File scan report
Verdict Safe
Is imyfone-
This iMyFone LockWiper installer carries a valid iMyFone signature, is widely submitted, and was flagged by only one less reliable engine with a generic label.
Read the whole reasonShow less
Strong evidence · Widely seen for a long time, and nothing harmful found.
This installer appears to be the genuine iMyFone LockWiper setup; download it only from the vendor's official site and keep your antivirus protection enabled.
Good practice2 tips
We found nothing harmful in this file.
Install it only if it came from the developer's own website or an official app store.
Keep your antivirus and Windows updates switched on.
No scanner can promise a file is 100% safe.
Antivirus results
1 of 71 flagged
- Flagged 1
- No detection 70
- No result 4
- Code signing Shenzhen iMyFone Technology Co., Ltd
- Test run Completed
- First seen 1y ago
Chapter 02
Why we think so
2 points against it and 5 in its favour, checked against the scan evidence.
The reasoning behind this verdict
Only 1 of the 71 antivirus engines that checked it flagged this installer, a generic VBA32 label, while all 18 major engines found nothing. The file is validly signed by Shenzhen iMyFone Technology Co., Ltd and has been submitted by 759 sources since it was first seen on Dec 19, 2024. The combined sandbox verdict was clean.
The single detection comes from a less reliable engine and uses a generic network-trojan bucket, not a named malware family. Every major engine stayed silent. The file carries a valid signature from the iMyFone company named in the file name, and it is widely distributed, with 759 distinct submitters. In the sandbox runs, the installer wrote its own configuration and language files and iMyfone registry keys, with no injection or persistence recorded. The 23 contacted hosts we cross-checked held no malicious or suspicious entries, and no external intelligence lists the file.
What We Detected
1 of the 71 antivirus engines that checked it (VBA32) flagged the file with a generic network-trojan label. None of the major engines, including Kaspersky, ESET, BitDefender and Avast, flagged it. The installer has a valid signature from Shenzhen iMyFone Technology Co., Ltd.
Threat Behavior
In the sandbox runs, the installer created iMyFone program folders, language and log files, and vendor registry keys. No process injection or persistence was recorded, and the combined sandbox verdict was clean. None of the 23 contacted hosts is known to be malicious.
What To Do Now
If you obtained this installer from iMyFone's official website, it fits the profile of the genuine product. Keep your antivirus enabled during installation.
Where this verdict could be wrong2 caveats
- A community annotation tags the file with defence-evasion and persistence labels and a high threat score, but the sandbox runs recorded no persistence and no high-risk techniques.
- The signer has no stored history with us and is not on our trusted-publisher list, so the signature alone does not vouch for the file.
These are the assessment's weak points. If you believe one applies to your file, report the verdict and we'll re-review it.
- Valid code signature from Shenzhen iMyFone Technology Co., Ltd
- Widely distributed: 759 distinct submitters since Dec 19, 2024
- None of the 18 major engines flagged the file
- The combined sandbox verdict was clean, with no high-risk techniques
- No contacted host has a malicious or suspicious reputation
- One less reliable engine flags the file with a generic trojan label.
- The signing company has no stored history in our records.
6 sources checked · all complete. See every source
Chapter 03
What it did in our test
It ran in 6 isolated tests; no test environment rated what it did as risky.
Test run summary
Capture complete- 6isolated sandbox runs
- 23sandbox rule tags
- 6spawned processes
- 17network contacts
- 22filesystem & mutex artifacts
What this file did when executed
This file was detonated in 6 sandboxes and its runtime behaviour was observed.
Sandbox verdicts
1- VT: CLEANclean
Techniques observed in the sandbox
23MITRE ATT&CK techniques the sandbox mapped. Highlighted ones are rare in normal software; the others are common in legitimate programs too.
