DragonReturn: Mixed Reality.exe DLL Sideload of nvdaHelperRemote.dll in WMP Dir
Detects potential DLL sideloading attempts where a malicious 'Mixed Reality.exe' loads a 'nvdaHelperRemote.dll' from the Windows Media Player directory, or the creation of these suspicious files by unrecognized processes, potentially linked to a dropper file 'COU_ITR-1_to_4_AY2026-27.exe'.
SentinelOne
