File scan report
Verdict Safe
Is Whisper.
Only 1 of the 71 antivirus engines that checked it flagged this widely submitted DLL, while major antivirus engines, sandbox observations, host reputation, and external…
Read the whole reasonShow less
Strong evidence · Widely seen for a long time, and nothing harmful found.
Good practice2 tips
We found nothing harmful in this file.
Use it only as part of a program you got from the developer's own website.
Keep your antivirus and Windows updates switched on.
No scanner can promise a file is 100% safe.
Antivirus results
1 of 71 flagged
- Flagged 1
- No detection 70
- No result 4
- Code signing Unsigned
- Test run Completed
- First seen 3y ago
Chapter 02
Why we think so
4 points against it and 5 in its favour, checked against the scan evidence.
The reasoning behind this verdict
Cynet was the only engine among 75 to flag the DLL, and none of the major antivirus engines detected it. Its long-established prevalence, non-malicious sandbox results, and completed reputation check for the sole contacted IP make that isolated alert highly likely to be a false positive.
Only 1 of the 71 antivirus engines that checked it flagged the file, and that alert came from Cynet without a named malware family. All 18 major antivirus engines that reported results produced no detection. The file has been submitted by 424 distinct sources over more than three years, yet broader detection consensus has not developed. Four sandbox runs returned no malicious verdict, identified no high-risk techniques or injection targets, and the sole contacted IP had no malicious or suspicious reputation record. The DLL is unsigned and uses anti-analysis-related features, but those weaker concerns are not corroborated by malware-specific rules, public sample-database listings, malicious files it created, or hostile evidence from the test run.
What We Detected
Only Cynet flagged the DLL, amounting to 1 of the 71 antivirus engines that checked it. The alert did not identify a specific malware family, while all 18 reporting major antivirus engines produced no detection. The file is also well established, with 424 distinct submitters and 489 submissions over more than three years.
Threat Behavior
Four sandbox runs produced no malicious verdict and showed no high-risk techniques, named injection targets, or persistence indicators. The DLL contacted one external IP directly; the completed reputation check covering that contact found no malicious or suspicious record. Anti-debugging and delayed-execution characteristics were noted, but these features can occur in protected or diagnostic software and were not backed by stronger hostile activity.
What To Do Now
No removal action is indicated by the available evidence. Keep security software enabled and, if the DLL arrived unexpectedly or from an untrusted source, verify its origin before loading it into an application.
Where this verdict could be wrong3 caveats
- Cynet assigned a malicious score, although no other engine corroborated it.
- The unsigned DLL contacted one external IP directly, but the completed reputation check found no malicious or suspicious record for that address.
- The file carries anti-debugging and long-sleep tags; these can impede analysis but were not accompanied by high-risk evidence from the test run.
These are the assessment's weak points. If you believe one applies to your file, report the verdict and we'll re-review it.
- All 18 reporting major antivirus engines produced no detection.
- The file has mature prevalence across 424 distinct submitters and 489 submissions.
- Four sandbox runs returned no malicious verdict and showed no high-risk techniques or process injection.
- The sole observed external IP had no malicious or suspicious reputation record.
- No malware-specific community rules, public malware-sample listing, malicious child, packing, or brand mismatch was found.
- The DLL is unsigned, so its publisher cannot be authenticated.
- Cynet reported a generic malicious result.
- The file includes anti-debugging and delayed-execution characteristics.
- It made a direct connection to an external IP rather than an application domain.
6 sources checked · all complete. See every source
Chapter 03
What it did in our test
It ran in 4 isolated tests; no test environment rated what it did as risky.
Test run summary
Capture complete- 4isolated sandbox runs
- 11sandbox rule tags
- 0spawned processes
- 1network contact
- 39filesystem & mutex artifacts
What this file did when executed
This file was detonated in 4 sandboxes and its runtime behaviour was observed.
Sandbox verdicts
1- VT: CLEANclean
Techniques observed in the sandbox
11MITRE ATT&CK techniques the sandbox mapped. Highlighted ones are rare in normal software; the others are common in legitimate programs too.
