SilverFox Tencent UxEnhanceHost DLL Side-Loading via UxEnhance64.dll

Ethan Andrews@eandrews

•updated Jun 22, 2026•1•0•38

Detects DLL side-loading where the signed Tencent UxEnhanceHost binary loads a malicious UxEnhance64.dll from randomized staging directories under C:\Users\Public\, a primary execution vehicle in the SilverFox campaign.