5 simple ways to check if an .exe file is safe.

Is that .exe file safe?
You probably found this page because you noticed a strange Windows .exe process or service running on your PC.

Maybe the program is causing your computer to crash or it’s using too much memory or CPU resources. Or perhaps you downloaded an .exe and you’re not sure if it’s safe to run.

If you’re concerned about a file on your PC just follow the 5 easy steps below to see if it’s safe. Our team has helped over 20 million people protect their PCs so you’ve come to the right place.

Let’s check that file for threats!

• 1. Check it with Windows itself
• 2. Upload the file to VirusTotal
• 3. Who is the publisher?
• 4. Run it in Windows Sandbox
• 5. Check the .exe’s network activity for suspicious behavior

1. How to check the .exe file with Windows Defender

These days all Windows versions come with Windows Security (formerly Microsoft Defender), and Windows Security has a built in easy way to scan specific .exe files. If the file is on your desktop right click it and choose “scan with Microsoft Defender”.

If you found the .exe you want to scan in the Windows task manager and you’re not sure of its location, then right click it and choose “open file location”. The file should then automatically be highlighted. Now right click the file once and scan it. If it’s marked as safe, then it’s probably safe to be on your PC.

Are you still not sure if an .exe file is safe? There are 4 more steps you can take.

2. Analyze the file with VirusTotal

Don’t trust Windows Security? That’s OK. Go to VirusTotal.com and upload the file. VirusTotal is a file analysis service that will analyze the file with over 25 different antimalware engines. Please note it’s not uncommon with most files to have one or two false positives.

When this happens people in the VirusTotal community will often leave some comments about the file, so click the comments and see what people are saying.

Want to analyze all your apps for security issues with VirusTotal automatically? Our GlassWire software does this for free for anyone who uses the app.

First install GlassWire (it’s free to try), then go to the top left menu and choose “settings” then “VirusTotal”, then turn on automatic executable security analysis. Once this VirusTotal API setting is enabled, every time an .exe accesses the network on your PC, it will automatically be analyzed by VirusTotal.

Don’t want automatic file checking? It’s optional, and it’s turned off by default. To adjust the security settings go to GlassWire’s firewall and mouse over the VirusTotal column next to any app to analyze it with VirusTotal manually.

3. Does the .exe have a publisher?

Are you still not sure about the file? Right click the file and check its properties to see if it has a known publisher. If a file is signed by Microsoft or a major company then it’s most likely safe. If the file isn’t signed at all then all bets are off. Look under “Digital Signature” to see once you check the file properties.

Please note that with our own GlassWire Network Security Monitoring app we show real-time network activity by publisher so it’s easy to see if unsigned apps are accessing the network. Keeping track of the apps on your PC and how they are signed is a great way to keep your device secure.

Do you still not trust the .exe file?

4. Check it in Windows Sandbox

Did you know the latest versions of Windows 10 or 11 have a free sandbox feature that allows you to safely run applications in a protected environment on your PC? Search for Windows Sandbox in the Windows search box to run it. Now copy the file, and then paste it into the Windows Sandbox. You can then run it and see what it does after it’s executed.

5. Monitor the file’s network activity for strange behavior

If you are already running the .exe on your PC and you think it’s suspicious then it’s very useful to see what hosts the .exe is connecting to along with the types of traffic it is sending and receiving. Our free GlassWire software can show you that data in real-time. If you find the .exe is behaving badly you can then block it instantly with our firewall, or even check it with VirusTotal directly from within GlassWire.

Check out this example of Calculator app:

Are you still not sure what files are safe or dangerous on your PC? We’ve put together this useful directory of commonly used Windows files so you can understand their purpose and threat level.

Directory of Windows .exe files

We at GlassWire have helped over 20 million people monitor the behavior of certain Windows .exe files on their PCs. Are you curious if a certain .exe file name is safe? Check out our directory below to see.

• svchost.exe
• lsass.exe
• igfxem.exe
• mrt.exe
• msascuil.exe
• gfxdownloadwrapper.exe
• tiworker.exe
• hxtsr.exe
• ntoskrnl.exe
• video.ui.exe
• localbridge.exe
• fingagent.exe
• werfault.exe
• backgroundtaskhost.exe
• spoolsv.exe
• msedge.exe
• olicenseheartbeat.exe
• cleanmgr.exe
• compattelrunner.exe
• mpcmdrun.exe
• sihclient.exe
• sdxhelper.exe
• msmpeng.exe
• apphostregistrationverifier.exe
• dashost.exe
• systemsettings.exe
• winstore.app.exe
• yourphone.exe
• microsoft.photos.exe
• Winword.exe
• rundll32.exe
• wermgr.exe
• pingsender.exe
• mousocoreworker.exe
• mpsigstub.exe
• dmclient.exe
• waasmedicagent.exe

Keeping track of what executables are running on your PC is a great first step to protect your privacy and security.

Want even more security and privacy? Consider trying out our free GlassWire Firewall app. GlassWire helps you see the network behavior of the apps on your PC in real-time. You can then use GlassWire’s firewall to reveal malware, bandwidth wasters, or other badly behaving apps.

Download GlassWire

_,,

Downloads!

Join our Internet security newsletter!

Learn how to protect and monitor your network with GlassWire.