- T1027· Obfuscated code
- T1036
- T1056.001· Keylogging
- T1071· Application protocol
- T1071.001· Application protocol
- T1082· System recon
- T1083· Scans your files
- T1129· Loads modules
- T1218.011
- T1497· Sandbox evasion
- T1518.001· Checks your AV
Observed activity
Network contacts
11 host, listed as 1 address. Links show the host and path only.
- IP address
209.197.3.8
Files
30Files the file created, changed or deleted.
- Written
C:\ProgramData\Microsoft\Windows\WER\Temp\WER86E.tmp - Written
C:\ProgramData\Microsoft\Windows\WER\Temp\WER86E.tmp.dmp - Written
C:\ProgramData\Microsoft\Windows\WER\Temp\WER998.tmp - Written
C:\ProgramData\Microsoft\Windows\WER\Temp\WER998.tmp.WERInternalMetadata.xml - Written
C:\ProgramData\Microsoft\Windows\WER\Temp\WERA06.tmp - Written
C:\ProgramData\Microsoft\Windows\WER\Temp\WERA06.tmp.xml
Show all 30 entries for files
- Written
C:\ProgramData\Microsoft\Windows\WER\Temp\WERF12D.tmp - Written
C:\ProgramData\Microsoft\Windows\WER\Temp\WERF12D.tmp.dmp - Written
C:\ProgramData\Microsoft\Windows\WER\Temp\WERF13D.tmp - Written
C:\ProgramData\Microsoft\Windows\WER\Temp\WERF13D.tmp.dmp - Written
C:\ProgramData\Microsoft\Windows\WER\Temp\WERF286.tmp - Written
C:\ProgramData\Microsoft\Windows\WER\Temp\WERF286.tmp.WERInternalMetadata.xml - Written
C:\ProgramData\Microsoft\Windows\WER\Temp\WERF295.tmp - Written
C:\ProgramData\Microsoft\Windows\WER\Temp\WERF295.tmp.WERInternalMetadata.xml - Written
C:\ProgramData\Microsoft\Windows\WER\Temp\WERF323.tmp - Deleted
C:\ProgramData\Microsoft\Windows\WER\Temp\WER86E.tmp - Deleted
C:\ProgramData\Microsoft\Windows\WER\Temp\WER86E.tmp.dmp - Deleted
C:\ProgramData\Microsoft\Windows\WER\Temp\WER998.tmp - Deleted
C:\ProgramData\Microsoft\Windows\WER\Temp\WER998.tmp.WERInternalMetadata.xml - Deleted
C:\ProgramData\Microsoft\Windows\WER\Temp\WERA06.tmp - Deleted
C:\ProgramData\Microsoft\Windows\WER\Temp\WERA06.tmp.xml - Deleted
C:\ProgramData\Microsoft\Windows\WER\Temp\WERC1A4.tmp.csv - Deleted
C:\ProgramData\Microsoft\Windows\WER\Temp\WERC1B4.tmp.csv - Deleted
C:\ProgramData\Microsoft\Windows\WER\Temp\WERC1D4.tmp.txt - Deleted
C:\ProgramData\Microsoft\Windows\WER\Temp\WERC1D5.tmp.txt - Deleted
C:\ProgramData\Microsoft\Windows\WER\Temp\WERCC66.tmp.csv - Deleted
C:\ProgramData\Microsoft\Windows\WER\Temp\WERCC86.tmp.txt - Deleted
C:\ProgramData\Microsoft\Windows\WER\Temp\WERD88D.tmp.csv - Deleted
C:\ProgramData\Microsoft\Windows\WER\Temp\WERD8AD.tmp.txt - Deleted
C:\ProgramData\Microsoft\Windows\WER\Temp\WERF12D.tmp
Registry and auto-start
15Settings the file changed, including ways to start again after a restart.
