Is autoruns.exe safe?
Windows executable 'autoruns.exe' (1.7 MB) scanned clean by all 76 engines in our antivirus network, including BitDefender, Kaspersky, ESET, and Avast.
This is a signed Win32 executable named autoruns.exe, first seen in February 2024. Our antivirus network's 76 engines, including top-tier ones like BitDefender and Kaspersky, all report it undetected with zero malicious flags. It's safe to run—no threats detected.
f41051697b220757f3…9ef0338e45c3b6Recommended next actions
Before running
Run it only when it came from the developer's official site or another source you independently trust.
If you already ran it
Keep normal device protection enabled and stop if the file behaves unexpectedly.
Intelligence
The saved assessment, checked against the scan evidence and recorded coverage.
The reasoning behind this verdict
This section explains the evidence supporting the verdict and keeps conflicting or missing signals visible.
This is a signed Win32 executable named autoruns.exe, first seen in February 2024. Our antivirus network's 76 engines, including top-tier ones like BitDefender and Kaspersky, all report it undetected with zero malicious flags. It's safe to run—no threats detected.
The file autoruns.exe is a 1.7 MB Win32 PE executable with an import hash of fc18756ef5e758178da800fd88864516, showing behaviors like checking user input, calling WMI, long sleeps, having an overlay, and detecting debug environments. Despite these common traits in both legit and suspicious files, all 76 engines in our network, including tier-1 protectors like BitDefender, Kaspersky, ESET, Avast, Microsoft, and Sophos, report it as undetected. No popular threat labels or names match it. This unanimous clean scan across dozens of engines indicates a safe file with no malware signatures. If run, it poses no risk based on our analysis. Proceed with normal use.
What We Detected
All 76 engines in our antivirus network, including BitDefender, Kaspersky, ESET, Avast, and Fortinet, scanned this 1.7 MB Win32 executable as undetected. No malicious or suspicious verdicts appeared, and there are no popular threat labels. The file is signed and shows standard PE behaviors like WMI calls and user input checks.
Threat Behavior
With zero detections from our AV partners, this file exhibits no malicious actions such as stealing data, downloading payloads, or granting remote access. Behaviors like long sleeps and debug detection are common in legitimate tools and do not trigger alarms here. If run, it would behave as a standard executable without harm.
What To Do Now
This file is safe based on our full scan—run it if needed for its intended purpose. Monitor for unusual system behavior as a general best practice, but no quarantine or removal is required. Keep your antivirus updated for ongoing protection.
- All 76 engines in our antivirus network report undetected, including tier-1 like BitDefender, Kaspersky, ESET, Avast, Microsoft, Sophos, and Fortinet.
- File is digitally signed, a strong indicator of legitimacy.
- No popular threat labels or names from our research.
- Consistent clean results across diverse engines like CrowdStrike, Elastic, and DrWeb.
- Standard Win32 EXE with known import hash, first seen over a year ago with no flags.
This file is safe to use—no quarantine or deletion needed. Run it normally if it's from a trusted source like Microsoft Sysinternals tools.
Coverage & freshness
Complete means the check returned a usable result. It does not mean the file is safe.
Antivirus
Complete0 of 76 engines flagged the file.
Sandbox
Not runNo runtime observation is recorded for this report.
No timestamp recordedNetwork
Not runNo contacted-host reputation check is recorded.
No timestamp recordedYARA
Not runNo rule evaluation is recorded for this report.
No timestamp recordedExternal intel
Not runNo independent reference checks are recorded.
No timestamp recorded
Behavior
Plain-English impact first, then the observed runtime evidence.
Runtime behavior was not available
The report does not treat a missing runtime observation as a clean result.
Detection & Forensics
Consensus, attribution, signatures, code structure, prevalence, and identity.
Evidence integrity
Chain of custody for the facts preserved in this report.
- 0rule hits recorded
- 0 / 76engines flagged
- 3traceable evidence facts
Why these facts are shown
Each statement identifies whether it was directly recorded or derived from saved scan facts.
- 01
0 of 76 antivirus engines flagged the file.
Verdict inputView chapterProvenanceObservedSourceAntivirus analysisObserved at - 02
One or more independent reference checks were incomplete or unavailable.
ProvenanceDerivedSourceExternal-intelligence coverageObserved at - 03
No completed runtime observation is available for this file.
ProvenanceDerivedSourceRuntime coverageObserved at
Detection sources at a glance
The available sources did not agree on a named threat category.
This legacy report does not record whether the independent reference checks completed.
YARA rules
Not runThis report does not contain a completed YARA rule pass.
0 of 76 engines flagged this file
View all 76 engine results
PE structure
Not runThis looks like a Windows executable, but no completed PE structure result is saved.
Fingerprint and provenance
- File name
- autoruns.exe
- Format
- Win32 EXE
- Code signing
- No verified publisher
- Size
- 1.7 MB
- Last analyzed
- Apr 20, 2026, 6:30 PM UTC
f41051697b220757f3612ecd00749b952ce7bcaadd9dc782d79ef0338e45c3b6Safety & FAQ
Complete recovery guidance and answers for the next decision.
What to do now
This file appears low risk based on the evidence available now.
- Recovery step 01
Run it only when it came from the developer's official site or another source you independently trust.
- Recovery step 02
A clean result reduces known risk, but it cannot guarantee that every new or targeted threat has been detected.
- Recovery step 03
Keep your antivirus and Windows updates switched on so you stay protected.
Safety FAQ
Direct answers grounded in the saved verdict and evidence in this report.
Is autoruns.exe safe?
What is autoruns.exe?
How many antivirus engines detected autoruns.exe?
What is the SHA-256 hash of autoruns.exe?
Is it safe to run autoruns.exe?
How up to date is this analysis of autoruns.exe?
Community
Member reviews and reports for this exact file hash.
