File scan report
Verdict Safe
Is FREE WOLF K8 setup 1.
None of the 68 antivirus engines that checked it flagged this validly signed Inno Setup installer, and the sandbox runs showed ordinary installer behaviour with no injection and…
Read the whole reasonShow less
Strong evidence · A verified publisher signature, and no engine flags it.
Download it only from the vendor's official site and keep your antivirus enabled while installing.
Good practice2 tips
We found nothing harmful in this file.
Install it only if it came from the developer's own website or an official app store.
Keep your antivirus and Windows updates switched on.
No scanner can promise a file is 100% safe.
Antivirus results
0 of 68 flagged
- Flagged 0
- No detection 68
- No result 6
- Code signing SHENZHEN SHINETEK TECHNOLOGY CO.,LTD
- Test run Completed
- First seen 3y ago
Chapter 02
Why we think so
3 points against it and 5 in its favour, checked against the scan evidence.
The reasoning behind this verdict
No antivirus engine flagged this installer, and its signature verifies. The sandbox runs showed typical installer activity, including file drops and a driver folder, with no process injection and no known-bad hosts. The signer has no history with us, so confidence is moderate.
0 of the 68 antivirus engines that checked it flagged the file, including 16 major antivirus engines that returned clean. The signature is valid, though the signer is not one we have history on. The combined sandbox verdict was clean, no injection targets were recorded, and the one dual-use mapping lacks any supporting artefact. The single direct-IP contact is low severity, and none of the 13 inspected hosts is known malicious. Community rule matches are all generic. Similar-file matches rely only on shared import tables and add little.
What We Detected
No engine out of 74 flagged this Windows installer. It carries a valid signature from SHENZHEN SHINETEK TECHNOLOGY CO.,LTD.
Threat Behavior
The sandbox runs showed an Inno Setup style installation into Program Files with a driver folder and a process-kill call. No process injection, persistence or known-malicious host contact was recorded.
What To Do Now
Install only if you obtained it from the vendor's official source and want the software; keep your antivirus enabled.
Where this verdict could be wrong3 caveats
- The signer has no history in our data and is not a trusted publisher, so the valid signature gives limited assurance.
- One direct-IP contact without a DNS lookup occurred, though it is low severity and consistent with installer or VM background traffic.
- The installer drops driver files and runs taskkill, which is unusual but consistent with a device-driver installer.
These are the assessment's weak points. If you believe one applies to your file, report the verdict and we'll re-review it.
- No detections from 74 engines
- Valid code signature
- Clean combined sandbox verdict with no injection
- No known-malicious contacted hosts
- Submitted by 48 sources since 2023
- The signer has no history in our data
- One direct-IP connection without a DNS lookup was seen
- The installer drops driver files, which warrants a trusted source
6 sources checked · all complete. See every source
Chapter 03
What it did in our test
It ran in 5 isolated tests; no test environment rated what it did as risky.
Test run summary
Capture complete- 5isolated sandbox runs
- 24sandbox rule tags
- 6spawned processes
- 2network contacts
- 21filesystem & mutex artifacts
What this file did when executed
This file was detonated in 5 sandboxes and its runtime behaviour was observed.
Sandbox verdicts
1- VT: CLEANclean
Techniques observed in the sandbox
24MITRE ATT&CK techniques the sandbox mapped. Highlighted ones are rare in normal software; the others are common in legitimate programs too.
- T1012
- T1027· Obfuscated code
- T1027.002· Obfuscated code
- T1033· Reads user info
- T1036
- T1047
- T1056· Keylogging
- T1057· Lists programs
- T1059· Runs commands
- T1070.006· Covers its tracks
- T1071· Application protocol
- T1071.001· Application protocol
- T1082· System recon
- T1083· Scans your files
- T1095· Custom network
- T1129· Loads modules
- T1134
- T1202
- T1497.001· Sandbox evasion
- T1529
- T1562.001· Disables security
- T1574.002· Execution hijack
- T1614
- T1614.001
Observed activity
Processes started
6Programs the file ran, with their command lines.
62b1280a3a231261072664eede0efe4e11a72a9788962c799b7544815681c210.exe%SAMPLEPATH%\62b1280a3a231261072664eede0efe4e11a72a9788962c799b7544815681c210.exe62b1280a3a231261072664eede0efe4e11a72a9788962c799b7544815681c210.tmp%USERPROFILE%\AppData\Local\Temp\is-0VR0U.tmp\62b1280a3a231261072664eede0efe4e11a72a9788962c799b7544815681c210.tmp62b1280a3a231261072664eede0efe4e11a72a9788962c799b7544815681c210.exeC:\Users\<USER>\AppData\Local\Temp\is-3QBR0.tmp\62b1280a3a231261072664eede0efe4e11a72a9788962c799b7544815681c210.tmp /SL5=$9014C,7734317,778240,C:\Users\<USER>\Downloads\62b1280a3a231261072664eede0efe4e11a72a9788962c799b7544815681c210.exeprogram.exe"C:\Users\user\Desktop\program.exe"program.tmp"C:\Users\user\AppData\Local\Temp\is-O05G2.tmp\program.tmp" /SL5="$2044A,7734317,778240,C:\Users\user\Desktop\program.exe"taskkill.exeC:\Windows\SysWOW64\taskkill.exe "C:\Windows\System32\taskkill.exe" /f /im DeviceDriver.exe
Network contacts
22 hosts, listed as 2 addresses. Links show the host and path only.
