File scan report
Verdict Safe
Is Unity Crash Handler64. exe safe? Yes, no threats found.
Unity's crash reporter, validly signed by Unity Technologies ApS, widely distributed since 2021 and flagged by none of the 70 antivirus engines that checked it.
Read the whole reasonShow less
Strong evidence · A verified publisher signature, and no engine flags it.
This is a standard Unity game component and can be left in place. If it appears outside a game install folder, confirm its Unity Technologies ApS signature in the file properties.
Good practice2 tips
We found nothing harmful in this file.
Run it only if it came from the developer's own website or an official app store.
Keep your antivirus and Windows updates switched on.
No scanner can promise a file is 100% safe.
Antivirus results
0 of 70 flagged
- Flagged 0
- No detection 70
- No result 5
- Code signing Unity Technologies ApS
- Test run Completed
- First seen 4y ago
Chapter 02
Why we think so
0 points against it and 5 in its favour, checked against the scan evidence.
The reasoning behind this verdict
This is the Unity engine crash handler that ships with many games. It carries a valid signature from Unity Technologies ApS and appears in a known-software reference set. Hundreds of sources have submitted it since Nov 20, 2021, and none of the 70 antivirus engines that checked it flagged it.
None of the 70 antivirus engines that checked it flagged this file, including every major antivirus engine that reported on it. It is validly signed by Unity Technologies ApS, a publisher on our trusted list. It is also listed in the NSRL known-software reference set and has been submitted by 554 sources since it was first seen on Nov 20, 2021. The sandbox runs produced a combined clean verdict, with no high-risk techniques and no process injection. Its network contacts were Microsoft and CDN hosts, and none of the 31 hosts we checked is known to be malicious. A third-party annotation calling it packed greyware is not supported by the file's structure.
What We Detected
None of the 70 antivirus engines that checked it flagged this file. It carries a valid code signature from Unity Technologies ApS, appears in a known-software reference set, and has been widely submitted since Nov 20, 2021. The antivirus analysis found no packer and normal section entropy.
Threat Behavior
Six sandbox runs produced a combined clean verdict. They recorded only techniques common in legitimate software and no injection into other processes. Contacted hosts were Microsoft and CDN infrastructure, and none of the 31 hosts we checked is known to be malicious.
What To Do Now
No action is needed. This file is part of games built with the Unity engine and reports crashes. If you find it outside a game folder, check that it is still signed by Unity Technologies ApS.
Where this verdict could be wrong1 caveat
- The file carries a negative community reputation score, and one third-party community annotation labels it suspicious greyware and packed. Our antivirus analysis found no packer and normal section entropy, so this annotation does not match the file's structure.
These are the assessment's weak points. If you believe one applies to your file, report the verdict and we'll re-review it.
- Valid signature from Unity Technologies ApS, a trusted publisher
- None of the 70 antivirus engines that checked it flagged the file
- Listed in a known-software reference set
- Widely distributed: 554 sources since Nov 20, 2021
- Sandbox runs returned a combined clean verdict with no high-risk techniques
6 sources checked · all complete. See every source
Chapter 03
What it did in our test
It ran in 6 isolated tests; no test environment rated what it did as risky.
Test run summary
Capture complete- 6isolated sandbox runs
- 10sandbox rule tags
- 4spawned processes
- 23network contacts
- 15filesystem & mutex artifacts
What this file did when executed
This file was detonated in 6 sandboxes and its runtime behaviour was observed.
Sandbox verdicts
1- VT: CLEANclean
Techniques observed in the sandbox
10MITRE ATT&CK techniques the sandbox mapped. Highlighted ones are rare in normal software; the others are common in legitimate programs too.
- T1027· Obfuscated code
- T1033· Reads user info
- T1057· Lists programs
- T1059· Runs commands
- T1071· Application protocol
- T1082· System recon
- T1083· Scans your files
- T1087
- T1095· Custom network
- T1129· Loads modules
Observed activity
Processes started
4Programs the file ran, with their command lines.
program.exe"C:\Users\<USER>\AppData\Local\Temp\program.exe"_1_4_a_4a80a2fce981d9ff78bfae696d411e07b24160d95fa130435879d9dc02de9a9c.exe%SAMPLEPATH%\_1_4_a_4a80a2fce981d9ff78bfae696d411e07b24160d95fa130435879d9dc02de9a9c.exe4a80a2fce981d9ff78bfae696d411e07b24160d95fa130435879d9dc02de9a9c.exe%SAMPLEPATH%\4a80a2fce981d9ff78bfae696d411e07b24160d95fa130435879d9dc02de9a9c.exeUnityCrashHandler64.exe%SAMPLEPATH%\UnityCrashHandler64.exe
Network contacts
2323 hosts, listed as 3 domains, 20 addresses. Links show the host and path only.
