File scan report
Verdict Malicious
Is linoutemp.
Nearly 30 antivirus engines, including eight major ones, identify this unsigned 64-bit executable as a hacking tool that loads vulnerable drivers, and two engines independently…
Read the whole reasonShow less
Strong evidence · Two or more major antivirus engines agree.
Delete it without running it, and if it came bundled with a game cheat, mod or activator, treat that entire bundle as unsafe. If it has already been launched as administrator, scan the machine and review recently added drivers and cleared security logs; keep your antivirus and tamper protection switched on.
What to do now4 steps
This is a hacking tool. It is risky to keep and run, but finding it is not by itself a sign that the device is infected.
What to do
Don't run it unless you got it on purpose for security testing on systems you own. Delete it, then empty the Recycle Bin.
If you didn't put it on the device yourself, delete it and run a full antivirus scan: something else may have brought it.
Tools like this often come with cracked or pirated software. If it came that way, treat the whole download as unsafe and scan everything it installed.
If you already ran it
Stop using it, run a full scan with your antivirus and watch for unexpected behavior or security alerts.
If you opened or installed it
Avoid banking and sign-ins on that device until it is clean. These free MalwareTips guides walk you through it.
- Trojan removal guideClear steps for Windows, Mac and Android. (opens malwaretips.com in a new tab)
- Remove malware from WindowsStep-by-step cleanup with free tools. (opens malwaretips.com in a new tab)
- Ask for free help on the MalwareTips forumWindows malware removal help, answered by volunteers. (opens malwaretips.com in a new tab)
Paste this report's link in your topic so helpers can see what was found.
Antivirus results
29 of 70 flagged
- Flagged 29
- No detection 41
- No result 5
- Code signing Unsigned
- Test run Completed
- First seen 27d ago
Chapter 02
Why we think so
6 points against it and 3 in its favour, checked against the scan evidence.
The reasoning behind this verdict
29 of the 70 antivirus engines that checked it flagged this unsigned executable, eight of them major antivirus engines naming it a hacking tool or a vulnerable-driver loader. ESET-NOD32 and Antiy-AVL both classify it as hacking tool software, and several others describe abuse of a known vulnerable driver. The sandbox runs were quiet, but the tooling labels are specific and corroborated, so it should not be run on a system you care about.
The antivirus results on this file are broad and specific rather than a lone generic hit. 29 of the 70 antivirus engines that checked it flagged it, including eight major antivirus engines, and the labels converge on a single theme: ESET-NOD32 calls it a hacking tool, DrWeb calls it a vulnerability-driver tool, and huorong, Lionic and Rising all name vulnerable-driver abuse. Two independent engines agreeing on the hacking-tool label is what turns that from a hunch into a corroborated classification, and the file carries no signature or publisher history to weigh against it. The built structure is unremarkable — moderate section entropy, no packer, no unusual wrapper — so nothing suggests the engines are reacting to obfuscation artefacts. The sandbox side is quiet: the combined sandbox verdict was clean, no injected process of the sample's own, no dropped files and no known-malicious contact, which fits a utility whose dangerous work only happens when it is aimed at a kernel driver on a real machine rather than in a virtual one. Public scanning rules in the researcher annotations describe the same thing, driver mapping through a known vulnerable Intel driver, so the static and behavioural picture line up with the engine labels.
What We Detected
This is a 64-bit Windows executable of about 372 KB, first seen on Oct 11, 2026 and submitted by 22 distinct sources since. It carries no digital signature and no publisher history. 29 of the 70 antivirus engines that checked it in our network flagged it, eight of them from our highest-trust group, and the wording is consistent across vendors: ESET-NOD32 describes a hacking tool, DrWeb a vulnerability-driver tool, and huorong, Lionic and Rising all name vulnerable-driver abuse or exploitation. Microsoft, Avast and AVG add generic trojan and reputation detections on top.
