Analysis

  • max time kernel
    149s
  • max time network
    126s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260911-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    17/10/2026, 11:13

General

  • Target
    Ylide_0.1.6_x64-setup.exe
  • Size 22.9MB
  • Sample261017-nbtxzaee92
  • SHA256 be4e7a1bc79d3188651f212a1732fed521858f1f1564b0eeb2506e7cc36d8e03
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10

Malware Config

Signatures

  • Loads dropped DLL 6 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Ylide_0.1.6_x64-setup.exe
    "C:\Users\Admin\AppData\Local\Temp\Ylide_0.1.6_x64-setup.exe"
    1⤵
    • Loads dropped DLL
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    PID:3412

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        LangDLL.dll

        • Path C:\Users\Admin\AppData\Local\Temp\nscA08E.tmp\LangDLL.dll
        • Size 5KB
        • SHA256 3c8b2629048c118e4fcf80188cbcdaad3a668270e49fd95d2809feccc98fe220
        • MD5 SHA1 SHA512 SSDEEP TLSH

        System.dll

        • Path C:\Users\Admin\AppData\Local\Temp\nscA08E.tmp\System.dll
        • Size 12KB
        • SHA256 afe032f942e2ed0bf7494ec08ba813f5739fb522c640bde81d30ecaf9f894432
        • MD5 SHA1 SHA512 SSDEEP TLSH

        modern-wizard.bmp

        • Path C:\Users\Admin\AppData\Local\Temp\nscA08E.tmp\modern-wizard.bmp
        • Size 150KB
        • SHA256 a5b2eee17847b0545a00dde56a7f2ee56d81799ca96431a5d4ec51ab44ab2aa1
        • MD5 SHA1 SHA512 SSDEEP TLSH

        nsDialogs.dll

        • Path C:\Users\Admin\AppData\Local\Temp\nscA08E.tmp\nsDialogs.dll
        • Size 9KB
        • SHA256 9c76f4d53ceee2a471c936e0899688405e1009ce962d140e9acb49ed68d114cb
        • MD5 SHA1 SHA512 SSDEEP TLSH

        nsis_tauri_utils.dll

        • Path C:\Users\Admin\AppData\Local\Temp\nscA08E.tmp\nsis_tauri_utils.dll
        • Size 33KB
        • SHA256 5ba143b5db4a87d32d6e7802e033330aae56cbceabe0d1e3ba41948385ad4709
        • MD5 SHA1 SHA512 SSDEEP TLSH

        LICENSE-BoringSSL

        • Path C:\Users\Admin\AppData\Local\Ylide\runtime\cpu\LICENSE-BoringSSL
        • Size 12KB
        • SHA256 827c8d8fc207c2392794eef9e00fe246f9f61fdcc132556c275be3dd8c3cd97f
        • MD5 SHA1 SHA512 SSDEEP TLSH

        llama-minicpmv-cli.exe

        • Path C:\Users\Admin\AppData\Local\Ylide\runtime\cpu\llama-minicpmv-cli.exe
        • Size 26KB
        • SHA256 39397a2f304ca9414de394303ca0751717afc484330b9a03f7d80091c298cbc3
        • MD5 SHA1 SHA512 SSDEEP TLSH

        llama-perplexity.exe

        • Path C:\Users\Admin\AppData\Local\Ylide\runtime\cpu\llama-perplexity.exe
        • Size 9KB
        • SHA256 de71c077b65743dbafffbfb66e87cd291bb89bf428ad6f31518336208c4750ea
        • MD5 SHA1 SHA512 SSDEEP TLSH

        LICENSE-LLVM-OpenMP

        • Path C:\Users\Admin\AppData\Local\Ylide\runtime\vulkan\LICENSE-LLVM-OpenMP
        • Size 19KB
        • SHA256 fdad1758a9e1f9d5a81e18879b3406772115edc92c24bfa36b70c654f325e8e4
        • MD5 SHA1 SHA512 SSDEEP TLSH

        LICENSE-httplib

        • Path C:\Users\Admin\AppData\Local\Ylide\runtime\vulkan\LICENSE-httplib
        • Size 1KB
        • SHA256 4b45cbe16d7b71b89ae6127e26e0d90a029198ca5e958ad8e3d0b8bbed364d8b
        • MD5 SHA1 SHA512 TLSH