- IP address
8.253.139.248 - IP address
104.98.118.146
Files
16Files the file created, changed or deleted.
- Written
C:\Users\<USER>\AppData\Local\Temp\is-3QBR0.tmp\62b1280a3a231261072664eede0efe4e11a72a9788962c799b7544815681c210.tmp - Written
C:\Program Files\FREE WOLF K8 - Written
C:\Program Files\FREE WOLF K8\db - Written
C:\Program Files\FREE WOLF K8\db\is-ANK1G.tmp - Written
C:\Program Files\FREE WOLF K8\driver - Written
C:\Program Files\FREE WOLF K8\driver\x64
Show all 16 entries for files
- Written
C:\Program Files\FREE WOLF K8\driver\x64\is-FBGSK.tmp - Written
C:\Program Files\FREE WOLF K8\driver\x64\is-FQQI0.tmp - Written
C:\Program Files\FREE WOLF K8\driver\x64\is-IVR9P.tmp - Written
C:\Program Files\FREE WOLF K8\driver\x64\is-J5G3G.tmp - Written
C:\Program Files\FREE WOLF K8\driver\x64\is-OF7H6.tmp - Written
C:\Program Files\FREE WOLF K8\driver\x64\is-S4G5L.tmp - Written
C:\Program Files\FREE WOLF K8\driver\x86 - Written
C:\Program Files\FREE WOLF K8\driver\x86\is-2P5PR.tmp - Written
C:\Program Files\FREE WOLF K8\driver\x86\is-3UAMB.tmp - Deleted
C:\Program Files\FREE WOLF K8\DeviceDriver.exe
Registry and auto-start
5Settings the file changed, including ways to start again after a restart.
- Set
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0000\SessionHash - Set
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0000\Owner - Set
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0000\Sequence - Set
HKEY_CURRENT_USER\Software\Microsoft\RestartManager - Set
HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0000
Mutexes
5Named locks a program uses so only one copy runs; malware families often reuse them.
Local\RstrMgr3887CAB8-533F-4C85-B0DC-3E5639F8D511Local\RstrMgr-3887CAB8-533F-4C85-B0DC-3E5639F8D511-Session0000\Sessions\1\BaseNamedObjects\Local\RstrMgr3887CAB8-533F-4C85-B0DC-3E5639F8D511\Sessions\1\BaseNamedObjects\Local\RstrMgr-3887CAB8-533F-4C85-B0DC-3E5639F8D511-Session0000\Sessions\1\BaseNamedObjects\Local\SessionImmersiveColorMutex
Sandbox background — not the file
15The analysis machine's own processes and connections, recorded in every run.
- VM process
updater.exeC:\Program Files\Google3768_1321550160\bin\updater.exe - VM process
conhost.exeC:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 - VM injection target
C:\Program Files\Google3768_1321550160\bin\updater.exe - VM host
www.microsoft.com - VM host
res.public.onecdn.static.microsoft - VM host
x1.c.lencr.org
Show all 15 entries for sandbox background — not the file
- VM host
crl.root-x1.letsencrypt.org.edgekey.net - VM host
e8652.dscx.akamaiedge.net - VM host
c.pki.goog - VM host
ecs-office.s-0005.dual-s-msedge.net - VM host
s-0005.dual-s-msedge.net - VM host
192.168.0.74 - VM host
20.69.140.28 - VM host
23.55.140.42 - VM host
23.196.145.221
Files this sample writes at runtime
This file drops 10 children at runtime. None are currently flagged malicious in our cache. 10 have no saved verdict and were not checked; that is missing coverage, not a finding.
- 587a6a251ce313601b33…d12202Not checkedno saved verdict
- 8dd884f0a0e54bf4c3e7…e2b99eNot checkedno saved verdict
- a0ea8bf22b2a02f680d0…b08a8fNot checkedno saved verdict
- 374fc000abcafcd79e53…075210Not checkedno saved verdict
- 989c9880a31907c35c04…ba68dfNot checkedno saved verdict
- cdd35e90a8820fa2bb96…229e5fNot checkedno saved verdict
- 74ab3c599caa24133175…e6bea7Not checkedno saved verdict
- 491a441706b847c422f4…1c4997Not checkedno saved verdict
- b45bb28a85d56a68c626…6fbc02Not checkedno saved verdict
- d88fb7ded9c7e3f0f0a8…a8c627Not checkedno saved verdict
Chapter 04
Technical details
None of the 68 antivirus engines that checked it flag it; signed by SHENZHEN SHINETEK TECHNOLOGY CO.,LTD.