Threat Behavior
Everything the engines point at is kernel-level: a utility whose purpose is to load a driver that Windows would otherwise refuse to load, by exploiting a known vulnerable signed driver from a hardware vendor. Researcher annotations attached to this hash describe the same capability, naming a driver-mapping approach that abuses an older Intel driver and command-line patterns associated with clearing system logs. A tool like this is how an unsigned driver gets into the kernel of a protected machine, so it is treated as offensive tooling regardless of who runs it. Our combined sandbox result over five runs was clean: no injected process belonging to the sample, no dropped files, no persistence recorded, and the only network contact was the analysis machine's own data. That is expected — the risky action requires a real target driver and elevated privileges that a virtual machine does not supply.
What To Do Now
Do not run this on a work or personal system. If it arrived as part of a "cheat", a game mod, an activation kit or a support engineer's fix, treat the whole bundle as untrustworthy and remove it; nothing legitimate needs a driver-mapping loader for ordinary tasks. Keep your antivirus and any tamper protection enabled — tools of this type often come with instructions to switch protections off, and those instructions should never be followed. If it was already launched with administrator rights on a machine you use, scan that machine with a reputable security product and review recent driver installations and security-log changes.
Where this verdict could be wrong3 caveats
- The sandbox runs finished with a clean combined verdict and recorded no injected process, dropped file or hostile contact, which is what a utility that only acts when pointed at a kernel driver on a real machine would look like.
- Several engines returned only generic machine-learning or reputation labels rather than a named tool, so the exact variant and its intended target are not established by the detections alone.
- Driver-mapping utilities are also used for legitimate administrative and security research work, though the unsigned binary and the corroborated hacking-tool labels do not fit a legitimate distribution channel.
These are the assessment's weak points. If you believe one applies to your file, report the verdict and we'll re-review it.
- The combined sandbox result across the five runs was clean, with no injected process, dropped file or persistence recorded.
- No contacted destination resolved to a known-malicious host in our lookup.
- The file is not packed and its code entropy is moderate, so the detections are not artefacts of obfuscation.
- 29 of the 70 antivirus engines that checked it flagged it, including eight from the most trusted group, so this is not a single-vendor false positive.
- ESET-NOD32 and Antiy-AVL both classify it as a hacking tool, an assessment two independent products agree on.
- Several engines specifically describe vulnerable-driver abuse or exploitation, the technique used to load unsigned kernel code on Windows.
- The executable is unsigned and has no publisher history, so there is no trusted identity behind it.
- Public scanning rules attached to this sample describe driver mapping through an older vulnerable Intel driver and log-clearing command patterns.
- It is still circulating: 22 distinct sources have submitted it since Oct 11, 2026.
6 sources checked · all complete. See every source
Chapter 03
What it did in our test
It ran in 5 isolated tests; no test environment rated what it did as risky.
Test run summary
Capture complete- 5isolated sandbox runs
- 19sandbox rule tags
- 3spawned processes
- 0network contacts
- 2filesystem & mutex artifacts
What the test run showed
What the file did on a test computer
Confirmed in the test run
Moderate concern: Contains packed or scrambled code that is harder to inspect (common in installers too).
Moderate concern: Ran commands or a script on the test computer.
Note: Read the user name of the test computer.
Note: Deleted files or logs during the test run (installers often clean up after themselves).
Note: Read basic details of the test computer, such as its Windows version.
Note: Looked through folders on the test computer (most installers do this).
Note: Loaded extra code modules while running.
Sandbox labels we could not confirm (common in safe files too)
Not confirmed: A sandbox rule tagged this run as code injection, but no injected program was recorded.
Not confirmed: A sandbox rule tagged this run as contacting a server, but no contacted host was recorded.
Not confirmed: A sandbox rule tagged this run as creating a service; no new service was recorded.
This file was run on a test computer (a sandbox), not on yours. Labels we could not confirm are listed so you can see them, but they are not treated as evidence against the file.
Threat context
How hacking tools are used
Hacking tools are programs that can switch off security software, test passwords or attack other computers. Security professionals use them on purpose; criminals also bundle them with malware.
Bottom line:Keep it only if you installed it on purpose, and check how it got onto the device if you didn't.
Recorded behavior
What happened in the test
Grouped by step. The order is not a timeline.
