File scan report
Verdict Safe
Is EXM AI Removal Pack.
Nothing harmful found: none of the 62 antivirus engines that checked it flag it.
Moderate evidence · No engine flags it, but no publisher signature confirms who made it.
Review the batch scripts in a text editor and create a restore point before running them, since they deliberately change Windows settings.
Good practice2 tips
We found nothing harmful in this file.
Open it only if you trust the person or website you got it from.
Keep your security software and system updates switched on.
No scanner can promise a file is 100% safe.
Antivirus results
0 of 62 flagged
- Flagged 0
- No detection 62
- No result 13
- Code signing Not applicable
- Test run Completed
- First seen 9d ago
Chapter 02
Why we think so
1 point against it and 4 in its favour, checked against the scan evidence.
The reasoning behind this verdict
This ZIP holds batch scripts that turn off Windows AI features such as Copilot and Recall. None of the 62 antivirus engines that checked it flagged it, and two sandbox runs recorded no high-risk techniques, injection or malicious network activity. The scripts do make system changes, so review them before running.
None of the 62 antivirus engines that checked it flagged the archive, including all 18 major antivirus engines. The sandbox runs showed the archive extracting a README and eight batch scripts named for disabling Copilot, Recall, Edge, Office and other AI features. The only behaviour rule that matched was a low-severity reconnaissance check caused by a 'net session' command, which batch scripts commonly use to confirm administrator rights. No public malware database or community rule lists the file, and the only network contact was the analysis machine's own Microsoft background traffic. The scripts intentionally alter Windows settings and may remove built-in apps, which is a usability consideration rather than a sign of malware.
What We Detected
None of the 62 antivirus engines that checked it flagged this ZIP archive, and all 18 major antivirus engines returned clean. No public malware database or community rule set lists it.
Threat Behavior
In two sandbox runs the archive extracted a README and eight batch scripts aimed at disabling Windows AI features (Copilot, Recall, AI in Search, Edge, Paint, Notepad and Office, AI apps and a background service). One script ran a 'net session' command, a routine check for administrator rights. No process injection, persistence or high-risk techniques were recorded, and the only network contact was the analysis machine's own background traffic.
What To Do Now
If you intended to disable Windows AI features, open the scripts in a text editor first to confirm what each one changes, and consider creating a restore point. Keep your antivirus enabled while running them.
Where this verdict could be wrong1 caveat
- The scripts change system settings and remove built-in apps by design, so a user can lose Windows features; our own static analysis of the script contents was not available.
These are the assessment's weak points. If you believe one applies to your file, report the verdict and we'll re-review it.
- None of the 62 antivirus engines that checked it flagged the archive, including every major antivirus engine.
- Sandbox runs recorded no high-risk techniques, injection or persistence.
- Not listed in any public malware database or matched by malware-specific rules.
- The only network contact was the analysis machine's own background traffic.
- The scripts change Windows settings and may remove built-in apps, which can be hard to undo.
6 sources checked · all complete. See every source
Chapter 03
What it did in our test
It ran in 2 isolated tests; no test environment rated what it did as risky.
Test run summary
Capture complete- 2isolated sandbox runs
- 7sandbox rule tags
- 15spawned processes
- 0network contacts
- 15filesystem & mutex artifacts
What this file did when executed
This file was detonated in 2 sandboxes and its runtime behaviour was observed.
Techniques observed in the sandbox
7MITRE ATT&CK techniques the sandbox mapped. Highlighted ones are rare in normal software; the others are common in legitimate programs too.
- T1033· Reads user info
- T1059· Runs commands
- T1064
- T1082· System recon
- T1202
- T1497· Sandbox evasion
- T1574· Execution hijack
Observed activity
Processes started
15Programs the file ran, with their command lines.
