File scan report
Verdict Safe
Is xenia_
This Xenia Canary emulator build is flagged by none of the 71 antivirus engines that checked it and behaved like an ordinary emulator in the sandbox, with no hostile activity…
Read the whole reasonShow less
Moderate evidence · No engine flags it, but no publisher signature confirms who made it.
This emulator build can be used normally. Obtain updates from the official Xenia Canary release page and keep your security software enabled.
Good practice2 tips
We found nothing harmful in this file.
Run it only if it came from the developer's own website or an official app store.
Keep your antivirus and Windows updates switched on.
No scanner can promise a file is 100% safe.
Reads the latest antivirus results for this file's hash. Nothing is uploaded.
Antivirus results
0 of 71 flagged
- Flagged 0
- No detection 71
- No result 4
- Code signing Unsigned
- Test run Completed
- First seen 8mo ago
Chapter 02
Why we think so
1 point against it and 5 in its favour, checked against the scan evidence.
The reasoning behind this verdict
In the sandbox it wrote its own log, config and shader cache and opened the project's GitHub wiki. All of the 22 contacted hosts we checked came back without a malicious or suspicious result.
None of the 71 antivirus engines that checked it flagged the file, and every major antivirus engine reported it clean. The sandbox run returned clean and recorded no high-risk techniques. The recorded behaviour fits a game emulator: a log file, a TOML config file, a DirectX shader cache, its own registry settings, and a browser opened to the project's quickstart wiki. No complete contacted-host reputation result was available. The file is unsigned, which is common for open-source nightly builds, and it is not packed.
What We Detected
None of the 71 antivirus engines that checked it flagged this file, and all 18 major antivirus engines reported it clean. The community YARA rules that matched are generic capability and anti-debug checks that ordinary software also matches. The file has no public malware database listing and has been seen from about 60 sources over roughly eight months.
Threat Behavior
In the sandbox the program created its own log and config files, a DirectX shader cache and its own registry settings. It then opened the Xenia Canary quickstart wiki on GitHub in the browser. No process injection target, persistence or credential access was recorded. The 22 contacted hosts we checked carry no malicious or suspicious reputation.
What To Do Now
The file appears to be a normal build of the Xenia Canary emulator. Download builds only from the project's official release page, and keep your antivirus enabled.
Where this verdict could be wrong1 caveat
- The file is unsigned, so its origin cannot be confirmed from a signature. A download outside the official project release channel could not be ruled out from this evidence alone.
These are the assessment's weak points. If you believe one applies to your file, report the verdict and we'll re-review it.
- None of the 71 antivirus engines that checked it flagged the file, including all 18 major antivirus engines.
- The sandbox run returned clean and showed only emulator-typical file, cache and settings activity.
- The program contacted only GitHub hosts, and none of the hosts we checked has a bad reputation.
- The file has been seen from about 60 sources over roughly eight months with no malware listing.
- The file is not packed or obfuscated.
- The executable is not digitally signed, so its publisher cannot be confirmed from a signature.
6 sources checked · 5 complete · 1 partial. See every source
Chapter 03
What it did in our test
It ran in our isolated test environment; no test environment rated what it did as risky.
Test run summary
Capture complete- 10sandbox rule tags
- 5spawned processes
- 37network contacts
- 32filesystem & mutex artifacts
Includes the sandbox verdicts, 10 mapped techniques, every process, file, registry and network entry and 5 dropped files.
Show the technical evidenceChapter 04
Technical details
None of the 71 antivirus engines that checked it flag it; no publisher signature.
Sources checked
Every check behind this verdict
6 sources checked · 5 complete · 1 partial. Complete means the check returned a usable result; it does not mean the file is safe.
File fingerprint
- Last analyzed
- Oct 9, 2026, 7:23 AM UTC
- SHA-256
76d57ad0a918cb485b2c2273b463b35fd2c9f27fc4a4d8b13af56ec7cb5c1a04- SHA-1
8f2e56bf1a7d4be162c9e479dffc6d5ddc36b0f7- MD5
21fb292e5435308e75a4cbc240d59899
About this file
xenia_canary.exe is a Win32 EXE file of 15.1 MB.
- Type and size
- Win32 EXE · 15.1 MB
- Signer
- UnsignedNo code signature.
- First seen
- Feb 15, 2026On VirusTotal.
- Submitted by
- 60 distinct sources
- Packer
- None detected
- Entropy
- 5.46 of 8
First scanned Updated
Verdict history
- Suspicious
- Safeafter a re-check of the saved evidence
Ratings change when antivirus engines, our checks or MalwareTips staff learn more about a file.
Includes every engine result (75), 25 matched signature rules, PE section entropy and packers and how widely the file has been seen.
Show the technical evidenceChapter 05
Questions & answers
Short answers to the 6 questions people ask most about this file.
Is xenia_canary.exe safe?
What is xenia_canary.exe?
How many antivirus engines detected xenia_canary.exe?
What is the SHA-256 hash of xenia_canary.exe?
Is it safe to run xenia_canary.exe?
How up to date is this analysis of xenia_canary.exe?
Community
Member reviews and reports for this exact file hash.