: Malicious actors drop custom-named DLLs into legitimate program folders. When the trusted application starts, it mistakenly loads the malicious DLL.

Because this is not a standard file, you should treat it as a potential threat and follow these verification steps: On the prevalence of software supply chain attacks - DFRWS

: Once loaded, such files can be used to establish a backdoor or run background tasks like the Cobalt Strike framework every time the system boots. Recommended Investigation Steps