- Domain
cdn.onenote.net - Domain
prod-azurecdn-akamai-iris.azureedge.net - Domain
www.msftconnecttest.com - IP address
23.39.19.41 - IP address
104.86.182.10 - IP address
13.107.39.203
Show all 23 entries for network contacts
- IP address
23.215.176.91 - IP address
23.34.172.81 - IP address
23.213.34.191 - IP address
20.96.52.198 - IP address
20.22.113.133 - IP address
104.86.182.8 - IP address
23.53.122.135 - IP address
23.216.147.67 - IP address
104.112.185.183 - IP address
23.34.215.248 - IP address
104.80.88.154 - IP address
23.64.191.115 - IP address
23.6.103.183 - IP address
23.198.146.35 - IP address
23.209.116.9 - IP address
23.53.122.133 - IP address
23.55.168.75
Files
15Files the file created, changed or deleted.
- Deleted
C:\ProgramData\Microsoft\Windows\WER\Temp\WER2620.tmp.WERInternalMetadata.xml - Deleted
C:\ProgramData\Microsoft\Windows\WER\Temp\WER268E.tmp.csv - Deleted
C:\ProgramData\Microsoft\Windows\WER\Temp\WER26BE.tmp.txt - Deleted
C:\ProgramData\Microsoft\Windows\WER\Temp\WER2B03.tmp.WERInternalMetadata.xml - Deleted
C:\ProgramData\Microsoft\Windows\WER\Temp\WER2B14.tmp.csv - Deleted
C:\ProgramData\Microsoft\Windows\WER\Temp\WER2B15.tmp.txt
Show all 15 entries for files
- Deleted
C:\Windows\System32\spp\store\2.0\cache\cache.dat - Deleted
C:\ProgramData\Microsoft\Windows\WER\Temp\WER2507.tmp.WERInternalMetadata.xml - Deleted
C:\ProgramData\Microsoft\Windows\WER\Temp\WER2584.tmp.csv - Deleted
C:\ProgramData\Microsoft\Windows\WER\Temp\WER25B4.tmp.txt - Deleted
C:\ProgramData\Microsoft\Windows\WER\Temp\WER28A2.tmp.WERInternalMetadata.xml - Deleted
C:\ProgramData\Microsoft\Windows\WER\Temp\WER28B3.tmp.csv - Deleted
C:\ProgramData\Microsoft\Windows\WER\Temp\WER28C3.tmp.txt - Deleted
C:\ProgramData\Microsoft\Windows\WER\Temp\WER9FD.tmp.WERInternalMetadata.xml - Deleted
C:\ProgramData\Microsoft\Windows\WER\Temp\WERA0F.tmp.csv
Registry and auto-start
6Settings the file changed, including ways to start again after a restart.
- Set
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\GoogleUpdaterInternalService122.0.6180.0\Start - Set
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\GoogleUpdaterInternalService122.0.6180.0\ImagePath - Set
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\GoogleUpdaterInternalService122.0.6234.0\ImagePath - Set
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\GoogleUpdaterInternalService122.0.6234.0\Start - Set
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\GoogleUpdaterInternalService123.0.6288.0\Start - Set
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\GoogleUpdaterInternalService123.0.6288.0\ImagePath
Sandbox background — not the file
24The analysis machine's own processes and connections, recorded in every run.
- VM process
wuapihost.exeC:\Windows\System32\wuapihost.exe - VM process
updater.exeC:\Program Files (x86)\Google1524_546823694\bin\updater.exe - VM process
updater.exeC:\Program Files (x86)\Google3908_1103993204\bin\updater.exe - VM process
updater.exeC:\Program Files (x86)\Google3004_1929805389\bin\updater.exe - VM process
updater.exeC:\Program Files (x86)\Google1976_846185126\bin\updater.exe - VM process
updater.exeC:\Program Files (x86)\Google3168_1769212113\bin\updater.exe
Show all 24 entries for sandbox background — not the file
- VM process
updater.exeC:\Program Files (x86)\Google2068_1835729263\bin\updater.exe - VM process
updater.exeC:\Program Files (x86)\Google464_55375442\bin\updater.exe - VM process
UI0Detect.exeC:\Windows\System32\UI0Detect.exe - VM process
updater.exeC:\Program Files\Google844_760268315\bin\updater.exe - VM process
updater.exeC:\Program Files\Google3432_564029737\bin\updater.exe - VM injection target
\\?\C:\Windows\system32\wbem\WMIADAP.EXE - VM injection target
C:\Program Files (x86)\Google1524_546823694\bin\updater.exe - VM injection target
C:\Program Files (x86)\Google3908_1103993204\bin\updater.exe - VM injection target
C:\Program Files (x86)\Google3004_1929805389\bin\updater.exe - VM injection target
C:\Program Files (x86)\Google1976_846185126\bin\updater.exe - VM host
query.prod.cms.rt.microsoft.com - VM host
www.microsoft.com - VM host
fp2e7a.wpc.2be4.phicdn.net - VM host
234.173.86.20.in-addr.arpa - VM host
45.107.88.104.in-addr.arpa - VM host
183.209.82.20.in-addr.arpa - VM host
fp2e7a.wpc.phicdn.net - VM host
56.160.74.23.in-addr.arpa
Chapter 04
Technical details
None of the 70 antivirus engines that checked it flag it; signed by Unity Technologies ApS.
