Adobe DLL Sideloading via urlmon.dll

Tim Peck@timpeck

•updated Jan 26, 2026•2•0•34

Detects the legitimate Adobe binary 'ADNotificationManager.exe' loading 'urlmon.dll' from a non-system directory. This is a DLL Sideloading technique (T1574.002) used by a Vietnamese Stealer campaign for initial execution.