File scan report
Verdict Safe
Is Whisper Desktop. exe safe? Yes, no threats found.
None of the 61 antivirus engines that checked it flag this widely shared desktop speech-to-text executable, and our sandbox runs recorded no high-risk behaviour or contact with…
Read the whole reasonShow less
Strong evidence · Widely seen for a long time, and nothing harmful found.
This file appears to be legitimate software. Use copies obtained from the official project release page and keep your security software enabled.
Good practice2 tips
We found nothing harmful in this file.
Run it only if it came from the developer's own website or an official app store.
Keep your antivirus and Windows updates switched on.
No scanner can promise a file is 100% safe.
Antivirus results
0 of 61 flagged
- Flagged 0
- No detection 61
- No result 14
- Code signing Unsigned
- Test run Completed
- First seen 3y ago
Chapter 02
Why we think so
2 points against it and 4 in its favour, checked against the scan evidence.
The reasoning behind this verdict
None of the 61 antivirus engines that checked it flagged this file, including 13 major antivirus engines that returned clean results. It has been shared by nearly 800 sources over more than three years. Five sandbox runs showed no high-risk techniques, no injection and no persistence, so the file looks like ordinary desktop software.
No engine detects the file, and the major antivirus engines that analysed it reported it clean. Its long history and wide distribution are typical of a popular open-source utility, not of targeted malware. The sandbox runs recorded only techniques common in legitimate software, with no injection into other processes and no persistence. The direct-IP network rule matched addresses that sit alongside the analysis machine's Microsoft background traffic, and none of the 22 hosts we checked has a bad reputation. The missing code signature is the main gap, but it is common for community-built tools.
What We Detected
None of the 61 antivirus engines that checked it flagged this unsigned 64-bit executable. Thirteen major antivirus engines returned clean results, and about 800 distinct sources have shared it since mid-2023.
Threat Behavior
Five sandbox runs recorded only techniques common in legitimate software, such as registry queries, system information discovery and module loading. There was no process injection, no persistence and no malicious sandbox result. The network traffic matched content-delivery and Microsoft address ranges, and none of the inspected hosts has a malicious or suspicious reputation.
What To Do Now
Download the tool only from its official project page, keep your antivirus enabled, and rescan any copy obtained from somewhere else.
Where this verdict could be wrong2 caveats
- The file is unsigned, so no publisher identity backs it.
- One external community scanner labelled it suspicious based on anti-debug and packing tags, though no engine detects it.
These are the assessment's weak points. If you believe one applies to your file, report the verdict and we'll re-review it.
- None of the 61 antivirus engines that checked it flagged it.
- Widely distributed for over three years by about 800 sources.
- Five sandbox runs showed no high-risk techniques, injection or persistence.
- None of the 22 contacted hosts we checked has a bad reputation.
- The executable is not code-signed, so no publisher identity is attached.
- It connected directly to several IP addresses, although they appear to be content-delivery and Microsoft infrastructure.
6 sources checked · all complete. See every source
Chapter 03
What it did in our test
It ran in 5 isolated tests; no test environment rated what it did as risky.
Test run summary
Capture complete- 5isolated sandbox runs
- 9sandbox rule tags
- 3spawned processes
- 17network contacts
- 15filesystem & mutex artifacts
What this file did when executed
This file was detonated in 5 sandboxes and its runtime behaviour was observed.
Sandbox verdicts
1- VT: CLEANclean
Techniques observed in the sandbox
9MITRE ATT&CK techniques the sandbox mapped. Highlighted ones are rare in normal software; the others are common in legitimate programs too.
- T1012
- T1027· Obfuscated code
- T1027.002· Obfuscated code
- T1071· Application protocol
- T1082· System recon
- T1083· Scans your files
- T1112
- T1129· Loads modules
- T1574.002· Execution hijack
Observed activity
Processes started
3Programs the file ran, with their command lines.
WhisperDesktop.exe%SAMPLEPATH%\WhisperDesktop.exe241e5d64de4c10377fb3f87da2da0a428069e3b268fa357b6d13bb8a634de9c7.exe%SAMPLEPATH%\241e5d64de4c10377fb3f87da2da0a428069e3b268fa357b6d13bb8a634de9c7.exesoftware.exe"C:\Users\user\Desktop\software.exe"
Network contacts
1717 hosts, listed as 17 addresses. Links show the host and path only.
