File scan report
Verdict Safe
Is Wispr
Signed installer with zero engine detections and medium prevalence across 54 sources.
Strong evidence · A verified publisher signature, and no engine flags it.
The sample shows no malicious indicators and can be treated as a legitimate installer when sourced from official channels.
Good practice2 tips
We found nothing harmful in this file.
Run it only if it came from the developer's own website or an official app store.
Keep your antivirus and Windows updates switched on.
No scanner can promise a file is 100% safe.
Antivirus results
0 of 69 flagged
- Flagged 0
- No detection 69
- No result 6
- Code signing Wispr AI, Inc.
- Test run Completed
- First seen 2mo ago
Chapter 02
Why we think so
3 points against it and 4 in its favour, checked against the scan evidence.
The reasoning behind this verdict
All 69 antivirus engines that checked it returned clean. The file is signed by 'Wispr AI' and shows installer behaviour with no malicious sandbox verdict or known-bad children.
Zero malicious detections across 75 reporting engines and no major flags indicate the file is not recognised as malware. Signing is verified but the publisher has no prior history in our records. Observed MITRE techniques and direct-IP traffic are consistent with legitimate Electron/Squirrel installers. Medium prevalence and absence of malicious files it created or sandbox verdicts support a safe classification.
What We Detected
75 engines scanned the sample; none flagged it malicious. The file is a signed 64-bit PE with verified signature from 'Wispr AI'. Sandbox execution recorded process creation, file writes, and network activity typical of an Electron-based installer using Squirrel.
Threat Behavior
Four MITRE techniques (T1055, T1485, T1486, T1543) were mapped from evidence from the test run, but no sandbox flagged the activity as malicious. Contacted hosts include one suspicious domain (raw.githubusercontent.com) and several IPs; none appear in our malicious-host cache. Ten files it created were inspected and none classified malicious.
What To Do Now
Keep security software enabled. The file can be executed if obtained from the official Wispr Flow distribution channel. Monitor for unexpected behaviour and report anomalies through normal support channels.
Where this verdict could be wrong1 caveat
- contactedHosts shows one suspicious host (raw.githubusercontent.com) and behaviour shows direct-IP traffic plus MITRE T1055/T1485/T1486/T1543, but no major detections or malicious sandbox verdict.
These are the assessment's weak points. If you believe one applies to your file, report the verdict and we'll re-review it.
- Zero detections across 75 engines
- Verified digital signature
- Medium prevalence from 54 sources
- No malicious files it created
- New signer with no historical samples
- Direct-IP network traffic observed
- One contacted host flagged suspicious
6 sources checked · 5 complete · 1 partial. See every source
Chapter 03
What it did in our test
It ran in our isolated test environment; no test environment rated what it did as risky.
Test run summary
Capture complete- 25sandbox rule tags
- 7spawned processes
- 15network contacts
- 29filesystem & mutex artifacts
What this file did when executed
This file was run in a sandbox and its runtime behaviour was observed.
Techniques observed in the sandbox
25MITRE ATT&CK techniques the sandbox mapped. Highlighted ones are rare in normal software; the others are common in legitimate programs too.
- T1027· Obfuscated code
- T1033· Reads user info
- T1047
- T1055· Process injection
- T1059· Runs commands
- T1070· Covers its tracks
- T1071· Application protocol
- T1074
- T1082· System recon
- T1090
- T1105· Network file transfer
- T1106
- T1112
- T1129· Loads modules
- T1485
- T1486· File encryption
- T1497· Sandbox evasion
- T1543· Service install
- T1547· Auto-start
- T1562· Disables security
- T1564· Hides artifacts
- T1564.003· Hides artifacts
- T1568
- T1573
- T1574· Execution hijack
Observed activity
Processes started
7Programs the file ran, with their command lines.
Squirrel.exe"C:\Users\<USER>\AppData\Local\WisprFlow\app-1.6.447\Squirrel.exe" --updateSelf=C:\Users\<USER>\AppData\Local\SquirrelTemp\Update.exeWispr Flow.exe"C:\Users\<USER>\AppData\Local\WisprFlow\app-1.6.447\Wispr Flow.exe" --squirrel-install 1.6.447WisprFlowInstaller.exe"C:\Users\<USER>\Desktop\WisprFlowInstaller.exe"WisprFlowSetup-347dd5362cd04269b63acbcfe3c73b1b.exe"C:\Users\<USER>\AppData\Local\Temp\WisprFlowSetup-347dd5362cd04269b63acbcfe3c73b1b.exe"Update.exe"C:\Users\<USER>\AppData\Local\SquirrelTemp\Update.exe" --install .WisprFlowSetup-7791a4c72f4145d58e33e5fb58574641.exeC:\Users\<USER>\AppData\Local\Temp\WisprFlowSetup-7791a4c72f4145d58e33e5fb58574641.exe
Show all 7 entries for processes started
WisprFlowInstaller.exe"C:\Users\user\Desktop\WisprFlowInstaller.exe"
Network contacts
1515 hosts, listed as 11 addresses, 5 links. Links show the host and path only.