- Set
HKU\S-1-5-21-575823232-3065301323-1442773979-1000\Software\Microsoft\SystemCertificates\Root\Certificates\0174E68C97DDF1E0EEEA415EA336A163D2B61AFD\Blob - Set
HKU\S-1-5-21-575823232-3065301323-1442773979-1000\Software\Microsoft\Windows\Windows Error Reporting\Debug\StoreLocation - Set
HKEY_USERS\S-1-5-21-575823232-3065301323-1442773979-1000\Software\Microsoft\SystemCertificates\Root\Certificates\0174E68C97DDF1E0EEEA415EA336A163D2B61AFD\Blob - Set
HKEY_USERS\S-1-5-21-575823232-3065301323-1442773979-1000\Software\Microsoft\Windows\Windows Error Reporting\Debug\StoreLocation - Set
\REGISTRY\A\{f2ba902c-70ed-ae86-cc98-68fa7e2e09c9}\Root\InventoryApplicationFile\PermissionsCheckTestKey - Set
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\{11517B7C-E79D-4e20-961B-75A811715ADD}
Show all 15 entries for registry and auto-start
- Set
\REGISTRY\A\{9fb1abf9-b130-cf86-19ef-23d01e75510c}\Root - Set
\REGISTRY\A\{9fb1abf9-b130-cf86-19ef-23d01e75510c}\Root\InventoryApplicationFile - Set
\REGISTRY\A\{9fb1abf9-b130-cf86-19ef-23d01e75510c}\Root\InventoryApplicationFile\rundll32.exe|c8d854bf61fafc41 - Set
\REGISTRY\A\{9fb1abf9-b130-cf86-19ef-23d01e75510c}\Root\InventoryApplicationFile\PermissionsCheckTestKey - Set
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\Windows Error Reporting\Debug - Set
\REGISTRY\A\{881f3c1f-c417-b284-088c-17050fe2377a}\Root\InventoryApplicationFile\PermissionsCheckTestKey - Set
\REGISTRY\A\{bca41fb4-5fab-c177-29d7-8a31e62761f3}\Root\InventoryApplicationFile\PermissionsCheckTestKey - Set
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\AmiHivePermissionsCorrect - Set
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\AmiHiveOwnerCorrect
Mutexes
9Named locks a program uses so only one copy runs; malware families often reuse them.
\Sessions\1\BaseNamedObjects\Local\WERReportingForProcess8012\Sessions\1\BaseNamedObjects\Global\AmiProviderMutex_InventoryApplicationFile\Sessions\1\BaseNamedObjects\Global\382fa8f4-c098-4273-88d9-e1dd3f9b2417\Sessions\1\BaseNamedObjects\Local\WERReportingForProcess8024\Sessions\1\BaseNamedObjects\Global\c08d3e0a-f7f5-4d47-94e3-49742c1b5082\Sessions\1\BaseNamedObjects\Local\WERReportingForProcess4792
Show all 9 entries for mutexes
\Sessions\1\BaseNamedObjects\Global\73889b3a-ed58-45e6-b3cd-50479df29ae6\Sessions\1\BaseNamedObjects\Local\WERReportingForProcess1612\Sessions\1\BaseNamedObjects\Global\6685985a-0346-45f1-b172-88f07f7b624f
Files this sample writes at runtime
This file drops 10 children at runtime. None are currently flagged malicious in our cache. 10 have no saved verdict and were not checked; that is missing coverage, not a finding.
- 1351cc259ffe912d2b5b…b5379dNot checkedno saved verdict
- 691124b7ff4747484e28…3a7a1fNot checkedno saved verdict
- d31dc5710b3b950b9339…9a7917Not checkedno saved verdict
- b407304e7c37382d1110…a356f8Not checkedno saved verdict
- 029cd33f3014fd71cb96…6b6499Not checkedno saved verdict
- f5f6a43c1ecbbcbfa21a…39364dNot checkedno saved verdict
- 2bd6ecf0c20e405d81fa…1d4f30Not checkedno saved verdict
- 380699a532935c0c8808…5bb6d7Not checkedno saved verdict
- 03740484dc7a04d83a01…010e60Not checkedno saved verdict
- 5cbe6c83ef3ac49b1157…cb976fNot checkedno saved verdict
Chapter 04
Technical details
1 of the 71 antivirus engines that checked it flags it; no publisher signature.
