Is unlocker-setup (1).exe safe, or is it malware?

unlocker-setup (1).exe is suspicious — treat it as unsafe until you're sure. 11 of 75 antivirus engines flag it (family: iobit unlocker pua), which isn't a strong consensus but is enough to be cautious. Don't run it unless you fully trust where it came from, and prefer downloading the software fresh from its official site.

What is unlocker-setup (1).exe?

unlocker-setup (1).exe is a Windows executable program, about 2.2 MB. We identify a file by its cryptographic hash rather than its name, because the same filename can be reused by completely different files — the hash below is the reliable fingerprint.

How many antivirus engines detected unlocker-setup (1).exe?

11 of 75 antivirus engines flagged unlocker-setup (1).exe, 11 of them as outright malicious. A small number of detections can include false positives, so we weigh which engines flagged it and what else the file does, not just the raw count.

I already downloaded and run unlocker-setup (1).exe — what should I do?

Act quickly. 1) Disconnect the device from the internet to stop the malware communicating or spreading. 2) Run a full scan with reputable anti-malware software (such as Malwarebytes) and quarantine everything it finds. 3) Change your important passwords from a DIFFERENT, clean device — many threats log keystrokes or steal saved credentials. 4) If you bank or shop on this device, watch closely for fraud and alert your bank. 5) For a confirmed infection, the most reliable fix is to back up your personal files and reinstall the operating system for a clean start.

How do I remove unlocker-setup (1).exe?

To remove unlocker-setup (1).exe: 1) restart into Safe Mode (Safe Mode with Networking if you need to download a tool) so the malware doesn't auto-start. 2) Run a full scan with reputable anti-malware software and let it quarantine or delete the detections. 3) Delete the original unlocker-setup (1).exe file and empty the Recycle Bin/Trash. 4) Check your browser extensions, startup items, and scheduled tasks for anything unfamiliar. 5) Reboot and scan again to confirm it's gone. If detections keep coming back, a clean operating-system reinstall is the most dependable cure.

What kind of malware is unlocker-setup (1).exe?

unlocker-setup (1).exe is classified as adware or a potentially unwanted program (PUA) — not always destructive, but it bundles ads, trackers, or unwanted changes you didn't ask for. Engines attribute it to the iobit unlocker pua family. Knowing the family matters because it tells you the likely impact — data theft, remote control, file encryption, or unwanted ads — and guides the cleanup.

Is unlocker-setup (1).exe digitally signed?

Yes — unlocker-setup (1).exe carries a valid digital signature from ORANGE VIEW LIMITED, which confirms the file hasn't been tampered with since that publisher signed it. A valid signature is a positive signal, but note that malware is occasionally signed with stolen or abused certificates, so it isn't proof of safety on its own.

What is the SHA-256 hash of unlocker-setup (1).exe?

The SHA-256 hash of unlocker-setup (1).exe is 25aa598dcc6e5d2eb2e860cf82beb72f38e78d5f562677aa8b0413f64052328f, and its MD5 is ff8f2d8cda2969cb0959338787653b0f. This hash is the file's unique fingerprint — two files with the same SHA-256 are identical. Use it to confirm you're looking at exactly this file (not just one with the same name) when comparing against antivirus databases or a download's published checksum.

How up to date is this analysis of unlocker-setup (1).exe?

This report reflects the scan run on June 2, 2026. Because a file's hash never changes, the identity of unlocker-setup (1).exe is fixed — but antivirus coverage improves over time, so a file that looks clean today can pick up detections later (and vice-versa). If you need the latest picture, MalwareTips staff can re-run the analysis from scratch.

