windows\System32\*	T1574.002	https://wietze.github.io/blog/hijacking-dlls-in-windows
768	TRUE	vssapi.dll	*\Windows\SysWOW64\*	T1574.002	https://wietze.github.io/blog/hijacking-dlls-in-windows
769	TRUE	vsstrace.dll	*\Windows\System32\*	T1574.002	https://wietze.github.io/blog/hijacking-dlls-in-windows
770	TRUE	vsstrace.dll	*\Windows\SysWOW64\*	T1574.002	https://wietze.github.io/blog/hijacking-dlls-in-windows
771	TRUE	wbemprox.dll	*\Windows\System32\wbem*	T1574.007	https://wietze.github.io/blog/save-the-environment-variables
772	TRUE	wbemprox.dll	*\Windows\SysWOW64\wbem*	T1574.007	https://wietze.github.io/blog/save-the-environment-variables
773	TRUE	wbemsvc.dll	*\Windows\System32\wbem*	T1574.007	https://wietze.github.io/blog/save-the-environment-variables
774	TRUE	wbemsvc.dll	*\Windows\SysWOW64\wbem*	T1574.007	https://wietze.github.io/blog/save-the-environment-variables
775	TRUE	wcmapi.dll	*\Windows\System32\*	T1574.002	https://wietze.github.io/blog/hijacking-dlls-in-windows
776	TRUE	wcmapi.dll	*\Windows\SysWOW64\*	T1574.002	https://wietze.github.io/blog/hijacking-dlls-in-windows
777	TRUE	wcnnetsh.dll	*\Windows\System32\*	T1574.002	https://wietze.github.io/blog/hijacking-dlls-in-windows
778	TRUE	wdi.dll	*\Windows\System32\*	T1574.002	https://wietze.github.io/blog/hijacking-dlls-in-windows
779	TRUE	wdi.dll	*\Windows\SysWOW64\*	T1574.002	https://wietze.github.io/blog/hijacking-dlls-in-windows
780	TRUE	wdscore.dll	*\Windows\System32\*	T1574.002	https://wietze.github.io/blog/hijacking-dlls-in-windows
781	TRUE	wdscore.dll	*\Windows\SysWOW64\*	T1574.002	https://wietze.github.io/blog/hijacking-dlls-in-windows
782	TRUE	webservices.dll	*\Windows\System32\*	T1574.002	https://wietze.github.io/blog/hijacking-dlls-in-windows
783	TRUE	webservices.dll	*\Windows\SysWOW64\*	T1574.002	https://wietze.github.io/blog/hijacking-dlls-in-windows
784	TRUE	wecapi.dll	*\Windows\System32\*	T1574.002	https://wietze.github.io/blog/hijacking-dlls-in-windows
785	TRUE	wecapi.dll	*\Windows\SysWOW64\*	T1574.002	https://wietze.github.io/blog/hijacking-dlls-in-windows
786	TRUE	wer.dll	*\Windows\System32\*	T1574.002	https://wietze.github.io/blog/hijacking-dlls-in-windows
787	TRUE	wer.dll	*\Windows\SysWOW64\*	T1574.002	https://wietze.github.io/blog/hijacking-dlls-in-windows
788	TRUE	wevtapi.dll	*\Windows\System32\*	T1574.002	https://wietze.github.io/blog/hijacking-dlls-in-windows
789	TRUE	wevtapi.dll	*\Windows\SysWOW64\*	T1574.002	https://wietze.github.io/blog/hijacking-dlls-in-windows
790	TRUE	whhelper.dll	*\Windows\System32\*	T1574.002	https://wietze.github.io/blog/hijacking-dlls-in-windows
791	TRUE	whhelper.dll	*\Windows\SysWOW64\*	T1574.002	https://wietze.github.io/blog/hijacking-dlls-in-windows
792	TRUE	wimgapi.dll	*\Windows\System32\*	T1574.002	https://www.hexacorn.com/blog/2015/02/23/beyond-good-ol-run-key-part-28/
793	TRUE	wimgapi.dll	*\Windows\SysWOW64\*	T1574.002	https://www.hexacorn.com/blog/2015/02/23/beyond-good-ol-run-key-part-28/
794	TRUE	wimgapi.dll	*\Program Files\Windows Kits\10\Assessment and Deployment Kit\Deployment Tools\arm64\DISM*	T1574.002	https://www.hexacorn.com/blog/2015/02/23/beyond-good-ol-run-key-part-28/
795	TRUE	winbio.dll	*\Windows\System32\*	T1574.002	https://securityintelligence.com/posts/windows-features-dll-sideloading/
796	TRUE	winbio.dll	*\Windows\SysWOW64\*	T1574.002	https://securityintelligence.com/posts/windows-features-dll-sideloading/
797	TRUE	winbrand.dll	*\Windows\System32\*	T1574.002	https://wietze.github.io/blog/hijacking-dlls-in-windows
