Is this file safe to open? A practical checklist
Every "is this safe?" question is really three questions: what IS this file, what happens if I open it, and do I trust where it came from? Windows makes the first question harder than it should be — hidden extensions, lying icons — but the answers are all checkable in a couple of minutes, locally, without running anything.
First: find out what the file actually is
File names and icons are claims, not facts. A file calling itself an invoice can be an executable wearing a PDF icon; a "photo" can be a shortcut that launches PowerShell. Two habits pierce the costume. Turn on real extensions: Explorer → View → Show → File name extensions — permanently; the number of infections this one checkbox has prevented is uncountable. And when the name still doesn't add up, check the file's bytes: drop it into our file identifier, which reads the magic numbers at the start of the file locally and tells you what it really is, extension be damned. A "document" that identifies as a PE executable has answered your safety question already.
Know the risk tiers
Runs immediately when double-clicked — .exe, .msi, .scr (a renamed exe), .bat/.cmd, .vbs, .js (outside the browser), .jar, and .lnk shortcuts (whose target line can launch anything). These deserve full scrutiny: unexpected arrival = don't run it. Acts when merged or installed — .reg files write directly into the registry; driver and installer packages change the system. Read before applying. Documents and media — PDFs, Office files, images, video: normally inert data, with two famous caveats — Office macros (.docm/.xlsm, and any "Enable Content" button: that button is the payload's trigger) and the occasional parser exploit, which staying updated addresses. Containers — ZIP/7z/RAR/ISO are envelopes; judge what's inside after extracting, not the envelope.
The .reg special case: read it, don't run it
Registry files are the classic "just merge this fix" payload, because one double-click can add an autostart program, disable Defender by policy, or hijack how every .exe launches. They're also often legitimate tweaks. The difference is entirely in WHICH keys they touch, and that's checkable: drop the file into the .reg viewer and read the safety summary — it decodes every value and flags the known persistence and policy locations by risk (the same locations documented in our registry reference). A file that only touches an app's own settings reads very differently from one writing to Run keys or Image File Execution Options.
Provenance: the question that outranks the file
The same bytes can be fine from one source and hostile from another. Ask where the file came from, concretely. Downloaded from the vendor's own site over HTTPS: good. Rehosted on a "download portal", forwarded through chat, or arriving as an unexpected email attachment — even from a real contact, whose account may be compromised: assume nothing. Check the digital signature on executables (right-click → Properties → Digital Signatures — a valid signature from the company you expected is strong evidence; its absence on commercial software is a caution flag). And let SmartScreen and Defender do their jobs: overriding their warnings for a file you can't vouch for is exactly the click the attacker is counting on.
When you must open something questionable
Sometimes "don't open it" isn't an option. Reduce the blast radius: scan it first (right-click → Scan with Microsoft Defender — or upload the file's HASH, not the file, to reputation services if it's sensitive); open documents in Protected View or a web viewer rather than the desktop app; test unknowns in a spare machine or a virtual machine, not your daily driver; and never enter credentials into anything a file opened. If a file DID run and you regret it: disconnect the network, run a full Defender scan (including the offline scan), check the autostart locations for new entries, and change passwords from a different, clean device.