GOLD ENCOUNTER DLL Sideload via ADNotificationManager.exe or QEMU Binary

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•5

Detects DLL sideloading activity where legitimate, signed binaries such as ADNotificationManager.exe or QEMU-related executables (qemu-system-x86_64.exe, qemu-system-i386.exe, qemu-img.exe) load malicious DLLs (e.g., vcruntime140_1.dll) from user-writable directories (e.g., AppData, Temp, ProgramData). This behavior is associated with the GOLD ENCOUNTER and STAC campaigns for delivering payloads like Havoc C2.