File scan report
Verdict Safe
Is EXM AI Removal Pack.
Nothing harmful found: none of the 62 antivirus engines that checked it flag it.
Moderate evidence · No engine flags it, but no publisher signature confirms who made it.
Review the batch scripts in a text editor and create a restore point before running them, since they deliberately change Windows settings.
Good practice2 tips
We found nothing harmful in this file.
Open it only if you trust the person or website you got it from.
Keep your security software and system updates switched on.
No scanner can promise a file is 100% safe.
Antivirus results
0 of 62 flagged
- Flagged 0
- No detection 62
- No result 13
- Code signing Not applicable
- Test run Completed
- First seen 9d ago
Chapter 02
Why we think so
1 point against it and 4 in its favour, checked against the scan evidence.
The reasoning behind this verdict
This ZIP holds batch scripts that turn off Windows AI features such as Copilot and Recall. None of the 62 antivirus engines that checked it flagged it, and two sandbox runs recorded no high-risk techniques, injection or malicious network activity. The scripts do make system changes, so review them before running.
None of the 62 antivirus engines that checked it flagged the archive, including all 18 major antivirus engines. The sandbox runs showed the archive extracting a README and eight batch scripts named for disabling Copilot, Recall, Edge, Office and other AI features. The only behaviour rule that matched was a low-severity reconnaissance check caused by a 'net session' command, which batch scripts commonly use to confirm administrator rights. No public malware database or community rule lists the file, and the only network contact was the analysis machine's own Microsoft background traffic. The scripts intentionally alter Windows settings and may remove built-in apps, which is a usability consideration rather than a sign of malware.
What We Detected
None of the 62 antivirus engines that checked it flagged this ZIP archive, and all 18 major antivirus engines returned clean. No public malware database or community rule set lists it.
Threat Behavior
In two sandbox runs the archive extracted a README and eight batch scripts aimed at disabling Windows AI features (Copilot, Recall, AI in Search, Edge, Paint, Notepad and Office, AI apps and a background service). One script ran a 'net session' command, a routine check for administrator rights. No process injection, persistence or high-risk techniques were recorded, and the only network contact was the analysis machine's own background traffic.
What To Do Now
If you intended to disable Windows AI features, open the scripts in a text editor first to confirm what each one changes, and consider creating a restore point. Keep your antivirus enabled while running them.
Where this verdict could be wrong1 caveat
- The scripts change system settings and remove built-in apps by design, so a user can lose Windows features; our own static analysis of the script contents was not available.
These are the assessment's weak points. If you believe one applies to your file, report the verdict and we'll re-review it.
- None of the 62 antivirus engines that checked it flagged the archive, including every major antivirus engine.
- Sandbox runs recorded no high-risk techniques, injection or persistence.
- Not listed in any public malware database or matched by malware-specific rules.
- The only network contact was the analysis machine's own background traffic.
- The scripts change Windows settings and may remove built-in apps, which can be hard to undo.
6 sources checked · all complete. See every source
Chapter 03
What it did in our test
It ran in 2 isolated tests; no test environment rated what it did as risky.
Test run summary
Capture complete- 2isolated sandbox runs
- 7sandbox rule tags
- 15spawned processes
- 0network contacts
- 15filesystem & mutex artifacts
Includes 7 mapped techniques, every process, file, registry and network entry and 10 dropped files.
Show the technical evidenceChapter 04
Technical details
None of the 62 antivirus engines that checked it flag it.
Sources checked
Every check behind this verdict
6 sources checked · all complete. Complete means the check returned a usable result; it does not mean the file is safe.
File fingerprint
- Last analyzed
- Oct 21, 2026, 2:44 PM UTC
- SHA-256
4ec060d1cd0894c8ccf54becf68983c1380a0cadc319ee608c831668ab401dff- SHA-1
ffbbcf92a320b144883148c2ca35c92253933642- MD5
d985c7c17c0c85688a2e8f7c0e099938
About this file
EXM AI Removal Pack.zip is a ZIP file of 8.6 kB.
- Type and size
- ZIP · 8.6 kB
- Signer
- Not applicable
- First seen
- Oct 16, 2026On VirusTotal.
- Submitted by
- 5 distinct sourcesRarely seen: few people have submitted this exact file.
First scanned
Includes every engine result (75), 1 matched signature rule and how widely the file has been seen.
Show the technical evidenceChapter 05
Questions & answers
Short answers to the 6 questions people ask most about this file.
Is EXM AI Removal Pack.zip safe?
What is EXM AI Removal Pack.zip?
How many antivirus engines detected EXM AI Removal Pack.zip?
What is the SHA-256 hash of EXM AI Removal Pack.zip?
Is it safe to open or extract EXM AI Removal Pack.zip?
How up to date is this analysis of EXM AI Removal Pack.zip?
Community
Member reviews and reports for this exact file hash.