File verdict·Decided by the MT AI Engine

Our call

Suspicious

Item: unlocker-setup (1).exe
Rating: 2.5
Author: MalwareTips File Scanner

IObit Unlocker installer showing PUA detections, verified signature from unknown publisher, and sandbox process-injection indicators.

iobit unlocker puaVerified · ORANGE VIEW LIMITED

Trust score48Caution

unlocker-setup (1).exe

2.2 MB

25aa598dcc6e5d2eb2…f64052328f

Antivirus engines

11 of 75 flagged

Code signing

Signed by ORANGE VIEW LIMITED

Age

First seen 3mo ago

MT AI Engine · Verdict analysis

The reasoning behind this verdict

The MT AI Engine weighs every signal from this scan — antivirus detections, sandbox behaviour, code signing, prevalence and historical matches — to reach a single, evidence-based verdict.

72%Confidence

High

Reasoning

The detection pattern is consistent with IObit software that security vendors routinely classify as PUA rather than outright malware. The signer lacks any trusted-publisher or historical safe-rate data, preventing an auto-trust decision. Offensive MITRE techniques and synthesis heuristics are present, yet the single sandbox run did not produce a malicious verdict and no malicious children or hosts were observed. One prior imphash match was ruled safe under similar low-trust conditions. Overall signals are mixed between aggressive but legitimate installer behaviour and grayware classification.

Key signals · 4

Each signal cites a concrete token from the evidence the arbiter saw — engine name, MITRE technique, signer string, or an exact count.

engines.topDetections: Sophos=IObit Unlocker (PUA), ESET=Win64/VulnDriver.IObit.A.gen, DrWeb=Program.Unwanted.5385
signing.signer=ORANGE VIEW LIMITED, verified=true, trustedPublisher.matched=false
behaviour.offensiveTechniques=[T1055,T1134,T1485,T1548] with triggeredHeuristics.ProcessInjection high severity
similarHashes[0].verdict=safe, matchKind=imphash, reasonCode=ai:low_trust_engines_only

Points in its favour

No malicious sandbox verdict
Zero malicious dropped children
Medium prevalence with hundreds of submitters
Similar imphash previously ruled safe

Points against

Process injection and LSASS access observed
Direct-IP C2 without DNS resolution
Unknown signer with zero historical samples
Multiple tier-1 PUA detections

Recommended action

Block or quarantine unless the file is confirmed to come from IObit; review installed components for additional IObit software.

What this file does

What it attempted when executed in an isolated sandbox

High concern: Hides inside another running program to evade antivirus.
High concern: Talks to a remote server to take commands or send out your data.
High concern: Installs itself to survive restarts (persistence).
Moderate concern: Obfuscates or packs its code to avoid detection.
Moderate concern: Runs hidden system commands (script or shell).
Moderate concern: Deletes traces of itself to cover its tracks.
Moderate concern: Scans through your files and folders.

Translated from the file's technical behaviour during analysis. It never ran on your device.

What to do now

We couldn't fully clear this file. Treat it with caution.

Don't run it unless you're certain it came from a source you trust.
Check where you got it — an email attachment or a random download link is a red flag.
If you're unsure, delete it. You can always re-download a clean copy from the official source.
If you're still unsure, scan it again in a day or two — detections often catch up on newer files.

Threat family attribution

iobit corroborated by 2 sources

VT (75 engines)
iobit
MT AI Engine
iobit unlocker pua

Runtime behaviour

What this file did when executed

This file was detonated in 1 sandbox and its runtime behaviour was observed.

MITRE ATT&CK

Adversary techniques mapped to the MITRE ATT&CK framework.

T1012T1027· Obfuscated codeT1027.002· Obfuscated codeT1033· Reads user infoT1036T1045T1055· Process injectionT1059· Runs commandsT1070· Covers its tracksT1071· Remote server (C2)T1082· System reconT1083· Scans your filesT1107T1112T1129· Loads modulesT1134T1485T1497· Sandbox evasionT1529T1548T1553T1614T1614.001

Spawned processes

$(unnamed)

"C:\Users\<USER>\Desktop\unlocker-setup.exe"

$(unnamed)

"C:\Users\<USER>\AppData\Local\Temp\is-MP8BH.tmp\unlocker-setup.tmp" /SL5="$20174,1708085,141824,C:\Users\<USER>\Desktop\unlocker-setup.exe"