        LICENSE-jsonhpp

        • Path C:\Users\Admin\AppData\Local\Ylide\runtime\vulkan\LICENSE-jsonhpp
        • Size 1KB
        • SHA256 c0d068392ea65358b798b8c165103560f06e9e3b38c4ab4e2d8810a7b931af86
        • MD5 SHA1 SHA512 TLSH

        LICENSE-llama.cpp

        • Path C:\Users\Admin\AppData\Local\Ylide\runtime\vulkan\LICENSE-llama.cpp
        • Size 1KB
        • SHA256 94f29bbed6a22c35b992c5c6ebf0e7c92f13b836b90f36f461c9cf2f0f1d010d
        • MD5 SHA1 SHA512 TLSH

        ggml-base.dll

        • Path C:\Users\Admin\AppData\Local\Ylide\runtime\vulkan\ggml-base.dll
        • Size 785KB
        • SHA256 0a259689ea3c105a8122159eb97fb53733f2531fadd3e9739689961cdab27600
        • MD5 SHA1 SHA512 SSDEEP TLSH

        ggml-cpu-alderlake.dll

        • Path C:\Users\Admin\AppData\Local\Ylide\runtime\vulkan\ggml-cpu-alderlake.dll
        • Size 1.4MB
        • SHA256 98b3bd12a84e848f57686f6d5f0969654ec79cda0c7636498933ea1063d14aa6
        • MD5 SHA1 SHA512 SSDEEP TLSH

        ggml-cpu-cannonlake.dll

        • Path C:\Users\Admin\AppData\Local\Ylide\runtime\vulkan\ggml-cpu-cannonlake.dll
        • Size 1.5MB
        • SHA256 fef636daea23b26f935cf5983be9a29b79f0541cd148b9d64a32bc9ea0cec704
        • MD5 SHA1 SHA512 SSDEEP TLSH

        ggml-cpu-cascadelake.dll

        • Path C:\Users\Admin\AppData\Local\Ylide\runtime\vulkan\ggml-cpu-cascadelake.dll
        • Size 1.5MB
        • SHA256 b32ee94fa0a366886cd03be48f80f1d8c1bbb338d71fc734a263753ec46aa8fd
        • MD5 SHA1 SHA512 SSDEEP TLSH

        ggml-cpu-cooperlake.dll

        • Path C:\Users\Admin\AppData\Local\Ylide\runtime\vulkan\ggml-cpu-cooperlake.dll
        • Size 1.5MB
        • SHA256 e67357a558e71b834360b6f6d62abc6b9fe19930f6f7dd21ee0339e7b144306e
        • MD5 SHA1 SHA512 SSDEEP TLSH

        ggml-cpu-haswell.dll

        • Path C:\Users\Admin\AppData\Local\Ylide\runtime\vulkan\ggml-cpu-haswell.dll
        • Size 1.4MB
        • SHA256 d33deb9bf3dd25427404f0f94a13c6b3da92b9b57b794199a9f354c3a327efb6
        • MD5 SHA1 SHA512 SSDEEP TLSH

        ggml-cpu-icelake.dll

        • Path C:\Users\Admin\AppData\Local\Ylide\runtime\vulkan\ggml-cpu-icelake.dll
        • Size 1.5MB
        • SHA256 41abb00a64bbf099c137cdb3b9547c7eb90bcd9c1d7b83238cbf10a74f97addd
        • MD5 SHA1 SHA512 SSDEEP TLSH

        ggml-cpu-ivybridge.dll

        • Path C:\Users\Admin\AppData\Local\Ylide\runtime\vulkan\ggml-cpu-ivybridge.dll
        • Size 1.2MB
        • SHA256 d674c12b3f40d657b0989801699560e68247dbe9509823651b055ac3816ba37c
        • MD5 SHA1 SHA512 SSDEEP TLSH

        ggml-cpu-piledriver.dll

        • Path C:\Users\Admin\AppData\Local\Ylide\runtime\vulkan\ggml-cpu-piledriver.dll
        • Size 1.2MB
        • SHA256 bb5215c806397adf56e986f52aa0c75b04b3b5b33203a722f647254eae2b94b2
        • MD5 SHA1 SHA512 SSDEEP TLSH

