File scan report
Verdict Safe
Is Game
This Microsoft-signed GameInput redistributable DLL was flagged by none of the 71 antivirus engines that checked it, shows no hostile sandbox behaviour, and matches the signer's…
Read the whole reasonShow less
Strong evidence · A verified publisher signature, and no engine flags it.
This file appears legitimate and can be used as normal. Keep your antivirus enabled and get Microsoft components from official sources.
Good practice2 tips
We found nothing harmful in this file.
Use it only as part of a program you got from the developer's own website.
Keep your antivirus and Windows updates switched on.
No scanner can promise a file is 100% safe.
Antivirus results
0 of 71 flagged
- Flagged 0
- No detection 71
- No result 4
- Code signing Microsoft Corporation
- Test run Completed
- First seen 1mo ago
Chapter 02
Why we think so
2 points against it and 4 in its favour, checked against the scan evidence.
The reasoning behind this verdict
None of the 71 antivirus engines that checked it flagged this DLL, and it carries a valid Microsoft Corporation signature. Three sandbox runs showed no malicious verdict, no process injection and no network contacts. The generic YARA matches are ordinary capability rules and carry no weight.
No engine flagged the file, and 18 major antivirus engines reported it clean. The signature is valid and belongs to Microsoft Corporation, whose history in our records is 35 of 35 clean samples. The combined sandbox summary shows no malicious verdict, no injection target and no contacted domains. The mapping has no supporting artefact, so it is not evidence of defence tampering. The YARA matches are all generic capability or anti-debug rules, which ordinary software also triggers. Similar Microsoft-signed files were all previously judged clean.
What We Detected
No engine out of 75 flagged this 64-bit DLL. It carries a valid Microsoft Corporation signature, and the file name matches Microsoft's GameInput redistributable.
Threat Behavior
The sandbox runs loaded the DLL through regsvr32 and rundll32 and showed no injection, persistence or network contact. Six generic community YARA rules matched, but none is malware-specific. A complete host-reputation check is not available, though no hosts were contacted.
What To Do Now
No action is needed. Obtain the file from Microsoft or an official installer and keep your security software enabled.
Where this verdict could be wrong2 caveats
- YARAify matched generic community rules, including names that mention Cobalt Strike and ransomware, but all are marked generic and no engine or malware-specific rule backs them.
- The sandbox mapped and noted anti-debug and long-sleep tags, but no artefact of defence tampering was recorded.
These are the assessment's weak points. If you believe one applies to your file, report the verdict and we'll re-review it.
- Valid Microsoft Corporation signature
- 0 of the 71 antivirus engines that checked it flagged the file
- Signer has 35 of 35 prior samples clean
- No injection or network activity in the sandbox runs
- The DLL includes anti-debug checks and long sleeps, which are common in protected commercial software.
- No complete host-reputation check is available for this file.
6 sources checked · 5 complete · 1 not needed or not applicable. See every source
Chapter 03
What it did in our test
It ran in 3 isolated tests; no test environment rated what it did as risky.
Test run summary
Capture complete- 3isolated sandbox runs
- 19sandbox rule tags
- 8spawned processes
- 0network contacts
- 21filesystem & mutex artifacts
What this file did when executed
This file was detonated in 3 sandboxes and its runtime behaviour was observed.
Techniques observed in the sandbox
19MITRE ATT&CK techniques the sandbox mapped. Highlighted ones are rare in normal software; the others are common in legitimate programs too.
- T1010
- T1012
- T1027· Obfuscated code
- T1027.002· Obfuscated code
- T1056· Keylogging
- T1056.001· Keylogging
- T1057· Lists programs
- T1071· Application protocol
- T1082· System recon
- T1083· Scans your files
- T1129· Loads modules
- T1218.010
- T1218.011
- T1497· Sandbox evasion
- T1518.001· Checks your AV
- T1542.003
- T1562.001· Disables security
- T1574· Execution hijack
- T1614.001
Observed activity
Processes started
8Programs the file ran, with their command lines.
regsvr32.exe"C:\Windows\sysnative\regsvr32.exe" C:\Users\<USER>\Desktop\readme.dllloaddll64.exeC:\Windows\System32\loaddll64.exe loaddll64.exe "C:\Users\user\Desktop\readme.dll"cmd.exeC:\Windows\System32\cmd.exe cmd.exe /C rundll32.exe "C:\Users\user\Desktop\readme.dll",#1rundll32.exeC:\Windows\System32\rundll32.exe rundll32.exe "C:\Users\user\Desktop\readme.dll",#1regsvr32.exeC:\Windows\System32\regsvr32.exe regsvr32.exe /s C:\Users\user\Desktop\readme.dllrundll32.exeC:\Windows\System32\rundll32.exe rundll32.exe C:\Users\user\Desktop\readme.dll,DllCanUnloadNow
Show all 8 entries for processes started
rundll32.exeC:\Windows\System32\rundll32.exe rundll32.exe C:\Users\user\Desktop\readme.dll,DllGetClassObjectrundll32.exeC:\Windows\System32\rundll32.exe rundll32.exe C:\Users\user\Desktop\readme.dll,DllRegisterServer
Files
15Files the file created, changed or deleted.
