WinCyberScan™ Windows Security Threat Scanner

WinCyberScan™ Windows Security Threat Scanner (WSTS)

A read-only forensic scanner that inspects your Windows PC for malware indicators, persistence mechanisms, and evidence of log or credential-store tampering.

Runs 100% locally. No account. No telemetry. Nothing ever leaves your machine.

Download for Windows Verify the file first

Version 1.0.0 · Windows 10 / 11 (64-bit) · Read-only & offline

What WSTS checks

Prefetch execution

Flags execution of known offensive-security tools and Windows LOLBins (Mimikatz, PsExec, certutil, mshta, and more).

Startup persistence

Inspects user and global Startup folders for suspicious scripts, shortcuts, and recently planted payloads.

Event-log tampering

Detects cleared or recently modified Security, System, and Application logs — a common anti-forensic move.

Credential stores

Checks DPAPI and Credential Manager artifacts for recent modification that may indicate theft attempts.

Amcache & NTUSER

Reviews application-execution history hives for recent tampering or unusual activity.

Local report

Results render in your browser at 127.0.0.1 — generated on-device and never uploaded.

Understanding your results

Every finding is shown in a table with five columns. Here is what each one means.

ColumnWhat it means
SEV Severity — how much attention this item deserves.
LOW Normal background activity worth noting.
MEDIUM Ran recently or is a commonly-abused tool — worth a quick look.
HIGH Known attack tool, suspicious location, or tampered log — investigate.
Executable The name of the program Windows recorded. Standard Windows processes like SVCHOST.EXE, MSEDGE.EXE, and DLLHOST.EXE are normal. Be alert to names you don’t recognise or known attack tools like MIMIKATZ.EXE or PSEXEC.EXE.
Last Run The exact date and time Windows last recorded that program running. Useful for checking whether activity happened at an unexpected time (e.g. 3 AM when nobody was at the computer).
Age How long ago the program ran, shown in hours or days (e.g. 0h = within the last hour, 2d = two days ago). Shorter ages mean more recent activity.
Flags The reason the item appears in the list. Common flags:
  • RAN_LAST_1H / RAN_LAST_24H — ran very recently. Not alarming on its own — just means it was active.
  • KNOWN_SUSPICIOUS_TOOL — matches a known hacking or exploitation tool by name. Investigate immediately.
  • POSSIBLY_CLEARED — an event log is empty or was recently wiped. Normal if you or IT cleared it; suspicious if unexplained.
  • RECENTLY_MODIFIED — a credential or registry artifact changed recently. Cross-check with your own activity.
  • SUSPICIOUS_LNK_TARGET / SCRIPT_IN_STARTUP — a startup shortcut points somewhere unusual, or a script is set to run at login. Worth reviewing.

Quick guide: is this finding a problem?

  1. Check the Executable name. Is it a program you recognise? Standard Windows names are almost always safe.
  2. Check the Last Run time. Did it run while you were at the computer doing something that explains it?
  3. Check the Flag. RAN_LAST_1H alone is informational. KNOWN_SUSPICIOUS_TOOL or POSSIBLY_CLEARED with no explanation — escalate.
  4. If you cannot explain a finding, do not ignore it. Disconnect the machine from the network and contact an IT or security professional.

Why this download is safe

Security tools are frequently flagged by antivirus engines because they read the same forensic artifacts that malware touches. We are fully transparent so you can trust — and independently verify — exactly what you are running.

Read-only by design

WSTS never writes, deletes, modifies, or transmits any file. It opens artifacts for reading and reports what it finds. Nothing else.

Source available for audit

WSTS is built from our own source, which we make available for independent security review on request. Contact us to arrange an audit.

No network access

The scanner makes no outbound connections. You can verify this with your own firewall — block it entirely and it still works.

Checksummed every release

Every release is published with a SHA-256 hash so you can confirm the file is genuine and unmodified. Authenticode code-signing is being provisioned and will be added in a future build.

Independently scanned

We submit each build to Microsoft Security Intelligence and VirusTotal. v1.0.0 received a Not malware determination from Microsoft (Submission ID: 330c460e…). Review the multi-engine report before you run anything.

View VirusTotal report →

If your antivirus flags it

A read-only forensic scanner reads the same credential and registry artifacts that malware touches, so an unsigned build can trigger a heuristic false-positive — Microsoft Defender may quarantine or delete it. To recover: open Windows Security → Virus & threat protection → Protection history, find the WSTS detection, and choose Restore / Allow. Always verify the SHA-256 hash below first. We submit every build to Microsoft and VirusTotal.

Verify before you run

Confirm the file you downloaded matches our official release. If the hash differs, do not run it — delete it and download again.

Verified by Microsoft Security Intelligence

wsts-setup-1.0.0.exe was submitted to Microsoft Security Intelligence for independent malware analysis. Microsoft’s scanners found no positive detection and reported no telemetry indicators for the file. The final determination is Not malware.

Filewsts-setup-1.0.0.exe
Submission ID330c460e-1275-422e-a026-c1a37d5bef33
SubmittedAug 15, 2026
Final determinationNot malware
Cloud scanNo malware detected
Client scanNo malware detected
Definition version1.457.180.0
Analyst comment“Our scanners show no positive detection, and we have no telemetry indicators for the file(s) submitted either.”
SHA-256…
VirusTotalView report →
Publisher signingUnsigned — code signing planned

1. SHA-256 checksum

Official hash for WSTS-Setup-1.0.0.exe:

<published with each release>

Verify in PowerShell:

Get-FileHash .\WSTS-Setup-1.0.0.exe -Algorithm SHA256

2. Authenticode signature

Code-signing is being provisioned. Until it is in place this build is unsigned, so Windows will report NotSigned — that is expected. Confirm authenticity with the SHA-256 hash above. You can check signature status with:

Get-AuthenticodeSignature .\WSTS-Setup-1.0.0.exe | Format-List Status, SignerCertificate

Current status: NotSigned · Publisher (after signing): Antibody Cyber Technology, LLC

Download WSTS

WSTS-Setup-1.0.0.exe

Windows 10 / 11 (64-bit) · ~12 MB · Version 1.0.0

Download

For best protection, always download directly from https://wincyberscan.com and verify the SHA-256 hash above. We never distribute WSTS through third-party sites.

Run as Administrator for full artifact access. WSTS opens a local dashboard at http://127.0.0.1:5900 in your browser.