File scan report
Verdict Safe
Is gooncheese.
This ZIP holds what appears to be a Unity-based game; none of the 65 antivirus engines that checked it flagged it and the sandbox runs showed no high-risk behaviour.
Read the whole reasonShow less
Moderate evidence · No engine flags it, but no publisher signature confirms who made it.
The archive appears safe to use. Download it only from a source you trust and keep your security software enabled.
Good practice2 tips
We found nothing harmful in this file.
Open it only if you trust the person or website you got it from.
Keep your security software and system updates switched on.
No scanner can promise a file is 100% safe.
Antivirus results
0 of 65 flagged
- Flagged 0
- No detection 65
- No result 10
- Code signing Not applicable
- Test run Completed
- First seen 4mo ago
Chapter 02
Why we think so
1 point against it and 4 in its favour, checked against the scan evidence.
The reasoning behind this verdict
The archive contains a Unity game build, with standard UnityEngine module libraries visible in the sandbox process list. No engine reported a detection, and a sandbox run returned a clean result. MalwareBazaar, YARAify and CIRCL had no entries for the file. It has been submitted by 27 sources over 133 days with no detections appearing.
What We Detected
None of the 65 antivirus engines that checked it flagged this ZIP archive, and all 18 major antivirus engines reported it clean. It contains a Unity game build. No public malware database or community rule matched it.
Threat Behavior
In the sandbox, the analysis environment tried loading the game's Unity engine libraries. Because these are managed libraries, the attempts produced Windows crash reports, which is expected. We saw no injection into other processes, no persistence and no network contact by the sample itself. No complete reputation check of contacted hosts is available.
What To Do Now
The archive appears safe to use. As with any unsigned game, run it only if you trust where you got it, and keep your antivirus enabled.
Where this verdict could be wrong2 caveats
- The archive contains executable code from an unsigned, unidentified game author, so a later-added malicious component cannot be ruled out by signatures alone.
- No complete reputation check of contacted hosts is available, although the sandbox recorded no network activity of the sample's own.
These are the assessment's weak points. If you believe one applies to your file, report the verdict and we'll re-review it.
- None of the 65 antivirus engines that checked it flagged the archive, including all major antivirus engines.
- A sandbox run returned clean, with no high-risk techniques observed.
- The contents match a standard Unity game build.
- No matches in public malware databases or community rule sets.
- The game files are not code-signed, so the author cannot be verified.
6 sources checked · 5 complete · 1 not needed or not applicable. See every source
Chapter 03
What it did in our test
It ran in 2 isolated tests; no test environment rated what it did as risky.
Test run summary
Capture complete- 2isolated sandbox runs
- 9sandbox rule tags
- 15spawned processes
- 0network contacts
- 31filesystem & mutex artifacts
What this file did when executed
This file was detonated in 2 sandboxes and its runtime behaviour was observed.
Sandbox verdicts
1- VT: CLEANclean
Techniques observed in the sandbox
9MITRE ATT&CK techniques the sandbox mapped. Highlighted ones are rare in normal software; the others are common in legitimate programs too.
- T1033· Reads user info
- T1055· Process injection
- T1057· Lists programs
- T1070.006· Covers its tracks
- T1071· Application protocol
- T1082· System recon
- T1497· Sandbox evasion
- T1562.001· Disables security
- T1574· Execution hijack
Observed activity
Processes started
15Programs the file ran, with their command lines.
