Seen by @redcanary: Tangerine Turkey worm dropping #HijackLib printui.dll in

C:\Windows \System32
(yes, with a space after 'Windows')

This bypasses UAC (!) and runs malicious code via signed Microsoft binary printui.exe

⚙️🐦
#HijackLib