File scan report
Verdict Safe
Is Win
None of the 71 antivirus engines that checked it flagged this validly signed NSIS portable launcher, first seen in 2016, and nine sandbox runs showed no injection, dropped files…
Read the whole reasonShow less
Strong evidence · A verified publisher signature, and no engine flags it.
This file looks safe to use. Get it from the official source and keep your antivirus protection enabled.
Good practice2 tips
We found nothing harmful in this file.
Run it only if it came from the developer's own website or an official app store.
Keep your antivirus and Windows updates switched on.
No scanner can promise a file is 100% safe.
Antivirus results
0 of 71 flagged
- Flagged 0
- No detection 71
- No result 5
- Code signing Rare Ideas, LLC
- Test run Completed
- First seen 10y ago
Chapter 02
Why we think so
1 point against it and 4 in its favour, checked against the scan evidence.
The reasoning behind this verdict
None of the 71 antivirus engines that checked it flagged this file, including 18 major antivirus engines that reported it clean. The sandbox runs were clean, with no injection and no flagged hosts contacted.
No engine flagged the file, and 71 engines returned results, so coverage is adequate. The signature verifies as valid, although the signer has no history with us. The combined sandbox verdict was clean, with only installer-style activity: temporary NSIS files and standard input-handling mappings. No injection targets were named, and no malicious or suspicious contacted hosts were found among the 5 inspected. The file has been in circulation since 2016 with 73 submitters, and no external intelligence source lists it.
What We Detected
No detections from 76 engines. The file is an NSIS-built portable launcher with a valid signature from Rare Ideas, LLC.
Threat Behavior
The sandbox runs showed temporary-file extraction and techniques common in legitimate software. There was no process injection, no dropped files with verdicts and no malicious hosts among those inspected.
What To Do Now
Normal use is reasonable. Download it from the official source and keep your security software enabled.
Where this verdict could be wrong2 caveats
- The signer has no history in our data and is not a curated trusted publisher, so the signature gives limited assurance.
- Similar files sharing the same NSIS import table include one suspicious past verdict, but that match reflects the shared installer framework, not this file.
These are the assessment's weak points. If you believe one applies to your file, report the verdict and we'll re-review it.
- No detections from any of the 76 engines
- Valid code signature from Rare Ideas, LLC
- Clean combined sandbox verdict across nine runs
- Widely submitted since 2016 by 73 sources
- The signer has no history in our data.
6 sources checked · all complete. See every source
Chapter 03
What it did in our test
It ran in 9 isolated tests; no test environment rated what it did as risky.
Test run summary
Capture complete- 9isolated sandbox runs
- 18sandbox rule tags
- 3spawned processes
- 3network contacts
- 22filesystem & mutex artifacts
What this file did when executed
This file was detonated in 9 sandboxes and its runtime behaviour was observed.
Sandbox verdicts
1- VT: CLEANclean
Techniques observed in the sandbox
18MITRE ATT&CK techniques the sandbox mapped. Highlighted ones are rare in normal software; the others are common in legitimate programs too.
- T1010
- T1012
- T1027· Obfuscated code
- T1056· Keylogging
- T1056.001· Keylogging
- T1059· Runs commands
- T1070.004· Covers its tracks
- T1071· Application protocol
- T1082· System recon
- T1083· Scans your files
- T1112
- T1115
- T1125
- T1129· Loads modules
- T1222
- T1529
- T1547.009· Auto-start
- T1574.002· Execution hijack
Observed activity
Processes started
3Programs the file ran, with their command lines.
file.exe"C:\Users\<USER>\Desktop\file.exe"e233fe3d6007dcb1ca4a6d037b08ffd871cc75ef86ca83bea9386d5f03d21ae7.exe%SAMPLEPATH%\e233fe3d6007dcb1ca4a6d037b08ffd871cc75ef86ca83bea9386d5f03d21ae7.exesoftware.exe"C:\Users\user\Desktop\software.exe"
Network contacts
33 hosts, listed as 1 domain, 2 addresses. Links show the host and path only.
- Domain
VBOXSVR.ovh.net - IP address
173.194.195.94 - IP address
<MACHINE_DNS_SERVER>
Files
15Files the file created, changed or deleted.
- Written
C:\Users\<USER>\AppData\Local\Temp\nsz485A.tmp - Written
C:\Documents and Settings\Administrator\Local Settings\Temp\nsi3.tmp - Written
C:\DOCUME~1\<USER>~1\LOCALS~1\Temp\nso2.tmp - Written
C:\Users\<USER>\AppData\Local\Temp\nsg888B.tmp - Written
C:\Users\user\AppData\Local\Microsoft\Windows\Caches - Written
C:\Users\user\AppData\Local\Temp\
Show all 15 entries for files
- Written
C:\Users\user\AppData\Local\Temp\nsf2523.tmp - Written
C:\Users\user\AppData\Local\Temp\nsf2524.tmp - Deleted
C:\Windows\System32\wbem\Performance\WmiApRpl.h - Deleted
C:\Windows\System32\wbem\Performance\WmiApRpl.ini - Deleted
C:\Documents and Settings\Administrator\Local Settings\Temp\nss2.tmp - Deleted
C:\Documents and Settings\Administrator\Local Settings\Temp\nsi3.tmp - Deleted
C:\DOCUME~1\<USER>~1\LOCALS~1\Temp\nso1.tmp - Deleted
C:\Users\<USER>\AppData\Local\Temp\nsq887A.tmp - Deleted
C:\Users\user\AppData\Local\Temp\nsf2523.tmp
Mutexes
7Named locks a program uses so only one copy runs; malware families often reuse them.
