File scan report
Verdict Safe
Is Evo
None of the 69 antivirus engines that checked it flagged this widely submitted launcher application, sandbox runs came back clean, and no external intelligence feed lists it.
Read the whole reasonShow less
Moderate evidence · No engine flags it, but no publisher signature confirms who made it.
Safe to use if obtained from the application's official source. Keep your antivirus enabled and re-scan if the file came from an unofficial site.
Good practice2 tips
We found nothing harmful in this file.
Run it only if it came from the developer's own website or an official app store.
Keep your antivirus and Windows updates switched on.
No scanner can promise a file is 100% safe.
Antivirus results
0 of 69 flagged
- Flagged 0
- No detection 69
- No result 6
- Code signing Unsigned
- Test run Completed
- First seen 14d ago
Chapter 02
Why we think so
2 points against it and 4 in its favour, checked against the scan evidence.
The reasoning behind this verdict
No antivirus engine flagged this file, including 18 major antivirus engines. It has been submitted by 431 different users and shows only ordinary self-extraction behaviour in the sandbox. It is unsigned, but nothing hostile was found.
The file wrote runtime and asset files to a temporary folder, which fits a self-contained .NET launcher. Hundreds of distinct submitters have uploaded it. It lacks a digital signature, which keeps confidence below the maximum, but no hostile evidence was found.
What We Detected
No engine among 75 flagged this 64-bit executable. No public malware database or community rule lists it.
Threat Behavior
In the sandbox it unpacked .NET runtime components and viewer assets into a temporary folder and ran normally. Contacted-host reputation was not checked, so no network conclusion is drawn.
What To Do Now
Download it only from the official source of the application. Keep your security software enabled.
Where this verdict could be wrong2 caveats
- The file is unsigned and only 8 days old, so reputation history is thin.
- Files built with the same import table received mixed verdicts (one suspicious, one safe), though these are framework collisions and weak evidence.
These are the assessment's weak points. If you believe one applies to your file, report the verdict and we'll re-review it.
- No antivirus engine flagged it, including 18 major antivirus engines.
- Submitted by 431 distinct users.
- Sandbox summary was clean.
- No public malware-database or community-rule hits.
- The file is unsigned, so the publisher cannot be verified.
- The file is new, first seen on Oct 11, 2026.
6 sources checked · 5 complete · 1 not needed or not applicable. See every source
Chapter 03
What it did in our test
It ran in 5 isolated tests; no test environment rated what it did as risky.
Test run summary
Capture complete- 5isolated sandbox runs
- 16sandbox rule tags
- 2spawned processes
- 0network contacts
- 21filesystem & mutex artifacts
What this file did when executed
This file was detonated in 5 sandboxes and its runtime behaviour was observed.
Sandbox verdicts
1- VT: CLEANclean
Techniques observed in the sandbox
16MITRE ATT&CK techniques the sandbox mapped. Highlighted ones are rare in normal software; the others are common in legitimate programs too.
- T1012
- T1027· Obfuscated code
- T1027.002· Obfuscated code
- T1033· Reads user info
- T1036
- T1047
- T1055· Process injection
- T1059· Runs commands
- T1071· Application protocol
- T1082· System recon
- T1129· Loads modules
- T1497· Sandbox evasion
- T1553
- T1553.002
- T1562· Disables security
- T1574· Execution hijack
Observed activity
Processes started
2Programs the file ran, with their command lines.
EvoVisLauncher.exe"C:\Users\<USER>\Desktop\EvoVisLauncher.exe"program.exe"C:\Users\user\Desktop\program.exe"
Files
20Files the file created, changed or deleted.
