Is AppvIsvSubsystems32.dll safe?
Seventeen of 74 engines flagged this new unsigned DLL, with multiple high-trust detections and repeated Yogi naming outweighing inconclusive sandbox findings.
This newly observed, unsigned DLL drew detections from 17 of 74 engines, including four independent high-trust votes. Multiple engines identify Yogi, although other labels differ and the sandbox produced no explicit malware judgment; avoid loading the DLL and quarantine it while investigating its source.
9d99df162cce23576b…a6f8d36decabc3Recommended next actions
Before using
Do not use it. Quarantine this component with your antivirus, then repair or reinstall the parent software from its official source. Do not delete or replace the component manually.
If you already used it
Disconnect from the internet, start a full or offline antivirus scan, then secure important accounts from a clean device.
Intelligence
The saved assessment, checked against the scan evidence and recorded coverage.
The reasoning behind this verdict
This section explains the evidence supporting the verdict and keeps conflicting or missing signals visible.
This newly observed, unsigned DLL drew detections from 17 of 74 engines, including four independent high-trust votes. Multiple engines identify Yogi, although other labels differ and the sandbox produced no explicit malware judgment; avoid loading the DLL and quarantine it while investigating its source.
The strongest evidence is the 17/74 detection count, including four independent high-trust votes. BitDefender, Emsisoft, and several other engines repeatedly use the Yogi name, while Microsoft and TrendMicro provide differing generic trojan labels. The file is unsigned and has only one recorded submission, leaving no established publisher or prevalence history to counterbalance those detections. One sandbox observed repeated rundll32 loading through multiple exports, but recorded no offensive-only techniques, malicious child, persistence, or explicit malicious runtime judgment. No complete contacted-host reputation result is available, and the differing labels reduce family-level certainty without erasing the broader malware signal.
What We Detected
Seventeen of 74 engines flagged the DLL. Four independent high-trust engines contributed detections, with BitDefender and Emsisoft naming Gen:Variant.Yogi.65517, Microsoft naming Wacatac, and TrendMicro-HouseCall naming VSX. The recurring Yogi label is meaningful, but the lack of strong tier-1 family consensus limits confidence in the exact family assignment.
Threat Behavior
One completed sandbox run observed the DLL being loaded repeatedly through rundll32.exe, including APIExportForDetours and several unusual named exports. It recorded five benign-common MITRE techniques but no offensive-only techniques, persistence indicators, dropped hashes, or explicit malicious sandbox judgment. No network contacts were recorded in that run, but no complete contacted-host reputation result is available.
What To Do Now
Do not load or distribute this DLL. Keep endpoint protection enabled, quarantine the file, verify where it originated, and inspect the host for related rundll32 activity or other files delivered alongside it.
Where this verdict could be wrong4 caveats
- behaviour.hasMaliciousSandboxVerdict=false and behaviour.offensiveCount=0; the completed sandbox run did not independently label the execution malicious.
- Ten tier-1 engines reported the sample clean, including ESET-NOD32, F-Secure, Fortinet, and Avira.
- externalIntel.malwareBazaar.hit=false and externalIntel.yaraify.ruleCount=0, although absence of those matches does not establish benignness.
- peAnalysis.likelyPacked=false and peAnalysis.highEntropyCode=false, providing no static indication of packing or unusually entropic code.
These are the assessment's weak points. If you believe one applies to your file, report the verdict and we'll re-review it.
- No explicit malicious sandbox verdict
- No offensive-only MITRE techniques observed
- No persistence indicators or dropped file hashes recorded
- No packing or high-entropy code detected
- No YARAify or MalwareBazaar match
- 17/74 antivirus detections
- Four independent high-trust detections
- Repeated Yogi-family labels across multiple engines
- Unsigned Win32 DLL
- Only one recorded submission and newly observed
- Repeated rundll32 execution through multiple exports
Quarantine the DLL and do not invoke it with rundll32. Keep endpoint protection enabled and investigate the download source and any related process activity.
Coverage & freshness
Complete means the check returned a usable result. It does not mean the file is safe.
Antivirus
Complete17 of 74 engines flagged the file.
Sandbox
Complete1 isolated runtime environment contributed observations.
Network
Not runNo contacted-host reputation check is recorded.
No timestamp recordedYARA
CompleteRule evaluation completed with no recorded matches.
External intel
Complete3 of 3 independent reference sources completed.
Behavior
Plain-English impact first, then the observed runtime evidence.
Runtime flight recorder
Capture complete- 1isolated sandbox run
- 5MITRE ATT&CK techniques
- 8spawned processes
- 0network contacts
- 1filesystem & mutex artifacts
What this file does
Observed actions and their security significance
High concern: Manipulated how the operating system loads code, which can redirect execution.
Moderate concern: Checked the environment for virtualisation or analysis tools.
Note: Reads your Windows user-account details.
Note: Collects details about your system.
These are observed capabilities from an isolated analysis. A technique does not prove malicious intent on its own, and the file never ran on your device.
Threat context
How trojans work
A trojan disguises itself as something useful or harmless to trick you into running it. Once open, it does its real job in the background — anything from stealing data to opening a back door or downloading more malware.