CTF.LBES.MutexDefaultS-1-5-21-1482476501-1645522239-1417001333-500CTF.Compart.MutexDefaultS-1-5-21-1482476501-1645522239-1417001333-500CTF.Asm.MutexDefaultS-1-5-21-1482476501-1645522239-1417001333-500CTF.Layouts.MutexDefaultS-1-5-21-1482476501-1645522239-1417001333-500CTF.TMD.MutexDefaultS-1-5-21-1482476501-1645522239-1417001333-500CTF.TimListCache.FMPDefaultS-1-5-21-1482476501-1645522239-1417001333-500MUTEX.DefaultS-1-5-21-1482476501-1645522239-1417001333-500
Show all 7 entries for mutexes
MSCTF.Shared.MUTEX.EBH
Sandbox background — not the file
2The analysis machine's own processes and connections, recorded in every run.
- VM host
20.99.186.246 - VM host
23.198.171.50
Chapter 04
Technical details
None of the 71 antivirus engines that checked it flag it; signed by Rare Ideas, LLC.
Sources checked
Every check behind this verdict
6 sources checked · all complete. Complete means the check returned a usable result; it does not mean the file is safe.
File fingerprint
- Last analyzed
- Oct 25, 2026, 2:21 PM UTC
- SHA-256
e233fe3d6007dcb1ca4a6d037b08ffd871cc75ef86ca83bea9386d5f03d21ae7- SHA-1
ed9f6aac5b33b9adafb7784d67f530e58f942c28- MD5
2c8b2510d396ca26e6ee0bab6cca1a40
About this file
WinCDEmuPortable.exe says it is WinCDEmu Portable (PortableApps.com Launcher) (WinCDEmu Portable), 158.3 kB.
- Claims to be
- WinCDEmu Portable (PortableApps.com Launcher) (WinCDEmu Portable)From the file's own version information, written by whoever built it.
- Original name
- WinCDEmuPortable.exeMatches the shared file name.
- Type and size
- Win32 EXE · 158.3 kB
- Signer
- Rare Ideas, LLCValid code signature.
- First seen
- Feb 12, 2016On VirusTotal.
- Submitted by
- 73 distinct sources
- Packer
- None detected
- Entropy
- 5.76 of 8
First scanned
Antivirus consensus
0 of 71 engines flagged this file
5 of the 76 engines returned no result for this file (file type not supported, or the scan did not finish), so they did not check it.
- Tier-118 engines0flagged
- Tier-235 engines0flagged
- Low-trust18 engines0flagged
View all 76 engine results
- AcronisClean
- AhnLab-V3Clean
- AlibabaClean
- alibabacloudClean
- ALYacClean
- Antiy-AVLClean
- APEXClean
- ArcabitClean
- AvastClean
- Avast-MobileNo result
- AVGClean
- AviraClean
- BaiduClean
- BitDefenderClean
- BitDefenderFalxNo result
- BkavClean
- CAT-QuickHealClean
- ClamAVClean
- CMCClean
- CrowdStrikeClean
- CTXClean
- CylanceClean
- CynetClean
- DeepInstinctClean
- DrWebClean
- ElasticClean
- EmsisoftClean
- ESET-NOD32Clean
- F-SecureClean
- FortinetClean
- GDataClean
- GoogleClean
- GridinsoftClean
- huorongClean
- IkarusClean
- JiangminClean
- K7AntiVirusClean
- K7GWClean
- KasperskyClean
- KingsoftNo result
- LionicClean
- MalwarebytesClean
- MaxSecureClean
- McAfeeDClean
- MicrosoftClean
- MicroWorld-eScanClean
- NANO-AntivirusClean
- PaloaltoClean
- PandaClean
- RisingClean
- SangforClean
- SentinelOneClean
- SkyhighClean
- SophosClean
- SUPERAntiSpywareClean
- SymantecClean
- SymantecMobileInsightNo result
- TACHYONClean
- tehtrisClean
- TencentClean
- TrapmineClean
- TrellixENSClean
- TrendMicroClean
- TrendMicro-HouseCallClean
- TrustlookNo result
- VaristClean
- VBA32Clean
- VIPREClean
- VirITClean
- ViRobotClean
- WebrootClean
- XcitiumClean
- YandexClean
- ZillyaClean
- ZoneAlarmClean
- ZonerClean
Section entropy & packers
No high-entropy executable section or known packer signature was detected. Data and resource sections can still have high entropy without indicating packed code.
These identify the compiler, runtime or installer used to build the file. They are not packing and are not a risk signal on their own.
How widely this file has been seen
Moderate prevalence — neither rare nor common. No strong prior applies.
Chapter 05
Questions & answers
Short answers to the 7 questions people ask most about this file.
Is WinCDEmuPortable.exe safe?
What is WinCDEmuPortable.exe?
How many antivirus engines detected WinCDEmuPortable.exe?
Is WinCDEmuPortable.exe digitally signed?
What is the SHA-256 hash of WinCDEmuPortable.exe?
Is it safe to run WinCDEmuPortable.exe?
How up to date is this analysis of WinCDEmuPortable.exe?
Community
Member reviews and reports for this exact file hash.