examples:

• description: "Place malicious dwrite.dll in the search order location" command: "copy malicious.dll "%SYSTEM32%\dwrite.dll""
• description: "Execute the vulnerable binary to trigger the hijack" command: ""%SYSTEM32%\cttune.exe""

dwrite.dll

Vendor: Microsoft

Expected Location: %SYSTEM32%

Vulnerable Executables:

• %SYSTEM32%\cttune.exe (Sideloading)
• %SYSTEM32%\dataexchangehost.exe (Sideloading)
• %SYSTEM32%\gamepanel.exe (Sideloading)
• %LOCALAPPDATA%\Discord\app-%VERSION%\Discord.exe (Sideloading)
• %LOCALAPPDATA%\Framer\app-%VERSION%\Framer.exe (Sideloading)
• %LOCALAPPDATA%\slack\app-%VERSION%\slack.exe (Sideloading)
• %LOCALAPPDATA%\Programs\Evernote\Evernote.exe (Sideloading)
• %LOCALAPPDATA%\Programs\Canva\Canva.exe (Sideloading)
• %LOCALAPPDATA%\Programs\Session\Session.exe (Sideloading)
• %LOCALAPPDATA%\Programs\Microsoft VS Code\Code.exe (Sideloading)
• %LOCALAPPDATA%\element-desktop\app-%VERSION%\Element.exe (Sideloading)
• %LOCALAPPDATA%\GitHubDesktop\app-%VERSION%\GitHubDesktop.exe (Sideloading)
• %LOCALAPPDATA%\Programs\GoLogin\GoLogin.exe (Sideloading)
• %LOCALAPPDATA%\Programs\Notion\Notion.exe (Sideloading)
• %PROGRAMFILES%\Obsidian\Obsidian.exe (Sideloading)

Acknowledgement: Wietze

Acknowledgement: Josh Allman