DLL Hijacking when performing operations in Acronis Secure Zone partition leading to Privilege Escalation

Summary Acronis True Image 2021 lets user create a special protected partition for storing backups. process enables browsing contents of the Acronis Secure Zone partition but every time any kind of operation gets performed in Secure Zone, looks for for (Google's custom implementation of dynamic …

1) C:\Program Files (x86)\Acronis\TrueImageHome
2) Application's current working directory
3) System directory
4) 16-bit System directory
5) Windows directory
6) Directories in System PATH environment variable
7) Directories in User PATH environment variable

Every Windows system contains