File scan report
Verdict Safe
Is 7SU2.
Clean RAR archive of an RPG Maker game with zero engine detections and no malicious runtime indicators.
Moderate evidence · No engine flags it, but no publisher signature confirms who made it.
Treat as safe for normal use; the archive contains a legitimate RPG Maker title with no confirmed malicious payload.
Good practice2 tips
We found nothing harmful in this file.
Open it only if you trust the person or website you got it from.
Keep your security software and system updates switched on.
No scanner can promise a file is 100% safe.
Reads the latest antivirus results for this file's hash. Nothing is uploaded.
Antivirus results
0 of 64 flagged
- Flagged 0
- No detection 64
- No result 11
- Code signing Not applicable
- Test run Completed
- First seen 9mo ago
Chapter 02
Why we think so
2 points against it and 4 in its favour, checked against the scan evidence.
The reasoning behind this verdict
All 64 reporting engines returned clean results including 17 major antivirus engines. Sandbox analysis found no malicious verdict despite minor MITRE noise, and none of the ten files it created were flagged. Medium prevalence over 109 days supports treating the file as benign.
Zero malicious detections across a broad engine set, including full major coverage, is the dominant signal. The single offensive MITRE technique and debug-evasion tags are outweighed by the complete lack of sandbox malice, external intelligence hits, or malicious files it created. The extracted contents match a typical RPG Maker 2000/2003 title, consistent with the medium-prevalence commodity pattern observed.
What We Detected
RAR containing RPG Maker runtime files (RPG_RT.exe, Harmony.dll, UNLHA32.DLL) and image assets. Extraction used password "infected". No AV engine raised an alert.
Threat Behavior
Observed T1562.001, debug-environment checks, and long sleeps, yet sandbox returned no malicious verdict. Ten files it created remain unflagged.
What To Do Now
File can be opened safely. If you distrust the source, scan the extracted folder with an on-demand scanner before running RPG_RT.exe.
Where this verdict could be wrong1 caveat
- The sandbox's offensive-technique list contains and tags include detect-debug-environment plus long-sleeps, which could indicate evasion if the archive were malicious.
These are the assessment's weak points. If you believe one applies to your file, report the verdict and we'll re-review it.
- 0 malicious engines out of 64
- 17 major clean reports
- no malicious sandbox verdict
- medium prevalence, no external hits
- technique observed
- debug-environment detection tag
6 sources checked · 5 complete · 1 not needed or not applicable. See every source
Chapter 03
What it did in our test
It ran in our isolated test environment; no test environment rated what it did as risky.
Test run summary
Capture complete- 3sandbox rule tags
- 5spawned processes
- 0network contacts
- 18filesystem & mutex artifacts
What this file did when executed
This file was run in a sandbox and its runtime behaviour was observed.
Techniques observed in the sandbox
3MITRE ATT&CK techniques the sandbox mapped. Highlighted ones are rare in normal software; the others are common in legitimate programs too.
- T1082· System recon
- T1497· Sandbox evasion
- T1562.001· Disables security
Observed activity
Processes started
5Programs the file ran, with their command lines.
rundll32.exe"C:\Windows\system32\rundll32.exe" "C:\Users\<USER>\AppData\Local\Temp\7SU/Harmony.dll",#1RPG_RT.exe"C:\Users\<USER>\AppData\Local\Temp\7SU/RPG_RT.exe"rundll32.exe"C:\Windows\system32\rundll32.exe" "C:\Users\<USER>\AppData\Local\Temp\7SU/UNLHA32.DLL",#1unarchiver.exeC:\Windows\SysWOW64\unarchiver.exe "C:\Windows\SysWow64\unarchiver.exe" "C:\Users\user\Desktop\7SU2.6_DQIII.rar"7za.exeC:\Windows\SysWOW64\7za.exe "C:\Windows\System32\7za.exe" x -pinfected -y -o"C:\Users\user\AppData\Local\Temp\rqav3pqc.v4e" "C:\Users\user\Desktop\7SU2.6_DQIII.rar"
Files
15Files the file created, changed or deleted.
- Written
C:\Users\user\AppData\Local\Temp\rqav3pqc.v4e - Written
C:\Users\user\AppData\Local\Temp\rqav3pqc.v4e\7SU - Written
C:\Users\user\AppData\Local\Temp\rqav3pqc.v4e\7SU\Backdrop - Written
C:\Users\user\AppData\Local\Temp\rqav3pqc.v4e\7SU\Backdrop\Mirage.png - Written
C:\Users\user\AppData\Local\Temp\rqav3pqc.v4e\7SU\Backdrop\beach.png - Written
C:\Users\user\AppData\Local\Temp\rqav3pqc.v4e\7SU\Backdrop\bedroom.png
Show all 15 entries for files
- Written
C:\Users\user\AppData\Local\Temp\rqav3pqc.v4e\7SU\Backdrop\black.png - Written
C:\Users\user\AppData\Local\Temp\rqav3pqc.v4e\7SU\Backdrop\brain.png - Written
C:\Users\user\AppData\Local\Temp\rqav3pqc.v4e\7SU\Backdrop\bridge(jikanteisi).png - Written
C:\Users\user\AppData\Local\Temp\rqav3pqc.v4e\7SU\Backdrop\bridge.png - Written
C:\Users\user\AppData\Local\Temp\rqav3pqc.v4e\7SU\Backdrop\canyon.png - Written
C:\Users\user\AppData\Local\Temp\rqav3pqc.v4e\7SU\Backdrop\cave.png - Written
C:\Users\user\AppData\Local\Temp\rqav3pqc.v4e\7SU\Backdrop\cliff.png - Written
C:\Users\user\AppData\Local\Temp\rqav3pqc.v4e\7SU\Backdrop\desert.png - Written
C:\Users\user\AppData\Local\Temp\rqav3pqc.v4e\7SU\Backdrop\dio-sinsitu(front).png
Mutexes
3Named locks a program uses so only one copy runs; malware families often reuse them.
