All Detections

Lolbin Unregmp2.exe Use As Proxy

Yamato Security Hayabusa@YamatoSecurityHayabusa
updated Jun 24, 202504

Detect usage of the "unregmp2.exe" binary as a proxy to launch a custom version of "wmpnscfg.exe"

Sigma