File scan report
Verdict Safe
Is Not
None of the 67 antivirus engines that checked it flagged this archive, which holds the Sysinternals NotMyFault crash-test utility and its driver, and three sandbox runs recorded…
Read the whole reasonShow less
Moderate evidence · No engine flags it, but no publisher signature confirms who made it.
Keep the archive if you need a crash-dump test tool, but run it only inside a virtual machine or a disposable test system, since it is designed to blue-screen Windows. Your antivirus needs no changes and should stay enabled.
Good practice2 tips
We found nothing harmful in this file.
Open it only if you trust the person or website you got it from.
Keep your security software and system updates switched on.
No scanner can promise a file is 100% safe.
Antivirus results
0 of 67 flagged
- Flagged 0
- No detection 67
- No result 8
- Code signing Not applicable
- Test run Completed
- First seen 6mo ago
Chapter 02
Why we think so
0 points against it and 4 in its favour, checked against the scan evidence.
The reasoning behind this verdict
This ZIP contains the NotMyFault crash-test utility, its 64-bit and console variants, and the myfault driver it loads. None of the 67 antivirus engines that checked it flagged it and three sandbox runs finished without hostile behaviour, matching what the tool declares itself to be. It is a legitimate testing tool, but it is built to crash Windows on purpose.
The archive produced no detections at all: none of the 67 antivirus engines that checked it, including 18 high-reputation ones such as BitDefender, Kaspersky, ESET-NOD32 and Fortinet, reported anything, and no engine in the lower tiers added a generic or rule-based flag. The sandbox runs agree — the combined result across the three runs was clean, with no malicious verdict, no injection into other processes, and no network destinations attributed to the sample. What the runs did record is entirely consistent with the utility it claims to be: it unpacked notmyfault.exe and its variants, wrote myfault.sys, and set a EULA-accepted setting under the Sysinternals NotMyFault registry key. Reference databases and community rule sets returned nothing, and the file has been circulating widely since first seen on May 7, 2026, with 71 distinct submitters. The only behavioural mapping of note concerns defence tampering without any corresponding artefact, which is a routine sandbox label and not evidence of anything. The single practical caution is operational rather than malicious: this tool deliberately triggers a system crash.
What We Detected
Nothing. None of the 67 antivirus engines that checked it flagged this archive or any of its contents, and the file has no suspicious rule labels either. The archive unpacks to the NotMyFault utility: a main executable, 64-bit and console builds, a EULA text file, and the myfault driver it installs. The tool sets a single user-level setting recording that its licence has been accepted.
Threat Behavior
Three sandbox runs were completed and their combined result was clean. A single defence-tampering mapping appeared without any matching artefact, which is a common label on ordinary installers and test utilities and carries no weight here. Malware and known-software reference databases returned nothing for this file.
What To Do Now
This is a legitimate crash-testing tool used to produce memory dumps and blue screens on purpose, so treat it accordingly: run it only on a virtual machine or a disposable test system you are willing to reboot, and never on a work or production computer. Keep your antivirus and other protection enabled; nothing here requires you to switch anything off. Because the file arrived inside an archive, open it from a location you control and check that you obtained it from the official source before running the driver.
Where this verdict could be wrong3 caveats
- The archive carries a kernel-mode driver and several variants of a tool designed to deliberately crash Windows; on any machine you rely on, running it will cause a genuine blue screen and reboot, even though nothing in the file is malicious.
- Three sandbox runs ended without hostile behaviour, but the contacted-host reputation check was not saved, so the one address seen in the sandbox could not be cross-referenced; it is listed as analysis-machine background traffic rather than the sample's own contact.
- No engine flagged the archive, but the executable and driver inside it were never re-scanned individually by us, so each packed file rests on the archive-level scan and the sandbox runs.
These are the assessment's weak points. If you believe one applies to your file, report the verdict and we'll re-review it.
