File scan report

Verdict Safe

Analyzed Oct 20, 20265 days ago

Is NoHesiLauncher-Setup.exe safe? Yes, no threats found.

None of the 68 antivirus engines that checked it flagged this validly signed Inno Setup installer for the NoHesi launcher, and sandbox runs showed ordinary installer and launcher…

Read the whole reasonShow less

Strong evidence · A verified publisher signature, and no engine flags it.

Install it as usual if it came from the official source

Install only if you obtained it from the official NoHesi site, and keep your antivirus enabled.

Good practice2 tips

We found nothing harmful in this file.

Install it only if it came from the developer's own website or an official app store.
Keep your antivirus and Windows updates switched on.

No scanner can promise a file is 100% safe.

Why we think so

Antivirus results

0 of 68 flagged

Flagged 0
No detection 68
No result 7

FileNoHesiLauncher-Setup.exe103.1 MBSHA-256 48b493be76ba…9b7a3c

Code signing No Hesi LLC
Test run Completed
First seen 6d ago

It has a valid digital signature from No Hesi LLC.

Chapter 02

Why we think so

2 points against it and 4 in its favour, checked against the scan evidence.

Analyst conclusion

None of the 68 antivirus engines that checked it flagged this installer, and it carries a valid signature from No Hesi LLC. Three sandbox runs showed a normal install and launcher start, with network contact only to the project's own domains. The signer is new to us, so reputation is still developing.

Where this verdict could be wrong2 caveats

The file was first seen on Oct 19, 2026, has 7 submitters and its signer has no history, so reputation is not yet established.
The .NET Reactor protector flag could hide content, though protectors are also common in legitimate launchers.

These are the assessment's weak points. If you believe one applies to your file, report the verdict and we'll re-review it.

6 sources checked · all complete. See every source

Chapter 03

What it did in our test

It ran in 3 isolated tests; no test environment rated what it did as risky.

Test run summary

Capture complete

3isolated sandbox runs
27sandbox rule tags
8spawned processes
11network contacts
36filesystem & mutex artifacts

Runtime behaviour

What this file did when executed

This file was detonated in 3 sandboxes and its runtime behaviour was observed.

1 clean detonation

Sandbox verdicts

VT: CLEANclean

Techniques observed in the sandbox

MITRE ATT&CK techniques the sandbox mapped. Highlighted ones are rare in normal software; the others are common in legitimate programs too.

T1012
T1027· Obfuscated code
T1033· Reads user info
T1047
T1055· Process injection
T1057· Lists programs
T1059· Runs commands
T1069
T1070· Covers its tracks
T1071· Application protocol
T1074
T1082· System recon
T1083· Scans your files
T1105· Network file transfer
T1106
T1112
T1129· Loads modules
T1485
T1486· File encryption
T1497· Sandbox evasion
T1547· Auto-start
T1547.001· Auto-start
T1562· Disables security
T1562.001· Disables security
T1564· Hides artifacts
T1564.003· Hides artifacts
T1574· Execution hijack

Observed activity

Processes started

Programs the file ran, with their command lines.

msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.92\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=NoHesiLauncher.exe --webview-exe-version=1.0.8+24c32648c0956828571bd1db81082cb1bc4b84d2 --user-data-dir="C:\Users\<USER>\AppData\Local\NoHesiLauncher\WebView2\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --disable-features=IsolateOrigins,site-per-process --disable-site-isolation-trials --enable-features=MojoIpcz --mojo-named-platform-channel-pipe=68.844.11437230368541729172
msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.92\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\<USER>\AppData\Local\NoHesiLauncher\WebView2\EBWebView /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\<USER>\AppData\Local\NoHesiLauncher\WebView2\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.129 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.92\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge Web…
NoHesiLauncher-Setup.exe"C:\Users\<USER>\Desktop\NoHesiLauncher-Setup.exe"
NoHesiLauncher-Setup.tmp"C:\Users\<USER>\AppData\Local\Temp\is-O2CUXNO1JI.tmp\NoHesiLauncher-Setup.tmp" /SL5="$400EE,101852373,851968,C:\Users\<USER>\Desktop\NoHesiLauncher-Setup.exe"
NoHesiLauncher.exe"C:\Users\<USER>\AppData\Local\NoHesi Launcher\NoHesiLauncher.exe"
NoHesiLauncher-Setup.exeC:\Users\<USER>\AppData\Local\Temp\is-PG3AGZJ3UB.tmp\NoHesiLauncher-Setup.tmp /SL5=$50166,101852373,851968,C:\Users\<USER>\Downloads\NoHesiLauncher-Setup.exe