Bottom line:The disguise is the whole trick, so a trustworthy-looking name or icon means nothing.
Attack story
Runtime observations grouped by analysis stage. Arrows organize the stages; they do not claim chronology or causality.
Input file
The submitted object
- FileObserved
AppvIsvSubsystems32.dll
9d99df162cce23576b0019e5a8667ff025cd6e49cb8ffcceb9a6f8d36decabc3
01Uploaded file
Processes
Runtime execution
- ProcessObserved
Observed process
"C:\Windows\System32\rundll32.exe" "C:\Users\<USER>\Desktop\AppvIsvSubsystems32.dll",#1
02Isolated runtime analysis - ProcessObserved
Observed process
C:\Windows\System32\loaddll32.exe loaddll32.exe "C:\Users\user\Desktop\AppvIsvSubsystems32.dll"
03Isolated runtime analysis - +1 more recorded observation in Analyst mode
Files
Created or changed
- Written fileObserved
Connect
\Device\ConDrv\\Connect
04Isolated runtime analysis
4 recorded facts from one runtime window. Every fact remains independently traceable in Analyst mode.
What this file did when executed
This file was detonated in 1 sandbox and its runtime behaviour was observed.
Adversary techniques mapped to the MITRE ATT&CK framework.
- \Device\ConDrv\\Connect
Detection & Forensics
Consensus, attribution, signatures, code structure, prevalence, and identity.
Evidence integrity
Chain of custody for the facts preserved in this report.
- 0rule hits recorded
- 17 / 74engines flagged
- 1sources in submission history
Why these facts are shown
Each statement identifies whether it was directly recorded or derived from saved scan facts.
- 01
17 of 74 antivirus engines flagged the file, including ALYac and Arcabit.
Verdict inputView chapterProvenanceObservedSourceAntivirus analysisObserved at - 02
The hash has been submitted 1 time from 1 source.
ProvenanceDerivedSourceSaved report factsObserved at - 03
Scanned file: AppvIsvSubsystems32.dll — 9d99df162cce23576b0019e5a8667ff025cd6e49cb8ffcceb9a6f8d36decabc3
ProvenanceObservedSourceUploaded fileObserved at - 04
Observed process — "C:\Windows\System32\rundll32.exe" "C:\Users\<USER>\Desktop\AppvIsvSubsystems32.dll",#1
ProvenanceObservedSourceIsolated runtime analysisObserved at - 05
Observed process — C:\Windows\System32\loaddll32.exe loaddll32.exe "C:\Users\user\Desktop\AppvIsvSubsystems32.dll"
ProvenanceObservedSourceIsolated runtime analysisObserved at - 06
File written: Connect — \Device\ConDrv\\Connect
ProvenanceObservedSourceIsolated runtime analysisObserved at
Detection sources at a glance
Category: generic-trojan
MalwareBazaar, YARAify, and CIRCL hashlookup completed and returned no entries for this hash.
YARA rules
No matchesThe rule pass completed without a saved public match.
17 of 74 engines flagged this file
View all 74 engine results
Section entropy & packers
No high-entropy executable section or known packer signature was detected. Data and resource sections can still have high entropy without indicating packed code.
How widely this file has been seen
Barely seen in the wild and first surfaced recently. 17 antivirus detections make that low prevalence materially relevant, but rarity alone is not proof of malware.
Fingerprint and provenance
- File name
- AppvIsvSubsystems32.dll
- Format
- Win32 DLL
- Code signing
- No verified publisher
- Size
- 174.0 KB
- Last analyzed
- Sep 15, 2026, 1:16 AM UTC
9d99df162cce23576b0019e5a8667ff025cd6e49cb8ffcceb9a6f8d36decabc3Safety & FAQ
Complete recovery guidance and answers for the next decision.
What to do now
This file is dangerous. Treat it as harmful and remove it.
- Recovery step 01
Don't use this component. Quarantine this component with your antivirus, then repair or reinstall the parent software from its official source. Do not delete or replace the component manually.
- Recovery step 02
If you already used it, disconnect from the internet and start with a full antivirus scan or Microsoft Defender Offline scan. If compromise is suspected or the problem persists, use a reputable second-opinion scanner and follow incident-recovery or clean-reinstall guidance.
- Recovery step 03
If you typed any passwords while it was open, change them from a device you trust.
- Recovery step 04
Reinstall the parent software from the developer's official site instead of replacing this component by itself.
Safety FAQ
Direct answers grounded in the saved verdict and evidence in this report.
Is AppvIsvSubsystems32.dll a virus?
What is AppvIsvSubsystems32.dll?
How many antivirus engines detected AppvIsvSubsystems32.dll?
What should I do if I already used AppvIsvSubsystems32.dll?
How do I remove AppvIsvSubsystems32.dll?
What kind of malware is AppvIsvSubsystems32.dll?
What is the SHA-256 hash of AppvIsvSubsystems32.dll?
How up to date is this analysis of AppvIsvSubsystems32.dll?
Community
Member reviews and reports for this exact file hash.