- T1010
- T1012
- T1016· Network recon
- T1016.001· Network recon
- T1027· Obfuscated code
- T1036
- T1056.001· Keylogging
- T1057· Lists programs
- T1059· Runs commands
- T1071· Application protocol
- T1082· System recon
- T1083· Scans your files
- T1105· Network file transfer
- T1129· Loads modules
- T1140· Deobfuscation
- T1497· Sandbox evasion
- T1497.001· Sandbox evasion
- T1497.002· Sandbox evasion
- T1518· Checks your AV
- T1518.001· Checks your AV
- T1564.003· Hides artifacts
- T1574.002· Execution hijack
- T1614.001
Observed activity
Processes started
6Programs the file ran, with their command lines.
file.exe"C:\Users\<USER>\Desktop\file.exe"imyfone-lockwiper_setup.exe%SAMPLEPATH%\imyfone-lockwiper_setup.exefa11a4d3552443cb9e9977f3f7412afdec9f36e5ac1356858cc4a64a58b84e64.exe%SAMPLEPATH%\fa11a4d3552443cb9e9977f3f7412afdec9f36e5ac1356858cc4a64a58b84e64.exefile.exe%SAMPLEPATH%\file.exeimyfone-lockwiper_setup.exe"C:\Users\user\Desktop\imyfone-lockwiper_setup.exe"software.exe"C:\Users\user\Desktop\software.exe"
Network contacts
1717 hosts, listed as 1 domain, 16 addresses. Links show the host and path only.
- Domain
cl-glcb907925.globalcdn.co - IP address
23.197.238.105 - IP address
20.75.60.91 - IP address
23.32.75.14 - IP address
20.24.121.134 - IP address
104.98.118.163
Show all 17 entries for network contacts
- IP address
23.46.228.49 - IP address
104.98.118.177 - IP address
23.215.176.97 - IP address
104.98.118.146 - IP address
104.98.118.160 - IP address
23.53.122.212 - IP address
217.20.54.35 - IP address
23.53.122.210 - IP address
23.32.75.15 - IP address
23.49.140.110 - IP address
23.32.75.146
Files
20Files the file created, changed or deleted.
- Written
C:\Program Files (x86)\imyfone_down\file\Log\imyfone_down.log - Written
C:\Program Files (x86)\imyfone_down\file\language\language.ini - Written
C:\Program Files (x86)\imyfone_down\file\language\productInfo.ini - Written
C:\Program Files (x86)\imyfone_down\file\language\text.ini - Written
C:\Program Files (x86)\imyfone_down\fa11a4d3552443cb9e9977f3f7412afdec9f36e5ac1356858cc4a64a58b84e64\language\language.ini - Written
C:\Program Files (x86)\imyfone_down\fa11a4d3552443cb9e9977f3f7412afdec9f36e5ac1356858cc4a64a58b84e64\language\productInfo.ini
Show all 20 entries for files
- Written
C:\Program Files (x86)\imyfone_down\fa11a4d3552443cb9e9977f3f7412afdec9f36e5ac1356858cc4a64a58b84e64\language\text.ini - Written
C:\Windows\System32\Tasks\Microsoft\Windows\Application Experience\Microsoft Compatibility Appraiser - Written
C:\Program Files (x86)\imyfone_down - Written
C:\Program Files (x86)\imyfone_down\imyfone-lockwiper_setup - Written
C:\Program Files (x86)\imyfone_down\imyfone-lockwiper_setup\Log - Written
C:\Program Files (x86)\imyfone_down\imyfone-lockwiper_setup\Log\ - Written
C:\Program Files (x86)\imyfone_down\imyfone-lockwiper_setup\Log\imyfone_down.log - Written
C:\Program Files (x86)\imyfone_down\imyfone-lockwiper_setup\language\ - Written
C:\Program Files (x86)\imyfone_down\imyfone-lockwiper_setup\language\language.ini - Deleted
C:\Users\<USER>\AppData\Local\Packages\Microsoft.XboxGamingOverlay_8wekyb3d8bbwe\LocalCache\KnownGameList.bin - Deleted
C:\Users\<USER>\AppData\Local\Microsoft\GameDVR\KnownGameList.update - Deleted
C:\Windows\System32\wbem\Performance\WmiApRpl.h - Deleted
C:\Windows\System32\wbem\Performance\WmiApRpl.ini - Deleted
%USERPROFILE%\AppData\Local\Microsoft\Windows\INetCache\IE\KLT1I0ZU\update50[1].xml
Registry and auto-start
5Settings the file changed, including ways to start again after a restart.