Show all 8 entries

NoHesiLauncher-Setup.exe"C:\Users\user\Desktop\NoHesiLauncher-Setup.exe"
NoHesiLauncher-Setup.tmp"C:\Users\user\AppData\Local\Temp\is-H2QBS1JHHM.tmp\NoHesiLauncher-Setup.tmp" /SL5="$1048A,101852373,851968,C:\Users\user\Desktop\NoHesiLauncher-Setup.exe"

Network contacts

11 hosts, listed as 5 domains, 6 addresses, 4 links. Links show the host and path only.

Domaing-1477cfbb3f344becbecc694e4eeb5b35.launcher-support.nohesi.gg
Domainahub.nohesi.gg
Domainleaderboard-06nkmjf5r0.nohesi.gg
Domainblog.nohesi.gg
Domaincdn.nohesi.gg
IP address13.226.251.23

Show all 15 entries

IP address172.67.172.254
IP address104.21.96.43
IP address51.102.65.87
IP address142.251.184.95
IP address74.125.69.94
URLhttps://leaderboard-06nkmjf5r0.nohesi.gg/ranks/thresholds
URLhttps://leaderboard-06nkmjf5r0.nohesi.gg/scores/maps/shuto_revival_project_beta
URLhttps://ahub.nohesi.gg/servers-api/servers
URLhttps://blog.nohesi.gg/api/blogs

Files

Files the file created, changed or deleted.

WrittenC:\Users\<USER>\AppData\Local\NoHesiLauncher\WebView2\EBWebView\Crashpad\throttle_store.dat
WrittenC:\Users\<USER>\AppData\Local\NoHesiLauncher\WebView2\EBWebView\Crashpad\settings.dat
WrittenC:\Users\<USER>\AppData\Local\NoHesiLauncher\WebView2\EBWebView\BrowserMetrics\BrowserMetrics-6AD66FB9-6AC.pma
WrittenC:\Users\<USER>\AppData\Local\NoHesiLauncher\WebView2\EBWebView\lockfile
WrittenC:\Users\<USER>\AppData\Local\NoHesiLauncher\WebView2\EBWebView\Variations
WrittenC:\Users\<USER>\AppData\Local\NoHesiLauncher\WebView2\EBWebView\8608ac46-561d-433d-8e97-36d77e7672ab.tmp

