File scan report
Verdict Suspicious
Is Solstice 26.
This unsigned 64-bit DLL is flagged by 23 of the 63 antivirus engines that checked it, including seven major ones, mostly as a game-hacking tool, though the sandbox runs recorded…
Read the whole reasonShow less
Why Suspicious? 23 antivirus engines flag it; nothing else confirms it.
Limited evidence · One sign points to a problem; nothing else confirms it.
Avoid loading this DLL and delete it unless you fully trust its source. If it has already run, scan your system with your security software and keep protection enabled.
What to do now4 steps
Some signs point to a problem, but nothing confirms it is harmful. Treat it with caution.
What to do
Don't use it unless you're sure where it came from.
Check where you got it: an unexpected attachment, a link someone sent you or a re-upload is a red flag.
If you can't confirm where it came from, delete it. If you need the program, download it again from the publisher's own website.
If you already used it
Stop using it, run a full scan with your antivirus and watch for unexpected behavior or security alerts.
Not sure what to do?
Ask the MalwareTips community before you run it. If you already ran it, follow the cleanup guide.
- Ask for free help on the MalwareTips forumWindows malware removal help, answered by volunteers. (opens malwaretips.com in a new tab)
- Remove malware from WindowsStep-by-step cleanup with free tools. (opens malwaretips.com in a new tab)
Paste this report's link in your topic so helpers can see what was found.
Antivirus results
23 of 63 flagged
- Flagged 23
- No detection 40
- No result 11
- Code signing Unsigned
- Test run Completed
- First seen 3mo ago
Chapter 02
Why we think so
4 points against it and 3 in its favour, checked against the scan evidence.
The reasoning behind this verdict
Most of their labels describe a game cheat or riskware, while Microsoft names it a trojan. The sandbox runs recorded no harmful activity, but game cheats are often abused to hide malware, so treat it with caution.
Detections are broad: 23 of the 63 antivirus engines that checked it, 20 of them independent, including ESET, Fortinet, Microsoft, Sophos, Symantec, Trellix and Trend Micro. The labels point to game-cheat software, such as ESET's potentially unsafe GameHack and Symantec's Gamehack. Some are trojan or generic labels, and Microsoft names it Kepavll. The file is unsigned and has no listing in reference databases. The combined sandbox verdict across three runs was clean, with no injection targets and no network activity of its own. This points to an unwanted cheat tool rather than confirmed malware, but the risk is real.
What We Detected
23 of the 63 antivirus engines that checked it flagged this unsigned 64-bit DLL, first seen on Jul 20, 2026. Seven major antivirus engines are among them. ESET and Fortinet label it a game hack or riskware, Symantec and Trend Micro use Gamehack trojan labels, and Microsoft reports Trojan:Win32/Kepavll.
Threat Behavior
The combined sandbox verdict across three runs was clean. No high-risk techniques, process injection or network contacts of its own were recorded. No complete host-reputation result is available.
What To Do Now
Do not load this DLL. Game cheats can breach game terms of service and are a common way to deliver malware. If you have already run it, scan your system with your security software and keep your protection enabled.
Where this verdict could be wrong2 caveats
- The combined sandbox verdict was clean and no high-risk techniques or injection targets were recorded, though a cheat DLL may only act inside its target game.
- Several engines use trojan labels and Microsoft names Kepavll, so a more harmful payload hidden in a cheat cannot be excluded.
These are the assessment's weak points. If you believe one applies to your file, report the verdict and we'll re-review it.
- The sandbox runs returned a clean combined verdict
- No injection targets or network activity of its own were recorded
- No listings in public malware databases or community malware rules
- Seven major antivirus engines flag the file
- Labels describe a game-hacking tool, with some trojan labels including Microsoft's
- The DLL is unsigned, so its author cannot be identified
- Our antivirus analysis could not inspect the file's contents beyond the engine scans
6 sources checked · 5 complete · 1 not needed or not applicable. See every source
Chapter 03
What it did in our test
It ran in 3 isolated tests; no test environment rated what it did as risky.