- 1
Input file
The submitted object
- Evidence 1 of 5: FileSeen in the test run
linoutemp.exe
615c9dba6267cc2342da26308733896092c1bb03a3b198533b6fe5c465d090cc
Uploaded file
- 2
Processes
What ran
- Evidence 2 of 5: ProcessSeen in the test run
cmd.exe
C:\Windows\system32\cmd.exe /c cls
Test run - Evidence 3 of 5: ProcessSeen in the test run
linoutemp.exe
"C:\Users\user\Desktop\linoutemp.exe"
Test run - +1 more recorded observation
- 2
Files
Created or changed
- Evidence 4 of 5: Written fileSeen in the test run
ConDrv
\Device\ConDrv
Test run - Evidence 5 of 5: Written fileSeen in the test run
Connect
\Device\ConDrv\\Connect
Test run - +1 more recorded observation
5 facts from the test run. See the full activity list.
What this file did when executed
This file was detonated in 5 sandboxes and its runtime behaviour was observed.
Sandbox verdicts
1- VT: CLEANclean
Techniques observed in the sandbox
19MITRE ATT&CK techniques the sandbox mapped. Highlighted ones are rare in normal software; the others are common in legitimate programs too.
- T1027· Obfuscated code
- T1027.002· Obfuscated code
- T1027.005· Obfuscated code
- T1033· Reads user info
- T1036
- T1055· Process injection
- T1059.001· Runs commands
- T1070.001· Covers its tracks
- T1071· Application protocol
- T1082· System recon
- T1083· Scans your files
- T1112
- T1129· Loads modules
- T1134
- T1543.003· Service install
- T1553
- T1553.002
- T1569.002
- T1614
Observed activity
Processes started
3Programs the file ran, with their command lines.
cmd.exeC:\Windows\system32\cmd.exe /c clslinoutemp.exe"C:\Users\user\Desktop\linoutemp.exe"cmd.exeC:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c cls
Files
2Files the file created, changed or deleted.
- Written
\Device\ConDrv - Written
\Device\ConDrv\\Connect
Sandbox background — not the file
2The analysis machine's own processes and connections, recorded in every run.
- VM process
conhost.exeC:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 - VM host
atm.teams.mira.tm.svc.cloud.microsoft
Chapter 04
Technical details
29 of the 70 antivirus engines that checked it flag it; no publisher signature.
Sources checked
Every check behind this verdict
6 sources checked · all complete. Complete means the check returned a usable result; it does not mean the file is safe.
Engines that flagged it 29
- Avast (major engine)FileRepMalware [Misc]
- AVG (major engine)FileRepMalware [Misc]
- DrWeb (major engine)Tool.VulnDriver.22
- ESET-NOD32 (major engine)Win64/HackTool.GameHack.CW trojan
- Fortinet (major engine)PossibleThreat.RF
- Microsoft (major engine)Trojan:Win32/Kepavll!rfn
- Symantec (major engine)ML.Attribute.HighConfidence
- TrellixENS (major engine)Artemis!1A51DBF1CA7C
File fingerprint
- Last analyzed
- Nov 5, 2026, 8:23 PM UTC
- SHA-256
615c9dba6267cc2342da26308733896092c1bb03a3b198533b6fe5c465d090cc- SHA-1
68141abd6c4f26aaa0fee8222a246c0b7d08a1f7- MD5
1a51dbf1ca7cef0094ab2f76cf752e6e
About this file
linoutemp.exe is a Win32 EXE file of 372.2 kB.
- Type and size
- Win32 EXE · 372.2 kB
- Signer
- UnsignedNo code signature.
- First seen
- Oct 11, 2026On VirusTotal.
- Submitted by
- 22 distinct sources
- Packer
- None detected
- Entropy
- 6.16 of 8
First scanned
Antivirus consensus
29 of 70 engines flagged this file
5 of the 75 engines returned no result for this file (file type not supported, or the scan did not finish), so they did not check it.
The 29 detections come from 27 independent scan engines: several vendors license the same engine, so their results are one vote.