Show all 30 entries

WrittenC:\Users\<USER>\AppData\Local\NoHesiLauncher\WebView2\EBWebView\Local State
WrittenC:\Users\<USER>\AppData\Local\NoHesiLauncher\WebView2\EBWebView\ShaderCache\index
WrittenC:\Users\<USER>\AppData\Local\NoHesiLauncher\WebView2\EBWebView\ShaderCache\data_0
WrittenC:\Users\<USER>\AppData\Local\NoHesiLauncher\WebView2\EBWebView\ShaderCache\data_1
WrittenC:\Users\<USER>\AppData\Local\NoHesiLauncher\WebView2\EBWebView\ShaderCache\data_2
WrittenC:\Users\<USER>\AppData\Local\NoHesiLauncher\WebView2\EBWebView\ShaderCache\data_3
WrittenC:\Users\<USER>\AppData\Local\NoHesiLauncher\WebView2\EBWebView\Last Version
WrittenC:\Users\<USER>\AppData\Local\NoHesiLauncher\WebView2\EBWebView\Default\README
WrittenC:\Users\<USER>\AppData\Local\NoHesiLauncher\WebView2\EBWebView\Default\History
DeletedC:\Users\<USER>\AppData\Local\NoHesiLauncher\WebView2\EBWebView\BrowserMetrics-spare.pma
DeletedC:\Users\<USER>\AppData\Local\NoHesiLauncher\WebView2\EBWebView\8608ac46-561d-433d-8e97-36d77e7672ab.tmp
DeletedC:\Users\<USER>\AppData\Local\NoHesiLauncher\WebView2\EBWebView\Default\Code Cache\wasm\index-dir\the-real-index
DeletedC:\Users\<USER>\AppData\Local\NoHesiLauncher\WebView2\EBWebView\Default\Code Cache\js\index-dir\the-real-index
DeletedC:\Users\<USER>\AppData\Local\NoHesiLauncher\WebView2\EBWebView\Default\Code Cache\wasm\index-dir\temp-index
DeletedC:\Users\<USER>\AppData\Local\NoHesiLauncher\WebView2\EBWebView\Default\Code Cache\js\index-dir\temp-index
DeletedC:\Users\<USER>\AppData\Local\NoHesiLauncher\WebView2\EBWebView\Default\Sync Data\LevelDB\000001.dbtmp
DeletedC:\Users\<USER>\AppData\Local\NoHesiLauncher\WebView2\EBWebView\Default\Site Characteristics Database\000001.dbtmp
DeletedC:\Users\<USER>\AppData\Local\NoHesiLauncher\WebView2\EBWebView\Default\Extension Rules\000001.dbtmp
DeletedC:\Users\<USER>\AppData\Local\NoHesiLauncher\WebView2\EBWebView\Default\Extension Scripts\000001.dbtmp
DeletedC:\Users\<USER>\AppData\Local\NoHesiLauncher\WebView2\EBWebView\Local State~RF316e4.TMP
DeletedC:\Users\<USER>\AppData\Local\NoHesiLauncher\WebView2\EBWebView\Default\shared_proto_db\metadata\000001.dbtmp
DeletedC:\Users\<USER>\AppData\Local\NoHesiLauncher\WebView2\EBWebView\Default\shared_proto_db\000001.dbtmp
DeletedC:\Users\<USER>\AppData\Local\NoHesiLauncher\WebView2\EBWebView\Local State~RF31adc.TMP
DeletedC:\Users\<USER>\AppData\Local\NoHesiLauncher\WebView2\EBWebView\Default\Extension State\000001.dbtmp

Registry and auto-start

Settings the file changed, including ways to start again after a restart.

SetHKEY_CURRENT_USER\SOFTWARE\Microsoft\EdgeUpdate\ClientState\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}\dr
SetHKEY_CURRENT_USER\SOFTWARE\Microsoft\EdgeWebView\StabilityMetrics\user_experience_metrics.stability.exited_cleanly
SetHKEY_CURRENT_USER\SOFTWARE\Microsoft\EdgeWebView\UsageStatsInSample
SetHKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\EdgeUpdate\ClientStateMedium\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}\usagestats
SetHKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\EdgeUpdate\ClientStateMedium\{F3017226-FE2A-4295-8BDF-00C3A9A7E4C5}\urlstats
SetHKEY_CURRENT_USER\SOFTWARE\Microsoft\EdgeWebView\PreferenceMACs\Default\media.cdm.origin_data

