Lorem Ipsum DLL Sideloading from ProgramData

Kaung Khant Ko@kaungkhantko

•updated Jun 17, 2026•1•0•35

Detects suspicious image loads where a renamed Microsoft .NET ClickOnce Launch Utility or other .NET masquerading binaries sideload mscoree.dll or msvcp140.dll from the ProgramData directory. This behavior is associated with the Lorem Ipsum threat activity.