798	TRUE	winbrand.dll	*\Windows\SysWOW64\*	T1574.002	https://wietze.github.io/blog/hijacking-dlls-in-windows
799	TRUE	windows.storage.dll	*\Windows\System32\*	T1574.007	https://wietze.github.io/blog/save-the-environment-variables
800	TRUE	windows.storage.dll	*\Windows\SysWOW64\*	T1574.007	https://wietze.github.io/blog/save-the-environment-variables
801	TRUE	windows.storage.search.dll	*\Windows\System32\*	T1574.007	https://wietze.github.io/blog/save-the-environment-variables
802	TRUE	windows.storage.search.dll	*\Windows\SysWOW64\*	T1574.007	https://wietze.github.io/blog/save-the-environment-variables
803	TRUE	windows.ui.immersive.dll	*\Windows\System32\*	T1574.002	https://securityintelligence.com/posts/windows-features-dll-sideloading/
804	TRUE	windows.ui.immersive.dll	*\Windows\SysWOW64\*	T1574.002	https://securityintelligence.com/posts/windows-features-dll-sideloading/
805	TRUE	windowscodecs.dll	*\Windows\System32\*	T1574.002	https://wietze.github.io/blog/hijacking-dlls-in-windows
806	TRUE	windowscodecs.dll	*\Windows\SysWOW64\*	T1574.002	https://wietze.github.io/blog/hijacking-dlls-in-windows
807	TRUE	windowscodecsext.dll	*\Windows\System32\*	T1574.007	https://wietze.github.io/blog/save-the-environment-variables
808	TRUE	windowscodecsext.dll	*\Windows\SysWOW64\*	T1574.007	https://wietze.github.io/blog/save-the-environment-variables
809	TRUE	windowsperformancerecordercontrol.dll	*\Program Files\windows kits\10\windows performance toolkit*	T1574.002	https://wietze.github.io/blog/hijacking-dlls-in-windows
810	TRUE	windowsperformancerecordercontrol.dll	*\Windows\System32\*	T1574.002	https://wietze.github.io/blog/hijacking-dlls-in-windows
811	TRUE	windowsperformancerecordercontrol.dll	*\Windows\SysWOW64\*	T1574.002	https://wietze.github.io/blog/hijacking-dlls-in-windows
812	TRUE	windowsperformancerecorderui.dll	*\Program Files\Windows Kits\10\Windows Performance Toolkit*	T1574.002	https://globetech.biz/index.php/2023/05/19/evading-edr-by-dll-sideloading-in-csharp/
813	TRUE	windowsudk.shellcommon.dll	*\Windows\System32\*	T1574.007	https://wietze.github.io/blog/save-the-environment-variables
814	TRUE	windowsudk.shellcommon.dll	*\Windows\SysWOW64\*	T1574.007	https://wietze.github.io/blog/save-the-environment-variables
815	TRUE	winhttp.dll	*\Windows\System32\*	T1574.002	https://wietze.github.io/blog/hijacking-dlls-in-windows
816	TRUE	winhttp.dll	*\Windows\SysWOW64\*	T1574.002	https://wietze.github.io/blog/hijacking-dlls-in-windows
817	TRUE	wininet.dll	*\Windows\System32\*	T1574.002	https://wietze.github.io/blog/hijacking-dlls-in-windows
818	TRUE	wininet.dll	*\Windows\SysWOW64\*	T1574.002	https://wietze.github.io/blog/hijacking-dlls-in-windows
819	TRUE	winipsec.dll	*\Windows\System32\*	T1574.002	https://wietze.github.io/blog/hijacking-dlls-in-windows
820	TRUE	winipsec.dll	*\Windows\SysWOW64\*	T1574.002	https://wietze.github.io/blog/hijacking-dlls-in-windows
821	TRUE	winmde.dll	*\Windows\System32\*	T1574.002	https://wietze.github.io/blog/hijacking-dlls-in-windows
822	TRUE	winmm.dll	*\Windows\System32\*	T1574.002	https://wietze.github.io/blog/hijacking-dlls-in-windows
823	TRUE	winmm.dll	*\Windows\SysWOW64\*	T1574.002	https://wietze.github.io/blog/hijacking-dlls-in-windows
824	TRUE	winnsi.dll	*\Windows\System32\*	T1574.002	https://wietze.github.io/blog/hijacking-dlls-in-windows
825	TRUE	winnsi.dll	*\Windows\SysWOW64\*	T1574.002	https://wietze.github.io/blog/hijacking-dlls-in-windows