Show all 21 entries

SetHKEY_CURRENT_USER\SOFTWARE\Microsoft\EdgeWebView\PreferenceMACs\Default\media.storage_id_salt
SetHKEY_CURRENT_USER\SOFTWARE\Microsoft\EdgeWebView\PreferenceMACs\Default\edge.services.account_id
SetHKEY_CURRENT_USER\SOFTWARE\Microsoft\EdgeWebView\PreferenceMACs\Default\edge.services.last_username
SetHKEY_CURRENT_USER\SOFTWARE\Microsoft\EdgeWebView\PreferenceMACs\Default\default_search_provider_data.template_url_data
SetHKEY_CURRENT_USER\SOFTWARE\Microsoft\EdgeWebView\PreferenceMACs\Default\safebrowsing.incidents_sent
SetHKEY_CURRENT_USER\SOFTWARE\Microsoft\EdgeWebView\PreferenceMACs\Default\pinned_tabs
SetHKEY_CURRENT_USER\SOFTWARE\Microsoft\EdgeWebView\PreferenceMACs\Default\search_provider_overrides
SetHKEY_CURRENT_USER\SOFTWARE\Microsoft\EdgeWebView\PreferenceMACs\Default\edge.services.last_account_id
SetHKEY_CURRENT_USER\SOFTWARE\Microsoft\EdgeWebView\PreferenceMACs\Default\session.startup_urls
DeletedHKEY_CURRENT_USER\SOFTWARE\Microsoft\EdgeWebView\PreferenceMACs\Default\extensions.settings
DeletedHKEY_CURRENT_USER\SOFTWARE\Microsoft\RestartManager\Session0000\RegFiles0000
DeletedHKEY_CURRENT_USER\SOFTWARE\Microsoft\RestartManager\Session0000\RegFilesHash
DeletedHKEY_CURRENT_USER\SOFTWARE\Microsoft\RestartManager\Session0000\SessionHash
DeletedHKEY_CURRENT_USER\SOFTWARE\Microsoft\RestartManager\Session0000\Sequence
DeletedHKEY_CURRENT_USER\SOFTWARE\Microsoft\RestartManager\Session0000\Owner

Mutexes

Named locks a program uses so only one copy runs; malware families often reuse them.

Local\ChromeProcessSingletonStartup!
__OMADM_NAMED_MUTEX__
cversions.3.m
NoHesiLauncher.SingleInstance.v1
DirectInput.{89521361-AA8A-11CF-BFC7-444553540000}
DirectInput.{5944E682-C92E-11CF-BFC7-444553540000}

Sandbox background — not the file

The analysis machine's own processes and connections, recorded in every run.

VM processservices.exeC:\Windows\system32\services.exe
VM processExplorer.EXEC:\Windows\Explorer.EXE
VM host224.0.0.251
VM host224.0.0.252

Dropped payload

Files this sample writes at runtime

This file drops 10 children at runtime. None are currently flagged malicious in our cache. 10 have no saved verdict and were not checked; that is missing coverage, not a finding.

10 not checked

773666084c8677031767…7b3ad9Not checked
no saved verdict
b059f68968554f4ec5cc…ba69d7Not checked
no saved verdict
b2e32a1374777eae0f7a…1bd34fNot checked
no saved verdict
451c354f4d16be367d75…e765bfNot checked
no saved verdict
c23cbbc5392aa22b2697…e38fc0Not checked
no saved verdict
bdea2d8e9bc629317117…3d0d0aNot checked
no saved verdict
7d295859b1132bd06102…3b217eNot checked
no saved verdict
1b34452bcc35e2e341e1…d887abNot checked
no saved verdict
2e4d6a76995f9cf2b466…d7177dNot checked
no saved verdict
f68df232302421d19cc0…535f0bNot checked
no saved verdict

Chapter 04

Technical details

None of the 68 antivirus engines that checked it flag it; signed by No Hesi LLC.

SourceStatusResultChecked

Antivirus enginesVirusTotal · 75 enginesComplete0 of 68 engines flagged it · 7 gave no result DetailsOct 19, 2026

Sandbox runVirusTotal sandboxes · CAPE Sandbox, VirusTotal Jujubox, ZenboxComplete3 runs: 1 clean, 2 without a verdict DetailsOct 20, 2026

Contacted hostsMalwareTips URL scannerComplete11 contacted hosts checked DetailsOct 20, 2026

Signature rulesYARAify community rules + MalwareTips rulesComplete1 MalwareTips behaviour rule DetailsOct 20, 2026

Malware sample databaseabuse.ch MalwareBazaarCompleteNot listedOct 20, 2026

Known-software referenceCIRCL hashlookupCompleteNo matchOct 20, 2026

File fingerprint

Last analyzed: Oct 20, 2026, 10:35 PM UTC

SHA-256: 48b493be76ba1d87508764274ead6fb2b60872ea2c0a70c8aa73eee70b9b7a3c
SHA-1: 5e806fc44e5783344c1c80f78e94d572b81f5bd0
MD5: 59315151ff5e6466a3699a1bfa261ae6

About this file

NoHesiLauncher-Setup.exe is a Win32 EXE file of 103.1 MB.

