GOLD ENCOUNTER Havoc C2 DLL Sideloading via ADNotificationManager.exe

Ibrahim Saud@tektrix

•updated Jun 30, 2026•2•0•4

Detects suspicious behavior associated with ADNotificationManager.exe, including DLL side-loading of vcruntime140_1.dll, loading of DLLs from user-writable directories (potential DLL hijacking), and the spawning of Rclone.exe for potential data exfiltration via SFTP.