rundll32.exe"C:\Windows\system32\rundll32.exe" "C:\Users\<USER>\AppData\Local\Temp\gooncheese/gooning simulator_Data/Managed/UnityEngine.TilemapModule.dll",#1rundll32.exe"C:\Windows\system32\rundll32.exe" "C:\Users\<USER>\AppData\Local\Temp\gooncheese/gooning simulator_Data/Managed/Unity.InputSystem.ForUI.dll",#1rundll32.exe"C:\Windows\system32\rundll32.exe" "C:\Users\<USER>\AppData\Local\Temp\gooncheese/gooning simulator_Data/Managed/UnityEngine.GridModule.dll",#1rundll32.exe"C:\Windows\system32\rundll32.exe" "C:\Users\<USER>\AppData\Local\Temp\gooncheese/gooning simulator_Data/Managed/UnityEngine.VehiclesModule.dll",#1rundll32.exe"C:\Windows\system32\rundll32.exe" "C:\Users\<USER>\AppData\Local\Temp\gooncheese/gooning simulator_Data/Managed/UnityEngine.DirectorModule.dll",#1rundll32.exe"C:\Windows\system32\rundll32.exe" "C:\Users\<USER>\AppData\Local\Temp\gooncheese/gooning simulator_Data/Managed/UnityEngine.DSPGraphModule.dll",#1
Show all 15 entries for processes started
rundll32.exe"C:\Windows\system32\rundll32.exe" "C:\Users\<USER>\AppData\Local\Temp\gooncheese/gooning simulator_Data/Managed/Unity.SurfaceCache.Runtime.dll",#1rundll32.exe"C:\Windows\system32\rundll32.exe" "C:\Users\<USER>\AppData\Local\Temp\gooncheese/gooning simulator_Data/Managed/UnityEngine.UnityWebRequestAudioModule.dll",#1rundll32.exe"C:\Windows\system32\rundll32.exe" "C:\Users\<USER>\AppData\Local\Temp\gooncheese/gooning simulator_Data/Managed/Unity.VisualScripting.Core.dll",#1rundll32.exe"C:\Windows\system32\rundll32.exe" "C:\Users\<USER>\AppData\Local\Temp\gooncheese/gooning simulator_Data/Managed/System.ComponentModel.Composition.dll",#1rundll32.exe"C:\Windows\system32\rundll32.exe" "C:\Users\<USER>\AppData\Local\Temp\gooncheese/gooning simulator_Data/Managed/Unity.RenderPipelines.GPUDriven.Runtime.dll",#1rundll32.exe"C:\Windows\system32\rundll32.exe" "C:\Users\<USER>\AppData\Local\Temp\gooncheese/gooning simulator_Data/Managed/UnityEngine.IMGUIModule.dll",#1rundll32.exe"C:\Windows\system32\rundll32.exe" "C:\Users\<USER>\AppData\Local\Temp\gooncheese/gooning simulator_Data/Managed/UnityEngine.WindModule.dll",#1rundll32.exe"C:\Windows\system32\rundll32.exe" "C:\Users\<USER>\AppData\Local\Temp\gooncheese/gooning simulator_Data/Managed/UnityEngine.InputLegacyModule.dll",#1rundll32.exe"C:\Windows\system32\rundll32.exe" "C:\Users\<USER>\AppData\Local\Temp\gooncheese/gooning simulator_Data/Managed/UnityEngine.CoreModule.dll",#1
Files
27Files the file created, changed or deleted.
- Written
C:\ProgramData\Microsoft\Windows\WER\Temp - Written
C:\ProgramData\Microsoft\Windows\WER\Temp\04bfcfaf-46e6-4c0f-b062-e071379bed1f - Written
C:\ProgramData\Microsoft\Windows\WER\ReportQueue - Written
C:\ProgramData\Microsoft\Windows\WER\Temp\91c08565-81d3-47c4-b3fc-d2a775517162 - Written
C:\ProgramData\Microsoft\Windows\WER\ReportArchive - Written
C:\ProgramData\Microsoft\Windows\WER\Temp\665bbb29-3275-4c6a-9510-55d4bc72028c
Show all 27 entries for files
- Written
C:\ProgramData\Microsoft\Windows\WER\Temp\fed583d7-c368-4955-aa82-6a5acc5a3bf1 - Written
C:\ProgramData\Microsoft\Windows\WER\ReportArchive\27676f84-8ff7-41fd-8d5f-8e4180964efd - Written
C:\ProgramData\Microsoft\Windows\WER\ReportQueue\6aa1cf6a-68f7-4e0b-baa4-71e59ce6dd35 - Written
C:\ProgramData\Microsoft\Windows\WER\Temp\WEREEF.tmp.dmp - Written
C:\ProgramData\Microsoft\Windows\WER\Temp\WER15B6.tmp.WERInternalMetadata.xml - Written
C:\ProgramData\Microsoft\Windows\WER\Temp\WER174E.tmp.xml - Written
C:\ProgramData\Microsoft\Windows\WER\Temp\0edc44f3-3a42-4b30-ba35-1938f91729cc - Written
C:\ProgramData\Microsoft\Windows\WER\Temp\be59b98a-c05b-4cd3-94b2-0ca044bb4806 - Written
C:\ProgramData\Microsoft\Windows\WER\Temp\6cc9fa80-77bb-4565-a79d-77655fdad8e8 - Deleted
C:\ProgramData\Microsoft\Windows\WER\Temp\WEREEF.tmp - Deleted
C:\ProgramData\Microsoft\Windows\WER\Temp\WER15B6.tmp - Deleted
C:\ProgramData\Microsoft\Windows\WER\Temp\WER174E.tmp - Deleted
C:\ProgramData\Microsoft\Windows\WER\Temp\WEREEF.tmp.dmp - Deleted
C:\ProgramData\Microsoft\Windows\WER\Temp\WER15B6.tmp.WERInternalMetadata.xml - Deleted
C:\ProgramData\Microsoft\Windows\WER\Temp\WER174E.tmp.xml - Deleted
C:\ProgramData\Microsoft\Windows\WER\Temp\WER145E.tmp - Deleted
C:\ProgramData\Microsoft\Windows\WER\Temp\WER1AF6.tmp - Deleted
C:\ProgramData\Microsoft\Windows\WER\Temp\WER1CEB.tmp - Deleted
C:\ProgramData\Microsoft\Windows\WER\Temp\WER145E.tmp.dmp - Deleted
C:\ProgramData\Microsoft\Windows\WER\Temp\WER1AF6.tmp.WERInternalMetadata.xml - Deleted
C:\ProgramData\Microsoft\Windows\WER\Temp\WER1CEB.tmp.xml
Mutexes
4Named locks a program uses so only one copy runs; malware families often reuse them.
