File scan report
Verdict Safe
Is cemu-
None of the 61 antivirus engines that checked it flagged this established Cemu disk image, while runtime and complete contacted-host checks found no corroborating hostile activity.
Read the whole reasonShow less
Strong evidence · Widely seen for a long time, and nothing harmful found.
Use a copy obtained from Cemu's official release channel and verify the published checksum if available. Keep macOS security protections enabled.
Good practice2 tips
We found nothing harmful in this file.
Install it only if it came from the developer's own website or an official app store.
Keep your security software and system updates switched on.
No scanner can promise a file is 100% safe.
Reads the latest antivirus results for this file's hash. Nothing is uploaded.
Antivirus results
0 of 61 flagged
- Flagged 0
- No detection 61
- No result 14
- Code signing Not applicable
- Test run Completed
- First seen 1y ago
Chapter 02
Why we think so
2 points against it and 5 in its favour, checked against the scan evidence.
The reasoning behind this verdict
None of the 61 antivirus engines that checked it flagged the file, including all 17 major contributors, and it has circulated broadly across 530 submitters. One completed observation from the test run produced no malicious verdict or high-risk technique, while all 26 observed contacted hosts were checked without a malicious or suspicious match.
The strongest evidence is the complete absence of detections among 75 engines, with all 17 major contributors also silent. The disk image is established rather than newly encountered, appearing across 530 submitters and 562 submissions. One completed observation from the test run recorded no malicious sandbox verdict and no high-risk MITRE technique. The host-reputation check covered all 26 distinct observed domains, IP addresses, and URLs and found no malicious or suspicious match. A third-party community annotation expressed mild suspicion, but it is uncorroborated by the engine, runtime, host, or researcher-rule evidence.
What We Detected
None of the 61 antivirus engines that checked it flagged the Macintosh disk image, including all 17 major contributors. No malware family was identified, and researcher intelligence produced no malware-specific YARA match or MalwareBazaar record.
Threat Behavior
One completed sandbox run launched the Cemu application and recorded no malicious sandbox verdict, high-risk MITRE technique, process injection, or persistence indicator. The reputation check covered all 26 distinct observed contacts and found no known-malicious or known-suspicious host. Five written or extracted files it created lack individual saved verdicts, which is missing coverage rather than evidence against them.
What To Do Now
The evidence is consistent with established commodity software. Obtain the disk image from the project's official release channel, verify its hash when the publisher provides one, and keep macOS security protections enabled.
Where this verdict could be wrong2 caveats
- A community annotation reports a sandbox suspicion score of 22/100, but it has no votes and is not corroborated by the completed runtime verdict or antivirus detections.
- Five dropped files lack saved verdicts, leaving their individual status unconfirmed even though none is recorded as a malicious child.
These are the assessment's weak points. If you believe one applies to your file, report the verdict and we'll re-review it.
- None of the 61 antivirus engines that checked it flagged the file, including all 17 major contributors.
- The file has been submitted 562 times by 530 distinct sources, indicating established circulation.
- The completed sandbox run produced no malicious verdict or high-risk behavior.
- All 26 observed contacted hosts were covered by the reputation check, with no malicious or suspicious matches.
- No malware-specific researcher rule or known malware repository match was found.
- A community annotation assigned a low sandbox suspicion score, although no other evidence corroborates it.
- Five extracted or written files it created do not have individual saved verdicts.
6 sources checked · all complete. See every source
Chapter 03
What it did in our test
It ran in our isolated test environment; no test environment rated what it did as risky.
Test run summary
Capture complete- 7sandbox rule tags
- 4spawned processes
- 26network contacts
- 8filesystem & mutex artifacts
What this file did when executed
This file was run in a sandbox and its runtime behaviour was observed.
Techniques observed in the sandbox
7MITRE ATT&CK techniques the sandbox mapped. Highlighted ones are rare in normal software; the others are common in legitimate programs too.
