File scan report
Verdict Safe
Is Xray_
This ZIP archive drew no detections from any of 74 antivirus engines and showed no hostile activity in its sandbox run, despite more than two thousand submitters.
Read the whole reasonShow less
Moderate evidence · No engine flags it, but no publisher signature confirms who made it.
The archive shows no signs of malware. Scan the extracted files with up-to-date antivirus before running them, and keep your protection enabled.
Good practice2 tips
We found nothing harmful in this file.
Open it only if you trust the person or website you got it from.
Keep your security software and system updates switched on.
No scanner can promise a file is 100% safe.
Antivirus results
0 of 63 flagged
- Flagged 0
- No detection 63
- No result 11
- Code signing Not applicable
- Test run Completed
- First seen 3mo ago
Chapter 02
Why we think so
2 points against it and 4 in its favour, checked against the scan evidence.
The reasoning behind this verdict
None of the 63 antivirus engines that checked it flagged this ZIP archive, including every major antivirus engine. Its sandbox run recorded no risky techniques, no injection and no network contacts. No public malware database lists it.
None of the 63 antivirus engines that checked it flagged the archive, and all 18 major antivirus engines returned clean results. Malware-sample databases and community rule sets returned no matches. The one sandbox run showed no high-risk techniques, no spawned processes and no network contacts; its only registry changes were routine browser statistics. More than 2,200 distinct submitters have seen the file over about three months without any detection appearing. Our own static analysis did not inspect the archive's contents, and no host-reputation check is available, so some residual uncertainty remains.
What We Detected
None of the 63 antivirus engines that checked it flagged this ZIP archive, and every major antivirus engine reported it clean. No public malware database or malware-specific rule matched its hash.
Threat Behavior
The single sandbox run recorded no high-risk techniques, no process injection and no network contacts. Only routine browser statistics registry values were written. The file has been submitted by over 2,200 sources across roughly three months with no detections appearing.
What To Do Now
The archive appears clean. Still, scan the extracted files before running them, and obtain software from its official publisher where possible, because archives named after paid editions sometimes carry unwanted extras.
Where this verdict could be wrong2 caveats
- The archive's contents were not unpacked by our own static analysis, so a payload hidden inside the archive cannot be ruled out entirely.
- Archives named after paid software editions are sometimes used to distribute cracks or unwanted bundles, which engines may miss inside a compressed file.
These are the assessment's weak points. If you believe one applies to your file, report the verdict and we'll re-review it.
- None of the 63 antivirus engines that checked it flagged the file, including all major antivirus engines.
- No listing in public malware databases and no malware-specific rule matches.
- The sandbox run showed no high-risk techniques, injection or network contacts.
- Seen by over 2,200 distinct submitters without detections.
- The archive's contents were not inspected by our own static analysis.
- No complete host-reputation result is available for the sandbox run.
6 sources checked · 5 complete · 1 not needed or not applicable. See every source
Chapter 03
What it did in our test
It ran in 1 isolated test; no test environment rated what it did as risky.
Test run summary
Capture complete- 1isolated sandbox run
- 0spawned processes
- 0network contacts
- 0filesystem & mutex artifacts
What this file did when executed
This file was detonated in 1 sandbox and its runtime behaviour was observed.
Observed activity
Registry and auto-start
4Settings the file changed, including ways to start again after a restart.
- Set
HKEY_USERS\S-1-5-21-575823232-3065301323-1442773979-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{72853161-30C5-4D22-B7F9-0BBC1D38A37E}\iexplore\Count - Set
HKEY_USERS\S-1-5-21-575823232-3065301323-1442773979-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{72853161-30C5-4D22-B7F9-0BBC1D38A37E}\iexplore\Time - Set
HKEY_USERS\S-1-5-21-575823232-3065301323-1442773979-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{72853161-30C5-4D22-B7F9-0BBC1D38A37E}\iexplore\Type - Set
HKEY_USERS\S-1-5-21-575823232-3065301323-1442773979-1000\Software\Microsoft\Internet Explorer\Toolbar\Locked
Chapter 04
Technical details
None of the 63 antivirus engines that checked it flag it.
Sources checked
Every check behind this verdict
6 sources checked · 5 complete · 1 not needed or not applicable. Complete means the check returned a usable result; it does not mean the file is safe.
File fingerprint
- Last analyzed
- Oct 21, 2026, 7:28 AM UTC
- SHA-256
e2b53ebaf65c4ee16597627874a1abefb54643df62fb7abd2d2a604466ff6833- SHA-1
a463542073c5cf923979691ed05100a3c3f291a7- MD5
f4403a847024e9850761e9253fbe8824
About this file
Xray_Ultimate_26.X_v5.4.2.zip is a ZIP file of 1.8 MB.
- Type and size
- ZIP · 1.8 MB
- Signer
- Not applicable
- First seen
- Jul 18, 2026On VirusTotal.
- Submitted by
- 2,265 distinct sources
First scanned
Antivirus consensus
0 of 63 engines flagged this file
11 of the 74 engines returned no result for this file (file type not supported, or the scan did not finish), so they did not check it.
- Tier-118 engines0flagged
- Tier-232 engines0flagged
- Low-trust13 engines0flagged
View all 74 engine results
- AcronisClean
- AhnLab-V3Clean
- AlibabaClean
- alibabacloudClean
- ALYacClean
- Antiy-AVLClean
- APEXNo result
- ArcabitClean
- AvastClean
- Avast-MobileClean
- AVGClean
- AviraClean
- BitDefenderClean
- BitDefenderFalxNo result
- BkavClean
- CAT-QuickHealClean
- ClamAVNo result
- CMCClean
- CrowdStrikeClean
- CTXClean
- CylanceNo result
- CynetClean
- DeepInstinctNo result
- DrWebClean
- ElasticNo result
- EmsisoftClean
- ESET-NOD32Clean
- F-SecureClean
- FortinetClean
- GDataClean
- GoogleClean
- GridinsoftClean
- huorongClean
- IkarusClean
- JiangminClean
- K7AntiVirusClean
- K7GWClean
- KasperskyClean
- KingsoftClean
- LionicClean
- MalwarebytesClean
- MaxSecureClean
- McAfeeDClean
- MicrosoftClean
- MicroWorld-eScanClean
- NANO-AntivirusClean
- PaloaltoNo result
- PandaClean
- RisingClean
- SangforClean
- SentinelOneClean
- SkyhighNo result
- SophosClean
- SUPERAntiSpywareClean
- SymantecClean
- SymantecMobileInsightNo result
- TACHYONClean
- tehtrisNo result
- TencentClean
- TrapmineNo result
- TrellixENSClean
- TrendMicroClean
- TrendMicro-HouseCallClean
- TrustlookClean
- VaristClean
- VBA32Clean
- VIPREClean
- VirITClean
- ViRobotClean
- WebrootClean
- XcitiumClean
- YandexClean
- ZoneAlarmClean
- ZonerClean
How widely this file has been seen
Widely uploaded, but first seen within the last six months. No strong prior applies.
Chapter 05
Questions & answers
Short answers to the 6 questions people ask most about this file.
Is Xray_Ultimate_26.X_v5.4.2.zip safe?
What is Xray_Ultimate_26.X_v5.4.2.zip?
How many antivirus engines detected Xray_Ultimate_26.X_v5.4.2.zip?
What is the SHA-256 hash of Xray_Ultimate_26.X_v5.4.2.zip?
Is it safe to open or extract Xray_Ultimate_26.X_v5.4.2.zip?
How up to date is this analysis of Xray_Ultimate_26.X_v5.4.2.zip?
Community
Member reviews and reports for this exact file hash.