Mavinject.exe

Used by App-v in Windows

ADS

Inject dll file into running process

Mavinject.exe 4172 /INJECTRUNNING {PATH_ABSOLUTE}:file.dll

Inject file.dll stored as an Alternate Data Stream (ADS) into a process with PID 4172 — MITRE: T1564.004 — Privileges: User

Execute

Inject dll file into running process

MavInject.exe 3110 /INJECTRUNNING {PATH_ABSOLUTE:.dll}

Inject evil.dll into a process with PID 3110. — MITRE: T1218.013 — Privileges: User