$(unnamed)

C:\Windows\Explorer.EXE

$(unnamed)

"C:\Windows\system32\regsvr32.exe" /s "C:\Program Files (x86)\IObit\IObit Unlocker\IObitUnlockerExtension.dll"

$(unnamed)

/s "C:\Program Files (x86)\IObit\IObit Unlocker\IObitUnlockerExtension.dll"

$(unnamed)

"C:\Program Files (x86)\IObit\IObit Unlocker\IObitUnlocker.exe"

$(unnamed)

C:\Windows\system32\services.exe

$(unnamed)

C:\Windows\System32\svchost.exe -k NetworkService -p

+7 more processes captured.

Network activity

IP addresses5

172.66.2.5
23.53.127.116
224.0.0.252
255.255.255.255
162.159.36.2

URLs3

http://s1.symcb.com/pca3-g5.crl
http://sv.symcb.com/sv.crl
http://update.iobit.com/infofiles/iobitunlocker.upt

Persistence

Indicators1

IObitUnlocker

Filesystem & mutexes

Files written15

C:\Users\<USER>\AppData\Local\Temp\is-MP8BH.tmp\unlocker-setup.tmp
C:\Users\<USER>\AppData\Local\Temp\is-B4OTG.tmp\_isetup\_setup64.tmp
C:\Users\<USER>\AppData\Local\Temp\is-B4OTG.tmp\RdZone.dll
C:\Users\<USER>\AppData\Local\Temp\is-B4OTG.tmp\IObitUnlocker.dll
C:\Users\<USER>\AppData\Local\Temp\is-B4OTG.tmp\Inno_English.lng

+10 more

Files deleted15

C:\Program Files (x86)\IObit\IObit Unlocker\is-RRHGU.tmp
C:\Program Files (x86)\IObit\IObit Unlocker\is-B9KGA.tmp
C:\Program Files (x86)\IObit\IObit Unlocker\is-E3J4G.tmp
C:\Program Files (x86)\IObit\IObit Unlocker\is-362TO.tmp
C:\Program Files (x86)\IObit\IObit Unlocker\is-UIB18.tmp

+10 more

Mutexes created10

cversions.3.m
madExceptSettingsMtx$175c
HookTThread$175c
Local\RstrMgr-3887CAB8-533F-4C85-B0DC-3E5639F8D511-Session0000
Global\C::Users:Virtual:AppData:Local:Microsoft:Windows:Explorer:thumbcache_1024.db!dfMaintainer

+5 more

Dropped payload

Files this sample writes at runtime

This file drops 10 children at runtime. None are currently flagged malicious in our cache.

10 unseen

01fe66a8aaea0faa04b1…89faaaNever scanned
never seen before
ab2752577faa9ff94e1a…86ed3eNever scanned
never seen before
54d53d160f189084b3e5…46998fNever scanned
never seen before
eaa9dc1c9dc8620549fe…fb43e7Never scanned
never seen before
01135e3c524fa4cdd5ad…7676d7Never scanned
never seen before
ef6b496609073be75cf4…7c10a8Never scanned
never seen before
c136b3136d38d13bcc7e…cc2504Never scanned
never seen before
05501e4be5128972bed8…5a6583Never scanned
never seen before
0a9c0405f08aa930a2e8…ca2443Never scanned
never seen before
47d56d71d51c3d4e9643…93abbeNever scanned
never seen before

No researcher-database hits

External threat-intel sources were not collected for this scan.

Signature matches

YARA & heuristic rule matches

A researcher-curated or high-severity heuristic rule matched this sample. These rules target specific malware families and are near-definitive.