826	TRUE	winrnr.dll	*\Windows\System32\*	T1574.007	https://wietze.github.io/blog/save-the-environment-variables
827	TRUE	winrnr.dll	*\Windows\SysWOW64\*	T1574.007	https://wietze.github.io/blog/save-the-environment-variables
828	TRUE	winscard.dll	*\Windows\System32\*	T1574.002	https://securityintelligence.com/posts/windows-features-dll-sideloading/
829	TRUE	winscard.dll	*\Windows\SysWOW64\*	T1574.002	https://securityintelligence.com/posts/windows-features-dll-sideloading/
830	TRUE	winsqlite3.dll	*\Windows\System32\*	T1574.002	https://wietze.github.io/blog/hijacking-dlls-in-windows
831	TRUE	winsqlite3.dll	*\Windows\SysWOW64\*	T1574.002	https://wietze.github.io/blog/hijacking-dlls-in-windows
832	TRUE	winsta.dll	*\Windows\System32\*	T1574.002	https://wietze.github.io/blog/hijacking-dlls-in-windows
833	TRUE	winsta.dll	*\Windows\SysWOW64\*	T1574.002	https://wietze.github.io/blog/hijacking-dlls-in-windows
834	TRUE	winsync.dll	*\Windows\System32\*	T1574.002	https://securityintelligence.com/posts/windows-features-dll-sideloading/
835	TRUE	winsync.dll	*\Windows\SysWOW64\*	T1574.002	https://securityintelligence.com/posts/windows-features-dll-sideloading/
836	TRUE	winutils.dll	*\Program Files\Palo Alto Networks\Traps*	T1574.002	https://research.checkpoint.com/2023/rorschach-a-new-sophisticated-and-fast-ransomware/
837	TRUE	wkscli.dll	*\Windows\System32\*	T1574.002	https://wietze.github.io/blog/hijacking-dlls-in-windows
838	TRUE	wkscli.dll	*\Windows\SysWOW64\*	T1574.002	https://wietze.github.io/blog/hijacking-dlls-in-windows
839	TRUE	wlanapi.dll	*\Windows\System32\*	T1574.002	https://wietze.github.io/blog/hijacking-dlls-in-windows
840	TRUE	wlanapi.dll	*\Windows\SysWOW64\*	T1574.002	https://wietze.github.io/blog/hijacking-dlls-in-windows
841	TRUE	wlancfg.dll	*\Windows\System32\*	T1574.002	https://wietze.github.io/blog/hijacking-dlls-in-windows
842	TRUE	wlancfg.dll	*\Windows\SysWOW64\*	T1574.002	https://wietze.github.io/blog/hijacking-dlls-in-windows
843	TRUE	wldp.dll	*\Windows\System32\*	T1574.002	https://wietze.github.io/blog/hijacking-dlls-in-windows
844	TRUE	wldp.dll	*\Windows\SysWOW64\*	T1574.002	https://wietze.github.io/blog/hijacking-dlls-in-windows
845	TRUE	wlidprov.dll	*\Windows\System32\*	T1574.007	https://wietze.github.io/blog/save-the-environment-variables
846	TRUE	wlidprov.dll	*\Windows\SysWOW64\*	T1574.007	https://wietze.github.io/blog/save-the-environment-variables
847	TRUE	wmiclnt.dll	*\Windows\System32\*	T1574.002	https://wietze.github.io/blog/hijacking-dlls-in-windows
848	TRUE	wmiclnt.dll	*\Windows\SysWOW64\*	T1574.002	https://wietze.github.io/blog/hijacking-dlls-in-windows
849	TRUE	wmidcom.dll	*\Windows\System32\*	T1574.007	https://wietze.github.io/blog/save-the-environment-variables
850	TRUE	wmidcom.dll	*\Windows\SysWOW64\*	T1574.007	https://wietze.github.io/blog/save-the-environment-variables
851	TRUE	wmiutils.dll	*\Windows\System32\wbem*	T1574.007	https://wietze.github.io/blog/save-the-environment-variables
852	TRUE	wmiutils.dll	*\Windows\SysWOW64\wbem*	T1574.007	https://wietze.github.io/blog/save-the-environment-variables
853	TRUE	wmpdui.dll	*\Windows\System32\*	T1574.002	https://wietze.github.io/blog/hijacking-dlls-in-windows
854	TRUE	wmsgapi.dll	*\Windows\System32\*	T1574.002	https://wietze.github.io/blog/hijacking-dlls-in-windows
855	TRUE	wmsgapi.dll	*\Windows\SysWOW64\*	T1574.002	https://wietze.github.io/blog/hijacking-dlls-in-windows
856	TRUE	wofutil.dll	*\Windows\System32\*	T1574.002	https://wietze.github.io/blog/hijacking-dlls-in-windows