- Written
C:\Users\<USER>\AppData\Local\Temp\.net\EvoVisLauncher\109c\runtimes\win-x64\native\WebView2Loader.dll - Written
C:\Users\<USER>\AppData\Local\Temp\.net\EvoVisLauncher\109c\assets\viewer\capes.json - Written
C:\Users\<USER>\AppData\Local\Temp\.net\EvoVisLauncher\109c\assets\viewer\cosmetic-thumbs.js - Written
C:\Users\<USER>\AppData\Local\Temp\.net\EvoVisLauncher\109c\assets\viewer\cosmetics-names.json - Written
C:\Users\<USER>\AppData\Local\Temp\.net\EvoVisLauncher\109c\assets\viewer\cosmetics\backpacks\adidas.geo.json - Written
C:\Users\<USER>\AppData\Local\Temp\.net\EvoVisLauncher\109c\assets\viewer\cosmetics\backpacks\adidas.png
Show all 20 entries for files
- Written
C:\Users\<USER>\AppData\Local\Temp\.net\EvoVisLauncher\109c\assets\viewer\cosmetics\backpacks\gucci.geo.json - Written
C:\Users\<USER>\AppData\Local\Temp\.net\EvoVisLauncher\109c\assets\viewer\cosmetics\backpacks\gucci.png - Written
C:\Users\<USER>\AppData\Local\Temp\.net\EvoVisLauncher\109c\assets\viewer\cosmetics\backpacks\hermes.geo.json - Written
C:\Users\<USER>\AppData\Local\Temp\.net\EvoVisLauncher\109c\assets\viewer\cosmetics\backpacks\hermes.png - Written
C:\Users\<USER>\AppData\Local\Temp\.net\EvoVisLauncher\109c\assets\viewer\cosmetics\backpacks\labubu.geo.json - Written
C:\Users\<USER>\AppData\Local\Temp\.net\EvoVisLauncher\109c\assets\viewer\cosmetics\backpacks\labubu.png - Written
C:\Users\<USER>\AppData\Local\Temp\.net\EvoVisLauncher\109c\assets\viewer\cosmetics\backpacks\lui_vuitton.geo.json - Written
C:\Users\<USER>\AppData\Local\Temp\.net\EvoVisLauncher\109c\assets\viewer\cosmetics\backpacks\lui_vuitton.png - Written
C:\Users\<USER>\AppData\Local\Temp\.net\EvoVisLauncher\109c\assets\viewer\cosmetics\backpacks\mage_staff.geo.json - Deleted
C:\Users\<USER>\AppData\Local\Temp\.net\EvoVisLauncher\109c - Deleted
C:\Users\<USER>\AppData\Local\Microsoft\Windows Media\12.0\WMSDKNS.XML.bak - Deleted
C:\Users\<USER>\AppData\Local\Microsoft\Windows Media\12.0\WMSDKNSD.XML - Deleted
C:\Users\<USER>\AppData\Local\Microsoft\Windows Media\12.0\WMSDKNSR.XML - Deleted
C:\Users\<USER>\AppData\Local\Microsoft\Windows Media\12.0\WMSDKNS.XML.done
Registry and auto-start
16Settings the file changed, including ways to start again after a restart.
- Set
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows Media\WMSDK\General\UniqueID - Set
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows Media\WMSDK\General\ComputerName - Set
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows Media\WMSDK\General\VolumeSerialNumber - Set
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows Media\WMSDK\Namespace\LocalBase - Set
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows Media\WMSDK\Namespace\DTDFile - Set
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows Media\WMSDK\Namespace\LocalDelta
Show all 16 entries for registry and auto-start
- Set
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows Media\WMSDK\Namespace\RemoteDelta - Set
HKEY_CURRENT_USER\SOFTWARE\Microsoft\MediaPlayer\Preferences\ProxySettings\HTTP\ProxyStyle - Set
HKEY_CURRENT_USER\SOFTWARE\Microsoft\MediaPlayer\Preferences\ProxySettings\HTTP\ProxyPort - Set
HKEY_CURRENT_USER\SOFTWARE\Microsoft\MediaPlayer\Preferences\ProxySettings\HTTP\ProxyBypass - Set
HKEY_CURRENT_USER\SOFTWARE\Microsoft\MediaPlayer\Preferences\ProxySettings\RTSP\ProxyStyle - Set
HKEY_CURRENT_USER\SOFTWARE\Microsoft\MediaPlayer\Preferences\ProxySettings\RTSP\ProxyPort - Set
HKEY_CURRENT_USER\SOFTWARE\Microsoft\MediaPlayer\Preferences\ProxySettings\RTSP\ProxyBypass - Set
HKEY_CURRENT_USER\SOFTWARE\Microsoft\MediaPlayer\Player\Tasks\NowPlaying\InitFlags - Set
HKEY_USERS\S-1-5-21-4270068108-2931534202-3907561125-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.exe\OpenWithProgids\exefile - Deleted
HKEY_CURRENT_USER\SOFTWARE\Microsoft\MediaPlayer\Player\Settings\Client ID
Mutexes
1Named locks a program uses so only one copy runs; malware families often reuse them.
Local\SessionImmersiveColorMutex
Sandbox background — not the file
1The analysis machine's own processes and connections, recorded in every run.
- VM host
162.159.36.2
Files this sample writes at runtime
This file drops 10 children at runtime. None are currently flagged malicious in our cache. 10 have no saved verdict and were not checked; that is missing coverage, not a finding.
