WSTS Windows Security Threat Scanner

Windows Security Threat Scanner - WSTS

A read-only forensic scanner that inspects your Windows PC for malware indicators, persistence mechanisms, and evidence of log or credential-store tampering.

Runs 100% locally. No account. No telemetry. Nothing ever leaves your machine.

Download for Windows Verify the file first

Version 1.0.0 · Windows 10 / 11 (64-bit) · Read-only & offline

README

What WSTS does

WSTS looks at the same forensic artifacts that incident responders check after a suspected compromise. It only reads these artifacts — it never changes, deletes, quarantines, or transmits anything.

CheckWhat it tells you
Prefetch executionWhether known hacking tools or abused Windows utilities (Mimikatz, PsExec, certutil, mshta, etc.) have run recently.
Startup persistenceSuspicious scripts or shortcuts planted in Startup folders that would re-launch malware on every boot.
Event-log tamperingCleared or recently wiped Security/System/Application logs — a common way attackers hide their tracks.
Credential storesRecent changes to DPAPI / Credential Manager files that may indicate credential theft.
Amcache & NTUSERTampering in the hives that record application-execution history.

Each finding is tagged so you can tell routine activity from things worth a closer look (for example: KNOWN_SUSPICIOUS_TOOL, RAN_LAST_24H, POSSIBLY_CLEARED, RECENTLY_MODIFIED).

Installing & running

  1. Go to https://wincyberscan.com and click Download for Windows.
  2. Verify the file (see Verify download) — recommended.
  3. Right-click WSTS-Setup-<version>.exe → Run as administrator.
    Administrator rights let WSTS read protected logs and hives. Without them the scan still runs, but some areas will show as inaccessible.
  4. WSTS opens a dashboard in your default browser at http://127.0.0.1:5900.

If Windows SmartScreen warns you: this is expected for newer security tools. After you’ve verified the SHA-256 hash, click More info → Run anyway.

Using the dashboard

  1. Click Run Scan. The scan takes a few seconds.
  2. Results appear grouped into collapsible sections — Prefetch, Startup, Event Logs, Credential Stores, and Amcache/NTUSER.
  3. Click any section header to expand or collapse it.
  4. The summary row at the top shows the host name, scan time, and a count of flagged items.

Reading the results

  • Green / informational items are normal and expected.
  • Flagged items carry one or more tags explaining why they were flagged.
  • A flag does not automatically mean infection. Some tools (like PowerShell or cmd) are flagged for review because attackers abuse them — but they’re also used legitimately every day.

What to do with a flagged item

  1. Note the path, timestamp, and tags.
  2. Ask: do I recognize this program, and did I expect it to run at that time?
  3. If something looks genuinely unexpected — for example a hacking tool you never installed, or a Security log that was recently cleared — treat the machine as potentially compromised: disconnect it from the network and consult an incident-response professional.

Privacy

  • WSTS makes no outbound network connections. You can block it in your firewall and it will still work.
  • All scanning happens locally. No results, files, or telemetry leave your machine.
  • No account, no registration, no email address required.

Read the full Privacy Policy →

What WSTS checks

Prefetch execution

Flags execution of known offensive-security tools and Windows LOLBins (Mimikatz, PsExec, certutil, mshta, and more).

Startup persistence

Inspects user and global Startup folders for suspicious scripts, shortcuts, and recently planted payloads.

Event-log tampering

Detects cleared or recently modified Security, System, and Application logs — a common anti-forensic move.

Credential stores

Checks DPAPI and Credential Manager artifacts for recent modification that may indicate theft attempts.

Amcache & NTUSER

Reviews application-execution history hives for recent tampering or unusual activity.

Local report

Results render in your browser at 127.0.0.1 — generated on-device and never uploaded.

Understanding your results

Every finding is shown in a table with five columns. Here is what each one means.