- IP address
104.26.5.130 - IP address
34.200.203.208 - IP address
34.160.81.0 - IP address
16.15.36.134 - IP address
50.18.104.48 - IP address
54.225.70.138
Show all 16 entries for network contacts
- IP address
185.199.111.133 - IP address
104.26.4.130 - IP address
23.15.3.154 - IP address
23.48.10.36 - IP address
54.221.50.175 - URL
https://dl.wisprflow.com/wispr-flow/win32/latest.json - URL
https://dl.wisprflow.com/wispr-flow/win32/x64/Wispr%20Flow%20Setup-v1.6.447.exe - URL
https://us.i.posthog.com/capture/ - URL
https://o4506267787395072.ingest.sentry.io/api/4506268508422144/envelope/ - URL
https://raw.githubusercontent.com/electron/electron/main/shell/browser/resources/win/electron.ico
Files
26Files the file created, changed or deleted.
- Written
C:\Users\<USER>\AppData\Local\WisprFlow\app-1.6.447\Squirrel-UpdateSelf.log - Written
C:\Users\<USER>\AppData\Local\WisprFlow\Update.exe - Written
C:\Users\<USER>\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\Squirrel.exe.log - Written
\Device\ConDrv\Connect - Written
C:\Users\<USER>\AppData\Local\Temp\WisprFlowSetup-347dd5362cd04269b63acbcfe3c73b1b.exe - Written
C:\Users\<USER>\AppData\Local\SquirrelTemp\background.gif
Show all 26 entries for files
- Written
C:\Users\<USER>\AppData\Local\SquirrelTemp\RELEASES - Written
C:\Users\<USER>\AppData\Local\SquirrelTemp\setupIcon.ico - Written
C:\Users\<USER>\AppData\Local\SquirrelTemp\Update.exe - Written
C:\Users\<USER>\AppData\Local\SquirrelTemp\WisprFlow-1.6.447-full.nupkg - Written
C:\Users\<USER>\AppData\Local\SquirrelTemp\Squirrel-Install.log - Written
C:\Users\<USER>\AppData\Local\Temp\.squirrel-lock-5968C381A6DF45E0DCFF9C22CB5F2B91930A54CF - Written
C:\Users\<USER>\AppData\Local\WisprFlow\app-1.6.447\chrome_100_percent.pak - Written
C:\Users\<USER>\AppData\Local\WisprFlow\app-1.6.447\chrome_200_percent.pak - Written
C:\Users\<USER>\AppData\Local\WisprFlow\app-1.6.447\d3dcompiler_47.dll - Deleted
C:\Users\<USER>\AppData\Local\Temp\WisprFlowSetup-347dd5362cd04269b63acbcfe3c73b1b.exe - Deleted
C:\Users\<USER>\AppData\Local\SquirrelTemp\background.gif - Deleted
C:\Users\<USER>\AppData\Local\SquirrelTemp\RELEASES - Deleted
C:\Users\<USER>\AppData\Local\SquirrelTemp\setupIcon.ico - Deleted
C:\Users\<USER>\AppData\Local\SquirrelTemp\Update.exe - Deleted
C:\Users\<USER>\AppData\Local\SquirrelTemp\WisprFlow-1.6.447-full.nupkg - Deleted
C:\Users\<USER>\AppData\Local\WisprFlow\packages\SquirrelTemp\tempa - Deleted
C:\Users\<USER>\AppData\Local\Temp\54e1bfeb-b229-425f-a372-1cbe2841ee52.png - Deleted
C:\Users\<USER>\AppData\Local\Temp\.squirrel-lock-5968C381A6DF45E0DCFF9C22CB5F2B91930A54CF - Deleted
C:\Users\<USER>\AppData\Local\Microsoft\Windows\Explorer\NotifyIcon\Microsoft.Explorer.Notification.{7820AE82-23E3-4229-82C1-E41CB67D5B9C}.png - Deleted
C:\Users\<USER>\AppData\Local\Temp\WisprFlowSetup-7791a4c72f4145d58e33e5fb58574641.exe
Mutexes
3Named locks a program uses so only one copy runs; malware families often reuse them.
Global\WisprFlowInstallercversions.3.m\Sessions\1\BaseNamedObjects\Global\WisprFlowInstaller
Sandbox background — not the file
3The analysis machine's own processes and connections, recorded in every run.
- VM process
Explorer.EXEC:\Windows\Explorer.EXE - VM host
8.8.8.8 - VM host
204.79.197.203
Files this sample writes at runtime
This file drops 9 children at runtime. None are currently flagged malicious in our cache. 9 have no saved verdict and were not checked; that is missing coverage, not a finding.
