File scan report
Verdict Safe
Analyzed , 7 days ago
Is winutil-
None of the 65 antivirus engines that checked it flagged this archive of PowerShell-based Windows utility scripts, and the sandbox runs recorded no high-risk techniques.
Read the whole reasonShow less
Moderate evidence · No engine flags it, but no publisher signature confirms who made it.
This archive can be used. Download it from the official project page and review any system tweaks before applying them.
Good practice2 tips
We found nothing harmful in this file.
Open it only if you trust the person or website you got it from.
Keep your security software and system updates switched on.
No scanner can promise a file is 100% safe.
Antivirus results
0 of 65 flagged
- Flagged 0
- No detection 65
- No result 10
Filewinutil-
- Code signing Not applicable
- Test run Completed
- First seen 18d ago
Chapter 02
Why we think so
1 point against it and 3 in its favour, checked against the scan evidence.
MT AI Engine · Verdict analysis
The reasoning behind this verdict
Analyst conclusion
It contains a PowerShell Windows tweaking utility. In two sandbox runs, the archive's own scripts ran without high-risk techniques, injection targets or persistence. Public malware databases and community rules returned no matches.
Full reasoning
No engine reported the archive, including all 18 major antivirus engines. The two sandbox runs show PowerShell running the tool's own function scripts from the extracted folder. That matches what a script-based Windows utility does. No public malware database or community rule lists the file. A contacted-host reputation result is not available, but the runs recorded no network contacts from the sample.
Detailed assessment
What We Detected
None of the 65 antivirus engines that checked it flagged this ZIP archive, and all 18 major antivirus engines reported it clean. Public malware databases and community YARA rules returned no matches.
Threat Behavior
In two sandbox runs, PowerShell executed the utility's own scripts, such as tweak-report and install-area initialisation functions. The runs recorded no high-risk techniques, no injection targets, no persistence and no network contacts from the sample. File and registry writes were ordinary shell and jump-list activity.
What To Do Now
Get the tool from its official project source. This utility changes Windows settings, so review the tweaks before applying them. Keep your antivirus enabled while you use it.
Where this verdict could be wrong1 caveat
- The archive runs PowerShell scripts with execution-policy bypass and changes system settings by design, so a tampered copy would be harder to tell apart from the real tool. No engine or rule found such tampering here.
These are the assessment's weak points. If you believe one applies to your file, report the verdict and we'll re-review it.
Points in its favour
- None of the 65 antivirus engines that checked it flagged the archive.
- The sandbox runs recorded no high-risk techniques, injection targets or persistence.
- No matches in public malware databases or malware-specific YARA rules.
Points against
- The tool runs PowerShell scripts with execution-policy bypass and is designed to change system settings.
6 sources checked · 5 complete · 1 not needed or not applicable. See every source
Chapter 03
What it did in our test
It ran in 2 isolated tests; no test environment rated what it did as risky.
Test run summary
Capture complete- 2isolated sandbox runs
- 18sandbox rule tags
- 15spawned processes
- 0network contacts
- 30filesystem & mutex artifacts
Runtime behaviour
What this file did when executed
This file was detonated in 2 sandboxes and its runtime behaviour was observed.
Techniques observed in the sandbox
18MITRE ATT&CK techniques the sandbox mapped. Highlighted ones are rare in normal software; the others are common in legitimate programs too.
- T1012
- T1027· Obfuscated code
- T1033· Reads user info
- T1055· Process injection
- T1059· Runs commands
- T1069
- T1071· Application protocol
- T1074
- T1082· System recon
- T1105· Network file transfer
- T1106
- T1129· Loads modules
- T1485
- T1497· Sandbox evasion
- T1518· Checks your AV
- T1562· Disables security
- T1573
- T1574· Execution hijack
Observed activity
Processes started
15Programs the file ran, with their command lines.