ColumnWhat it means
SEV Severity — how much attention this item deserves.
LOW Normal background activity worth noting.
MEDIUM Ran recently or is a commonly-abused tool — worth a quick look.
HIGH Known attack tool, suspicious location, or tampered log — investigate.
Executable The name of the program Windows recorded. Standard Windows processes like SVCHOST.EXE, MSEDGE.EXE, and DLLHOST.EXE are normal. Be alert to names you don’t recognise or known attack tools like MIMIKATZ.EXE or PSEXEC.EXE.
Last Run The exact date and time Windows last recorded that program running. Useful for checking whether activity happened at an unexpected time (e.g. 3 AM when nobody was at the computer).
Age How long ago the program ran, shown in hours or days (e.g. 0h = within the last hour, 2d = two days ago). Shorter ages mean more recent activity.
Flags The reason the item appears in the list. Common flags:
  • RAN_LAST_1H / RAN_LAST_24H — ran very recently. Not alarming on its own — just means it was active.
  • KNOWN_SUSPICIOUS_TOOL — matches a known hacking or exploitation tool by name. Investigate immediately.
  • POSSIBLY_CLEARED — an event log is empty or was recently wiped. Normal if you or IT cleared it; suspicious if unexplained.
  • RECENTLY_MODIFIED — a credential or registry artifact changed recently. Cross-check with your own activity.
  • SUSPICIOUS_LNK_TARGET / SCRIPT_IN_STARTUP — a startup shortcut points somewhere unusual, or a script is set to run at login. Worth reviewing.

Quick guide: is this finding a problem?

  1. Check the Executable name. Is it a program you recognise? Standard Windows names are almost always safe.
  2. Check the Last Run time. Did it run while you were at the computer doing something that explains it?
  3. Check the Flag. RAN_LAST_1H alone is informational. KNOWN_SUSPICIOUS_TOOL or POSSIBLY_CLEARED with no explanation — escalate.
  4. If you cannot explain a finding, do not ignore it. Disconnect the machine from the network and contact an IT or security professional.

Why this download is safe

Security tools are frequently flagged by antivirus engines because they read the same forensic artifacts that malware touches. We are fully transparent so you can trust — and independently verify — exactly what you are running.

Read-only by design

WSTS never writes, deletes, modifies, or transmits any file. It opens artifacts for reading and reports what it finds. Nothing else.

Source available for audit

WSTS is built from our own source, which we make available for independent security review on request. Contact us to arrange an audit.

No network access

The scanner makes no outbound connections. You can verify this with your own firewall — block it entirely and it still works.

Checksummed every release

Every release is published with a SHA-256 hash so you can confirm the file is genuine and unmodified. Authenticode code-signing is being provisioned and will be added in a future build.

Independently scanned

We submit each build to VirusTotal. Review the multi-engine report before you run anything.

View VirusTotal report →

If your antivirus flags it

A read-only forensic scanner reads the same credential and registry artifacts that malware touches, so an unsigned build can trigger a heuristic false-positive — Microsoft Defender may quarantine or delete it. To recover: open Windows Security → Virus & threat protection → Protection history, find the WSTS detection, and choose Restore / Allow. Always verify the SHA-256 hash below first. We submit every build to Microsoft and VirusTotal.

Verify before you run

Confirm the file you downloaded matches our official release. If the hash differs, do not run it — delete it and download again.

1. SHA-256 checksum

Official hash for WSTS-Setup-1.0.0.exe:

<published with each release>

Verify in PowerShell:

Get-FileHash .\WSTS-Setup-1.0.0.exe -Algorithm SHA256

2. Authenticode signature

Code-signing is being provisioned. Until it is in place this build is unsigned, so Windows will report NotSigned — that is expected. Confirm authenticity with the SHA-256 hash above. You can check signature status with:

Get-AuthenticodeSignature .\WSTS-Setup-1.0.0.exe | Format-List Status, SignerCertificate

Current status: NotSigned · Publisher (after signing): Antibody Cyber Technology, LLC

Download WSTS

WSTS-Setup-1.0.0.exe

Windows 10 / 11 (64-bit) · ~12 MB · Version 1.0.0

Download

For best protection, always download directly from https://wincyberscan.com and verify the SHA-256 hash above. We never distribute WSTS through third-party sites.

Run as Administrator for full artifact access. WSTS opens a local dashboard at http://127.0.0.1:5900 in your browser.