DragonReturn nvdaHelperRemote.dll Sideloading via Mixed Reality.exe in WMP Dir
Detects the loading of the 'nvdaHelperRemote.dll' library by potentially unauthorized or suspicious executable processes, including 'Mixed Reality.exe' and 'COU_ITR-1_to_4_AY2026-27.exe', or when it is loaded from an unexpected path such as a Windows Media Player directory. This pattern is indicative of DLL side-loading or masquerading techniques.
Splunk (SPL)