- Set
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\iMyfone\iMyfoneDown\GUID - Set
SOFTWARE\WOW6432Node\iMyfone\iMyfoneDown\GUID - Set
HKEY_USERS\S-1-5-21-4270068108-2931534202-3907561125-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.exe\OpenWithProgids\exefile - Set
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\iMyfone - Set
HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\iMyfone\iMyfoneDown
Mutexes
2Named locks a program uses so only one copy runs; malware families often reuse them.
imyfone-lockwiper_setup.exe\Sessions\1\BaseNamedObjects\imyfone-lockwiper_setup.exe
Sandbox background — not the file
22The analysis machine's own processes and connections, recorded in every run.
- VM process
services.exeC:\Windows\system32\services.exe - VM process
Explorer.EXEC:\Windows\Explorer.EXE - VM process
UI0Detect.exeC:\Windows\System32\UI0Detect.exe - VM process
updater.exeC:\Program Files\Google2588_329888450\bin\updater.exe - VM process
updater.exeC:\Program Files\Google3108_487624300\bin\updater.exe - VM process
updater.exeC:\Program Files\Google3268_1786951258\bin\updater.exe
Show all 22 entries for sandbox background — not the file
- VM process
updater.exeC:\Program Files\Google2180_117220303\bin\updater.exe - VM process
updater.exeC:\Program Files\Google3748_230154143\bin\updater.exe - VM process
updater.exeC:\Program Files\Google3588_555287391\bin\updater.exe - VM injection target
\\?\C:\Windows\system32\wbem\WMIADAP.EXE - VM injection target
C:\Program Files\Google2588_329888450\bin\updater.exe - VM injection target
C:\Program Files\Google3108_487624300\bin\updater.exe - VM injection target
C:\Program Files\Google3268_1786951258\bin\updater.exe - VM injection target
C:\Program Files\Google2180_117220303\bin\updater.exe - VM host
res.public.onecdn.static.microsoft - VM host
www.microsoft.com - VM host
windows.msn.com-ion.edgesuite.net - VM host
a1672.dscr.akamai.net - VM host
a83f:8110:0:0:1400:1400:2800:3800 - VM host
151.101.22.172 - VM host
23.216.81.152 - VM host
192.168.0.28
Files this sample writes at runtime
This file drops 6 children at runtime. None are currently flagged malicious in our cache. 6 have no saved verdict and were not checked; that is missing coverage, not a finding.
- b534192c073fa516c372…2b89b4Not checkedno saved verdict
- 8fb25dd0cb1931d19bd1…fde4a8Not checkedno saved verdict
- 8cb9eb8227e7c34b6437…80777cNot checkedno saved verdict
- 5f9c1cf522b5adaf977a…9e680dNot checkedno saved verdict
- cc56bc1de268ac312fbe…27c23eNot checkedno saved verdict
- d01d332f4acea9489245…02a633Not checkedno saved verdict
Chapter 04
Technical details
1 of the 71 antivirus engines that checked it flags it; signed by Shenzhen iMyFone Technology Co., Ltd.
Sources checked
Every check behind this verdict
6 sources checked · all complete. Complete means the check returned a usable result; it does not mean the file is safe.
Engines that flagged it 1
The Safe verdict weighed these detections and treats them as non-decisive.
- VBA32BScope.Trojan.Win32.NetworkGeneric
File fingerprint
- Last analyzed
- Oct 23, 2026, 8:38 PM UTC
- SHA-256
fa11a4d3552443cb9e9977f3f7412afdec9f36e5ac1356858cc4a64a58b84e64- SHA-1
deb6cf9ee8f2a9ec220e2cb2fb2a7c69eab9ac9d- MD5
d539b65ce5afec3c73839858e08be5ba
About this file
imyfone-lockwiper_setup.exe is a Win32 EXE file of 3.0 MB.