- IP address
23.198.146.35 - IP address
23.53.122.135 - IP address
23.209.116.25 - IP address
20.22.113.133 - IP address
23.51.202.8 - IP address
23.204.150.28
Show all 17 entries for network contacts
- IP address
23.213.34.163 - IP address
23.60.131.209 - IP address
23.218.232.159 - IP address
104.98.118.171 - IP address
23.101.168.44 - IP address
23.32.75.41 - IP address
23.96.180.189 - IP address
23.46.228.49 - IP address
23.53.122.215 - IP address
23.34.172.74 - IP address
23.32.75.12
Files
15Files the file created, changed or deleted.
- Deleted
C:\ProgramData\Microsoft\Windows\WER\Temp\WER1B82.tmp.WERInternalMetadata.xml - Deleted
C:\ProgramData\Microsoft\Windows\WER\Temp\WER1C3D.tmp.csv - Deleted
C:\ProgramData\Microsoft\Windows\WER\Temp\WER1C7D.tmp.txt - Deleted
C:\ProgramData\Microsoft\Windows\WER\Temp\WER21EB.tmp.WERInternalMetadata.xml - Deleted
C:\ProgramData\Microsoft\Windows\WER\Temp\WER21EC.tmp.csv - Deleted
C:\ProgramData\Microsoft\Windows\WER\Temp\WER21FD.tmp.txt
Show all 15 entries for files
- Deleted
C:\Windows\System32\spp\store\2.0\cache\cache.dat - Deleted
C:\ProgramData\Microsoft\Windows\WER\Temp\WER2BBE.tmp.WERInternalMetadata.xml - Deleted
C:\ProgramData\Microsoft\Windows\WER\Temp\WER2C89.tmp.csv - Deleted
C:\ProgramData\Microsoft\Windows\WER\Temp\WER2CC9.tmp.txt - Deleted
C:\ProgramData\Microsoft\Windows\WER\Temp\WER2F2A.tmp.WERInternalMetadata.xml - Deleted
C:\ProgramData\Microsoft\Windows\WER\Temp\WER2F4A.tmp.csv - Deleted
C:\ProgramData\Microsoft\Windows\WER\Temp\WER2F5B.tmp.txt - Deleted
C:\ProgramData\Microsoft\Windows\WER\Temp\WER1298.tmp.WERInternalMetadata.xml - Deleted
C:\ProgramData\Microsoft\Windows\WER\Temp\WER14DB.tmp.csv
Registry and auto-start
2Settings the file changed, including ways to start again after a restart.
- Set
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\GoogleUpdaterInternalService126.0.6462.0\Start - Set
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\GoogleUpdaterInternalService126.0.6462.0\ImagePath
Sandbox background — not the file
17The analysis machine's own processes and connections, recorded in every run.
- VM process
wuapihost.exeC:\Windows\System32\wuapihost.exe - VM process
UI0Detect.exeC:\Windows\System32\UI0Detect.exe - VM process
updater.exeC:\Program Files\Google3000_904218327\bin\updater.exe - VM process
updater.exeC:\Program Files\Google1840_1130220904\bin\updater.exe - VM process
updater.exeC:\Program Files\Google2364_545521834\bin\updater.exe - VM process
updater.exeC:\Program Files\Google3016_2030620324\bin\updater.exe
Show all 17 entries for sandbox background — not the file
- VM injection target
\\?\C:\Windows\system32\wbem\WMIADAP.EXE - VM injection target
C:\Program Files\Google3000_904218327\bin\updater.exe - VM injection target
C:\Program Files\Google1840_1130220904\bin\updater.exe - VM injection target
C:\Program Files\Google2364_545521834\bin\updater.exe - VM injection target
C:\Program Files\Google3016_2030620324\bin\updater.exe - VM host
query.prod.cms.rt.microsoft.com - VM host
www.microsoft.com - VM host
res.public.onecdn.static.microsoft - VM host
a83f:8110:3100:2e00:3800:3700:3800:3000 - VM host
20.99.186.246 - VM host
192.229.211.108
Chapter 04
Technical details
None of the 61 antivirus engines that checked it flag it; no publisher signature.
