File scan report
Verdict Safe
Is EA DLC Unlocker v2 155-
The high prevalence (504 unique submitters) and clean engine consensus indicate this is a known, widely-distributed tool.
Read the whole reasonShow less
Moderate evidence · No engine flags it, but no publisher signature confirms who made it.
This file is a known game-mod DLC-unlocker tool with no malicious engine consensus and high legitimate prevalence. It is safe to use if obtained from a trusted source and if you accept the risk of violating game publisher terms of service. Monitor for any unexpected system changes or performance issues.
Good practice2 tips
We found nothing harmful in this file.
Open it only if you trust the person or website you got it from.
Keep your security software and system updates switched on.
No scanner can promise a file is 100% safe.
Reads the latest antivirus results for this file's hash. Nothing is uploaded.
Antivirus results
0 of 67 flagged
- Flagged 0
- No detection 67
- No result 8
- Code signing Not applicable
- Test run Completed
- First seen 5mo ago
Chapter 02
Why we think so
3 points against it and 4 in its favour, checked against the scan evidence.
The reasoning behind this verdict
The file exhibits a clean engine profile: zero malicious detections, 17 major antivirus engines silent, and no major family consensus. Prevalence data shows 504 unique submitters and 567 submissions since mid-May, indicating widespread known distribution rather than a rare suspicious sample. The dropped files and process logs reference game-specific .ini files (Cities Skylines, Dead Space 2023, F1 22/23) and setup scripts, not malware infrastructure. No complete contacted-host reputation result was available.
What We Detected
A ZIP archive named 'EA DLC Unlocker v2 155-0.zip' (250 KB) submitted on May 17, 2026. The file is unsigned and contains a game-mod tool designed to unlock downloadable content (DLC) in Electronic Arts games.
Engine Analysis
Major antivirus engines (Kaspersky, BitDefender, ESET-NOD32, Avira, Fortinet, F-Secure, Emsisoft, Ikarus, GData, DrWeb, Avast, AVG) all reported the file as undetected. No malware family consensus was reached.
Threat Behavior
The tool uses rundll32.exe to load version.dll files from the temp directory, a common pattern for game-mod tools that patch game memory when it ran. Dropped files include game-specific configuration files (g_Cities Skylines.ini, g_Dead Space 2023.ini, g_F1 22.ini, g_F1 23.ini) and setup scripts, consistent with a DLC-unlocker utility.
Prevalence & Distribution
The file has been submitted 567 times by 504 unique sources since May 17, 2026, classified as 'widely seen but new.' This widespread distribution pattern is typical of known game-mod tools, not active malware campaigns.
What To Do Now
This file is a known game-mod tool with no malicious indicators. Users who intentionally downloaded it for game modding purposes may use it safely. However, game-mod tools modify game processes and may violate game publisher terms of service or anti-cheat policies. Consider the source and intended use before execution.
Where this verdict could be wrong1 caveat
- Files it created are all unknown verdicts (not yet scanned or benign) — if any were later found malicious, this verdict would need revision. However, the parent ZIP itself shows no malicious indicators and the children appear to be game config/DLL files based on naming.
These are the assessment's weak points. If you believe one applies to your file, report the verdict and we'll re-review it.
- High prevalence: 504 unique submitters, 567 submissions — known widespread distribution
- Dropped files and process logs reference legitimate game titles and config files
- No malicious files it created, no contacted malicious hosts, no external YARA/CIRCL hits
- Behaviour consistent with game-patching tools, not malware a control server or exfiltration
- Sandbox evasion — tool detects and avoids analysis environments
- Unsigned binary — no publisher verification available
- Game-mod tool — may violate game publisher terms of service
6 sources checked · 5 complete · 1 not needed or not applicable. See every source
Chapter 03
What it did in our test
It ran in our isolated test environment; no test environment rated what it did as risky.
Test run summary
Capture complete- 10sandbox rule tags
- 10spawned processes
- 0network contacts
- 15filesystem & mutex artifacts
What this file did when executed
This file was run in a sandbox and its runtime behaviour was observed.
Techniques observed in the sandbox
10MITRE ATT&CK techniques the sandbox mapped. Highlighted ones are rare in normal software; the others are common in legitimate programs too.