4 synthesis

MITRE ATT&CK profile

Persistence× 1Defense evasion× 1Cred access× 1C2× 1

MalwareTips synthesis rules

Our own detection rules, applied to the scan data and sandbox behaviour

PersistenceScheduledTask
T1053.005 T1543.003
medium
Sandbox flagged persistence indicators (registry Run keys / services / scheduled tasks).
Evidence
IObitUnlocker
ProcessInjection
T1055
high
MITRE T1055 (Process Injection) observed — CreateRemoteThread / APC / reflective-DLL injection. The payload is being smuggled into a legitimate process to bypass AV hooks.
Evidence
C:\Windows\Explorer.EXE
CredentialDumper
T1003 T1003.001
medium
Sandbox observed process activity targeting LSASS (Windows credential store). Legitimate software has no business reading LSASS memory — this is Mimikatz-shape behaviour.
Evidence
C:\Windows\system32\lsass.exe
DirectIpC2
T1071
medium
Sample contacted 3 external IP address(es) and zero domains. Benign software virtually always uses DNS; no-DNS direct-IP C2 is a strong malware indicator because it bypasses reputation systems and dodges domain-based blocklists.
Evidence
172.66.2.5 · 23.53.127.116 · 162.159.36.2

Antivirus engine breakdown

11 detections across 75 engines

11 malicious0 suspicious64 clean

Tier-117 engines

3flag

Top commercial AVs (low FP rate)

Tier-241 engines

4flag

Mainstream engines with mixed FP rates

Low-trust17 engines

4flag

Heuristic / generic-AI engines (high FP rate)

CrowdStrike

malicious

win/grayware_confidence_60% (D)

Cylance

malicious

Unsafe

DeepInstinct

malicious

MALICIOUS

DrWeb

malicious

Program.Unwanted.5385

ESET-NOD32

malicious

Win64/VulnDriver.IObit.A.gen potentially unsafe application

Malwarebytes

malicious

Generic.Malware/Suspicious

MaxSecure

malicious

Trojan.Malware.682788895.susgen

Paloalto

malicious

generic.ml

Rising

malicious

PUA.VulnDriver!8.1D4E6 (CLOUD)

Sophos

malicious

IObit Unlocker (PUA)

TrellixENS

malicious

Artemis!FF8F2D8CDA29

Hash 25aa598dcc6e… cross-referenced against 75 AV engines via our AV network.

PE forensics

Section entropy & packers

Section-level entropy and packer detection from the PE header. Nothing suspicious here — entropy is within the normal range for unpacked code.

ent 8.00Unpacked

Section entropy8 sections

.text

6.38

.itext

5.78

.data

2.30

.bss

0.00

.idata

4.60

.tls

0.00

.rdata

0.20

.rsrc

5.33

0.0Packed threshold 7.28.0

Prevalence

How widely this file has been seen

Moderate prevalence — neither rare nor common. No strong prior applies.

Medium

Unique uploaders

469

Hundreds of people have uploaded this — common.

Total submissions

575

Includes repeat uploads by the same source.

First seen

3mo ago

Apr 30, 2026

Prevalence quadrant

Rare · New

Targeted malware lives here

Common · New

Just-released software

Rare · Old

Niche or internal tooling

Common · Old

Trusted legitimate binaries

File identity

Forensic fingerprint

File biography

First seen (VT)

4/30/2026, 6:19:45 AM

First seen (MalwareBazaar)

—

Last analysis (VT)

6/1/2026, 4:14:28 PM

Scanned here

6/2/2026, 4:14:59 AM

File name: unlocker-setup (1).exe
Size: 2.18 MB
MIME type: (unknown)
Detected type: Win32 EXE
SHA-256: 25aa598dcc6e5d2eb2e860cf82beb72f38e78d5f562677aa8b0413f64052328f
MD5: ff8f2d8cda2969cb0959338787653b0f
SHA-1: 89360ff8e2d203eb9fda387cd5398919abac91dd
PE imphash: 20dd26497880c05caed9305b3c8b9109
First seen (VT): 4/30/2026, 6:19:45 AM
Last analysis (VT): 6/1/2026, 4:14:28 PM
First scan (MalwareTips): 6/2/2026, 4:14:59 AM
Last scan (MalwareTips): 6/2/2026, 4:14:59 AM
Code signer: ORANGE VIEW LIMITEDverified

