File scan report
Verdict Suspicious
Is unlocker-
Installer for a file-unlocking utility that 16 of the 71 antivirus engines that checked it flag, several major antivirus engines naming a vulnerable driver or unwanted…
Read the whole reasonShow less
Why Suspicious? 16 antivirus engines flag it and one of our detection rules matched it.
Moderate evidence · More than one sign points to a problem, but nothing confirms it is harmful.
If it came from a link, an attachment or a stranger, delete it.
What to do now4 steps
Some signs point to a problem, but nothing confirms it is harmful. Treat it with caution.
What to do
Don't install it unless you're sure where it came from.
Check where you got it: an unexpected attachment, a link someone sent you or a re-upload is a red flag.
If you can't confirm where it came from, delete it. If you need the program, download it again from the publisher's own website.
If you already installed it
Stop using it, run a full scan with your antivirus and watch for unexpected behavior or security alerts.
Not sure what to do?
Ask the MalwareTips community before you run it. If you already ran it, follow the cleanup guide.
- Ask for free help on the MalwareTips forumWindows malware removal help, answered by volunteers. (opens malwaretips.com in a new tab)
- Remove malware from WindowsStep-by-step cleanup with free tools. (opens malwaretips.com in a new tab)
Paste this report's link in your topic so helpers can see what was found.
Reads the latest antivirus results for this file's hash. Nothing is uploaded.
Antivirus results
16 of 71 flagged
- Flagged 16
- No detection 55
- No result 4
- Code signing ORANGE VIEW LIMITED
- Test run Completed
- First seen 5mo ago
Chapter 02
Why we think so
4 points against it and 3 in its favour, checked against the scan evidence.
The reasoning behind this verdict
ESET labels its driver a potentially unsafe vulnerable driver, and Sophos and DrWeb call it an unwanted application, while other major detections use generic labels. The combined sandbox verdict was clean and the run simply installed the utility, but the signer has almost no history with us.
Six major antivirus engines detections, from at least four independent scan engines, prevent treating this as a clean file. The most specific labels describe a potentially unsafe vulnerable driver and an unwanted application rather than a named malware family, and the remaining major labels are generic buckets. In the sandbox the installer placed program files, registered a shell extension and contacted its update server, and the combined sandbox verdict was clean with no injected process recorded. The valid signature belongs to a publisher with only one prior sample in our records, so it adds little trust. Taken together, this looks like a legitimate-purpose tool carrying components that engines consider risky, not confirmed malware.
What We Detected
16 of the 71 antivirus engines that checked it flagged the file. ESET reports a potentially unsafe vulnerable driver, Sophos and DrWeb report a potentially unwanted application, and Avast, AVG, Avira, F-Secure and Trellix use generic malware labels. No malware family is agreed on by multiple major antivirus engines. The file was first seen on Apr 30, 2026 and has been submitted by about 1,900 sources.
Threat Behavior
The combined sandbox verdict was clean. The installer unpacked itself, installed the unlocker program and its libraries, registered a shell extension and contacted its vendor's update server. No complete contacted-host reputation result was available. Engines flag drivers like this because a vulnerable driver can be abused by other malware to gain kernel access.
What To Do Now
Install it only if you need a file-unlocking tool and obtained it from the developer's official site. Keep your antivirus enabled; if your security software blocks or quarantines it, prefer the built-in Windows options or an alternative tool rather than overriding the protection.
Where this verdict could be wrong2 caveats
- The combined sandbox verdict was clean and the run looked like an ordinary installer placing IObit Unlocker files, so the detections may reflect the product's driver rather than hostile intent.
- Nearly 1,900 distinct sources have submitted the file and it carries a valid signature, which is more typical of distributed commercial software than of a targeted trojan.
These are the assessment's weak points. If you believe one applies to your file, report the verdict and we'll re-review it.
- The combined sandbox verdict was clean and the run looked like an ordinary installation
- No injected process was recorded
- Valid code signature and about 1,900 distinct submitters
- Six major antivirus engines detections, including a vulnerable-driver label from ESET
- Sophos and DrWeb label the program a potentially unwanted application
- The signing publisher has almost no history in our records
- The installer registers a shell extension and a persistent program entry
6 sources checked · 5 complete · 1 partial. See every source
Chapter 03
What it did in our test
It ran in our isolated test environment; no test environment rated what it did as risky.
Test run summary
Capture complete- 23sandbox rule tags
- 7spawned processes
- 7network contacts
- 40filesystem & mutex artifacts
What the test run showed
What the file did on a test computer
Confirmed in the test run
Moderate concern: Set itself to start automatically after a restart.
Moderate concern: Contains packed or scrambled code that is harder to inspect (common in installers too).