- None of the 67 antivirus engines that checked it flagged the archive, including 18 of the highest-reputation ones
- Three sandbox runs finished with a clean combined result, no injection into other processes and no persistence
- The files written and the settings changed match exactly what the named NotMyFault crash-test utility does
- Widely shared: 71 distinct submitters since first seen on May 7, 2026, and no malicious or unwanted-software reference entries
6 sources checked · 5 complete · 1 not needed or not applicable. See every source
Chapter 03
What it did in our test
It ran in 3 isolated tests; no test environment rated what it did as risky.
Test run summary
Capture complete- 3isolated sandbox runs
- 4sandbox rule tags
- 4spawned processes
- 0network contacts
- 12filesystem & mutex artifacts
What this file did when executed
This file was detonated in 3 sandboxes and its runtime behaviour was observed.
Sandbox verdicts
1- VT: CLEANclean
Techniques observed in the sandbox
4MITRE ATT&CK techniques the sandbox mapped. Highlighted ones are rare in normal software; the others are common in legitimate programs too.
- T1071· Application protocol
- T1082· System recon
- T1497· Sandbox evasion
- T1562.001· Disables security
Observed activity
Processes started
4Programs the file ran, with their command lines.
notmyfault.exe"C:\Users\<USER>\AppData\Local\Temp\notmyfault.exe"unarchiver.exeC:\Windows\SysWOW64\unarchiver.exe "C:\Windows\SysWow64\unarchiver.exe" "C:\Users\user\Desktop\NotMyFault_0508.zip"7za.exeC:\Windows\SysWOW64\7za.exe "C:\Windows\System32\7za.exe" x -pinfected -y -o"C:\Users\user\AppData\Local\Temp\q2rpj3pz.vnx" "C:\Users\user\Desktop\NotMyFault_0508.zip"cmd.exeC:\Windows\SysWOW64\cmd.exe "cmd.exe" /C "C:\Users\user\AppData\Local\Temp\q2rpj3pz.vnx\notmyfault.exe"
Files
12Files the file created, changed or deleted.
- Written
C:\Windows\System32\drivers\myfault.sys - Written
C:\Users\user\AppData\Local\Temp\q2rpj3pz.vnx - Written
C:\Users\user\AppData\Local\Temp\q2rpj3pz.vnx\Eula.txt - Written
C:\Users\user\AppData\Local\Temp\q2rpj3pz.vnx\notmyfault.exe - Written
C:\Users\user\AppData\Local\Temp\q2rpj3pz.vnx\notmyfault64.exe - Written
C:\Users\user\AppData\Local\Temp\q2rpj3pz.vnx\notmyfault64a.exe
Show all 12 entries for files
- Written
C:\Users\user\AppData\Local\Temp\q2rpj3pz.vnx\notmyfaultc.exe - Written
C:\Users\user\AppData\Local\Temp\q2rpj3pz.vnx\notmyfaultc64.exe - Written
C:\Users\user\AppData\Local\Temp\q2rpj3pz.vnx\notmyfaultc64a.exe - Written
C:\Users\user\AppData\Local\Temp\unarchiver.log - Written
\Device\ConDrv\\Connect - Written
stdout
Registry and auto-start
1Settings the file changed, including ways to start again after a restart.
- Set
HKEY_CURRENT_USER\SOFTWARE\Sysinternals\NotMyFault\EulaAccepted
Sandbox background — not the file
2The analysis machine's own processes and connections, recorded in every run.
- VM process
conhost.exeC:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 - VM host
162.159.36.2
Files this sample writes at runtime
This file drops 8 children at runtime. None are currently flagged malicious in our cache. 8 have no saved verdict and were not checked; that is missing coverage, not a finding.