- T1033· Reads user info
- T1055· Process injection
- T1082· System recon
- T1083· Scans your files
- T1202
- T1497· Sandbox evasion
- T1518.001· Checks your AV
- T1562.001· Disables security
- T1564.001· Hides artifacts
- T1574· Execution hijack
Observed activity
Processes started
10Programs the file ran, with their command lines.
rundll32.exe"C:\Windows\system32\rundll32.exe" "C:\Users\<USER>\AppData\Local\Temp\EA DLC Unlocker v2/ea_app/version.dll",#1rundll32.exe"C:\Windows\system32\rundll32.exe" "C:\Users\<USER>\AppData\Local\Temp\EA DLC Unlocker v2/origin/version.dll",#1cmd.exe"C:\Windows\system32\cmd.exe" /c "cd ^"C:\Users\<USER>\AppData\Local\Temp^" && start /wait ^"^" ^"C:\Users\<USER>\AppData\Local\Temp\EA DLC Unlocker v2/setup.bat^"cmd.exeC:\Windows\system32\cmd.exe /K "C:\Users\<USER>\AppData\Local\Temp\EA DLC Unlocker v2/setup.batunarchiver.exeC:\Windows\SysWOW64\unarchiver.exe "C:\Windows\SysWow64\unarchiver.exe" "C:\Users\user\Desktop\RksIGn6O-EA DLC Unlocker v2 155-0.zip"7za.exeC:\Windows\SysWOW64\7za.exe "C:\Windows\System32\7za.exe" x -pinfected -y -o"C:\Users\user\AppData\Local\Temp\qic0wtdn.43i" "C:\Users\user\Desktop\RksIGn6O-EA DLC Unlocker v2 155-0.zip"
Show all 10 entries for processes started
exo-open/usr/bin/exo-open exo-open "/tmp/RksIGn6O-EA DLC Unlocker v2 155-0.zip"exo-open/usr/bin/exo-open -engrampa/usr/bin/engrampa engrampa "/tmp/RksIGn6O-EA DLC Unlocker v2 155-0.zip"7z/usr/lib/p7zip/7z l -slt -bd -y -- "/tmp/RksIGn6O-EA DLC Unlocker v2 155-0.zip"
Files
15Files the file created, changed or deleted.
- Written
C:\Users\user\AppData\Local\Temp\qic0wtdn.43i - Written
C:\Users\user\AppData\Local\Temp\qic0wtdn.43i\EA DLC Unlocker v2 - Written
C:\Users\user\AppData\Local\Temp\qic0wtdn.43i\EA DLC Unlocker v2\config.ini - Written
C:\Users\user\AppData\Local\Temp\qic0wtdn.43i\EA DLC Unlocker v2\ea_app - Written
C:\Users\user\AppData\Local\Temp\qic0wtdn.43i\EA DLC Unlocker v2\ea_app\version.dll - Written
C:\Users\user\AppData\Local\Temp\qic0wtdn.43i\EA DLC Unlocker v2\g_Cities Skylines.ini
Show all 15 entries for files
- Written
C:\Users\user\AppData\Local\Temp\qic0wtdn.43i\EA DLC Unlocker v2\g_Dead Space 2023.ini - Written
C:\Users\user\AppData\Local\Temp\qic0wtdn.43i\EA DLC Unlocker v2\g_Dead Space 3.ini - Written
C:\Users\user\AppData\Local\Temp\qic0wtdn.43i\EA DLC Unlocker v2\g_F1 22.ini - Written
C:\Users\user\AppData\Local\Temp\qic0wtdn.43i\EA DLC Unlocker v2\g_F1 23.ini - Written
C:\Users\user\AppData\Local\Temp\qic0wtdn.43i\EA DLC Unlocker v2\g_Frostpunk.ini - Written
C:\Users\user\AppData\Local\Temp\qic0wtdn.43i\EA DLC Unlocker v2\g_GRID Legends.ini - Written
C:\Users\user\AppData\Local\Temp\qic0wtdn.43i\EA DLC Unlocker v2\g_It Takes Two.ini - Written
C:\Users\user\AppData\Local\Temp\qic0wtdn.43i\EA DLC Unlocker v2\g_Mutant Year Zero.ini - Written
C:\Users\user\AppData\Local\Temp\qic0wtdn.43i\EA DLC Unlocker v2\g_My Time at Portia.ini
Sandbox background — not the file
2The analysis machine's own processes and connections, recorded in every run.
- VM process
conhost.exeC:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 - VM process
dbus-launch/usr/bin/dbus-launch dbus-launch --autolaunch=a39eb3ed78b7401fb6809ed0c562a5b1 --binary-syntax --close-stderr
Files this sample writes at runtime
This file drops 10 children at runtime. None are currently flagged malicious in our cache. 10 have no saved verdict and were not checked; that is missing coverage, not a finding.