Behavior tags

overlaypeexesigned

Frequently asked

Safety FAQ

Common questions about unlocker-setup (1).exe, answered from the scan data above.

unlocker-setup (1).exe is suspicious — treat it as unsafe until you're sure. 11 of 75 antivirus engines flag it (family: iobit unlocker pua), which isn't a strong consensus but is enough to be cautious. Don't run it unless you fully trust where it came from, and prefer downloading the software fresh from its official site.
unlocker-setup (1).exe is a Windows executable program, about 2.2 MB. We identify a file by its cryptographic hash rather than its name, because the same filename can be reused by completely different files — the hash below is the reliable fingerprint.
11 of 75 antivirus engines flagged unlocker-setup (1).exe, 11 of them as outright malicious. A small number of detections can include false positives, so we weigh which engines flagged it and what else the file does, not just the raw count.
Act quickly. 1) Disconnect the device from the internet to stop the malware communicating or spreading. 2) Run a full scan with reputable anti-malware software (such as Malwarebytes) and quarantine everything it finds. 3) Change your important passwords from a DIFFERENT, clean device — many threats log keystrokes or steal saved credentials. 4) If you bank or shop on this device, watch closely for fraud and alert your bank. 5) For a confirmed infection, the most reliable fix is to back up your personal files and reinstall the operating system for a clean start.
To remove unlocker-setup (1).exe: 1) restart into Safe Mode (Safe Mode with Networking if you need to download a tool) so the malware doesn't auto-start. 2) Run a full scan with reputable anti-malware software and let it quarantine or delete the detections. 3) Delete the original unlocker-setup (1).exe file and empty the Recycle Bin/Trash. 4) Check your browser extensions, startup items, and scheduled tasks for anything unfamiliar. 5) Reboot and scan again to confirm it's gone. If detections keep coming back, a clean operating-system reinstall is the most dependable cure.
unlocker-setup (1).exe is classified as adware or a potentially unwanted program (PUA) — not always destructive, but it bundles ads, trackers, or unwanted changes you didn't ask for. Engines attribute it to the iobit unlocker pua family. Knowing the family matters because it tells you the likely impact — data theft, remote control, file encryption, or unwanted ads — and guides the cleanup.
Yes — unlocker-setup (1).exe carries a valid digital signature from ORANGE VIEW LIMITED, which confirms the file hasn't been tampered with since that publisher signed it. A valid signature is a positive signal, but note that malware is occasionally signed with stolen or abused certificates, so it isn't proof of safety on its own.
The SHA-256 hash of unlocker-setup (1).exe is 25aa598dcc6e5d2eb2e860cf82beb72f38e78d5f562677aa8b0413f64052328f, and its MD5 is ff8f2d8cda2969cb0959338787653b0f. This hash is the file's unique fingerprint — two files with the same SHA-256 are identical. Use it to confirm you're looking at exactly this file (not just one with the same name) when comparing against antivirus databases or a download's published checksum.
This report reflects the scan run on June 2, 2026. Because a file's hash never changes, the identity of unlocker-setup (1).exe is fixed — but antivirus coverage improves over time, so a file that looks clean today can pick up detections later (and vice-versa). If you need the latest picture, MalwareTips staff can re-run the analysis from scratch.

Community classification

Reviews & malware reports(0)

Tell the community what you saw. Tag the sample — Trojan, Adware, False Positive — and share what the file did on your system. Your report helps confirm or dispute the AV verdict.

Loading…

Loading reports…

Scanned by

harlan4096Staff

Scan another

Check a different file

URL instead?

Check if a link is safe

Files are processed in a streaming pass-through — MalwareTips never stores the binary on its servers. Only the scan result (hash, detections, verdict) is retained so the next person who scans the same file gets an instant answer. If you ran this file on your computer and are worried, scan your system with an up-to-date antivirus and change critical passwords from a different device.