DDACLSys.dll
SysPrep module for Resetting Data Drive ACL file version info
Library on Windows 2 known copies with hashes
Is it the real DDACLSys.dll?
Installed in
C:\Windows\system32\C:\Windows\SysWOW64\Signed byMicrosoft Windows
ProductMicrosoft Windows Operating System, Microsoft Corporation
DescriptionSysPrep module for Resetting Data Drive ACL
2 known copies
10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\SysWOW64\DDACLSys.dll · signed by Microsoft Windows
e6bf727713558ddf11a536ba45ce22530c5c09e5d784471345657aa13fd1a0f910.0.19041.1 (WinBuild.160101.0800) · C:\Windows\system32\DDACLSys.dll · signed by Microsoft Windows
fd323f73a4d4efb6c459fc772a0327ca5ed0b52cbff1a8ac50314d3215743558From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.