net.exeC:\Windows\SysWOW64\net.exe net sessioncmd.exe"C:\Windows\system32\cmd.exe" /c "cd ^"C:\Users\<USER>\AppData\Local\Temp^" && start /wait ^"^" ^"C:\Users\<USER>\AppData\Local\Temp\1 - Disable Copilot.bat^"cmd.exeC:\Windows\system32\cmd.exe /K "C:\Users\<USER>\AppData\Local\Temp\1 - Disable Copilot.batcmd.exe"C:\Windows\system32\cmd.exe" /c "cd ^"C:\Users\<USER>\AppData\Local\Temp^" && start /wait ^"^" ^"C:\Users\<USER>\AppData\Local\Temp\2 - Disable Recall and Windows AI.bat^"cmd.exeC:\Windows\system32\cmd.exe /K "C:\Users\<USER>\AppData\Local\Temp\2 - Disable Recall and Windows AI.batcmd.exe"C:\Windows\system32\cmd.exe" /c "cd ^"C:\Users\<USER>\AppData\Local\Temp^" && start /wait ^"^" ^"C:\Users\<USER>\AppData\Local\Temp\3 - Disable AI in Search, Typing and Voice.bat^"
Show all 15 entries for processes started
cmd.exeC:\Windows\system32\cmd.exe /K "C:\Users\<USER>\AppData\Local\Temp\3 - Disable AI in Search, Typing and Voice.batcmd.exe"C:\Windows\system32\cmd.exe" /c "cd ^"C:\Users\<USER>\AppData\Local\Temp^" && start /wait ^"^" ^"C:\Users\<USER>\AppData\Local\Temp\4 - Disable AI in Edge.bat^"cmd.exeC:\Windows\system32\cmd.exe /K "C:\Users\<USER>\AppData\Local\Temp\4 - Disable AI in Edge.batcmd.exe"C:\Windows\system32\cmd.exe" /c "cd ^"C:\Users\<USER>\AppData\Local\Temp^" && start /wait ^"^" ^"C:\Users\<USER>\AppData\Local\Temp\5 - Disable AI in Paint and Notepad.bat^"cmd.exeC:\Windows\system32\cmd.exe /K "C:\Users\<USER>\AppData\Local\Temp\5 - Disable AI in Paint and Notepad.batcmd.exe"C:\Windows\system32\cmd.exe" /c "cd ^"C:\Users\<USER>\AppData\Local\Temp^" && start /wait ^"^" ^"C:\Users\<USER>\AppData\Local\Temp\6 - Disable AI in Office.bat^"cmd.exeC:\Windows\system32\cmd.exe /K "C:\Users\<USER>\AppData\Local\Temp\6 - Disable AI in Office.batcmd.exe"C:\Windows\system32\cmd.exe" /c "cd ^"C:\Users\<USER>\AppData\Local\Temp^" && start /wait ^"^" ^"C:\Users\<USER>\AppData\Local\Temp\7 - Remove AI Apps.bat^"cmd.exeC:\Windows\system32\cmd.exe /K "C:\Users\<USER>\AppData\Local\Temp\7 - Remove AI Apps.bat
Files
15Files the file created, changed or deleted.
- Written
C:\Users\user\AppData\Local\Temp\3ecudybk.3yg\README.txt - Written
C:\Users\user\AppData\Local\Temp\3ecudybk.3yg - Written
C:\Users\user\AppData\Local\Temp\3ecudybk.3yg\1 - Disable Copilot.bat - Written
C:\Users\user\AppData\Local\Temp\3ecudybk.3yg\2 - Disable Recall and Windows AI.bat - Written
C:\Users\user\AppData\Local\Temp\3ecudybk.3yg\3 - Disable AI in Search, Typing and Voice.bat - Written
C:\Users\user\AppData\Local\Temp\3ecudybk.3yg\4 - Disable AI in Edge.bat
Show all 15 entries for files
- Written
C:\Users\user\AppData\Local\Temp\3ecudybk.3yg\5 - Disable AI in Paint and Notepad.bat - Written
C:\Users\user\AppData\Local\Temp\3ecudybk.3yg\6 - Disable AI in Office.bat - Written
C:\Users\user\AppData\Local\Temp\3ecudybk.3yg\7 - Remove AI Apps.bat - Written
C:\Users\user\AppData\Local\Temp\3ecudybk.3yg\8 - Disable AI Background Service.bat - Written
C:\Users\user\AppData\Local\Temp\3ecudybk.3yg\9 - Remove Recall.bat - Written
C:\Users\user\AppData\Local\Temp\3ecudybk.3yg\Optional - Remove Xbox Game Bar.bat - Written
C:\Users\user\AppData\Local\Temp\3ecudybk.3yg\Revert - Restore Windows AI.bat - Written
C:\Users\user\AppData\Local\Temp\unarchiver.log - Written
\Device\ConDrv\\Connect
Sandbox background — not the file
1The analysis machine's own processes and connections, recorded in every run.
- VM host
atm.teams.mira.tm.svc.cloud.microsoft
Files this sample writes at runtime
This file drops 10 children at runtime. None are currently flagged malicious in our cache. 10 have no saved verdict and were not checked; that is missing coverage, not a finding.