- e305b8a3399785fb4393…cdd990Not checkedno saved verdict
- cf784476719a93e3fb84…0d2b83Not checkedno saved verdict
- 87df6f4f1c246e0e5d43…215052Not checkedno saved verdict
- 070ac609263921f4c910…2c0b89Not checkedno saved verdict
- cfbe14fc02f08a2b941d…8945faNot checkedno saved verdict
- 06c8f383e8383c4b1736…e84c02Not checkedno saved verdict
- b6b4797b1ce41e14b7c3…f1b1f6Not checkedno saved verdict
- f66f3e8899c43a8433af…3e60d6Not checkedno saved verdict
- a03bcf45efe6a821ad11…ee5809Not checkedno saved verdict
- a92107a9a24d5a80dc95…c96cd4Not checkedno saved verdict
Chapter 04
Technical details
None of the 67 antivirus engines that checked it flag it.
Sources checked
Every check behind this verdict
6 sources checked · 5 complete · 1 not needed or not applicable. Complete means the check returned a usable result; it does not mean the file is safe.
File fingerprint
- Last analyzed
- Jun 9, 2026, 11:49 PM UTC
- SHA-256
5410236d86e3f1296466ae18cd326a987bb3ff43bbd94d3fee26e57710fb6f7c- SHA-1
9559498f491097acbeffabb9258afcd48fb2ecb1- MD5
f4d43fbf319b4f3e90c183c57a113efa
About this file
EA DLC Unlocker v2 155-0.zip is a ZIP file of 251.0 kB.
- Type and size
- ZIP · 251.0 kB
- Signer
- Not applicable
- First seen
- May 17, 2026On VirusTotal.
- Submitted by
- 504 distinct sources
First scanned
Antivirus consensus
0 of 67 engines flagged this file
8 of the 75 engines returned no result for this file (file type not supported, or the scan did not finish), so they did not check it.
- Tier-118 engines0flagged
- Tier-236 engines0flagged
- Low-trust13 engines0flagged
View all 75 engine results
- AcronisClean
- AhnLab-V3Clean
- AlibabaClean
- alibabacloudClean
- ALYacClean
- Antiy-AVLClean
- APEXNo result
- ArcabitClean
- AvastClean
- Avast-MobileClean
- AVGClean
- AviraClean
- BitDefenderClean
- BitDefenderFalxNo result
- BkavClean
- CAT-QuickHealClean
- ClamAVClean
- CMCClean
- CrowdStrikeClean
- CTXClean
- CylanceNo result
- CynetClean
- DeepInstinctClean
- DrWebClean
- ElasticClean
- EmsisoftClean
- ESET-NOD32Clean
- F-SecureClean
- FortinetClean
- GDataClean
- GoogleClean
- GridinsoftClean
- huorongClean
- IkarusClean
- JiangminClean
- K7AntiVirusClean
- K7GWClean
- KasperskyClean
- KingsoftClean
- LionicClean
- MalwarebytesClean
- MaxSecureClean
- McAfeeDClean
- MicrosoftClean
- MicroWorld-eScanClean
- NANO-AntivirusClean
- PaloaltoNo result
- PandaClean
- RisingClean
- SangforClean
- SentinelOneClean
- SkyhighClean
- SophosClean
- SUPERAntiSpywareClean
- SymantecClean
- SymantecMobileInsightNo result
- TACHYONClean
- tehtrisNo result
- TencentClean
- TrapmineNo result
- TrellixENSClean
- TrendMicroClean
- TrendMicro-HouseCallClean
- TrustlookNo result
- VaristClean
- VBA32Clean
- VIPREClean
- VirITClean
- ViRobotClean
- WebrootClean
- XcitiumClean
- YandexClean
- ZillyaClean
- ZoneAlarmClean
- ZonerClean
Signatures and behavior heuristics
Low-severity pattern matches — worth noting but not on their own cause for alarm.
VirusTotal's sandbox summary maps this run to MITRE T1055 (Process Injection), but no injected process of the sample's own was recorded (the analysis VM's own WMI adapter, crash handlers and Chrome updater are not counted). VirusTotal maps T1055 on about half of all files no engine flags, so the mapping alone is not evidence of injection.
EvidenceT1055 (sandbox MITRE mapping)
How widely this file has been seen
Widely uploaded, but first seen within the last six months. No strong prior applies.
Chapter 05
Questions & answers
Short answers to the 6 questions people ask most about this file.
Is EA DLC Unlocker v2 155-0.zip safe?
What is EA DLC Unlocker v2 155-0.zip?
How many antivirus engines detected EA DLC Unlocker v2 155-0.zip?
What is the SHA-256 hash of EA DLC Unlocker v2 155-0.zip?
Is it safe to open or extract EA DLC Unlocker v2 155-0.zip?
How up to date is this analysis of EA DLC Unlocker v2 155-0.zip?
Community
Member reviews and reports for this exact file hash.