File scan report
Verdict Safe
Is winscript-
Clean scans across 72 engines including top major antivirus engines, behaviour consistent with portable web-based app using Microsoft Edge WebView2, medium prevalence supports…
Read the whole reasonShow less
Moderate evidence · No engine flags it, but no publisher signature confirms who made it.
This appears to be a safe portable application, likely a web-scripting tool using Edge WebView2. Run in a sandbox if wary of the debug detection tag.
Good practice2 tips
We found nothing harmful in this file.
Run it only if it came from the developer's own website or an official app store.
Keep your antivirus and Windows updates switched on.
No scanner can promise a file is 100% safe.
Reads the latest antivirus results for this file's hash. Nothing is uploaded.
Antivirus results
0 of 72 flagged
- Flagged 0
- No detection 72
- No result 4
- Code signing Unsigned
- Test run Completed
- First seen 6mo ago
Chapter 02
Why we think so
4 points against it and 5 in its favour, checked against the scan evidence.
The reasoning behind this verdict
No detections from the antivirus engines despite high coverage. The file runs a legitimate Microsoft Edge WebView2 process and creates app-specific directories under flick.winscript.dev. Tags like detect-debug are noted but outweighed by unanimous clean verdicts.
Unanimous clean results from 72 engines, including 17 major like BitDefender and Kaspersky, indicate no malicious signatures or behaviour rules matched. Behaviour shows standard WebView2 spawning for a portable app, with files dropped in expected user data paths. One offensive MITRE technique and debug detection tag raise minor flags, but absence of sandbox alerts, malicious files it created, or external intel confirms safety. Medium prevalence across 17 sources aligns with legitimate software distribution.
What We Detected
Clean across all 72 reporting engines (0 malicious). No PE packing or high entropy.
Threat Behavior
Spawns msedgewebview2.exe (Microsoft runtime), writes to C:\Users\user\AppData\Local\flick.winscript.dev. Offensive technique T1562.001 noted but no harmful outcomes in sandbox.
What To Do Now
Safe to use as portable app. Monitor for unexpected network activity if concerned about debug evasion tag.
Where this verdict could be wrong2 caveats
- tags['detect-debug-environment'] + behaviour.offensiveTechniques T1562.001 (Impair Defenses) could indicate anti-analysis, though not corroborated by engines or sandbox verdicts.
- unsigned with no signerStats — lacks publisher reputation, relying solely on clean scans and behaviour.
These are the assessment's weak points. If you believe one applies to your file, report the verdict and we'll re-review it.
- 0/72 engines.malicious, tier1ReportedClean=17
- Legitimate Microsoft Edge WebView2 processes
- Medium prevalence (17 unique sources)
- No malicious files it created or sandbox verdicts
- No external intel or rule triggers
- Unsigned executable (no Authenticode verification)
- The sandbox's offensive-technique list includes T1562.001 (potential tool disablement)
- tags['detect-debug-environment'] suggests anti-analysis
- Recent file (it was first seen on Apr 19, 2026), reputation=0
6 sources checked · 5 complete · 1 not needed or not applicable. See every source
Chapter 03
What it did in our test
It ran in our isolated test environment; no test environment rated what it did as risky.
Test run summary
Capture complete- 8sandbox rule tags
- 7spawned processes
- 0network contacts
- 18filesystem & mutex artifacts
Includes 8 mapped techniques, every process, file, registry and network entry and 7 dropped files.
Show the technical evidenceChapter 04
Technical details
None of the 72 antivirus engines that checked it flag it; no publisher signature.
Sources checked
Every check behind this verdict
6 sources checked · 5 complete · 1 not needed or not applicable. Complete means the check returned a usable result; it does not mean the file is safe.
File fingerprint
- Last analyzed
- Apr 27, 2026, 9:20 AM UTC
- SHA-256
6f8d7de09986672827739e88e7bd62149560f87114177c3d7b9ead05a0df392f- SHA-1
e1319ed657e59c66dc42597e0c75b70873e09935- MD5
563a1e38b112f0c84595040ac38fe829
About this file
winscript-portable.exe is a Win32 EXE file of 10.8 MB.
- Type and size
- Win32 EXE · 10.8 MB
- Signer
- UnsignedNo code signature.
- First seen
- Apr 19, 2026On VirusTotal.
- Submitted by
- 17 distinct sources
- Packer
- None detected
- Entropy
- 6.23 of 8
First scanned Updated
Includes every engine result (76), PE section entropy and packers and how widely the file has been seen.
Show the technical evidenceChapter 05
Questions & answers
Short answers to the 6 questions people ask most about this file.
Is winscript-portable.exe safe?
What is winscript-portable.exe?
How many antivirus engines detected winscript-portable.exe?
What is the SHA-256 hash of winscript-portable.exe?
Is it safe to run winscript-portable.exe?
How up to date is this analysis of winscript-portable.exe?
Community
Member reviews and reports for this exact file hash.
