The living-off-the-land binary (LOLBin) is anchoring a rash of cyberattacks bent on evading security detection to drop Qbot and Lokibot. A Windows living-off-the-land binary (LOLBin) known as Regsvr32 ...

The module <NameOfSystemFile> failed to load. Make sure the binary is sorted at the specified path or debug it to check for problems with the binary or dependent .DLL ...

A security researcher named Casey Smith published an article last week where he detailed how the Windows Regsvr32.exe command could be used to bypass AppLocker restrictions. In this article he ...

Malware distributors have turned to an older trick known as Squiblydoo to spread Qbot and Lokibot via Microsoft Office document using regsvr32.exe. A report from the threat research team at security ...

If I use the regsvr32 command to initialize (register?) a .dll or .ocx file, is there an actual procedure to reverse this or do I simply delete the file? TIA.

A researcher has discovered that Windows’ Regsvr32 can be used to download and run JavaScript and VBScript remotely from the Internet, bypassing AppLocker’s whitelisting protections. A core Windows ...

A researcher in Colorado has discovered a feature in Regsvr32 that allows an attacker to bypass application whitelisting protections, such as those afforded by Microsoft’s AppLocker. If the technique ...