        ggml-cpu-sandybridge.dll

        • Path C:\Users\Admin\AppData\Local\Ylide\runtime\vulkan\ggml-cpu-sandybridge.dll
        • Size 1.2MB
        • SHA256 55d5659b45afcbe7a1d7611ab1914d2888476fc3024933e4b82122cdc58d6fd5
        • MD5 SHA1 SHA512 SSDEEP TLSH

        ggml-cpu-sapphirerapids.dll

        • Path C:\Users\Admin\AppData\Local\Ylide\runtime\vulkan\ggml-cpu-sapphirerapids.dll
        • Size 1.8MB
        • SHA256 83af3cacf3bf32b98626791358f950da4b45a22af85bde63afe537fe51e60848
        • MD5 SHA1 SHA512 SSDEEP TLSH

        ggml-cpu-skylakex.dll

        • Path C:\Users\Admin\AppData\Local\Ylide\runtime\vulkan\ggml-cpu-skylakex.dll
        • Size 1.5MB
        • SHA256 20722299dc5e4703056ff95b7ef329c223390ab87469c822721c1e67e4cc2a24
        • MD5 SHA1 SHA512 SSDEEP TLSH

        ggml-cpu-sse42.dll

        • Path C:\Users\Admin\AppData\Local\Ylide\runtime\vulkan\ggml-cpu-sse42.dll
        • Size 895KB
        • SHA256 1c0fc615b6d97a79e58f33e8a7fb4e8de1834ad0f3f0e00e8943a4d416ddd242
        • MD5 SHA1 SHA512 SSDEEP TLSH

        ggml-cpu-x64.dll

        • Path C:\Users\Admin\AppData\Local\Ylide\runtime\vulkan\ggml-cpu-x64.dll
        • Size 888KB
        • SHA256 7c9df996db7fe98510571524e3e62dd267a4034350185014814418dbad3c25ea
        • MD5 SHA1 SHA512 SSDEEP TLSH

        ggml-cpu-zen4.dll

        • Path C:\Users\Admin\AppData\Local\Ylide\runtime\vulkan\ggml-cpu-zen4.dll
        • Size 1.5MB
        • SHA256 83ae254f6204670e9011e11db84786122567bde2fab07354e7c4827c18589ee1
        • MD5 SHA1 SHA512 SSDEEP TLSH

        ggml-rpc-server.exe

        • Path C:\Users\Admin\AppData\Local\Ylide\runtime\vulkan\ggml-rpc-server.exe
        • Size 114KB
        • SHA256 e852937ded50b18b1c22f67d2368dde42decd58ad7be8544cd771608aa6e2bda
        • MD5 SHA1 SHA512 SSDEEP TLSH

        ggml-rpc.dll

        • Path C:\Users\Admin\AppData\Local\Ylide\runtime\vulkan\ggml-rpc.dll
        • Size 226KB
        • SHA256 b52bd8eddb79ebd1dc0b832b34483bef23d44a34c6d5639301d92cb971f874a4
        • MD5 SHA1 SHA512 SSDEEP TLSH

        ggml.dll

        • Path C:\Users\Admin\AppData\Local\Ylide\runtime\vulkan\ggml.dll
        • Size 77KB
        • SHA256 2649a5d914934188cccbe2c58e4642d2d4408bcda0f7068d58390686bd7ea62f
        • MD5 SHA1 SHA512 SSDEEP TLSH

        libomp.dll

        • Path C:\Users\Admin\AppData\Local\Ylide\runtime\vulkan\libomp.dll
        • Size 750KB
        • SHA256 a12116ba72d1d6820407cf30be23da04ce79d6bb8a71a5ee71759c5a1faa6f1c
        • MD5 SHA1 SHA512 SSDEEP TLSH

        llama-batched-bench-impl.dll

        • Path C:\Users\Admin\AppData\Local\Ylide\runtime\vulkan\llama-batched-bench-impl.dll
        • Size 60KB
        • SHA256 86dd3cc19af625bd826f7919767883a7e78481e012fb141e5393677235518190
        • MD5 SHA1 SHA512 SSDEEP TLSH

        llama-batched-bench.exe

        • Path C:\Users\Admin\AppData\Local\Ylide\runtime\vulkan\llama-batched-bench.exe
        • Size 9KB
        • SHA256 0ef5c88a7acf32f4aee060980745909f268d77645091fcdfb16493ac36597a88
        • MD5 SHA1 SHA512 SSDEEP TLSH

