Safe
Unsigned game-mod DLC unlocker tool; zero malicious engine detections across 68 engines; 504 submitters; process injection consistent with game patching, not malware.
5410236d86e3f12964…7710fb6f7cThe verdict, reasoned out.
Not a rules engine. The MT AI Engine reads every signal we collected, weighs them against history, and commits to an answer.
The file exhibits a clean engine profile: zero malicious detections, 17 tier-1 engines silent, and no tier-1 family consensus. Prevalence data shows 504 unique submitters and 567 submissions since mid-May, indicating widespread known distribution rather than a rare suspicious sample. Sandbox behaviour reveals process injection (T1055) and evasion (T1497) techniques, which triggered a heuristic rule; however, these are consistent with game-mod tools that patch running game processes to unlock DLC. The dropped files and process logs reference game-specific .ini files (Cities Skylines, Dead Space 2023, F1 22/23) and setup scripts, not malware infrastructure. No malicious children, no contacted malicious hosts, and no external YARA/CIRCL hits further support a benign classification.
Each signal cites a concrete token from the evidence the arbiter saw — engine name, MITRE technique, signer string, or an exact count.
engines: 0/68 malicious; tier1Malicious=0; tier1ReportedClean=17 (Kaspersky, BitDefender, ESET-NOD32, Avira, Fortinet, F-Secure, Emsisoft, Ikarus, GData, DrWeb, Avast, AVG all silent)
prevalence.classification=common_new; 504 unique submitters, 567 submissions since 2026-05-17 — widespread known distribution
triggeredHeuristics: MalwareTips.Synth.ProcessInjection fired on rundll32.exe + version.dll injection — consistent with game-mod DLL patching, not malware C2 beacon
droppedChildren: 10 inspected, 0 malicious, all unknown verdicts; no malicious sandbox verdict; no contacted malicious hosts
filename + process logs (setup.bat, config.ini, g_Cities Skylines.ini, g_Dead Space 2023.ini) indicate game-mod/DLC-unlocker tool, not trojan
- Zero malicious detections across 68 engines; 17 tier-1 vendors silent
- High prevalence: 504 unique submitters, 567 submissions — known widespread distribution
- Dropped files and process logs reference legitimate game titles and config files
- No malicious children, no contacted malicious hosts, no external YARA/CIRCL hits
- Behaviour consistent with game-patching tools, not malware C2 or exfiltration
- Process injection (T1055) — DLL loaded into rundll32.exe for game patching
- Sandbox evasion (T1497) — tool detects and avoids analysis environments
- Unsigned binary — no publisher verification available
- Game-mod tool — may violate game publisher terms of service
This file is a known game-mod DLC-unlocker tool with no malicious engine consensus and high legitimate prevalence. It is safe to use if obtained from a trusted source and if you accept the risk of violating game publisher terms of service. Monitor for any unexpected system changes or performance issues.
What this file did when executed
This file was detonated in 1 sandbox and its runtime behaviour was observed.
Adversary techniques mapped to the MITRE ATT&CK framework.
- C:\Users\user\AppData\Local\Temp\qic0wtdn.43i
- C:\Users\user\AppData\Local\Temp\qic0wtdn.43i\EA DLC Unlocker v2
- C:\Users\user\AppData\Local\Temp\qic0wtdn.43i\EA DLC Unlocker v2\config.ini
- C:\Users\user\AppData\Local\Temp\qic0wtdn.43i\EA DLC Unlocker v2\ea_app
- C:\Users\user\AppData\Local\Temp\qic0wtdn.43i\EA DLC Unlocker v2\ea_app\version.dll
Files this sample writes at runtime
This file drops 10 children at runtime. None are currently flagged malicious in our cache.
- e305b8a3399785fb4393…cdd990Never scannednever seen before
- cf784476719a93e3fb84…0d2b83Never scannednever seen before
- 87df6f4f1c246e0e5d43…215052Never scannednever seen before
- 070ac609263921f4c910…2c0b89Never scannednever seen before
- cfbe14fc02f08a2b941d…8945faNever scannednever seen before
- 06c8f383e8383c4b1736…e84c02Never scannednever seen before
- b6b4797b1ce41e14b7c3…f1b1f6Never scannednever seen before
- f66f3e8899c43a8433af…3e60d6Never scannednever seen before
- a03bcf45efe6a821ad11…ee5809Never scannednever seen before
- a92107a9a24d5a80dc95…c96cd4Never scannednever seen before
YARA + heuristic rules that fired
A researcher-curated or high-severity heuristic rule matched this sample. These rules target specific malware families and are near-definitive.
MITRE T1055 (Process Injection) observed — CreateRemoteThread / APC / reflective-DLL injection. The payload is being smuggled into a legitimate process to bypass AV hooks.
Evidence"C:\Windows\system32\rundll32.exe" "C:\Users\<USER>\AppData\Local\Temp\EA DLC Unlocker v2/ea_app/version.dll",#1
0 detections across 75 engines
How often this file shows up in the wild
Lots of people are uploading this but it's recent — typical of newly-released legitimate software. Low prior for malware.
Forensic fingerprint
- File name
- EA DLC Unlocker v2 155-0.zip
- Size
- 245.1 KB
- MIME type
- (unknown)
- Detected type
- ZIP
- SHA-256
- 5410236d86e3f1296466ae18cd326a987bb3ff43bbd94d3fee26e57710fb6f7c
- MD5
- f4d43fbf319b4f3e90c183c57a113efa
- SHA-1
- 9559498f491097acbeffabb9258afcd48fb2ecb1
- First seen (VT)
- 5/17/2026, 5:42:33 PM
- Last analysis (VT)
- 6/9/2026, 5:15:00 PM
- First scan (MalwareTips)
- 6/9/2026, 7:49:12 PM
- Last scan (MalwareTips)
- 6/9/2026, 7:49:12 PM
Reviews & malware reports(0)
Tell the community what you saw. Tag the sample — Trojan, Adware, False Positive — and share what the file did on your system. Your report helps confirm or dispute the AV verdict.