ABRSubProcess.exe (ACCA Software-signed) sideloading oversized borlndmm.dll (OnyxC2)

Duo Tech@duotech

•updated Aug 14, 2026•3•0•5

Detects DLL sideloading of a malicious, AES-256-encrypted borlndmm.dll masquerading as an NVIDIA graphics library, loaded via the legitimate ACCA Software S.p.A.-signed ABRSubProcess.exe to launch OnyxC2.