857	TRUE	wofutil.dll	*\Windows\SysWOW64\*	T1574.002	https://wietze.github.io/blog/hijacking-dlls-in-windows
858	TRUE	wpdshext.dll	*\Windows\System32\*	T1574.007	https://wietze.github.io/blog/save-the-environment-variables
859	TRUE	wpdshext.dll	*\Windows\SysWOW64\*	T1574.007	https://wietze.github.io/blog/save-the-environment-variables
860	TRUE	wsc.dll	*\Program Files\AVAST Software\Avast*	T1574.001	https://github.com/netero1010/Vulnerability-Disclosure/tree/main/CVE-2022-AVAST2
861	TRUE	wscapi.dll	*\Windows\System32\*	T1574.002	https://securityintelligence.com/posts/windows-features-dll-sideloading/
862	TRUE	wscapi.dll	*\Windows\SysWOW64\*	T1574.002	https://securityintelligence.com/posts/windows-features-dll-sideloading/
863	TRUE	wsdapi.dll	*\Windows\System32\*	T1574.002	https://globetech.biz/index.php/2023/05/19/evading-edr-by-dll-sideloading-in-csharp/
864	TRUE	wsdapi.dll	*\Windows\SysWOW64\*	T1574.002	https://globetech.biz/index.php/2023/05/19/evading-edr-by-dll-sideloading-in-csharp/
865	TRUE	wshbth.dll	*\Windows\System32\*	T1574.007	https://wietze.github.io/blog/save-the-environment-variables
866	TRUE	wshbth.dll	*\Windows\SysWOW64\*	T1574.007	https://wietze.github.io/blog/save-the-environment-variables
867	TRUE	wshelper.dll	*\Windows\System32\*	T1574.002	https://wietze.github.io/blog/hijacking-dlls-in-windows
868	TRUE	wshelper.dll	*\Windows\SysWOW64\*	T1574.002	https://wietze.github.io/blog/hijacking-dlls-in-windows
869	TRUE	wsmsvc.dll	*\Windows\System32\*	T1574.002	https://securityintelligence.com/posts/windows-features-dll-sideloading/
870	TRUE	wsmsvc.dll	*\Windows\SysWOW64\*	T1574.002	https://securityintelligence.com/posts/windows-features-dll-sideloading/
871	TRUE	wtsapi32.dll	*\Windows\System32\*	T1574.002	https://wietze.github.io/blog/hijacking-dlls-in-windows
872	TRUE	wtsapi32.dll	*\Windows\SysWOW64\*	T1574.002	https://wietze.github.io/blog/hijacking-dlls-in-windows
873	TRUE	wwancfg.dll	*\Windows\System32\*	T1574.002	https://wietze.github.io/blog/hijacking-dlls-in-windows
874	TRUE	wwancfg.dll	*\Windows\SysWOW64\*	T1574.002	https://wietze.github.io/blog/hijacking-dlls-in-windows
875	TRUE	wwapi.dll	*\Windows\System32\*	T1574.002	https://wietze.github.io/blog/hijacking-dlls-in-windows
876	TRUE	wwapi.dll	*\Windows\SysWOW64\*	T1574.002	https://wietze.github.io/blog/hijacking-dlls-in-windows
877	TRUE	xmllite.dll	*\Windows\System32\*	T1574.002	https://wietze.github.io/blog/hijacking-dlls-in-windows
878	TRUE	xmllite.dll	*\Windows\SysWOW64\*	T1574.002	https://wietze.github.io/blog/hijacking-dlls-in-windows
879	TRUE	xolehlp.dll	*\Windows\System32\*	T1574.002	https://wietze.github.io/blog/hijacking-dlls-in-windows
880	TRUE	xolehlp.dll	*\Windows\SysWOW64\*	T1574.002	https://wietze.github.io/blog/hijacking-dlls-in-windows
881	TRUE	xpsservices.dll	*\Windows\System32\*	T1574.002	https://securityintelligence.com/posts/windows-features-dll-sideloading/
882	TRUE	xpsservices.dll	*\Windows\SysWOW64\*	T1574.002	https://securityintelligence.com/posts/windows-features-dll-sideloading/
883	TRUE	xwizards.dll	*\Windows\System32\*	T1574.007	https://wietze.github.io/blog/save-the-environment-variables
884	TRUE	xwizards.dll	*\Windows\SysWOW64\*	T1574.007	https://wietze.github.io/blog/save-the-environment-variables
885	TRUE	xwtpw32.dll	*\Windows\System32\*	T1574.007	https://wietze.github.io/blog/save-the-environment-variables
886	TRUE	xwtpw32.dll	*\Windows\SysWOW64\*	T1574.007	https://wietze.github.io/blog/save-the-environment-variables