Sources checked
Every check behind this verdict
6 sources checked · all complete. Complete means the check returned a usable result; it does not mean the file is safe.
File fingerprint
- Last analyzed
- Oct 23, 2026, 3:54 AM UTC
- SHA-256
62b1280a3a231261072664eede0efe4e11a72a9788962c799b7544815681c210- SHA-1
10edf4f03de35365ca6047ecbbd607a786c22e20- MD5
85a16185b396880ca12015589c812c1e
About this file
FREE WOLF K8 setup 1.0.3.1.exe says it is FREE WOLF K8 Setup (FREE WOLF K8), 8.6 MB.
- Claims to be
- FREE WOLF K8 Setup (FREE WOLF K8)From the file's own version information, written by whoever built it.
- Type and size
- Win32 EXE · 8.6 MB
- Signer
- SHENZHEN SHINETEK TECHNOLOGY CO.,LTDValid code signature.
- First seen
- Oct 23, 2023On VirusTotal.
- Submitted by
- 48 distinct sources
- Packer
- None detected
- Entropy
- 6.29 of 8
First scanned
Antivirus consensus
0 of 68 engines flagged this file
6 of the 74 engines returned no result for this file (file type not supported, or the scan did not finish), so they did not check it.
- Tier-116 engines0flagged
- Tier-234 engines0flagged
- Low-trust18 engines0flagged
View all 74 engine results
- AcronisClean
- AhnLab-V3Clean
- AlibabaClean
- alibabacloudClean
- ALYacClean
- Antiy-AVLClean
- APEXClean
- ArcabitClean
- AvastNo result
- Avast-MobileNo result
- AVGNo result
- AviraClean
- BaiduClean
- BitDefenderClean
- BitDefenderFalxNo result
- BkavClean
- CAT-QuickHealClean
- ClamAVClean
- CMCClean
- CrowdStrikeClean
- CTXClean
- CylanceClean
- CynetClean
- DeepInstinctClean
- DrWebClean
- ElasticClean
- EmsisoftClean
- ESET-NOD32Clean
- F-SecureClean
- FortinetClean
- GDataClean
- GridinsoftClean
- huorongClean
- IkarusClean
- JiangminClean
- K7AntiVirusClean
- K7GWClean
- KasperskyClean
- KingsoftClean
- LionicClean
- MalwarebytesClean
- MaxSecureClean
- McAfeeDClean
- MicrosoftClean
- MicroWorld-eScanClean
- NANO-AntivirusClean
- PaloaltoClean
- PandaClean
- RisingClean
- SangforClean
- SentinelOneClean
- SkyhighClean
- SophosClean
- SUPERAntiSpywareClean
- SymantecClean
- SymantecMobileInsightNo result
- TACHYONClean
- tehtrisClean
- TencentClean
- TrapmineClean
- TrellixENSClean
- TrendMicroClean
- TrendMicro-HouseCallClean
- TrustlookNo result
- VaristClean
- VBA32Clean
- VIPREClean
- VirITClean
- ViRobotClean
- WebrootClean
- XcitiumClean
- YandexClean
- ZoneAlarmClean
- ZonerClean
Signatures and behavior heuristics
Community YARA rules matched, but all of them are generic capability, anti-debug or compiler rules that ordinary software also matches. Worth noting, not on their own cause for alarm.
- Borlandgeneric
- CP_AllMal_Detectorgeneric
- HUNTING_SUSP_TLS_SECTIONgeneric
- pe_detect_tls_callbacksgeneric
- PE_Digital_Certificategeneric
- shellcodegeneric
- Sus_Obf_Enc_Spoof_Hide_PEgeneric
The sample contacted an external IP address directly and no application domain was recorded. Direct-IP traffic also occurs in legitimate installers and infrastructure, so this is supporting context only and requires corroboration from host reputation and other runtime evidence.
Evidence8.253.139.248
Section entropy & packers
No high-entropy executable section or known packer signature was detected. Data and resource sections can still have high entropy without indicating packed code.
How widely this file has been seen
Moderate prevalence — neither rare nor common. No strong prior applies.
Chapter 05
Questions & answers
Short answers to the 7 questions people ask most about this file.
Is FREE WOLF K8 setup 1.0.3.1.exe safe?
What is FREE WOLF K8 setup 1.0.3.1.exe?
How many antivirus engines detected FREE WOLF K8 setup 1.0.3.1.exe?
Is FREE WOLF K8 setup 1.0.3.1.exe digitally signed?
What is the SHA-256 hash of FREE WOLF K8 setup 1.0.3.1.exe?
Is it safe to install FREE WOLF K8 setup 1.0.3.1.exe?
How up to date is this analysis of FREE WOLF K8 setup 1.0.3.1.exe?
Community
Member reviews and reports for this exact file hash.