        llama-bench-impl.dll

        • Path C:\Users\Admin\AppData\Local\Ylide\runtime\vulkan\llama-bench-impl.dll
        • Size 395KB
        • SHA256 e4ff088cb9f50568366c281684b3ad4c69e9ddea3be6deb4a0a4fb63a6bf0650
        • MD5 SHA1 SHA512 SSDEEP TLSH

        llama-bench.exe

        • Path C:\Users\Admin\AppData\Local\Ylide\runtime\vulkan\llama-bench.exe
        • Size 9KB
        • SHA256 24473241d5af8781563c2878a0b581b7888467d13ee602df9b68b398b371a911
        • MD5 SHA1 SHA512 SSDEEP TLSH

        llama-cli-impl.dll

        • Path C:\Users\Admin\AppData\Local\Ylide\runtime\vulkan\llama-cli-impl.dll
        • Size 3.2MB
        • SHA256 8a50d8db8599970726f824f50d5d0a4570d2ff602a39940e09362d23f2c7fca5
        • MD5 SHA1 SHA512 SSDEEP TLSH

        llama-cli.exe

        • Path C:\Users\Admin\AppData\Local\Ylide\runtime\vulkan\llama-cli.exe
        • Size 9KB
        • SHA256 4eaabb9f97a843540b2c78802b31777d0952eff13d536dbeed8e9a4b12ff4c30
        • MD5 SHA1 SHA512 SSDEEP TLSH

        llama-common.dll

        • Path C:\Users\Admin\AppData\Local\Ylide\runtime\vulkan\llama-common.dll
        • Size 7.7MB
        • SHA256 9adf40bc08e99005699d6397bcacb72c3aced68c9db01f13b5bd31c6abc7b2b5
        • MD5 SHA1 SHA512 SSDEEP TLSH

        llama-completion-impl.dll

        • Path C:\Users\Admin\AppData\Local\Ylide\runtime\vulkan\llama-completion-impl.dll
        • Size 137KB
        • SHA256 e10c6bba8275b289e3121aa3ab2820b8583d744109dfc5d546e7220328a4ee1d
        • MD5 SHA1 SHA512 SSDEEP TLSH

        llama-fit-params-impl.dll

        • Path C:\Users\Admin\AppData\Local\Ylide\runtime\vulkan\llama-fit-params-impl.dll
        • Size 42KB
        • SHA256 a08d9a6fc98cd0a340bb80703e7a43a1bca4b362eb6f5bc3d235993b38b69d89
        • MD5 SHA1 SHA512 SSDEEP TLSH

        llama-fit-params.exe

        • Path C:\Users\Admin\AppData\Local\Ylide\runtime\vulkan\llama-fit-params.exe
        • Size 9KB
        • SHA256 d38927b1072ab91f92ecb13a7e778934f8fff5b0db77da2fb87b189a68efca40
        • MD5 SHA1 SHA512 SSDEEP TLSH

        llama-gguf-split.exe

        • Path C:\Users\Admin\AppData\Local\Ylide\runtime\vulkan\llama-gguf-split.exe
        • Size 59KB
        • SHA256 259db5e609e1e079374eb93cdf24bd8bc9371a1b15bc1c953ddfdc5a933afcfa
        • MD5 SHA1 SHA512 SSDEEP TLSH

        llama-imatrix.exe

        • Path C:\Users\Admin\AppData\Local\Ylide\runtime\vulkan\llama-imatrix.exe
        • Size 246KB
        • SHA256 e7521d4b6e0a48bf337e0b632fb51f76c3918c15c2bb8b0ed683c4e636a55de7
        • MD5 SHA1 SHA512 SSDEEP TLSH

        llama-llava-cli.exe

        • Path C:\Users\Admin\AppData\Local\Ylide\runtime\vulkan\llama-llava-cli.exe
        • Size 26KB
        • SHA256 91bdde129470b0201988336f682b84832b16bca4a85e78e69f8b4d6cc28224cf
        • MD5 SHA1 SHA512 SSDEEP TLSH

        llama-mtmd-cli.exe

        • Path C:\Users\Admin\AppData\Local\Ylide\runtime\vulkan\llama-mtmd-cli.exe
        • Size 90KB
        • SHA256 81634bc89b0d698712c9706cf1716239f827558111cf520b21f8b40b99e88293
        • MD5 SHA1 SHA512 SSDEEP TLSH