- T1027· Obfuscated code
- T1071· Application protocol
- T1082· System recon
- T1090
- T1095· Custom network
- T1518.001· Checks your AV
- T1573
Observed activity
Processes started
4Programs the file ran, with their command lines.
open/usr/bin/open /Volumes/Cemu/Cemu.appCemu/Volumes/Cemu/Cemu.app/Contents/MacOS/Cemuopen/usr/bin/open -Cemu/Volumes/Cemu/Cemu.app/Contents/MacOS/Cemu -
Network contacts
2626 hosts, listed as 6 domains, 20 addresses, 5 links. Links show the host and path only.
- Domain
ocsp.comodoca.com - Domain
ocsp.comodoca.com.cdn.cloudflare.net - Domain
ocsp.usertrust.com - Domain
api.apple-cloudkit.com - Domain
calendars.icloud.com - Domain
updates.cdn-apple.com
Show all 31 entries for network contacts
- IP address
151.101.3.6 - IP address
151.101.67.6 - IP address
151.101.131.6 - IP address
151.101.195.6 - IP address
17.253.20.125 - IP address
64.78.201.1 - IP address
17.253.144.10 - IP address
17.253.7.143 - IP address
17.253.21.204 - IP address
17.248.195.69 - IP address
17.248.195.70 - IP address
17.253.7.145 - IP address
64.78.200.1 - IP address
17.253.20.247 - IP address
17.253.21.205 - IP address
17.253.26.117 - IP address
17.248.195.74 - IP address
17.253.21.207 - IP address
17.248.195.73 - IP address
184.25.164.143 - URL
http://ocsp.comodoca.com/MFcwVaADAgEAME4wTDBKMAkGBSsOAwIaBQAEFOsl2JD%2BJyD0HX1qwV7vds9iz6t4BBR1cacZSBm8nZ3qQUfflMRId5nTeQIRAJjBcnaqg2kI3NxbTvi9QXQ%3D - URL
http://ocsp.usertrust.com/MFYwVKADAgEAME0wSzBJMAkGBSsOAwIaBQAEFM0w0kw0OoKrHwVwFYrXoQd2KZLpBBRTeb9aqitKz1SA4dibwJ3ysgNmywIQXfq7lXfPq2cfx93%2B0c8gWw%3D%3D - URL
http://ocsp.comodoca.com/MFcwVaADAgEAME4wTDBKMAkGBSsOAwIaBQAEFOsl2JD+JyD0HX1qwV7vds9iz6t4BBR1cacZSBm8nZ3qQUfflMRId5nTeQIRAJjBcnaqg2kI3NxbTvi9QXQ= - URL
http://ocsp.usertrust.com/MFYwVKADAgEAME0wSzBJMAkGBSsOAwIaBQAEFM0w0kw0OoKrHwVwFYrXoQd2KZLpBBRTeb9aqitKz1SA4dibwJ3ysgNmywIQXfq7lXfPq2cfx93+0c8gWw== - URL
http://ocsp.usertrust.com/ME8wTTBLMEkwRzAHBgUrDgMCGgQUzTDSTDQ6gqsfBXAVitehB3YpkukEFFN5v1qqK0rPVIDh2JvAnfKyA2bLAhBd+ruVd8+rZx/H3f7RzyBb
Files
8Files the file created, changed or deleted.
- Written
/Users/maria/Library/Application Support/Cemu/_kSP7MCqX.tmp - Written
/Users/maria/Library/Application Support/Cemu/_xcrTKLKR.tmp - Written
/Users/maria/Library/Caches/Cemu/_qTBAZlpa.tmp - Written
/var/db/analyticsd/aggregate_persist_temp - Written
/Users/user1/Library/Application Support/com.apple.spotlight/.dat.nosync01f3.rGkVE2 - Deleted
/Users/maria/Library/Application Support/Cemu/_kSP7MCqX.tmp
Show all 8 entries for files
- Deleted
/Users/maria/Library/Application Support/Cemu/_xcrTKLKR.tmp - Deleted
/Users/maria/Library/Caches/Cemu/_qTBAZlpa.tmp
Files this sample writes at runtime
This file drops 5 children at runtime. None are currently flagged malicious in our cache. 5 have no saved verdict and were not checked; that is missing coverage, not a finding.
