# False Positive Report — 4K\_Render\_Automation.exe — Malicious (high Confidence) **URL:** \ **Category:** Endpoint Security\ **Tags:** elastic-stack-security\ **Created:** [May 30, 2026, 1:38pm UTC](https://discuss.elastic.co/t/false-positive-report-4k-render-automation-exe-malicious-high-confidence/386586 "2026-05-30T13:38:19Z")\ **Posts on this page:** 6\ **Page:** 1
**Author:** ![Qu\_c\_Chau](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/qu_c_chau/32/147610_2.png) [@Qu\_c\_Chau](https://discuss.elastic.co/u/Qu_c_Chau)\ **Post date:** [May 30, 2026, 1:38pm UTC](https://discuss.elastic.co/t/false-positive-report-4k-render-automation-exe-malicious-high-confidence/386586/1 "2026-05-30T13:38:19Z")
Reporting a false positive for Elastic's malware detection engine. File: 4K\_Render\_Automation.exe SHA256: 8e8ab81e34a69221ff50b5b94f033cc31969cc39214efd0346f06a48957b991f Detection: Malicious (high Confidence) VT link: [VirusTotal](https://www.virustotal.com/gui/file/8e8ab81e34a69221ff50b5b94f033cc31969cc39214efd0346f06a48957b991f) This is a legitimate commercial Windows tool compiled with Nuitka (Python compiler) bundled with FFmpeg. 66/71 VT engines clean. Sold at [worktimerstudio.gumroad.com](http://worktimerstudio.gumroad.com) Elastic appears to be flagging the Nuitka-compiled PE structure as suspicious via static ML model, not dynamic behavior. Please review for false positive correction. ---
**Author:** ![cyril-t-f](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/cyril-t-f/32/147616_2.png) [@cyril-t-f](https://discuss.elastic.co/u/cyril-t-f)\ **Post date:** [June 1, 2026, 10:13am UTC](https://discuss.elastic.co/t/false-positive-report-4k-render-automation-exe-malicious-high-confidence/386586/2 "2026-06-01T10:13:52Z")
Hello @Qu_c_Chau thanks for sharing. We have an **[official form](https://docs.google.com/forms/d/e/1FAIpQLSfKZOPSPcucmgNR9_j316JnG_qYbJBpti5JSsNxQNQtTHjsxw/view)** you can use to submit your request. ---
**Author:** ![Qu\_c\_Chau](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/qu_c_chau/32/147610_2.png) [@Qu\_c\_Chau](https://discuss.elastic.co/u/Qu_c_Chau)\ **Post date:** [June 2, 2026, 2:40pm UTC](https://discuss.elastic.co/t/false-positive-report-4k-render-automation-exe-malicious-high-confidence/386586/3 "2026-06-02T14:40:35Z")
Hi Cyril, thanks for the quick response. Unfortunately the official form link in your reply appears to be broken — it returns an error when I try to open it. Could you share an alternative link or direct me to the correct submission page? Happy to provide any additional details needed to process the false positive review. ---
**Author:** ![cyril-t-f](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/cyril-t-f/32/147616_2.png) [@cyril-t-f](https://discuss.elastic.co/u/cyril-t-f)\ **Post date:** [June 2, 2026, 3:16pm UTC](https://discuss.elastic.co/t/false-positive-report-4k-render-automation-exe-malicious-high-confidence/386586/4 "2026-06-02T15:16:51Z")
Sorry i messed with the link, it should work [Elastic False Positive Submission](https://docs.google.com/forms/d/e/1FAIpQLSfKZOPSPcucmgNR9_j316JnG_qYbJBpti5JSsNxQNQtTHjsxw/viewform) ---
**Author:** ![Qu\_c\_Chau](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/qu_c_chau/32/147610_2.png) [@Qu\_c\_Chau](https://discuss.elastic.co/u/Qu_c_Chau)\ **Post date:** [June 4, 2026, 2:23pm UTC](https://discuss.elastic.co/t/false-positive-report-4k-render-automation-exe-malicious-high-confidence/386586/5 "2026-06-04T14:23:14Z")
> [@Qu\_c\_Chau](#): > > thanks thanks you ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [July 2, 2026, 2:24pm UTC](https://discuss.elastic.co/t/false-positive-report-4k-render-automation-exe-malicious-high-confidence/386586/6 "2026-07-02T14:24:04Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.