Sources checked
Every check behind this verdict
6 sources checked · all complete. Complete means the check returned a usable result; it does not mean the file is safe.
File fingerprint
- Last analyzed
- Oct 21, 2026, 1:42 PM UTC
- SHA-256
241e5d64de4c10377fb3f87da2da0a428069e3b268fa357b6d13bb8a634de9c7- SHA-1
36632bcfb51be92cd2907c4f9c879dd01b200b8f- MD5
dc8fb5f2b64fc7324fe5904318d64b40
About this file
WhisperDesktop.exe says it is OpenAI's Whisper automatic speech recognition (ASR) model, 332.8 kB.
- Claims to be
- OpenAI's Whisper automatic speech recognition (ASR) modelFrom the file's own version information, written by whoever built it.
- Original name
- WhisperDesktop.exeMatches the shared file name.
- Type and size
- Win32 EXE · 332.8 kB
- Signer
- UnsignedNo code signature.
- First seen
- Jul 23, 2023On VirusTotal.
- Submitted by
- 792 distinct sources
- Packer
- None detected
- Entropy
- 6.33 of 8
First scanned
Antivirus consensus
0 of 61 engines flagged this file
14 of the 75 engines returned no result for this file (file type not supported, or the scan did not finish), so they did not check it.
- Tier-113 engines0flagged
- Tier-231 engines0flagged
- Low-trust17 engines0flagged
View all 75 engine results
- AcronisClean
- AhnLab-V3Clean
- AlibabaClean
- alibabacloudClean
- ALYacNo result
- Antiy-AVLClean
- APEXClean
- ArcabitNo result
- AvastClean
- Avast-MobileNo result
- AVGClean
- AviraClean
- BitDefenderNo result
- BitDefenderFalxNo result
- BkavClean
- CAT-QuickHealClean
- ClamAVClean
- CMCClean
- CrowdStrikeClean
- CTXNo result
- CylanceClean
- CynetClean
- DeepInstinctClean
- DrWebClean
- ElasticClean
- EmsisoftNo result
- ESET-NOD32No result
- F-SecureClean
- FortinetClean
- GDataClean
- GoogleNo result
- GridinsoftClean
- huorongClean
- IkarusClean
- JiangminClean
- K7AntiVirusClean
- K7GWClean
- KasperskyClean
- KingsoftClean
- LionicClean
- MalwarebytesClean
- MaxSecureClean
- McAfeeDClean
- MicrosoftClean
- MicroWorld-eScanClean
- NANO-AntivirusClean
- PaloaltoClean
- PandaClean
- RisingClean
- SangforClean
- SentinelOneClean
- SkyhighNo result
- SophosClean
- SUPERAntiSpywareClean
- SymantecClean
- SymantecMobileInsightNo result
- TACHYONClean
- tehtrisClean
- TencentClean
- TrapmineClean
- TrellixENSClean
- TrendMicroNo result
- TrendMicro-HouseCallNo result
- TrustlookNo result
- VaristClean
- VBA32Clean
- VIPREClean
- VirITClean
- ViRobotClean
- WebrootClean
- XcitiumClean
- YandexClean
- ZillyaClean
- ZoneAlarmClean
- ZonerClean
Section entropy & packers
No high-entropy executable section or known packer signature was detected. Data and resource sections can still have high entropy without indicating packed code.
How widely this file has been seen
Widely seen in the wild for a long time. High prior this is legitimate; isolated detections on common-old files are usually false positives.
Chapter 05
Questions & answers
Short answers to the 6 questions people ask most about this file.
Is WhisperDesktop.exe safe?
What is WhisperDesktop.exe?
How many antivirus engines detected WhisperDesktop.exe?
What is the SHA-256 hash of WhisperDesktop.exe?
Is it safe to run WhisperDesktop.exe?
How up to date is this analysis of WhisperDesktop.exe?
Community
Member reviews and reports for this exact file hash.