- Written
C:\ProgramData\Microsoft\Windows\WER\ReportArchive\172b8f07-a3f4-438d-b9b3-f346d0e85736 - Written
C:\ProgramData\Microsoft\Windows\WER\ReportArchive\3b6899da-d360-40b6-ad41-062c97382c25 - Written
C:\ProgramData\Microsoft\Windows\WER\ReportQueue\91508ea5-0e64-4eeb-b4ab-d28fafefc0a5 - Written
C:\ProgramData\Microsoft\Windows\WER\ReportQueue\b93e1417-303c-4ef0-9573-cc179ec05c9f - Written
C:\ProgramData\Microsoft\Windows\WER\Temp\2e07cb51-d6c1-4ace-8add-5b732632c433 - Written
C:\ProgramData\Microsoft\Windows\WER\Temp\3388f7f8-095d-4df0-a634-7f4ea3c76d74
Show all 15 entries for files
- Written
C:\ProgramData\Microsoft\Windows\WER\Temp\504d4383-37a9-4b99-a4b7-71d865c3f5d6 - Written
C:\ProgramData\Microsoft\Windows\WER\Temp\58567f7d-70d6-4b99-a9d3-b48086653576 - Written
C:\ProgramData\Microsoft\Windows\WER\Temp\64c8465e-82b5-447e-b957-d749186c510c - Written
C:\ProgramData\Microsoft\Windows\WER\Temp\66df098e-c75b-4de4-8c2d-96abacf3884b - Written
C:\ProgramData\Microsoft\Windows\WER\Temp\8b6899d7-fbaf-469b-8e27-4fe2d29037d3 - Written
C:\ProgramData\Microsoft\Windows\WER\Temp\WER.306a6a57-e7bc-47b6-92b0-832246086aab.tmp.WERInternalMetadata.xml - Written
C:\ProgramData\Microsoft\Windows\WER\Temp\WER.39117e8a-51cf-4147-ae54-c01af05cda39.tmp.dmp - Written
C:\ProgramData\Microsoft\Windows\WER\Temp\WER.6f0ae397-be7f-4544-9aae-afef6b369d4c.tmp.xml - Written
C:\ProgramData\Microsoft\Windows\WER\Temp\WER.771b8904-d7cf-44b7-b99a-a5df5da07fae.tmp.dmp
Registry and auto-start
16Settings the file changed, including ways to start again after a restart.
- Set
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{6F64F9F3-42D4-4D3B-90D5-1FAFECB8D53B} - Set
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{6F64F9F3-42D4-4D3B-90D5-1FAFECB8D53B}\InProcServer32 - Set
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{CEE41410-CF25-4B6A-A99D-4F313596DE89} - Set
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{CEE41410-CF25-4B6A-A99D-4F313596DE89}\ProxyStubClsid32 - Set
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{CEE41410-CF25-4B6A-A99D-4F313596DE89}\NumMethods - Set
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{24B74419-7178-4183-B51A-38CC69AF7A54}
Show all 16 entries for registry and auto-start
- Set
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{24B74419-7178-4183-B51A-38CC69AF7A54}\ProxyStubClsid32 - Set
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{24B74419-7178-4183-B51A-38CC69AF7A54}\NumMethods - Set
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{94CD1F3A-7B05-43D8-8C84-126DD11E7206} - Set
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{94CD1F3A-7B05-43D8-8C84-126DD11E7206}\ProxyStubClsid32 - Set
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{94CD1F3A-7B05-43D8-8C84-126DD11E7206}\NumMethods - Set
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{96A98D57-8EE4-4D6F-9816-11DD8C469C51} - Set
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{96A98D57-8EE4-4D6F-9816-11DD8C469C51}\ProxyStubClsid32 - Set
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{96A98D57-8EE4-4D6F-9816-11DD8C469C51}\NumMethods - Set
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{BF2915CE-D079-4CDB-A65C-4AD4C56C6D76} - Deleted
\REGISTRY\A\{1586cde0-e23b-3dab-e92a-4e0fc8c1d5ca}\Root\InventoryApplicationFile\PermissionsCheckTestKey
Mutexes
6Named locks a program uses so only one copy runs; malware families often reuse them.
\Sessions\1\BaseNamedObjects\Local\WERReportingForProcess6500\Sessions\1\BaseNamedObjects\InventorySynchronizationInventoryApplicationFileMutex6680\Sessions\1\BaseNamedObjects\Global\b7adbe65-ec8a-447c-85aa-3e6be4dc0bed\Sessions\1\BaseNamedObjects\Local\WERReportingForProcess5652\Sessions\1\BaseNamedObjects\InventorySynchronizationInventoryApplicationFileMutex2724\Sessions\1\BaseNamedObjects\Global\8cb7fdea-bb91-4c80-a9d1-265322bbae1b
Sandbox background — not the file
3The analysis machine's own processes and connections, recorded in every run.
