File scan report
Verdict Safe
Is NS-
This unsigned installer for the open-source NS-RPC project shows no major malicious signals, with only less reliable engines flagging it, consistent with common false-positive…
Read the whole reasonShow less
Moderate evidence · No engine flags it, but no publisher signature confirms who made it.
The file is likely safe for use. Ensure it was downloaded from the official project repository.
Good practice2 tips
We found nothing harmful in this file.
Install it only if it came from the developer's own website or an official app store.
Keep your antivirus and Windows updates switched on.
No scanner can promise a file is 100% safe.
Reads the latest antivirus results for this file's hash. Nothing is uploaded.
Antivirus results
2 of 64 flagged
- Flagged 2
- No detection 62
- No result 10
- Code signing Unsigned
- Test run Completed
- First seen 3y ago
Chapter 02
Why we think so
2 points against it and 3 in its favour, checked against the scan evidence.
The reasoning behind this verdict
Our analysis indicates this file is a legitimate installer for the NS-RPC project. The detections are limited to less reliable engines and lack corroboration from major antivirus engines or malicious behavioral indicators.
The file is an unsigned installer for a known open-source project, which explains the lack of a digital signature. While two less reliable engines flagged the file, no major antivirus engines identified it as malicious, and the behavioral analysis showed no evidence of actual compromise or malicious activity. The direct IP connections flagged by our rules are typical for certain installer frameworks. Given the age of the file and the lack of corroborating malicious signals, we consider this a false-positive scenario.
What We Detected
The file 'NS-RPC-windows-installer.exe' was analyzed across 74 antivirus engines. Only 2 less reliable engines provided generic 'Unsafe' or 'suspicious' labels, while all 17 major antivirus engines remained silent. The file is unsigned, which is common for community-driven open-source projects.
Threat Behavior
The file exhibited installer-like behavior, including creating directories and program markers associated with update processes. While a rule-based rule flagged direct IP connections, these are consistent with standard installer network activity and did not involve any known malicious infrastructure.
What To Do Now
This file appears to be a legitimate community-developed tool. If you obtained this file from the official project repository, it is likely safe to use. Ensure you always download software from trusted, official sources to maintain system integrity.
Where this verdict could be wrong2 caveats
- The 'one of our behaviour rules' rule flagged direct IP connections, which could be interpreted as suspicious behavior in a more restrictive environment.
- The lack of a digital signature prevents verification of the publisher, leaving the file's integrity reliant on the source repository.
These are the assessment's weak points. If you believe one applies to your file, report the verdict and we'll re-review it.
- 0/17 major antivirus engines malicious
- no malicious sandbox verdict
- medium prevalence (65 submissions)
- unsigned executable
- direct IP connections
6 sources checked · 5 complete · 1 partial. See every source
Chapter 03
What it did in our test
It ran in our isolated test environment; no test environment rated what it did as risky.
Test run summary
Capture complete- 24sandbox rule tags
- 2spawned processes
- 3network contacts
- 33filesystem & mutex artifacts
Includes 24 mapped techniques, every process, file, registry and network entry and 10 dropped files.
Show the technical evidenceChapter 04
Technical details
2 of the 64 antivirus engines that checked it flag it; no publisher signature.
Sources checked
Every check behind this verdict
6 sources checked · 5 complete · 1 partial. Complete means the check returned a usable result; it does not mean the file is safe.
Engines that flagged it 2
The saved verdict treats these detections as likely false positives.
- CylanceUnsafe
- Trapminesuspicious.low.ml.score
File fingerprint
- Last analyzed
- Jul 23, 2026, 9:22 PM UTC
- SHA-256
ca22633bae88e927bba2e96c43920f4cafb93c77a000e4922d0f0365e277eac9- SHA-1
cb549289046e1a603f2e31cc8ef6a4438c471f80- MD5
1b014f5ff25719146e1287a45af16ab8
About this file
NS-RPC-windows-installer.exe is a Win32 EXE file of 5.5 MB.
- Type and size
- Win32 EXE · 5.5 MB
- Signer
- UnsignedNo code signature.
- First seen
- Jun 10, 2023On VirusTotal.
- Submitted by
- 60 distinct sources
- Packer
- None detected
- Entropy
- 7.99 of 8
First scanned
Includes every engine result (74), PE section entropy and packers and how widely the file has been seen.
Show the technical evidenceChapter 05
Questions & answers
Short answers to the 6 questions people ask most about this file.
Is NS-RPC-windows-installer.exe safe?
What is NS-RPC-windows-installer.exe?
How many antivirus engines detected NS-RPC-windows-installer.exe?
What is the SHA-256 hash of NS-RPC-windows-installer.exe?
Is it safe to install NS-RPC-windows-installer.exe?
How up to date is this analysis of NS-RPC-windows-installer.exe?
Community
Member reviews and reports for this exact file hash.