powershell.exe"C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy bypass -File "C:\Users\<USER>\AppData\Local\Temp\winutil-main/functions/private/Get-WinUtilTweaksStateReport.ps1"powershell.exe"C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy bypass -File "C:\Users\<USER>\AppData\Local\Temp\winutil-main/functions/private/Get-WinUtilVariables.ps1"powershell.exe"C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy bypass -File "C:\Users\<USER>\AppData\Local\Temp\winutil-main/functions/private/Initialize-InstallAppArea.ps1"powershell.exe"C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy bypass -File "C:\Users\<USER>\AppData\Local\Temp\winutil-main/functions/private/Initialize-InstallAppEntry.ps1"powershell.exe"C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy bypass -File "C:\Users\<USER>\AppData\Local\Temp\winutil-main/functions/private/Initialize-InstallCategoryAppList.ps1"powershell.exe"C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy bypass -File "C:\Users\<USER>\AppData\Local\Temp\winutil-main/functions/private/Initialize-WinUtilInstallTabControls.ps1"
Show all 15 entries for processes started
powershell.exe"C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy bypass -File "C:\Users\<USER>\AppData\Local\Temp\winutil-main/functions/private/Initialize-WinUtilRunspacePool.ps1"powershell.exe"C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy bypass -File "C:\Users\<USER>\AppData\Local\Temp\winutil-main/functions/private/Initialize-WinUtilTabContent.ps1"powershell.exe"C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy bypass -File "C:\Users\<USER>\AppData\Local\Temp\winutil-main/functions/private/Initialize-WinUtilTaskbarOverlayAssets.ps1"powershell.exe"C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy bypass -File "C:\Users\<USER>\AppData\Local\Temp\winutil-main/functions/private/Install-WinUtilAPPX.ps1"powershell.exe"C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy bypass -File "C:\Users\<USER>\AppData\Local\Temp\winutil-main/functions/private/Install-WinUtilChoco.ps1"powershell.exe"C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy bypass -File "C:\Users\<USER>\AppData\Local\Temp\winutil-main/functions/private/Install-WinUtilProgramChoco.ps1"powershell.exe"C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy bypass -File "C:\Users\<USER>\AppData\Local\Temp\winutil-main/functions/private/Install-WinUtilProgramWinget.ps1"powershell.exe"C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy bypass -File "C:\Users\<USER>\AppData\Local\Temp\winutil-main/functions/private/Install-WinUtilWinget.ps1"powershell.exe"C:\Windows\sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy bypass -File "C:\Users\<USER>\AppData\Local\Temp\winutil-main/functions/private/Invoke-WinUtilAppCategoryChip.ps1"
Files
30Files the file created, changed or deleted.
- Written
C:\Users\<USER>\Desktop\%AppData%\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\Windows PowerShell.lnk - Written
C:\Users\<USER>\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\8WCEHSL5KMKJQKPXVHBV.temp - Written
C:\Users\<USER>\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms - Written
C:\Users\<USER>\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms~RF26d37.TMP - Written
C:\Users\<USER>\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive - Written
C:\Users\<USER>\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\R2QJVHXJBPPW15I1U5MD.temp
Show all 30 entries for files
- Written
C:\Users\<USER>\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms~RF285ef.TMP - Written
C:\Users\<USER>\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\N599VHOGSOUCQYC7QSOW.temp - Written
C:\Users\<USER>\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms~RF2b617.TMP - Written
C:\Users\<USER>\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\YWKF9KCN6ZXXI13OYFVC.temp - Written
C:\Users\<USER>\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms~RF2cf6b.TMP - Written
C:\Users\<USER>\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\PRVWUK6758W900LZOXTQ.temp - Written
C:\Users\<USER>\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms~RF2ea18.TMP - Written
C:\Users\<USER>\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\N6N2JA2DXSZRQXBK65UY.temp - Written
C:\Users\<USER>\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms~RF302ff.TMP - Deleted
C:\Users\<USER>\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms~RF26d37.TMP - Deleted
C:\Users\<USER>\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms~RF285ef.TMP - Deleted
C:\Users\<USER>\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms~RF2b617.TMP - Deleted
C:\Users\<USER>\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms~RF2cf6b.TMP - Deleted
C:\Users\<USER>\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms~RF2ea18.TMP - Deleted
C:\Users\<USER>\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms~RF302ff.TMP - Deleted
C:\Users\<USER>\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms~RF31ec4.TMP - Deleted
C:\Users\<USER>\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms~RF33a4b.TMP - Deleted
C:\Users\<USER>\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms~RF356cc.TMP - Deleted
C:\Users\<USER>\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms~RF374f2.TMP - Deleted
C:\Users\<USER>\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms~RF3b065.TMP - Deleted
C:\Users\<USER>\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms~RF3cebb.TMP - Deleted
C:\Users\<USER>\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms~RF3ebb9.TMP - Deleted
C:\Users\<USER>\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms~RF407eb.TMP - Deleted
C:\Users\<USER>\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms~RF11018.TMP
Registry and auto-start
15Settings the file changed, including ways to start again after a restart.