Sources checked
Every check behind this verdict
6 sources checked · all complete. Complete means the check returned a usable result; it does not mean the file is safe.
Engines that flagged it 1
The saved verdict treats these detections as likely false positives.
- CynetMalicious (score: 100)
File fingerprint
- Last analyzed
- Oct 21, 2026, 1:44 PM UTC
- SHA-256
41de3af338d54ab09a85f6e94a688b1b2a18f486188b10cd16157ac47897f1be- SHA-1
bfae6a9e11905f8e92d9ff061321a4f8705cc572- MD5
34d06f51c5f919576f696fcf494f83ab
About this file
Whisper.dll says it is DirectCompute port of whisper.cpp library, 576.5 kB.
- Claims to be
- DirectCompute port of whisper.cpp libraryFrom the file's own version information, written by whoever built it.
- Original name
- Whisper.dllMatches the shared file name.
- Type and size
- Win32 DLL · 576.5 kB
- Signer
- UnsignedNo code signature.
- First seen
- Jul 23, 2023On VirusTotal.
- Submitted by
- 424 distinct sources
- Packer
- None detected
- Entropy
- 6.18 of 8
First scanned
Antivirus consensus
1 of 71 engines flagged this file
4 of the 75 engines returned no result for this file (file type not supported, or the scan did not finish), so they did not check it.
- Tier-118 engines0flagged
- Tier-236 engines0flagged
- Low-trust17 engines1flagged
View all 75 engine results
- CynetMalicious: Malicious (score: 100)
- AcronisClean
- AhnLab-V3Clean
- AlibabaClean
- alibabacloudClean
- ALYacClean
- Antiy-AVLClean
- APEXClean
- ArcabitClean
- AvastClean
- Avast-MobileNo result
- AVGClean
- AviraClean
- BitDefenderClean
- BitDefenderFalxNo result
- BkavClean
- CAT-QuickHealClean
- ClamAVClean
- CMCClean
- CrowdStrikeClean
- CTXClean
- CylanceClean
- DeepInstinctClean
- DrWebClean
- ElasticClean
- EmsisoftClean
- ESET-NOD32Clean
- F-SecureClean
- FortinetClean
- GDataClean
- GoogleClean
- GridinsoftClean
- huorongClean
- IkarusClean
- JiangminClean
- K7AntiVirusClean
- K7GWClean
- KasperskyClean
- KingsoftClean
- LionicClean
- MalwarebytesClean
- MaxSecureClean
- McAfeeDClean
- MicrosoftClean
- MicroWorld-eScanClean
- NANO-AntivirusClean
- PaloaltoClean
- PandaClean
- RisingClean
- SangforClean
- SentinelOneClean
- SkyhighClean
- SophosClean
- SUPERAntiSpywareClean
- SymantecClean
- SymantecMobileInsightNo result
- TACHYONClean
- tehtrisClean
- TencentClean
- TrapmineClean
- TrellixENSClean
- TrendMicroClean
- TrendMicro-HouseCallClean
- TrustlookNo result
- VaristClean
- VBA32Clean
- VIPREClean
- VirITClean
- ViRobotClean
- WebrootClean
- XcitiumClean
- YandexClean
- ZillyaClean
- ZoneAlarmClean
- ZonerClean
Section entropy & packers
No high-entropy executable section or known packer signature was detected. Data and resource sections can still have high entropy without indicating packed code.
How widely this file has been seen
Widely seen in the wild for a long time. High prior this is legitimate; isolated detections on common-old files are usually false positives.
Chapter 05
Questions & answers
Short answers to the 6 questions people ask most about this file.
Is Whisper.dll safe?
What is Whisper.dll?
How many antivirus engines detected Whisper.dll?
What is the SHA-256 hash of Whisper.dll?
Is it safe to use Whisper.dll?
How up to date is this analysis of Whisper.dll?
Community
Member reviews and reports for this exact file hash.