Sources checked
Every check behind this verdict
6 sources checked · all complete. Complete means the check returned a usable result; it does not mean the file is safe.
File fingerprint
- Last analyzed
- Oct 25, 2026, 9:24 AM UTC
- SHA-256
4a80a2fce981d9ff78bfae696d411e07b24160d95fa130435879d9dc02de9a9c- SHA-1
695dc5f962eec1af0c8b0dffe9831beacd000ce2- MD5
9d975bd36aff9f92920210e3caf0532f
About this file
UnityCrashHandler64.exe is a Win32 EXE file of 1.2 MB.
- Type and size
- Win32 EXE · 1.2 MB
- Signer
- Unity Technologies ApSValid code signature.
- First seen
- Nov 20, 2021On VirusTotal.
- Submitted by
- 554 distinct sources
- Packer
- None detected
- Entropy
- 4.95 of 8
First scanned
Antivirus consensus
0 of 70 engines flagged this file
5 of the 75 engines returned no result for this file (file type not supported, or the scan did not finish), so they did not check it.
- Tier-118 engines0flagged
- Tier-235 engines0flagged
- Low-trust17 engines0flagged
View all 75 engine results
- AcronisClean
- AhnLab-V3Clean
- AlibabaClean
- alibabacloudClean
- ALYacClean
- Antiy-AVLClean
- APEXClean
- ArcabitClean
- AvastClean
- Avast-MobileNo result
- AVGClean
- AviraClean
- BitDefenderClean
- BitDefenderFalxNo result
- BkavClean
- CAT-QuickHealClean
- ClamAVNo result
- CMCClean
- CrowdStrikeClean
- CTXClean
- CylanceClean
- CynetClean
- DeepInstinctClean
- DrWebClean
- ElasticClean
- EmsisoftClean
- ESET-NOD32Clean
- F-SecureClean
- FortinetClean
- GDataClean
- GoogleClean
- GridinsoftClean
- huorongClean
- IkarusClean
- JiangminClean
- K7AntiVirusClean
- K7GWClean
- KasperskyClean
- KingsoftClean
- LionicClean
- MalwarebytesClean
- MaxSecureClean
- McAfeeDClean
- MicrosoftClean
- MicroWorld-eScanClean
- NANO-AntivirusClean
- PaloaltoClean
- PandaClean
- RisingClean
- SangforClean
- SentinelOneClean
- SkyhighClean
- SophosClean
- SUPERAntiSpywareClean
- SymantecClean
- SymantecMobileInsightNo result
- TACHYONClean
- tehtrisClean
- TencentClean
- TrapmineClean
- TrellixENSClean
- TrendMicroClean
- TrendMicro-HouseCallClean
- TrustlookNo result
- VaristClean
- VBA32Clean
- VIPREClean
- VirITClean
- ViRobotClean
- WebrootClean
- XcitiumClean
- YandexClean
- ZillyaClean
- ZoneAlarmClean
- ZonerClean
Section entropy & packers
No high-entropy executable section or known packer signature was detected. Data and resource sections can still have high entropy without indicating packed code.
How widely this file has been seen
Widely seen in the wild for a long time. High prior this is legitimate; isolated detections on common-old files are usually false positives.
Chapter 05
Questions & answers
Short answers to the 7 questions people ask most about this file.
Is UnityCrashHandler64.exe safe?
What is UnityCrashHandler64.exe?
How many antivirus engines detected UnityCrashHandler64.exe?
Is UnityCrashHandler64.exe digitally signed?
What is the SHA-256 hash of UnityCrashHandler64.exe?
Is it safe to run UnityCrashHandler64.exe?
How up to date is this analysis of UnityCrashHandler64.exe?
Community
Member reviews and reports for this exact file hash.