- Set
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Search\JumplistData\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}\WindowsPowerShell\v1.0\powershell.exe - Set
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SessionInfo\1\ApplicationViewManagement\W32:00000000000301EE\VirtualDesktop - Set
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SessionInfo\1\ApplicationViewManagement\W32:000000000001020A\VirtualDesktop - Set
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SessionInfo\1\ApplicationViewManagement\W32:000000000009004A\VirtualDesktop - Set
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\Shell\Bags\1\Desktop\IconLayouts - Set
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\Shell\Bags\1\Desktop\IconNameVersion
Show all 15 entries for registry and auto-start
- Set
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SessionInfo\1\ApplicationViewManagement\W32:000000000002021E\VirtualDesktop - Set
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SessionInfo\1\ApplicationViewManagement\W32:00000000000D0048\VirtualDesktop - Set
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SessionInfo\1\ApplicationViewManagement\W32:000000000003021A\VirtualDesktop - Set
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SessionInfo\1\ApplicationViewManagement\W32:000000000004021A\VirtualDesktop - Set
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SessionInfo\1\ApplicationViewManagement\W32:0000000000060204\VirtualDesktop - Set
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SessionInfo\1\ApplicationViewManagement\W32:000000000007021A\VirtualDesktop - Set
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SessionInfo\1\ApplicationViewManagement\W32:0000000000090204\VirtualDesktop - Set
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SessionInfo\1\ApplicationViewManagement\W32:00000000000A021A\VirtualDesktop - Set
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SessionInfo\1\ApplicationViewManagement\W32:00000000000C0204\VirtualDesktop
Dropped payload
Files this sample writes at runtime
This file drops 10 children at runtime. None are currently flagged malicious in our cache. 10 have no saved verdict and were not checked; that is missing coverage, not a finding.
10 not checked
- f544575d53b22fd41603…96aebbNot checkedno saved verdict
- aef35003a81c6e524f88…eb308aNot checkedno saved verdict
- df2f295e0fafc5535e37…0630adNot checkedno saved verdict
- c64a9752d02fbb70c1b5…cdee71Not checkedno saved verdict
- f0e8168241afc6a09fba…422182Not checkedno saved verdict
- 156f684a13d09d999664…d7b7ebNot checkedno saved verdict
- 9a1b8416a65a998f7d86…83c96aNot checkedno saved verdict
- 14a52472cc5531b716b5…c141d4Not checkedno saved verdict
- b23186778043f948039c…c71055Not checkedno saved verdict
- 4c2e4322af8d5247e839…83b814Not checkedno saved verdict
Chapter 04
Technical details
None of the 65 antivirus engines that checked it flag it.
Sources checked
Every check behind this verdict
6 sources checked · 5 complete · 1 not needed or not applicable. Complete means the check returned a usable result; it does not mean the file is safe.
SourceStatusResultChecked
Antivirus enginesVirusTotal · 75 enginesCompletePositive signal: 0 of 65 engines flagged it · 10 gave no result Details for antivirus engines
Sandbox runVirusTotal sandboxes · CAPE Sandbox, ZenboxComplete2 runs, no sandbox verdict recorded Details for sandbox run
Contacted hostsMalwareTips URL scannerNot neededThe sandbox recorded no contacted hosts to checkNo date recorded
Signature rulesYARAify community rules + MalwareTips rulesComplete1 MalwareTips behaviour rule Details for signature rules
Malware sample databaseabuse.ch MalwareBazaarCompleteNot listed
Known-software referenceCIRCL hashlookupCompleteNo match
File fingerprint
- Last analyzed
- Oct 18, 2026, 6:22 PM UTC
- SHA-256
4f4cb4212be3b45c7e0df8af830c91892acda5b70f93b33fdfa133c0a605939c- SHA-1
20da710e26dd36e03fc4e0ab8c5db4b1926baa07- MD5
8787dfae89b783e5cb246b7fc6c07d1b
About this file
winutil-main.zip is a ZIP file of 2.8 MB.
- Type and size
- ZIP · 2.8 MB
- Signer
- Not applicable
- First seen
- Oct 8, 2026On VirusTotal.
- Submitted by
- 9 distinct sourcesRarely seen: few people have submitted this exact file.
First scanned
Antivirus consensus
0 of 65 engines flagged this file
0 malicious0 suspicious65 not flagged10 no result
10 of the 75 engines returned no result for this file (file type not supported, or the scan did not finish), so they did not check it.
- Tier-118 engines0flagged
- Tier-234 engines0flagged
- Low-trust13 engines0flagged
No antivirus engine flagged this file.
