Suspicious DLL Load from ProgramData by .NET Runtime Optimization Service

nomit vyas@xoxo

•updated Jun 24, 2026•1•0•12

Detects the loading of 'mscoree.dll' or 'msvcp140.dll' from the 'C:\ProgramData\' directory by processes masquerading as '.NET Runtime Optimization Service' or originating from a highly suspicious, obfuscated folder path. This behavior is indicative of malware attempting to evade detection through DLL side-loading or process masquerading, as legitimate .NET Runtime Optimization Service processes should not load these DLLs from this location or from such unusual paths.