Claims to be: No Hesi Launcher Setup (No Hesi Launcher)From the file's own version information, written by whoever built it.
Type and size: Win32 EXE · 103.1 MB
Signer: No Hesi LLCValid code signature.
First seen: Oct 19, 2026On VirusTotal.
Submitted by: 7 distinct sourcesRarely seen: few people have submitted this exact file.
Packer: .NET Reactor 2.X-3.X (DetectItEasy protector)Packing hides code; legitimate installers use it too.
Entropy: 6.37 of 8

First scanned Oct 20, 2026

Antivirus consensus

0 of 68 engines flagged this file

0 malicious0 suspicious68 not flagged7 no result

7 of the 75 engines returned no result for this file (file type not supported, or the scan did not finish), so they did not check it.

Tier-118 engines
0flagged
Tier-234 engines
0flagged
Low-trust16 engines
0flagged

No antivirus engine flagged this file.

View all 75 engine results

AcronisClean
AhnLab-V3Clean
AlibabaClean
alibabacloudClean
ALYacClean
Antiy-AVLClean
APEXClean
ArcabitClean
AvastClean
Avast-MobileNo result
AVGClean
AviraClean
BitDefenderClean
BitDefenderFalxNo result
BkavClean
CAT-QuickHealClean
ClamAVClean
CMCClean
CrowdStrikeClean
CTXClean
CylanceClean
CynetNo result
DeepInstinctClean
DrWebClean
ElasticNo result
EmsisoftClean
ESET-NOD32Clean
F-SecureClean
FortinetClean
GDataClean
GoogleClean
GridinsoftClean
huorongClean
IkarusClean
JiangminClean
K7AntiVirusClean
K7GWClean
KasperskyClean
KingsoftClean
LionicClean
MalwarebytesClean
MaxSecureClean
McAfeeDClean
MicrosoftClean
MicroWorld-eScanClean
NANO-AntivirusClean
PaloaltoClean
PandaClean
RisingClean
SangforClean
SentinelOneClean
SkyhighClean
SophosClean
SUPERAntiSpywareClean
SymantecClean
SymantecMobileInsightNo result
TACHYONClean
tehtrisNo result
TencentClean
TrapmineClean
TrellixENSClean
TrendMicroClean
TrendMicro-HouseCallClean
TrustlookNo result
VaristClean
VBA32Clean
VIPREClean
VirITClean
ViRobotClean
WebrootClean
XcitiumClean
YandexClean
ZillyaClean
ZoneAlarmClean
ZonerClean

Rule-based evidence

Signatures and behavior heuristics

Low-severity pattern matches — worth noting but not on their own cause for alarm.

1 heuristic

MITRE ATT&CK profile

Defense evasion× 1

Behavior heuristics

Deterministic patterns derived from scan data and observed runtime behavior

ProcessInjection
T1055
low
VirusTotal's sandbox summary maps this run to MITRE T1055 (Process Injection), but no injected process of the sample's own was recorded (the analysis VM's own WMI adapter, crash handlers and Chrome updater are not counted). VirusTotal maps T1055 on about half of all files no engine flags, so the mapping alone is not evidence of injection.
Evidence
T1055 (sandbox MITRE mapping)

PE forensics

Section entropy & packers

A known packer signature (UPX / Themida / VMProtect / etc.) matched this file. Packers aren't malicious on their own, but most malware uses them.

ent 6.37Likely packed

Section entropy11 sections

.text

6.38

.itext

6.04

.data

5.18

.bss

0.00

.idata

4.82

.didata

2.76

.edata

1.34

.tls

0.00

.rdata

1.38

.reloc

6.70

.rsrc

6.63

0.0Packed threshold 7.28.0

Detected packers

.NET Reactor 2.X-3.X (DetectItEasy protector)

Packers compress or encrypt the executable and only unpack it at runtime. Legitimate commercial software uses them too — but if the file is also unsigned and rare, it's a strong malware signal.