Test run summary
Capture complete- 3isolated sandbox runs
- 7sandbox rule tags
- 4spawned processes
- 0network contacts
- 1filesystem & mutex artifacts
What the test run showed
What the file did on a test computer
Confirmed in the test run
Moderate concern: Contains packed or scrambled code that is harder to inspect (common in installers too).
Note: Read the user name of the test computer.
Note: Read basic details of the test computer, such as its Windows version.
Sandbox labels we could not confirm (common in safe files too)
Not confirmed: A sandbox rule tagged this run as contacting a server, but no contacted host was recorded.
Not confirmed: A sandbox rule tagged this run as changing how Windows loads code; nothing confirms it.
This file was run on a test computer (a sandbox), not on yours. Labels we could not confirm are listed so you can see them, but they are not treated as evidence against the file.
Recorded behavior
What happened in the test
Grouped by step. The order is not a timeline.
- 1
Input file
The submitted object
- Evidence 1 of 4: FileSeen in the test run
Solstice 26.3X.dll
53154d375be24ef7766663a29ed69272c33762ad7f9cdfda53129c8cec738a23
Uploaded file
- 2
Processes
What ran
- Evidence 2 of 4: ProcessSeen in the test run
rundll32.exe
"C:\Windows\sysnative\rundll32.exe" "C:\Users\<USER>\Desktop\Solstice.dll",#1
Test run - Evidence 3 of 4: ProcessSeen in the test run
loaddll64.exe
C:\Windows\System32\loaddll64.exe loaddll64.exe "C:\Users\user\Desktop\Solstice.dll"
Test run - +1 more recorded observation
- 1
Files
Created or changed
- Evidence 4 of 4: Written fileSeen in the test run
Connect
\Device\ConDrv\\Connect
Test run
4 facts from the test run. See the full activity list.
What this file did when executed
This file was detonated in 3 sandboxes and its runtime behaviour was observed.
Sandbox verdicts
1- VT: CLEANclean
Techniques observed in the sandbox
7MITRE ATT&CK techniques the sandbox mapped. Highlighted ones are rare in normal software; the others are common in legitimate programs too.
- T1027· Obfuscated code
- T1027.002· Obfuscated code
- T1033· Reads user info
- T1071· Application protocol
- T1082· System recon
- T1218.011
- T1574· Execution hijack
Observed activity
Processes started
4Programs the file ran, with their command lines.
rundll32.exe"C:\Windows\sysnative\rundll32.exe" "C:\Users\<USER>\Desktop\Solstice.dll",#1loaddll64.exeC:\Windows\System32\loaddll64.exe loaddll64.exe "C:\Users\user\Desktop\Solstice.dll"cmd.exeC:\Windows\System32\cmd.exe cmd.exe /C rundll32.exe "C:\Users\user\Desktop\Solstice.dll",#1rundll32.exeC:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\Solstice.dll",#1
Files
1Files the file created, changed or deleted.
- Written
\Device\ConDrv\\Connect
Sandbox background — not the file
2The analysis machine's own processes and connections, recorded in every run.
- VM process
conhost.exeC:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 - VM host
162.159.36.2
Chapter 04
Technical details
23 of the 63 antivirus engines that checked it flag it; no publisher signature.
Sources checked
Every check behind this verdict
6 sources checked · 5 complete · 1 not needed or not applicable. Complete means the check returned a usable result; it does not mean the file is safe.
Engines that flagged it 23
- ESET-NOD32 (major engine)Win32/GameHack.FZV potentially unsafe application
- Fortinet (major engine)Riskware/GameHack
- Microsoft (major engine)Trojan:Win32/Kepavll!rfn
- Sophos (major engine)Mal/Generic-S
- Symantec (major engine)Trojan.Gamehack!ATN
- TrellixENS (major engine)Artemis!164A0ED1F188
- TrendMicro-HouseCall (major engine)Trojan.Win64.GAMEHACK.USBLGR26
- BkavW32.Malware.99279CE
File fingerprint
- Last analyzed
- Oct 27, 2026, 5:00 PM UTC
- SHA-256
53154d375be24ef7766663a29ed69272c33762ad7f9cdfda53129c8cec738a23- SHA-1
7333adb7d47d64796ff421cbc80c0d6285af429b- MD5
164a0ed1f188fa4a41122b56ab55d44e
About this file
Solstice 26.3X.dll is a Win32 DLL file of 19.5 MB.