- 2d64a312551930dc5661…00b493Not checkedno saved verdict
- 3db1d92202bd30235270…2516aaNot checkedno saved verdict
- b1b0b2c0d97ad136e88c…5c3723Not checkedno saved verdict
- bd4bcf0e3bd2933b053e…f8a5f4Not checkedno saved verdict
- dd2772e113e09aa81397…5b6182Not checkedno saved verdict
- e16b9bc243657eb3d138…0e660aNot checkedno saved verdict
- a7fc1cdd2f5cc5502370…7580e7Not checkedno saved verdict
- 80df1bb14375ffd0010f…b8d683Not checkedno saved verdict
- e66d41cdc4355c555af5…7a4ea9Not checkedno saved verdict
- 5d2cfc1a9949d1862af2…0a34bcNot checkedno saved verdict
Chapter 04
Technical details
None of the 69 antivirus engines that checked it flag it; no publisher signature.
Sources checked
Every check behind this verdict
6 sources checked · 5 complete · 1 not needed or not applicable. Complete means the check returned a usable result; it does not mean the file is safe.
File fingerprint
- Last analyzed
- Oct 20, 2026, 6:38 AM UTC
- SHA-256
a132e3137fb3a9686f510e279880fb4a452855de9bd221cdb48e1f1af7068c3f- SHA-1
b5f841978e5e1d430f0568d18630f1e18b85d46b- MD5
8338142d7085f4c6d3397f3e93278227
About this file
EvoVisLauncher.dll is a Win32 EXE file of 78.1 MB.
- Claims to be
- EvoVisLauncherFrom the file's own version information, written by whoever built it.
- Original name
- EvoVisLauncher.dllMatches the shared file name.
- Type and size
- Win32 EXE · 78.1 MB
- Signer
- UnsignedNo code signature.
- First seen
- Oct 11, 2026On VirusTotal.
- Submitted by
- 431 distinct sources
- Packer
- None detected
- Entropy
- 6.22 of 8
First scanned
Antivirus consensus
0 of 69 engines flagged this file
6 of the 75 engines returned no result for this file (file type not supported, or the scan did not finish), so they did not check it.
- Tier-118 engines0flagged
- Tier-234 engines0flagged
- Low-trust17 engines0flagged
View all 75 engine results
- AcronisClean
- AhnLab-V3Clean
- AlibabaClean
- alibabacloudClean
- ALYacClean
- Antiy-AVLClean
- APEXClean
- ArcabitClean
- AvastClean
- Avast-MobileNo result
- AVGClean
- AviraClean
- BitDefenderClean
- BitDefenderFalxNo result
- BkavClean
- CAT-QuickHealClean
- ClamAVClean
- CMCClean
- CrowdStrikeClean
- CTXClean
- CylanceClean
- CynetClean
- DeepInstinctClean
- DrWebClean
- ElasticNo result
- EmsisoftClean
- ESET-NOD32Clean
- F-SecureClean
- FortinetClean
- GDataClean
- GoogleClean
- GridinsoftClean
- huorongClean
- IkarusClean
- JiangminClean
- K7AntiVirusClean
- K7GWClean
- KasperskyClean
- KingsoftClean
- LionicClean
- MalwarebytesClean
- MaxSecureClean
- McAfeeDClean
- MicrosoftClean
- MicroWorld-eScanClean
- NANO-AntivirusClean
- PaloaltoClean
- PandaClean
- RisingClean
- SangforClean
- SentinelOneClean
- SkyhighClean
- SophosClean
- SUPERAntiSpywareClean
- SymantecClean
- SymantecMobileInsightNo result
- TACHYONClean
- tehtrisNo result
- TencentClean
- TrapmineClean
- TrellixENSClean
- TrendMicroClean
- TrendMicro-HouseCallClean
- TrustlookNo result
- VaristClean
- VBA32Clean
- VIPREClean
- VirITClean
- ViRobotClean
- WebrootClean
- XcitiumClean
- YandexClean
- ZillyaClean
- ZoneAlarmClean
- ZonerClean
Signatures and behavior heuristics
Low-severity pattern matches — worth noting but not on their own cause for alarm.
VirusTotal's sandbox summary maps this run to MITRE T1055 (Process Injection), but no injected process of the sample's own was recorded (the analysis VM's own WMI adapter, crash handlers and Chrome updater are not counted). VirusTotal maps T1055 on about half of all files no engine flags, so the mapping alone is not evidence of injection.
EvidenceT1055 (sandbox MITRE mapping)
Section entropy & packers
No high-entropy executable section or known packer signature was detected. Data and resource sections can still have high entropy without indicating packed code.
How widely this file has been seen
Lots of people are uploading this but it's recent — typical of newly-released legitimate software. Low prior for malware.
Chapter 05
Questions & answers
Short answers to the 6 questions people ask most about this file.
Is EvoVisLauncher.dll safe?
What is EvoVisLauncher.dll?
How many antivirus engines detected EvoVisLauncher.dll?
What is the SHA-256 hash of EvoVisLauncher.dll?
Is it safe to run EvoVisLauncher.dll?
How up to date is this analysis of EvoVisLauncher.dll?
Community
Member reviews and reports for this exact file hash.