Prevalence

How widely this file has been seen

Moderate prevalence — neither rare nor common. No strong prior applies.

Medium

Unique uploaders

Moderate upload volume.

Total submissions

Includes repeat uploads by the same source.

First seen

6d ago

Oct 19, 2026

Prevalence quadrant

Rare · New

Needs evidence-led scrutiny

Common · New

Just-released software

Rare · Old

Niche or internal tooling

Common · Old

Often established software

Chapter 05

Questions & answers

Short answers to the 7 questions people ask most about this file.

Is NoHesiLauncher-Setup.exe safe?

We found nothing harmful in NoHesiLauncher-Setup.exe. None of the 68 antivirus engines that checked it flag it. It has a valid digital signature from No Hesi LLC. Install it only if it came from the developer's own website or an official app store.

What is NoHesiLauncher-Setup.exe?

NoHesiLauncher-Setup.exe is a software installer, about 103.1 MB. Its version information says it is “No Hesi Launcher Setup” (No Hesi Launcher). The digital signature from No Hesi LLC checks out. VirusTotal first saw it on Oct 19, 2026.

How many antivirus engines detected NoHesiLauncher-Setup.exe?

None of the 68 antivirus engines that checked it flag NoHesiLauncher-Setup.exe. That is a good sign, but not proof, so we also weigh who made it, how widely it is used and what it did in a test run.

Is NoHesiLauncher-Setup.exe digitally signed?

Yes. NoHesiLauncher-Setup.exe has a valid digital signature from No Hesi LLC, which shows the file hasn't been changed since that publisher signed it. Malware is sometimes signed with stolen certificates, so a signature alone isn't proof of safety.

What is the SHA-256 hash of NoHesiLauncher-Setup.exe?

The SHA-256 fingerprint of NoHesiLauncher-Setup.exe is 48b493be76ba1d87508764274ead6fb2b60872ea2c0a70c8aa73eee70b9b7a3c, and its MD5 is 59315151ff5e6466a3699a1bfa261ae6. Two files with the same SHA-256 are identical, so use it to check you have exactly this file, not just one with the same name.

Is it safe to install NoHesiLauncher-Setup.exe?

We found nothing harmful in NoHesiLauncher-Setup.exe, and its digital signature checks out. The main caveat is where you got it: attackers sometimes spread malware under the name of real software, so get it from the official website. If your own antivirus warns about it, check the source before you ignore the warning.

How up to date is this analysis of NoHesiLauncher-Setup.exe?

This report reflects the scan on Oct 20, 2026. A file's fingerprint never changes, but antivirus engines keep learning, so a rating can change later. To get a newer result, scan the file again: we refresh the antivirus results when the saved ones are out of date.

Chapter 06

Community

Member reviews and reports for this exact file hash.

Is NoHesiLauncher-Setup.exe safe? Yes, no threats found.

Why we think so

The reasoning behind this verdict

What We Detected

Threat Behavior

What To Do Now

What it did in our test

Test run summary

What this file did when executed

Sandbox verdicts

Techniques observed in the sandbox

Observed activity

Processes started

Network contacts

Files

Registry and auto-start

Mutexes

Sandbox background — not the file

Files this sample writes at runtime

Technical details

Every check behind this verdict

File fingerprint

About this file

0 of 68 engines flagged this file

Signatures and behavior heuristics

Section entropy & packers

How widely this file has been seen

Questions & answers

Community

Is NoHesiLauncher-Setup.exe safe? Yes, no threats found.

What We Detected

Threat Behavior

What To Do Now

Test run summary

Sandbox verdicts

Techniques observed in the sandbox

Observed activity

Processes started

Network contacts

Files

Registry and auto-start

Mutexes

Sandbox background — not the file

File fingerprint

About this file

Related file reports