- Type and size
- Win32 DLL · 19.5 MB
- Signer
- UnsignedNo code signature.
- First seen
- Jul 20, 2026On VirusTotal.
- Submitted by
- 445 distinct sources
- Packer
- None detected
- Entropy
- 6.60 of 8
First scanned
Antivirus consensus
23 of 63 engines flagged this file
11 of the 74 engines returned no result for this file (file type not supported, or the scan did not finish), so they did not check it.
The 23 detections come from 20 independent scan engines: several vendors license the same engine, so their results are one vote.
- Tier-113 engines7flagged
- Tier-234 engines10flagged11 vendors sharing 10 engines
- Low-trust16 engines5flagged
View all 74 engine results
- BkavMalicious: W32.Malware.99279CE
- CylanceMalicious: Unsafe
- CynetMalicious: Malicious (score: 100)
- DeepInstinctMalicious: MALICIOUS
- ESET-NOD32Malicious: Win32/GameHack.FZV potentially unsafe application
- FortinetMalicious: Riskware/GameHack
- GoogleMalicious: Detected
- GridinsoftMalicious: Trojan.Win64.Wacatac.cl
- K7AntiVirusMalicious: Unwanted-Program ( 006e106f1 )
- K7GWMalicious: Unwanted-Program ( 006e106f1 )
- KingsoftMalicious: Win32.Troj.kepavll.v
- LionicMalicious: Trojan.Win32.GameHack.4!c
- MalwarebytesMalicious: RiskWare.GameHack
- McAfeeDMalicious: ti!53154D375BE2
- MicrosoftMalicious: Trojan:Win32/Kepavll!rfn
- PaloaltoMalicious: generic.ml
- PandaMalicious: Trj/PhxIK.A
- SkyhighMalicious: Artemis
- SophosMalicious: Mal/Generic-S
- SymantecMalicious: Trojan.Gamehack!ATN
- TrellixENSMalicious: Artemis!164A0ED1F188
- TrendMicro-HouseCallMalicious: Trojan.Win64.GAMEHACK.USBLGR26
- VaristMalicious: W64/ABApplication.AMSV-1852
- AcronisClean
- AhnLab-V3Clean
- AlibabaClean
- alibabacloudClean
- ALYacClean
- Antiy-AVLClean
- APEXClean
- ArcabitClean
- AvastNo result
- Avast-MobileNo result
- AVGNo result
- AviraClean
- BitDefenderNo result
- BitDefenderFalxNo result
- CAT-QuickHealClean
- ClamAVClean
- CMCClean
- CrowdStrikeClean
- CTXNo result
- DrWebClean
- ElasticClean
- EmsisoftClean
- F-SecureClean
- GDataClean
- huorongClean
- IkarusClean
- JiangminClean
- KasperskyNo result
- MaxSecureClean
- MicroWorld-eScanClean
- NANO-AntivirusClean
- RisingClean
- SangforClean
- SentinelOneClean
- SUPERAntiSpywareClean
- SymantecMobileInsightNo result
- TACHYONClean
- tehtrisNo result
- TencentClean
- TrendMicroNo result
- TrustlookNo result
- VBA32Clean
- VIPREClean
- VirITClean
- ViRobotClean
- WebrootClean
- XcitiumClean
- YandexClean
- ZillyaClean
- ZoneAlarmClean
- ZonerClean
Section entropy & packers
No high-entropy executable section or known packer signature was detected. Data and resource sections can still have high entropy without indicating packed code.
How widely this file has been seen
Widely uploaded, but first seen within the last six months. No strong prior applies.
Chapter 05
Questions & answers
Short answers to the 6 questions people ask most about this file.
Is Solstice 26.3X.dll safe, or is it malware?
What is Solstice 26.3X.dll?
How many antivirus engines detected Solstice 26.3X.dll?
What should I do if I already used Solstice 26.3X.dll?
What is the SHA-256 hash of Solstice 26.3X.dll?
How up to date is this analysis of Solstice 26.3X.dll?
Community
Member reviews and reports for this exact file hash.