- 747efbb344307093fe00…d06494Not checkedno saved verdict
- 7d8a1ee74213171b6879…73281cNot checkedno saved verdict
- 53503cd8ef402e0a4c9a…81ed2eNot checkedno saved verdict
- ebc525fff7979dad83b8…16a3a7Not checkedno saved verdict
- 14d02f4336c0717cc339…ca6438Not checkedno saved verdict
Chapter 04
Technical details
None of the 61 antivirus engines that checked it flag it.
Sources checked
Every check behind this verdict
6 sources checked · all complete. Complete means the check returned a usable result; it does not mean the file is safe.
File fingerprint
- Last analyzed
- Oct 11, 2026, 12:57 AM UTC
- SHA-256
698c4b298f94983e4d6c30e9687ba8ff05094dd3930837c5104cddc0b0a49e4e- SHA-1
44d544c07b8825fa9c78463d1d7a6e2e5ca1e70b- MD5
a817f6fa87f936020ef081b1e399d5c9
About this file
cemu-2.6-macos-12-x64.dmg is a Macintosh Disk Image file of 36.6 MB.
- Type and size
- Macintosh Disk Image · 36.6 MB
- Signer
- Not applicable
- First seen
- Feb 6, 2025On VirusTotal.
- Submitted by
- 530 distinct sources
First scanned
Antivirus consensus
0 of 61 engines flagged this file
14 of the 75 engines returned no result for this file (file type not supported, or the scan did not finish), so they did not check it.
- Tier-118 engines0flagged
- Tier-232 engines0flagged
- Low-trust11 engines0flagged
View all 75 engine results
- AcronisClean
- AhnLab-V3Clean
- AlibabaNo result
- alibabacloudClean
- ALYacClean
- Antiy-AVLClean
- APEXNo result
- ArcabitClean
- AvastClean
- Avast-MobileNo result
- AVGClean
- AviraClean
- BitDefenderClean
- BitDefenderFalxNo result
- BkavClean
- CAT-QuickHealClean
- ClamAVClean
- CMCClean
- CrowdStrikeClean
- CTXClean
- CylanceNo result
- CynetClean
- DeepInstinctNo result
- DrWebClean
- ElasticNo result
- EmsisoftClean
- ESET-NOD32Clean
- F-SecureClean
- FortinetClean
- GDataClean
- GoogleClean
- GridinsoftClean
- huorongClean
- IkarusClean
- JiangminClean
- K7AntiVirusClean
- K7GWClean
- KasperskyClean
- KingsoftClean
- LionicClean
- MalwarebytesClean
- MaxSecureClean
- McAfeeDClean
- MicrosoftClean
- MicroWorld-eScanClean
- NANO-AntivirusClean
- PaloaltoNo result
- PandaClean
- RisingClean
- SangforClean
- SentinelOneNo result
- SkyhighClean
- SophosClean
- SUPERAntiSpywareClean
- SymantecClean
- SymantecMobileInsightNo result
- TACHYONClean
- tehtrisNo result
- TencentClean
- TrapmineNo result
- TrellixENSClean
- TrendMicroClean
- TrendMicro-HouseCallClean
- TrustlookNo result
- VaristClean
- VBA32Clean
- VIPREClean
- VirITClean
- ViRobotClean
- WebrootNo result
- XcitiumClean
- YandexClean
- ZillyaClean
- ZoneAlarmClean
- ZonerClean
How widely this file has been seen
Widely seen in the wild for a long time. High prior this is legitimate; isolated detections on common-old files are usually false positives.
Chapter 05
Questions & answers
Short answers to the 6 questions people ask most about this file.
Is cemu-2.6-macos-12-x64.dmg safe?
What is cemu-2.6-macos-12-x64.dmg?
How many antivirus engines detected cemu-2.6-macos-12-x64.dmg?
What is the SHA-256 hash of cemu-2.6-macos-12-x64.dmg?
Is it safe to install cemu-2.6-macos-12-x64.dmg?
How up to date is this analysis of cemu-2.6-macos-12-x64.dmg?
Community
Member reviews and reports for this exact file hash.