        llama-mtmd-debug.exe

        • Path C:\Users\Admin\AppData\Local\Ylide\runtime\vulkan\llama-mtmd-debug.exe
        • Size 54KB
        • SHA256 b44ad219a3365b961fc1c10d23daa42be15b7ef94953222a9a2650942d36f4eb
        • MD5 SHA1 SHA512 SSDEEP TLSH

        llama-perplexity-impl.dll

        • Path C:\Users\Admin\AppData\Local\Ylide\runtime\vulkan\llama-perplexity-impl.dll
        • Size 193KB
        • SHA256 4ade93257c26e936770f5ad9e65de400efb73dbe3abcba9244c9756378b4de07
        • MD5 SHA1 SHA512 SSDEEP TLSH

        llama-quantize-impl.dll

        • Path C:\Users\Admin\AppData\Local\Ylide\runtime\vulkan\llama-quantize-impl.dll
        • Size 134KB
        • SHA256 c792c25b55fada62323f50d9e68da797dc92e52b4f79601708fa203533586f86
        • MD5 SHA1 SHA512 SSDEEP TLSH

        llama-results.exe

        • Path C:\Users\Admin\AppData\Local\Ylide\runtime\vulkan\llama-results.exe
        • Size 45KB
        • SHA256 f0267a77191b2d0f94b8965c5359d82832f65145ef4fddbc7111bd7919e4e0f6
        • MD5 SHA1 SHA512 SSDEEP TLSH

        llama-server-impl.dll

        • Path C:\Users\Admin\AppData\Local\Ylide\runtime\vulkan\llama-server-impl.dll
        • Size 8.8MB
        • SHA256 24b1249ddd19e3ba3551804707dbe2f3c154c007542899ea8b16d69a94ab6597
        • MD5 SHA1 SHA512 SSDEEP TLSH

        llama-server.exe

        • Path C:\Users\Admin\AppData\Local\Ylide\runtime\vulkan\llama-server.exe
        • Size 9KB
        • SHA256 6a4635aeb35656153d4bfeeddf761d24ed84aada9c9108d580737cbed465141b
        • MD5 SHA1 SHA512 SSDEEP TLSH

        llama-tokenize.exe

        • Path C:\Users\Admin\AppData\Local\Ylide\runtime\vulkan\llama-tokenize.exe
        • Size 57KB
        • SHA256 962b97b132cb29e763a46c84f1943b2874ed7879037ac37fbe986400ac165ecf
        • MD5 SHA1 SHA512 SSDEEP TLSH

        llama-tts.exe

        • Path C:\Users\Admin\AppData\Local\Ylide\runtime\vulkan\llama-tts.exe
        • Size 41KB
        • SHA256 6d73d057bcc00fd3bd246e459bf2e31790e1a590a24493331c3301e799de81a8
        • MD5 SHA1 SHA512 SSDEEP TLSH

        llama.dll

        • Path C:\Users\Admin\AppData\Local\Ylide\runtime\vulkan\llama.dll
        • Size 3.4MB
        • SHA256 aacb073c9c0d30090dd3e56f49772545452ccc4fd311efbfdb7d1bba7bbb0bda
        • MD5 SHA1 SHA512 SSDEEP TLSH

        llama.exe

        • Path C:\Users\Admin\AppData\Local\Ylide\runtime\vulkan\llama.exe
        • Size 102KB
        • SHA256 6db3725ca76e195ef16129ae16d7d49f809523e77cb3a1fde290f86dcf545bca
        • MD5 SHA1 SHA512 SSDEEP TLSH

        mtmd.dll

        • Path C:\Users\Admin\AppData\Local\Ylide\runtime\vulkan\mtmd.dll
        • Size 1.8MB
        • SHA256 bd4a9dac32ba8b14cf95da3361495380ac556b34f48434ebe477ffef23f40bd1
        • MD5 SHA1 SHA512 SSDEEP TLSH

        ylide.exe

        • Path C:\Users\Admin\AppData\Local\Ylide\ylide.exe
        • Size 27.1MB
        • SHA256 302cbf9b91aeab2f28bf6267de1329ca73bf8b5eb43ed777123f0ec9f91d4953
        • MD5 SHA1 SHA512 SSDEEP TLSH