- Tier-118 engines8flagged9 vendors sharing 8 engines
- Tier-235 engines10flagged
- Low-trust17 engines10flagged
View all 75 engine results
- Antiy-AVLMalicious: HackTool/Win64.Gamehack
- APEXMalicious: Malicious
- AvastMalicious: FileRepMalware [Misc]
- AVGMalicious: FileRepMalware [Misc]
- BkavMalicious: W32.Malware.6F7ED577
- CrowdStrikeMalicious: win/malicious_confidence_90% (W)
- CylanceMalicious: Unsafe
- CynetMalicious: Malicious (score: 100)
- DeepInstinctMalicious: MALICIOUS
- DrWebMalicious: Tool.VulnDriver.22
- ElasticMalicious: malicious (high confidence)
- ESET-NOD32Malicious: Win64/HackTool.GameHack.CW trojan
- FortinetMalicious: PossibleThreat.RF
- GoogleMalicious: Detected
- huorongMalicious: Exploit/Vulndriver.c!crit
- LionicMalicious: Trojan.Win32.Vulndriver.4!c
- MalwarebytesMalicious: Malware.AI.3233424603
- MaxSecureMalicious: Trojan.Malware.8328611.susgen
- McAfeeDMalicious: ti!615C9DBA6267
- MicrosoftMalicious: Trojan:Win32/Kepavll!rfn
- PaloaltoMalicious: generic.ml
- RisingMalicious: Exploit.Vulndriver!8.1B9F1 (CLOUD)
- SangforMalicious: Trojan.Win32.Save.a
- SentinelOneMalicious: Static AI - Malicious PE
- SymantecMalicious: ML.Attribute.HighConfidence
- TrapmineMalicious: malicious.moderate.ml.score
- TrellixENSMalicious: Artemis!1A51DBF1CA7C
- TrendMicro-HouseCallMalicious: TROJ_GEN.R002H01JP26
- VaristMalicious: W64/ABApplication.CYLT-2919
- AcronisClean
- AhnLab-V3Clean
- AlibabaClean
- alibabacloudClean
- ALYacClean
- ArcabitClean
- Avast-MobileNo result
- AviraClean
- BitDefenderClean
- BitDefenderFalxNo result
- CAT-QuickHealClean
- ClamAVClean
- CMCClean
- CTXNo result
- EmsisoftClean
- F-SecureClean
- GDataClean
- GridinsoftClean
- IkarusClean
- JiangminClean
- K7AntiVirusClean
- K7GWClean
- KasperskyClean
- KingsoftClean
- MicroWorld-eScanClean
- NANO-AntivirusClean
- PandaClean
- SkyhighClean
- SophosClean
- SUPERAntiSpywareClean
- SymantecMobileInsightNo result
- TACHYONClean
- tehtrisClean
- TencentClean
- TrendMicroClean
- TrustlookNo result
- VBA32Clean
- VIPREClean
- VirITClean
- ViRobotClean
- WebrootClean
- XcitiumClean
- YandexClean
- ZillyaClean
- ZoneAlarmClean
- ZonerClean
Signatures and behavior heuristics
Low-severity pattern matches — worth noting but not on their own cause for alarm.
VirusTotal's sandbox summary maps this run to MITRE T1055 (Process Injection), but no injected process of the sample's own was recorded (the analysis VM's own WMI adapter, crash handlers and Chrome updater are not counted). VirusTotal maps T1055 on about half of all files no engine flags, so the mapping alone is not evidence of injection.
EvidenceT1055 (sandbox MITRE mapping)
Section entropy & packers
No high-entropy executable section or known packer signature was detected. Data and resource sections can still have high entropy without indicating packed code.
How widely this file has been seen
Moderate prevalence — neither rare nor common. No strong prior applies.
Chapter 05
Questions & answers
Short answers to the 8 questions people ask most about this file.
Is linoutemp.exe malware?
What is linoutemp.exe?
How many antivirus engines detected linoutemp.exe?
I already downloaded and ran linoutemp.exe — what should I do?
How do I remove linoutemp.exe?
What kind of program is linoutemp.exe?
What is the SHA-256 hash of linoutemp.exe?
How up to date is this analysis of linoutemp.exe?
Community
Member reviews and reports for this exact file hash.