- dee5b710ca72425cd4d1…24208fNot checkedno saved verdict
- 1e70708b70756914f4f1…880f33Not checkedno saved verdict
- c0992ae19d143e94e106…f2c799Not checkedno saved verdict
- d990f4ced39e31a1149d…94c16bNot checkedno saved verdict
- 83e2d22e2caf95780d16…ee5d53Not checkedno saved verdict
- b084a873d9d4d558e74f…f9f85aNot checkedno saved verdict
- cae2837b053a34e807e7…1a2968Not checkedno saved verdict
- fade08034183e6703f64…f9e972Not checkedno saved verdict
- 1a2c9397f6fdfc6bd6ac…8add98Not checkedno saved verdict
Chapter 04
Technical details
None of the 69 antivirus engines that checked it flag it; signed by Wispr AI, Inc..
Sources checked
Every check behind this verdict
6 sources checked · 5 complete · 1 partial. Complete means the check returned a usable result; it does not mean the file is safe.
File fingerprint
- Last analyzed
- Oct 17, 2026, 1:23 PM UTC
- SHA-256
f7e114a361af2d6efad2b660e7d13cb7cf7163fbfec168784781954eeca4a8ee- SHA-1
5a5069f3a0f1869d5a574c1d304613966f6c86fa- MD5
68e984a45fe5846f3014b8bd3396bf1b
About this file
WisprFlowInstaller.dll is a Win32 EXE file of 6.2 MB.
- Type and size
- Win32 EXE · 6.2 MB
- Signer
- Wispr AI, Inc.Valid code signature.
- First seen
- Aug 11, 2026On VirusTotal.
- Submitted by
- 54 distinct sources
- Packer
- None detected
- Entropy
- 7.55 of 8
First scanned Updated
Antivirus consensus
0 of 69 engines flagged this file
6 of the 75 engines returned no result for this file (file type not supported, or the scan did not finish), so they did not check it.
- Tier-116 engines0flagged
- Tier-236 engines0flagged
- Low-trust17 engines0flagged
View all 75 engine results
- AcronisClean
- AhnLab-V3Clean
- AlibabaClean
- alibabacloudClean
- ALYacClean
- Antiy-AVLClean
- APEXClean
- ArcabitClean
- AvastClean
- Avast-MobileNo result
- AVGClean
- AviraClean
- BitDefenderClean
- BitDefenderFalxNo result
- BkavClean
- CAT-QuickHealClean
- ClamAVClean
- CMCClean
- CrowdStrikeClean
- CTXClean
- CylanceClean
- CynetClean
- DeepInstinctClean
- DrWebClean
- ElasticClean
- EmsisoftClean
- ESET-NOD32Clean
- F-SecureClean
- FortinetClean
- GDataClean
- GoogleClean
- GridinsoftClean
- huorongClean
- IkarusNo result
- JiangminClean
- K7AntiVirusClean
- K7GWClean
- KasperskyClean
- KingsoftClean
- LionicClean
- MalwarebytesClean
- MaxSecureClean
- McAfeeDClean
- MicrosoftClean
- MicroWorld-eScanClean
- NANO-AntivirusClean
- PaloaltoClean
- PandaClean
- RisingClean
- SangforClean
- SentinelOneClean
- SkyhighClean
- SophosClean
- SUPERAntiSpywareClean
- SymantecClean
- SymantecMobileInsightNo result
- TACHYONClean
- tehtrisClean
- TencentClean
- TrapmineClean
- TrellixENSClean
- TrendMicroNo result
- TrendMicro-HouseCallClean
- TrustlookNo result
- VaristClean
- VBA32Clean
- VIPREClean
- VirITClean
- ViRobotClean
- WebrootClean
- XcitiumClean
- YandexClean
- ZillyaClean
- ZoneAlarmClean
- ZonerClean
Signatures and behavior heuristics
Low-severity pattern matches — worth noting but not on their own cause for alarm.
VirusTotal's sandbox summary maps this run to MITRE T1055 (Process Injection), but no injected process of the sample's own was recorded (the analysis VM's own WMI adapter, crash handlers and Chrome updater are not counted). VirusTotal maps T1055 on about half of all files no engine flags, so the mapping alone is not evidence of injection.
EvidenceT1055 (sandbox MITRE mapping)
Section entropy & packers
No high-entropy executable section or known packer signature was detected. Data and resource sections can still have high entropy without indicating packed code.
How widely this file has been seen
Moderate prevalence — neither rare nor common. No strong prior applies.
Chapter 05
Questions & answers
Short answers to the 7 questions people ask most about this file.
Is WisprFlowInstaller.dll safe?
What is WisprFlowInstaller.dll?
How many antivirus engines detected WisprFlowInstaller.dll?
Is WisprFlowInstaller.dll digitally signed?
What is the SHA-256 hash of WisprFlowInstaller.dll?
Is it safe to run WisprFlowInstaller.dll?
How up to date is this analysis of WisprFlowInstaller.dll?
Community
Member reviews and reports for this exact file hash.