File scan report
Verdict Safe
Is WPD.
None of the 72 antivirus engines that checked it flagged this unsigned Windows program, which has circulated for about five years without detections and matched only generic…
Read the whole reasonShow less
Moderate evidence · No engine flags it, but no publisher signature confirms who made it.
Use the file only if you obtained it from a trusted source, and keep your security software enabled; never disable Windows Defender at a program's request.
Good practice2 tips
We found nothing harmful in this file.
Run it only if it came from the developer's own website or an official app store.
Keep your antivirus and Windows updates switched on.
No scanner can promise a file is 100% safe.
Reads the latest antivirus results for this file's hash. Nothing is uploaded.
Antivirus results
0 of 72 flagged
- Flagged 0
- No detection 72
- No result 4
- Code signing Unsigned
- Test run Not run
- First seen 5y ago
Chapter 02
Why we think so
2 points against it and 3 in its favour, checked against the scan evidence.
The reasoning behind this verdict
It has been known for roughly five years, is absent from public malware databases, and matched only generic community rules. No sandbox run is available, so the picture rests on static and reputation evidence.
Across 72 engines that returned results, none raised a malicious or suspicious detection, including every major antivirus engine. Three community YARA rules matched, but all are generic indicators, one of them a string pattern referencing Windows Defender registry settings, which is not evidence of actual tampering. The file is not listed in MalwareBazaar and has a long history of about 1,831 days with no detections appearing. It is unsigned, so no publisher identity backs it, and no observation from the test run was recorded. Files sharing its import hash are mostly unrelated programs built with the same toolchain and carry little weight.
What We Detected
None of the 72 antivirus engines that checked it flagged this file; all 18 major antivirus engines reported it clean. Three generic community pattern rules matched, one noting embedded registry strings related to Windows Defender settings. No public malware database listing was found.
Threat Behavior
No sandbox run is available, so no behaviour in the test run was observed. The evidence is static: an unsigned Win32 program first seen on Oct 17, 2021 that has never drawn detections. The registry string match describes text inside the file, not an action it was seen performing.
What To Do Now
The file appears clean on current evidence. Run it only if it came from a source you trust, keep your antivirus and Windows Defender enabled, and be wary if the program ever asks you to turn security features off.
Where this verdict could be wrong2 caveats
- A generic community rule matched registry strings associated with turning off Windows Defender features; this is a string pattern only and not observed behaviour, but no sandbox run is available to confirm either way.
- The file is unsigned and carries a slightly negative community reputation score.
These are the assessment's weak points. If you believe one applies to your file, report the verdict and we'll re-review it.
- None of the 72 antivirus engines that checked it flagged the file, including all 18 major antivirus engines.
- The file has circulated for about five years without attracting detections.
- It does not appear in public malware sample databases.
- The program is unsigned, so its publisher cannot be verified.
- A generic pattern rule found registry strings associated with Windows Defender settings.
6 sources checked · 4 complete · 1 not run · 1 not needed or not applicable. See every source
Chapter 03
Technical details
None of the 72 antivirus engines that checked it flag it; no publisher signature.
Sources checked
Every check behind this verdict
6 sources checked · 4 complete · 1 not run · 1 not needed or not applicable. Complete means the check returned a usable result; it does not mean the file is safe.
File fingerprint
- Last analyzed
- Apr 20, 2026, 7:33 PM UTC
- SHA-256
c21e9de5b28de8edfb6b2264b33846e842f7954ad70fa07b3c652feb5f0a09d7- SHA-1
acf8022648f3eab3b6da50e0f90301eefe64a3f7- MD5
65325f636ac238568a21f389387f0299
About this file
WPD.exe is a Win32 EXE file of 590.3 kB.
- Type and size
- Win32 EXE · 590.3 kB
- Signer
- UnsignedNo code signature.
- First seen
- Oct 17, 2021On VirusTotal.
First scanned Updated
Verdict history
- Malicious
- Safeafter a re-check of the saved evidence
Ratings change when antivirus engines, our checks or MalwareTips staff learn more about a file.
Antivirus consensus
0 of 72 engines flagged this file
4 of the 76 engines returned no result for this file (file type not supported, or the scan did not finish), so they did not check it.
- Tier-118 engines0flagged
- Tier-236 engines0flagged
- Low-trust18 engines0flagged
View all 76 engine results
- AcronisClean
- AhnLab-V3Clean
- AlibabaClean
- alibabacloudClean
- ALYacClean
- Antiy-AVLClean
- APEXClean
- ArcabitClean
- AvastClean
- Avast-MobileNo result
- AVGClean
- AviraClean
- BaiduClean
- BitDefenderClean
- BitDefenderFalxNo result
- BkavClean
- CAT-QuickHealClean
- ClamAVClean
- CMCClean
- CrowdStrikeClean
- CTXClean
- CylanceClean
- CynetClean
- DeepInstinctClean
- DrWebClean
- ElasticClean
- EmsisoftClean
- ESET-NOD32Clean
- F-SecureClean
- FortinetClean
- GDataClean
- GoogleClean
- GridinsoftClean
- huorongClean
- IkarusClean
- JiangminClean
- K7AntiVirusClean
- K7GWClean
- KasperskyClean
- KingsoftClean
- LionicClean
- MalwarebytesClean
- MaxSecureClean
- McAfeeDClean
- MicrosoftClean
- MicroWorld-eScanClean
- NANO-AntivirusClean
- PaloaltoClean
- PandaClean
- RisingClean
- SangforClean
- SentinelOneClean
- SkyhighClean
- SophosClean
- SUPERAntiSpywareClean
- SymantecClean
- SymantecMobileInsightNo result
- TACHYONClean
- tehtrisClean
- TencentClean
- TrapmineClean
- TrellixENSClean
- TrendMicroClean
- TrendMicro-HouseCallClean
- TrustlookNo result
- VaristClean
- VBA32Clean
- VIPREClean
- VirITClean
- ViRobotClean
- WebrootClean
- XcitiumClean
- YandexClean
- ZillyaClean
- ZoneAlarmClean
- ZonerClean
Signatures and behavior heuristics
Community YARA rules matched, but all of them are generic capability, anti-debug or compiler rules that ordinary software also matches. Worth noting, not on their own cause for alarm.
- INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefendergeneric
- pe_imphashgeneric
- Skystars_Malware_Imphashgeneric
Chapter 04
Questions & answers
Short answers to the 6 questions people ask most about this file.
Is WPD.exe safe?
What is WPD.exe?
How many antivirus engines detected WPD.exe?
What is the SHA-256 hash of WPD.exe?
Is it safe to run WPD.exe?
How up to date is this analysis of WPD.exe?
Community
Member reviews and reports for this exact file hash.