- VM process
conhost.exeC:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 - VM process
WerFault.exeC:\Windows\System32\WerFault.exe C:\Windows\system32\WerFault.exe -u -p 6500 -s 464 - VM process
WerFault.exeC:\Windows\System32\WerFault.exe C:\Windows\system32\WerFault.exe -u -p 5652 -s 448
Files this sample writes at runtime
This file drops 4 children at runtime. None are currently flagged malicious in our cache. 4 have no saved verdict and were not checked; that is missing coverage, not a finding.
- 05b19a6114fc685a4e65…ae412cNot checkedno saved verdict
- e8a2c176b587d7639849…556efaNot checkedno saved verdict
- d3f91fa354f4e51cc897…bd6db6Not checkedno saved verdict
- 05ac808e5d2d86573002…cb066bNot checkedno saved verdict
Chapter 04
Technical details
None of the 71 antivirus engines that checked it flag it; signed by Microsoft Corporation.
Sources checked
Every check behind this verdict
6 sources checked · 5 complete · 1 not needed or not applicable. Complete means the check returned a usable result; it does not mean the file is safe.
File fingerprint
- Last analyzed
- Oct 20, 2026, 5:03 AM UTC
- SHA-256
6d3650dbeea5f8c639972537dbaed3f2bb465561e63d34fa9661902f24cb9686- SHA-1
cd39cb59e01ea26996b8f611757c9aef612ed57d- MD5
655e7652532d3b966c1674c52d14873b
About this file
GameInputRedist.dll says it is GameInput (Microsoft® Windows® GameInput), 952.4 kB.
- Claims to be
- GameInput (Microsoft® Windows® GameInput)From the file's own version information, written by whoever built it.
- Original name
- GameInputRedist.dllMatches the shared file name.
- Type and size
- Win32 DLL · 952.4 kB
- Signer
- Microsoft CorporationValid code signature.
- First seen
- Sep 6, 2026On VirusTotal.
- Submitted by
- 467 distinct sources
- Packer
- None detected
- Entropy
- 5.79 of 8
First scanned
Antivirus consensus
0 of 71 engines flagged this file
4 of the 75 engines returned no result for this file (file type not supported, or the scan did not finish), so they did not check it.
- Tier-118 engines0flagged
- Tier-236 engines0flagged
- Low-trust17 engines0flagged
View all 75 engine results
- AcronisClean
- AhnLab-V3Clean
- AlibabaClean
- alibabacloudClean
- ALYacClean
- Antiy-AVLClean
- APEXClean
- ArcabitClean
- AvastClean
- Avast-MobileNo result
- AVGClean
- AviraClean
- BitDefenderClean
- BitDefenderFalxNo result
- BkavClean
- CAT-QuickHealClean
- ClamAVClean
- CMCClean
- CrowdStrikeClean
- CTXClean
- CylanceClean
- CynetClean
- DeepInstinctClean
- DrWebClean
- ElasticClean
- EmsisoftClean
- ESET-NOD32Clean
- F-SecureClean
- FortinetClean
- GDataClean
- GoogleClean
- GridinsoftClean
- huorongClean
- IkarusClean
- JiangminClean
- K7AntiVirusClean
- K7GWClean
- KasperskyClean
- KingsoftClean
- LionicClean
- MalwarebytesClean
- MaxSecureClean
- McAfeeDClean
- MicrosoftClean
- MicroWorld-eScanClean
- NANO-AntivirusClean
- PaloaltoClean
- PandaClean
- RisingClean
- SangforClean
- SentinelOneClean
- SkyhighClean
- SophosClean
- SUPERAntiSpywareClean
- SymantecClean
- SymantecMobileInsightNo result
- TACHYONClean
- tehtrisClean
- TencentClean
- TrapmineClean
- TrellixENSClean
- TrendMicroClean
- TrendMicro-HouseCallClean
- TrustlookNo result
- VaristClean
- VBA32Clean
- VIPREClean
- VirITClean
- ViRobotClean
- WebrootClean
- XcitiumClean
- YandexClean
- ZillyaClean
- ZoneAlarmClean
- ZonerClean
Signatures and behavior heuristics
Community YARA rules matched, but all of them are generic capability, anti-debug or compiler rules that ordinary software also matches. Worth noting, not on their own cause for alarm.
- cobalt_strike_tmp01925d3fgeneric
- DebuggerCheck__APIgeneric
- golang_bin_JCorn_CSC846generic
- pe_detect_tls_callbacksgeneric
- PE_Digital_Certificategeneric
- VECT_Ransomwaregeneric
Section entropy & packers
No high-entropy executable section or known packer signature was detected. Data and resource sections can still have high entropy without indicating packed code.
How widely this file has been seen
Widely uploaded, but first seen within the last six months. No strong prior applies.
Chapter 05
Questions & answers
Short answers to the 7 questions people ask most about this file.
Is GameInputRedist.dll safe?
What is GameInputRedist.dll?
How many antivirus engines detected GameInputRedist.dll?
Is GameInputRedist.dll digitally signed?
What is the SHA-256 hash of GameInputRedist.dll?
Is it safe to use GameInputRedist.dll?
How up to date is this analysis of GameInputRedist.dll?
Community
Member reviews and reports for this exact file hash.