View all 75 engine results
- AcronisClean
- AhnLab-V3Clean
- AlibabaClean
- alibabacloudClean
- ALYacClean
- Antiy-AVLClean
- APEXNo result
- ArcabitClean
- AvastClean
- Avast-MobileClean
- AVGClean
- AviraClean
- BitDefenderClean
- BitDefenderFalxNo result
- BkavClean
- CAT-QuickHealClean
- ClamAVClean
- CMCClean
- CrowdStrikeClean
- CTXClean
- CylanceNo result
- CynetClean
- DeepInstinctNo result
- DrWebClean
- ElasticNo result
- EmsisoftClean
- ESET-NOD32Clean
- F-SecureClean
- FortinetClean
- GDataClean
- GoogleClean
- GridinsoftClean
- huorongClean
- IkarusClean
- JiangminClean
- K7AntiVirusClean
- K7GWClean
- KasperskyClean
- KingsoftClean
- LionicClean
- MalwarebytesClean
- MaxSecureClean
- McAfeeDClean
- MicrosoftClean
- MicroWorld-eScanClean
- NANO-AntivirusClean
- PaloaltoNo result
- PandaClean
- RisingClean
- SangforClean
- SentinelOneClean
- SkyhighClean
- SophosClean
- SUPERAntiSpywareClean
- SymantecClean
- SymantecMobileInsightNo result
- TACHYONClean
- tehtrisNo result
- TencentClean
- TrapmineNo result
- TrellixENSClean
- TrendMicroClean
- TrendMicro-HouseCallClean
- TrustlookNo result
- VaristClean
- VBA32Clean
- VIPREClean
- VirITClean
- ViRobotClean
- WebrootClean
- XcitiumClean
- YandexClean
- ZillyaClean
- ZoneAlarmClean
- ZonerClean
Rule-based evidence
Signatures and behavior heuristics
Low-severity pattern matches — worth noting but not on their own cause for alarm.
1 heuristic
MITRE ATT&CK profile
Defense evasion× 1
Behavior heuristics
Deterministic patterns derived from scan data and observed runtime behavior
VirusTotal's sandbox summary maps this run to MITRE T1055 (Process Injection), but no injected process of the sample's own was recorded (the analysis VM's own WMI adapter, crash handlers and Chrome updater are not counted). VirusTotal maps T1055 on about half of all files no engine flags, so the mapping alone is not evidence of injection.
EvidenceT1055 (sandbox MITRE mapping)
Prevalence
How widely this file has been seen
Moderate prevalence — neither rare nor common. No strong prior applies.
Medium
Unique uploaders
9
Moderate upload volume.
Total submissions
10
Includes repeat uploads by the same source.
First seen
18d ago
Oct 8, 2026
Prevalence quadrant
Rare · New
Needs evidence-led scrutiny
Common · New
Just-released software
Rare · Old
Niche or internal tooling
Common · Old
Often established software
Chapter 05
Questions & answers
Short answers to the 6 questions people ask most about this file.
Is winutil-main.zip safe?
We found nothing harmful in winutil-main.zip. None of the 65 antivirus engines that checked it flag it. Open it only if you trust the person or website you got it from.
What is winutil-main.zip?
winutil-main.zip is a ZIP archive, about 2.8 MB. VirusTotal first saw it on Oct 8, 2026.
How many antivirus engines detected winutil-main.zip?
None of the 65 antivirus engines that checked it flag winutil-main.zip. That is a good sign, but not proof, so we also weigh who made it, how widely it is used and what it did in a test run.
What is the SHA-256 hash of winutil-main.zip?
The SHA-256 fingerprint of winutil-main.zip is 4f4cb4212be3b45c7e0df8af830c91892acda5b70f93b33fdfa133c0a605939c, and its MD5 is 8787dfae89b783e5cb246b7fc6c07d1b. Two files with the same SHA-256 are identical, so use it to check you have exactly this file, not just one with the same name.
Is it safe to open or extract winutil-main.zip?
We found nothing harmful in winutil-main.zip. The main caveat is where you got it: attackers sometimes spread malware under the name of real software, so get it from the official website. If your own antivirus warns about it, check the source before you ignore the warning.
How up to date is this analysis of winutil-main.zip?
This report reflects the scan on Oct 18, 2026. A file's fingerprint never changes, but antivirus engines keep learning, so a rating can change later. To get a newer result, scan the file again: we refresh the antivirus results when the saved ones are out of date.
Chapter 06
Community
Member reviews and reports for this exact file hash.