1. File activity
Windows reports a new or modified file in a monitored location.
HOW IT WORKS
Most of the work happens on the PC.
Kraken keeps its active definition set locally. Internet access is used to activate the license and fetch newer definitions or application builds; it is not required for every file check.
WHEN A FILE CHANGES
Kraken notices the event, decides whether the file is in scope, then checks it locally.
The real-time service watches supported activity under Windows user locations. Files covered by the current edition are hashed and compared with the loaded definition set. A known match is moved to Quarantine and written to Protection History.
Manual scans use the same local definitions, but they let you choose how much of the machine to walk through.
2. Local check
Kraken calculates the file hash and compares it with the active definitions.
3. If it matches
The file is moved to Quarantine and the event is recorded.
DEFINITIONS
Updates are additive to the offline pack.
The installer includes a local database so the scanner still has definitions after a reboot with no connection. While online, Kraken checks TheMate.DEV for a newer definition pack and verifies its SHA-256 before loading it.
GAME MODE
Protection stays active while background work quiets down.
Game Mode adds a short delay before non-urgent real-time checks, reducing background activity while the protection service remains enabled.
REQUIREMENTS
Windows 10 or 11, 64-bit.
Kraken installs a native desktop application and an automatic Windows service. A connection is needed for first activation and fresh downloads. Local scanning continues with the definition set already on disk.
Windows 10 x64Windows 11 x64Administrator rights for setupInternet for activation