- Claims to be
- imyfone-lockwiper_setup.exe (iMyFone LockWiper)From the file's own version information, written by whoever built it.
- Type and size
- Win32 EXE · 3.0 MB
- Signer
- Shenzhen iMyFone Technology Co., LtdValid code signature.
- First seen
- Dec 19, 2024On VirusTotal.
- Submitted by
- 759 distinct sources
- Packer
- None detected
- Entropy
- 6.42 of 8
First scanned
Antivirus consensus
1 of 71 engines flagged this file
4 of the 75 engines returned no result for this file (file type not supported, or the scan did not finish), so they did not check it.
- Tier-118 engines0flagged
- Tier-236 engines0flagged
- Low-trust17 engines1flagged
View all 75 engine results
- VBA32Malicious: BScope.Trojan.Win32.NetworkGeneric
- AcronisClean
- AhnLab-V3Clean
- AlibabaClean
- alibabacloudClean
- ALYacClean
- Antiy-AVLClean
- APEXClean
- ArcabitClean
- AvastClean
- Avast-MobileNo result
- AVGClean
- AviraClean
- BitDefenderClean
- BitDefenderFalxNo result
- BkavClean
- CAT-QuickHealClean
- ClamAVClean
- CMCClean
- CrowdStrikeClean
- CTXClean
- CylanceClean
- CynetClean
- DeepInstinctClean
- DrWebClean
- ElasticClean
- EmsisoftClean
- ESET-NOD32Clean
- F-SecureClean
- FortinetClean
- GDataClean
- GoogleClean
- GridinsoftClean
- huorongClean
- IkarusClean
- JiangminClean
- K7AntiVirusClean
- K7GWClean
- KasperskyClean
- KingsoftClean
- LionicClean
- MalwarebytesClean
- MaxSecureClean
- McAfeeDClean
- MicrosoftClean
- MicroWorld-eScanClean
- NANO-AntivirusClean
- PaloaltoClean
- PandaClean
- RisingClean
- SangforClean
- SentinelOneClean
- SkyhighClean
- SophosClean
- SUPERAntiSpywareClean
- SymantecClean
- SymantecMobileInsightNo result
- TACHYONClean
- tehtrisClean
- TencentClean
- TrapmineClean
- TrellixENSClean
- TrendMicroClean
- TrendMicro-HouseCallClean
- TrustlookNo result
- VaristClean
- VIPREClean
- VirITClean
- ViRobotClean
- WebrootClean
- XcitiumClean
- YandexClean
- ZillyaClean
- ZoneAlarmClean
- ZonerClean
Signatures and behavior heuristics
Low-severity pattern matches — worth noting but not on their own cause for alarm.
Signed by "Shenzhen iMyFone Technology Co., Ltd" — short generic company CN. Paired with 1 engine hit(s); possible stolen, fraudulent, or reseller-purchased code-signing certificate.
EvidenceShenzhen iMyFone Technology Co., Ltd
Section entropy & packers
No high-entropy executable section or known packer signature was detected. Data and resource sections can still have high entropy without indicating packed code.
How widely this file has been seen
Widely seen in the wild for a long time. High prior this is legitimate; isolated detections on common-old files are usually false positives.
Chapter 05
Questions & answers
Short answers to the 7 questions people ask most about this file.
Is imyfone-lockwiper_setup.exe safe?
What is imyfone-lockwiper_setup.exe?
How many antivirus engines detected imyfone-lockwiper_setup.exe?
Is imyfone-lockwiper_setup.exe digitally signed?
What is the SHA-256 hash of imyfone-lockwiper_setup.exe?
Is it safe to install imyfone-lockwiper_setup.exe?
How up to date is this analysis of imyfone-lockwiper_setup.exe?
Community
Member reviews and reports for this exact file hash.