- 52f734766df2550134ca…3f5ee7Not checkedno saved verdict
- 74ba9d1354ab3b19aafc…12a2b6Not checkedno saved verdict
- 6a948ce998d51de110dc…659f31Not checkedno saved verdict
- cc062645ebd4413294a4…7749deNot checkedno saved verdict
- 9acea6cb854838f6a013…f0ae1bNot checkedno saved verdict
- 4d36fba9216c86f9074d…56b1d3Not checkedno saved verdict
- 8329bcbadc7f81539a49…ec005aNot checkedno saved verdict
- fc822c5faaaa61913a2b…f33d30Not checkedno saved verdict
Chapter 04
Technical details
None of the 67 antivirus engines that checked it flag it.
Sources checked
Every check behind this verdict
6 sources checked · 5 complete · 1 not needed or not applicable. Complete means the check returned a usable result; it does not mean the file is safe.
File fingerprint
- Last analyzed
- Nov 6, 2026, 11:55 PM UTC
- SHA-256
b175534279f4c75ec0546e787599c94090cfc9be4fcdc43aa5d24ec744b99ebd- SHA-1
42d84361d47c9ed98ee0b9979f3ce59af632bfcd- MD5
a30466e113421d905b2a9d356cb0ad9d
About this file
NotMyFault.zip is a ZIP file of 1.5 MB.
- Type and size
- ZIP · 1.5 MB
- Signer
- Not applicable
- First seen
- May 7, 2026On VirusTotal.
- Submitted by
- 71 distinct sources
First scanned
Antivirus consensus
0 of 67 engines flagged this file
8 of the 75 engines returned no result for this file (file type not supported, or the scan did not finish), so they did not check it.
- Tier-118 engines0flagged
- Tier-236 engines0flagged
- Low-trust13 engines0flagged
View all 75 engine results
- AcronisClean
- AhnLab-V3Clean
- AlibabaClean
- alibabacloudClean
- ALYacClean
- Antiy-AVLClean
- APEXNo result
- ArcabitClean
- AvastClean
- Avast-MobileClean
- AVGClean
- AviraClean
- BitDefenderClean
- BitDefenderFalxNo result
- BkavClean
- CAT-QuickHealClean
- ClamAVClean
- CMCClean
- CrowdStrikeClean
- CTXClean
- CylanceNo result
- CynetClean
- DeepInstinctClean
- DrWebClean
- ElasticClean
- EmsisoftClean
- ESET-NOD32Clean
- F-SecureClean
- FortinetClean
- GDataClean
- GoogleClean
- GridinsoftClean
- huorongClean
- IkarusClean
- JiangminClean
- K7AntiVirusClean
- K7GWClean
- KasperskyClean
- KingsoftClean
- LionicClean
- MalwarebytesClean
- MaxSecureClean
- McAfeeDClean
- MicrosoftClean
- MicroWorld-eScanClean
- NANO-AntivirusClean
- PaloaltoNo result
- PandaClean
- RisingClean
- SangforClean
- SentinelOneClean
- SkyhighClean
- SophosClean
- SUPERAntiSpywareClean
- SymantecClean
- SymantecMobileInsightNo result
- TACHYONClean
- tehtrisNo result
- TencentClean
- TrapmineNo result
- TrellixENSClean
- TrendMicroClean
- TrendMicro-HouseCallClean
- TrustlookNo result
- VaristClean
- VBA32Clean
- VIPREClean
- VirITClean
- ViRobotClean
- WebrootClean
- XcitiumClean
- YandexClean
- ZillyaClean
- ZoneAlarmClean
- ZonerClean
How widely this file has been seen
Moderate prevalence — neither rare nor common. No strong prior applies.
Chapter 05
Questions & answers
Short answers to the 6 questions people ask most about this file.
Is NotMyFault.zip safe?
What is NotMyFault.zip?
How many antivirus engines detected NotMyFault.zip?
What is the SHA-256 hash of NotMyFault.zip?
Is it safe to open or extract NotMyFault.zip?
How up to date is this analysis of NotMyFault.zip?
Community
Member reviews and reports for this exact file hash.