Local\WERReportingForProcess4812Global\91026bb3-253e-4bb0-ad3f-2ba66662f836Local\WERReportingForProcess2036Global\43f92148-fb52-4b63-81a5-edf19d88d41b
Sandbox background — not the file
1The analysis machine's own processes and connections, recorded in every run.
- VM host
162.159.36.2
Files this sample writes at runtime
This file drops 10 children at runtime. None are currently flagged malicious in our cache. 10 have no saved verdict and were not checked; that is missing coverage, not a finding.
- 9c83ee39fb0d200d03ef…b7ecafNot checkedno saved verdict
- 22362d813e444a18592e…7d679eNot checkedno saved verdict
- a16d7efbbb92dfd1b404…9ad933Not checkedno saved verdict
- 9f08e4aefe0d3e931375…88fec1Not checkedno saved verdict
- 2bb893b4e289b739ddde…0f8a35Not checkedno saved verdict
- f1e0909723a04b1b8ba3…97a68fNot checkedno saved verdict
- 40be4cdbabdb7e416dac…53ba8dNot checkedno saved verdict
- 9000c2415ceeb6ef8f03…ebb67bNot checkedno saved verdict
- 043c8fc2c6a2f924851c…3272a4Not checkedno saved verdict
- 18cde0260773c9ca79f5…1c97dfNot checkedno saved verdict
Chapter 04
Technical details
None of the 65 antivirus engines that checked it flag it.
Sources checked
Every check behind this verdict
6 sources checked · 5 complete · 1 not needed or not applicable. Complete means the check returned a usable result; it does not mean the file is safe.
File fingerprint
- Last analyzed
- Oct 22, 2026, 1:50 AM UTC
- SHA-256
71198255210833a48f867ff477aa78c9f9dcc32fca76773d01870d7dac12afdb- SHA-1
d08789d6bf21d636e7141cb73101d5d68b9ea1ca- MD5
26ac27f2471fec432bb64833f9e67da3
About this file
gooncheese.zip is a ZIP file of 41.7 MB.
- Type and size
- ZIP · 41.7 MB
- Signer
- Not applicable
- First seen
- Jun 11, 2026On VirusTotal.
- Submitted by
- 27 distinct sources
First scanned
Antivirus consensus
0 of 65 engines flagged this file
10 of the 75 engines returned no result for this file (file type not supported, or the scan did not finish), so they did not check it.
- Tier-118 engines0flagged
- Tier-235 engines0flagged
- Low-trust12 engines0flagged
View all 75 engine results
- AcronisClean
- AhnLab-V3Clean
- AlibabaClean
- alibabacloudClean
- ALYacClean
- Antiy-AVLClean
- APEXNo result
- ArcabitClean
- AvastClean
- Avast-MobileClean
- AVGClean
- AviraClean
- BitDefenderClean
- BitDefenderFalxNo result
- BkavClean
- CAT-QuickHealClean
- ClamAVNo result
- CMCClean
- CrowdStrikeClean
- CTXClean
- CylanceNo result
- CynetClean
- DeepInstinctClean
- DrWebClean
- ElasticClean
- EmsisoftClean
- ESET-NOD32Clean
- F-SecureClean
- FortinetClean
- GDataClean
- GoogleClean
- GridinsoftClean
- huorongClean
- IkarusClean
- JiangminClean
- K7AntiVirusClean
- K7GWClean
- KasperskyClean
- KingsoftClean
- LionicClean
- MalwarebytesClean
- MaxSecureNo result
- McAfeeDClean
- MicrosoftClean
- MicroWorld-eScanClean
- NANO-AntivirusClean
- PaloaltoNo result
- PandaClean
- RisingClean
- SangforClean
- SentinelOneClean
- SkyhighClean
- SophosClean
- SUPERAntiSpywareClean
- SymantecClean
- SymantecMobileInsightNo result
- TACHYONClean
- tehtrisNo result
- TencentClean
- TrapmineNo result
- TrellixENSClean
- TrendMicroClean
- TrendMicro-HouseCallClean
- TrustlookNo result
- VaristClean
- VBA32Clean
- VIPREClean
- VirITClean
- ViRobotClean
- WebrootClean
- XcitiumClean
- YandexClean
- ZillyaClean
- ZoneAlarmClean
- ZonerClean
Signatures and behavior heuristics
Low-severity pattern matches — worth noting but not on their own cause for alarm.
VirusTotal's sandbox summary maps this run to MITRE T1055 (Process Injection), but no injected process of the sample's own was recorded (the analysis VM's own WMI adapter, crash handlers and Chrome updater are not counted). VirusTotal maps T1055 on about half of all files no engine flags, so the mapping alone is not evidence of injection.
EvidenceT1055 (sandbox MITRE mapping)
How widely this file has been seen
Moderate prevalence — neither rare nor common. No strong prior applies.
Chapter 05
Questions & answers
Short answers to the 6 questions people ask most about this file.
Is gooncheese.zip safe?
What is gooncheese.zip?
How many antivirus engines detected gooncheese.zip?
What is the SHA-256 hash of gooncheese.zip?
Is it safe to open or extract gooncheese.zip?
How up to date is this analysis of gooncheese.zip?
Community
Member reviews and reports for this exact file hash.