- 70535edf56b75ae180c3…1d028fNot checkedno saved verdict
- 338dc093fd039cdb9295…4e53efNot checkedno saved verdict
- 1fbef62d4783703b134b…b15ed3Not checkedno saved verdict
- 22a261f030d373dbcd23…010158Not checkedno saved verdict
- 89d19b0d76f109c8a55d…39eff7Not checkedno saved verdict
- 16edec03a203f6b8ae3a…16fdabNot checkedno saved verdict
- 68d45aa74deba8e1e9fe…868294Not checkedno saved verdict
- f592c7a6559256ec4450…ad3026Not checkedno saved verdict
- 42a443bf2a3ebba5d53c…1aa448Not checkedno saved verdict
- ae029180fbf4676e8f7d…497263Not checkedno saved verdict
Chapter 04
Technical details
None of the 62 antivirus engines that checked it flag it.
Sources checked
Every check behind this verdict
6 sources checked · all complete. Complete means the check returned a usable result; it does not mean the file is safe.
File fingerprint
- Last analyzed
- Oct 21, 2026, 2:44 PM UTC
- SHA-256
4ec060d1cd0894c8ccf54becf68983c1380a0cadc319ee608c831668ab401dff- SHA-1
ffbbcf92a320b144883148c2ca35c92253933642- MD5
d985c7c17c0c85688a2e8f7c0e099938
About this file
EXM AI Removal Pack.zip is a ZIP file of 8.6 kB.
- Type and size
- ZIP · 8.6 kB
- Signer
- Not applicable
- First seen
- Oct 16, 2026On VirusTotal.
- Submitted by
- 5 distinct sourcesRarely seen: few people have submitted this exact file.
First scanned
Antivirus consensus
0 of 62 engines flagged this file
13 of the 75 engines returned no result for this file (file type not supported, or the scan did not finish), so they did not check it.
- Tier-118 engines0flagged
- Tier-231 engines0flagged
- Low-trust13 engines0flagged
View all 75 engine results
- AcronisClean
- AhnLab-V3Clean
- AlibabaClean
- alibabacloudClean
- ALYacClean
- Antiy-AVLClean
- APEXNo result
- ArcabitClean
- AvastClean
- Avast-MobileClean
- AVGClean
- AviraClean
- BitDefenderClean
- BitDefenderFalxNo result
- BkavClean
- CAT-QuickHealClean
- ClamAVClean
- CMCClean
- CrowdStrikeClean
- CTXClean
- CylanceNo result
- CynetClean
- DeepInstinctNo result
- DrWebClean
- ElasticNo result
- EmsisoftClean
- ESET-NOD32Clean
- F-SecureClean
- FortinetClean
- GDataClean
- GoogleClean
- GridinsoftClean
- huorongClean
- IkarusClean
- JiangminClean
- K7AntiVirusClean
- K7GWClean
- KasperskyClean
- KingsoftClean
- LionicNo result
- MalwarebytesClean
- MaxSecureClean
- McAfeeDClean
- MicrosoftClean
- MicroWorld-eScanClean
- NANO-AntivirusClean
- PaloaltoNo result
- PandaClean
- RisingClean
- SangforClean
- SentinelOneNo result
- SkyhighClean
- SophosClean
- SUPERAntiSpywareClean
- SymantecClean
- SymantecMobileInsightNo result
- TACHYONClean
- tehtrisNo result
- TencentClean
- TrapmineNo result
- TrellixENSClean
- TrendMicroClean
- TrendMicro-HouseCallClean
- TrustlookNo result
- VaristClean
- VBA32Clean
- VIPREClean
- VirITClean
- ViRobotClean
- WebrootClean
- XcitiumClean
- YandexClean
- ZillyaNo result
- ZoneAlarmClean
- ZonerClean
Signatures and behavior heuristics
Low-severity pattern matches — worth noting but not on their own cause for alarm.
How widely this file has been seen
Moderate prevalence — neither rare nor common. No strong prior applies.
Chapter 05
Questions & answers
Short answers to the 6 questions people ask most about this file.
Is EXM AI Removal Pack.zip safe?
What is EXM AI Removal Pack.zip?
How many antivirus engines detected EXM AI Removal Pack.zip?
What is the SHA-256 hash of EXM AI Removal Pack.zip?
Is it safe to open or extract EXM AI Removal Pack.zip?
How up to date is this analysis of EXM AI Removal Pack.zip?
Community
Member reviews and reports for this exact file hash.