DirectSound Administrator shared thread array (lockDirectInput.{89521361-AA8A-11CF-BFC7-444553540000}DirectInput.{5944E682-C92E-11CF-BFC7-444553540000}
Sandbox background — not the file
1The analysis machine's own processes and connections, recorded in every run.
- VM process
conhost.exeC:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Files this sample writes at runtime
This file drops 10 children at runtime. None are currently flagged malicious in our cache. 10 have no saved verdict and were not checked; that is missing coverage, not a finding.
- 14e1652ee0bda8d425b9…d969e6Not checkedno saved verdict
- 50d9e9eb48fac59e48e9…5c9c3bNot checkedno saved verdict
- 546abce7b3e4e84ce589…62191fNot checkedno saved verdict
- 2bf0e599b4c5ebec7b14…dfcd79Not checkedno saved verdict
- 803439eef85287043632…0ea8cdNot checkedno saved verdict
- d131abe3129907799d4d…300bb0Not checkedno saved verdict
- e43b41b2ebcedfc849ef…f95ea9Not checkedno saved verdict
- cc0ab71df327cf827c0b…3d7ea0Not checkedno saved verdict
- 253fb1389c3d72d46b5e…765e0aNot checkedno saved verdict
- 66ff4d3e1c39b1c84f78…f9edfcNot checkedno saved verdict
Chapter 04
Technical details
None of the 64 antivirus engines that checked it flag it.
Sources checked
Every check behind this verdict
6 sources checked · 5 complete · 1 not needed or not applicable. Complete means the check returned a usable result; it does not mean the file is safe.
File fingerprint
- Last analyzed
- May 16, 2026, 12:25 AM UTC
- SHA-256
4b72f0f8e6184a54b83e2a0ead2c2f14f6b7d0c97d4f3dffca497e054605f5a7- SHA-1
d40c118575d790602bf236eaf734ec65b8d31f91- MD5
4d469aee981b82e3cf321a2167bdbfaf
About this file
7SU2.6_DQIII.rar is an RAR file of 20.8 MB.
- Type and size
- RAR · 20.8 MB
- Signer
- Not applicable
- First seen
- Jan 26, 2026On VirusTotal.
- Submitted by
- 12 distinct sources
First scanned
Antivirus consensus
0 of 64 engines flagged this file
11 of the 75 engines returned no result for this file (file type not supported, or the scan did not finish), so they did not check it.
- Tier-118 engines0flagged
- Tier-234 engines0flagged
- Low-trust12 engines0flagged
View all 75 engine results
- AcronisClean
- AhnLab-V3Clean
- AlibabaNo result
- alibabacloudClean
- ALYacClean
- Antiy-AVLClean
- APEXNo result
- ArcabitClean
- AvastClean
- Avast-MobileNo result
- AVGClean
- AviraClean
- BitDefenderClean
- BitDefenderFalxNo result
- BkavClean
- CAT-QuickHealClean
- ClamAVClean
- CMCClean
- CrowdStrikeClean
- CTXClean
- CylanceNo result
- CynetClean
- DeepInstinctClean
- DrWebClean
- ElasticNo result
- EmsisoftClean
- ESET-NOD32Clean
- F-SecureClean
- FortinetClean
- GDataClean
- GoogleClean
- GridinsoftClean
- huorongClean
- IkarusClean
- JiangminClean
- K7AntiVirusClean
- K7GWClean
- KasperskyClean
- KingsoftClean
- LionicClean
- MalwarebytesClean
- MaxSecureClean
- McAfeeDClean
- MicrosoftClean
- MicroWorld-eScanClean
- NANO-AntivirusClean
- PaloaltoNo result
- PandaClean
- RisingClean
- SangforClean
- SentinelOneClean
- SkyhighClean
- SophosClean
- SUPERAntiSpywareClean
- SymantecClean
- SymantecMobileInsightNo result
- TACHYONClean
- tehtrisNo result
- TencentClean
- TrapmineNo result
- TrellixENSClean
- TrendMicroClean
- TrendMicro-HouseCallClean
- TrustlookNo result
- VaristClean
- VBA32Clean
- VIPREClean
- VirITClean
- ViRobotClean
- WebrootClean
- XcitiumClean
- YandexClean
- ZillyaClean
- ZoneAlarmClean
- ZonerClean
How widely this file has been seen
Moderate prevalence — neither rare nor common. No strong prior applies.
Chapter 05
Questions & answers
Short answers to the 6 questions people ask most about this file.
Is 7SU2.6_DQIII.rar safe?
What is 7SU2.6_DQIII.rar?
How many antivirus engines detected 7SU2.6_DQIII.rar?
What is the SHA-256 hash of 7SU2.6_DQIII.rar?
Is it safe to open or extract 7SU2.6_DQIII.rar?
How up to date is this analysis of 7SU2.6_DQIII.rar?
Community
Member reviews and reports for this exact file hash.