Moderate concern: Ran commands or a script on the test computer.
Moderate concern: Checked whether it was running on a test computer.
Note: Read the user name of the test computer.
Note: Deleted files or logs during the test run (installers often clean up after themselves).
Note: Talked to servers over the internet during the test run.
Sandbox labels we could not confirm (common in safe files too)
Not confirmed: A sandbox rule tagged this run as code injection, but no injected program was recorded.
This file was run on a test computer (a sandbox), not on yours. Labels we could not confirm are listed so you can see them, but they are not treated as evidence against the file.
Recorded behavior
What happened in the test
Grouped by step. The order is not a timeline.
- 1
Input file
The submitted object
- Evidence 1 of 7: FileSeen in the test run
unlocker-setup (1).exe
25aa598dcc6e5d2eb2e860cf82beb72f38e78d5f562677aa8b0413f64052328f
Uploaded file
- 2
Processes
What ran
- Evidence 2 of 7: ProcessSeen in the test run
unlocker-setup.exe
"C:\Users\<USER>\Desktop\unlocker-setup.exe"
Test run - Evidence 3 of 7: ProcessSeen in the test run
unlocker-setup.tmp
"C:\Users\<USER>\AppData\Local\Temp\is-MP8BH.tmp\unlocker-setup.tmp" /SL5="$20174,1708085,141824,C:\Users\<USER>\Desktop\unlocker-setup.exe"
Test run - +1 more recorded observation
- 2
Files
Created or changed
- Evidence 4 of 7: Written fileSeen in the test run
unlocker-setup.tmp
C:\Users\<USER>\AppData\Local\Temp\is-MP8BH.tmp\unlocker-setup.tmp
Test run - Evidence 5 of 7: Written fileSeen in the test run
_setup64.tmp
C:\Users\<USER>\AppData\Local\Temp\is-B4OTG.tmp\_isetup\_setup64.tmp
Test run - +1 more recorded observation
- 2
Network
Hosts contacted
- Evidence 6 of 7: Contacted hostSeen in the test run
s1.symcb.com
Contacted during the test run.
Test run - Evidence 7 of 7: Contacted hostSeen in the test run
sv.symcb.com
Contacted during the test run.
Test run - +1 more recorded observation
7 facts from the test run. See the full activity list.
Includes the sandbox verdicts, 23 mapped techniques, every process, file, registry and network entry and 10 dropped files.
Show the technical evidenceChapter 04
Technical details
16 of the 71 antivirus engines that checked it flag it; signed by ORANGE VIEW LIMITED.
Sources checked
Every check behind this verdict
6 sources checked · 5 complete · 1 partial. Complete means the check returned a usable result; it does not mean the file is safe.
Engines that flagged it 16
- Avast (major engine)Other:Malware-gen [Trj]
- AVG (major engine)Other:Malware-gen [Trj]
- Avira (major engine)TR/W32.Malware
- DrWeb (major engine)Program.Unwanted.5385
- ESET-NOD32 (major engine)Win64/VulnDriver.IObit.A.gen potentially unsafe application
- F-Secure (major engine)Trojan.TR/Malware
- Sophos (major engine)IObit Unlocker (PUA)
- TrellixENS (major engine)Artemis!FF8F2D8CDA29
File fingerprint
- Last analyzed
- Oct 6, 2026, 9:25 PM UTC
- SHA-256
25aa598dcc6e5d2eb2e860cf82beb72f38e78d5f562677aa8b0413f64052328f- SHA-1
89360ff8e2d203eb9fda387cd5398919abac91dd- MD5
ff8f2d8cda2969cb0959338787653b0f
About this file
unlocker-setup (1).exe is a Win32 EXE file of 2.3 MB.
- Type and size
- Win32 EXE · 2.3 MB
- Signer
- ORANGE VIEW LIMITEDValid code signature.
- First seen
- Apr 30, 2026On VirusTotal.
- Submitted by
- 1,906 distinct sources
- Packer
- None detected
- Entropy
- 5.69 of 8
First scanned Updated
Includes every engine result (75), 2 matched signature rules, PE section entropy and packers and how widely the file has been seen.
Show the technical evidenceChapter 05
Questions & answers
Short answers to the 7 questions people ask most about this file.
Is unlocker-setup (1).exe safe, or is it malware?
What is unlocker-setup (1).exe?
How many antivirus engines detected unlocker-setup (1).exe?
I already downloaded and installed unlocker-setup (1).exe — what should I do?
Is unlocker-setup (1).exe digitally signed?
What is the SHA-256 hash of unlocker-setup (1).exe?
How up to date is this analysis of unlocker-setup (1).exe?
Community
Member reviews and reports for this exact file hash.
