Program file

UnityPlayer.dll: the Unity engine in your game folder, or a planted copy?

UnityPlayer.dll is the Unity engine, a library that every Windows game made with Unity ships next to its own .exe. A copy in a game you installed from a store is normal. Because a signed Unity game .exe loads whatever UnityPlayer.dll sits beside it, attackers have planted fake copies to start malware, so a copy anywhere else needs checking.

By 2-Spyware Editorial TeamPublished Oct 17, 2026

Prefer to check it yourself? The manual checks follow.

Unity engine: safe in a game's install folder

A UnityPlayer.dll in the install folder of a game or app you installed, next to that program's .exe and a <game>_Data folder, and signed by Unity Technologies ApS, is the genuine engine. It is not a process: the game's .exe loads it, so in Task Manager you see the game, not the DLL. Every Unity game has its own copy, so finding many of them is expected.

A Unity game's .exe trusts the UnityPlayer.dll in its own folder. A copy in Temp, AppData, Downloads or a folder you did not install, next to an .exe with a game's or another program's name, can be a malicious loader that uses the signed .exe to start itself.

Publisher: Unity Technologies ApS (the engine), shipped by each game's developer
Description in the file: Unity playback engine. Many genuine copies leave the company and description fields empty: 10 of the 11 copies in a public DLL catalogue do
Shipped by: Every Windows game or app built with Unity, in its own install folder, in the Unity release it was made with. 32-bit and 64-bit builds use the same file name
Genuine folder: The game's install folder, next to its .exe, UnityCrashHandler64.exe or UnityCrashHandler32.exe and a <game>_Data folder, for example under steamapps\common\<game>. Never in C:\Windows
Size: Large for a DLL: about 16 MB to 40 MB across the 11 copies collected in a public DLL catalogue
Signed by: Unity Technologies ApS, Copenhagen, with a DigiCert code signing certificate (check the signature; a planted loader does not carry it)
Runs as a process: No. It is a library loaded into the game or app that uses it
Abused for: DLL sideloading: a malicious file under this name next to a genuine, signed Unity .exe

What UnityPlayer.dll does

UnityPlayer.dll holds all of the native code of the Unity engine: drawing, sound, physics, input and the loading of the game's content. Unity's manual describes a Windows build as a small .exe that starts the game, UnityPlayer.dll with the engine, signed with the Unity Technologies certificate so it can be verified, and a <game>_Data folder with the game itself. The developer ships these files together, which is why every Unity game has its own copy in its own version.

The design has one weak point. The .exe of a Unity game is small, signed and does little more than load the UnityPlayer.dll from its own folder. Anyone who copies that .exe to another folder and puts a different UnityPlayer.dll next to it gets a trusted program that starts their code. This is called DLL sideloading. HijackLibs, a public list of such cases, records UnityPlayer.dll with the game executable KingdomTwoCrowns.exe as one example, and Sophos documented the technique in a real campaign.

About .dll files. A .dll file is a library: it cannot run on its own and is loaded into a program's process. It does not appear in Task Manager under its own name; Process Explorer shows which process loaded it.

How a planted UnityPlayer.dll next to a genuine signed Unity game executable gets loaded and starts malware — The .exe is genuine and signed; the UnityPlayer.dll next to it decides what runs.

How to check a copy of UnityPlayer.dll

Four questions decide it: where the file is, which .exe sits next to it, who signed it, and how big it is. A library never shows in Task Manager under its own name, so use these checks.

List every copy and where it sits. Copies inside the install folders of games and apps you installed are normal, one per Unity program. Look closer at copies in Downloads, Desktop, Temp, AppData or C:\Users\Public, and in any folder that has an .exe but no <game>_Data folder next to it.
```
Get-ChildItem -Path C:\ -Filter UnityPlayer.dll -Recurse -ErrorAction SilentlyContinue | Select-Object FullName, Length, LastWriteTime
```
Check the digital signature. Status Valid with Unity Technologies ApS as the signer means an unmodified Unity build. NotSigned, HashMismatch or another signer mean the file is not Unity's, whatever its name and version say.
```
Get-AuthenticodeSignature "C:\path\to\UnityPlayer.dll" | Format-List Status, SignerCertificate
```
Look at the .exe next to it. A genuine copy sits beside the .exe of the game it belongs to, together with UnityCrashHandler and a <game>_Data folder. A lone .exe with a game's name, or with an unrelated name, in a folder you never installed, next to a UnityPlayer.dll and an extra data or text file, is the pattern of a sideloading package.
Compare the size and checksum. Use the file check on this page. The engine is tens of megabytes; the copies in the public catalogue range from about 16 MB to 40 MB. A file far below that size cannot be the whole engine. A match identifies a known copy; no match is not proof of a fake, because most Unity builds are not listed. The signature check is the deciding one.

A valid Unity signature clears that one file. It says nothing about the .exe, installer or other files next to it, and in a sideloading package the .exe is genuine too: the danger is the other files in the folder and how they got there.

Four checks that tell Unity's genuine UnityPlayer.dll from a planted copy: folder, signature, neighbours and size — The folder and the Unity signature decide; a name and a version can be copied.

Check your unityplayer.dll

Choose the unityplayer.dll you are unsure about. Its SHA-256 and SHA-1 checksums are calculated in your browser and compared with the 11 versions of the file known from a public DLL catalogue.

or drop the file here

The file stays on your computer. Nothing is uploaded: the checksum is computed locally.

Do you need UnityPlayer.dll?

Keep every copy inside the games and apps you installed: without it they do not start. A copy that failed the checks above did not come with a program you chose, and the safe way out is to remove the whole folder it came in and scan the PC, not only to delete the DLL.

Leave installed Unity games alone. A copy in a game's install folder belongs to that game. If it is damaged or flagged, the game's store or launcher restores the right copy; deleting it only stops the game from starting.
Uninstall a program you do not recognise. Open Settings, Apps, Installed apps, find the program the folder belongs to and uninstall it. A sideloading package often has no entry there: then note the folder's path and delete the whole folder after the scan, not only UnityPlayer.dll.
Run a Microsoft Defender full scan. Open Windows Security, Virus and threat protection, Scan options, Full scan. Quarantine what it finds. Look at Protection history afterwards for anything found in Downloads, Temp, AppData or C:\Users\Public.
Run the offline scan. Some malware hides while Windows runs. The offline scan restarts the PC and scans before Windows starts. It takes about 15 minutes.
```
Start-MpWDOScan
```
Check what starts with Windows. Open Task Manager, Startup apps, and Task Scheduler. A sideloading package needs a way to start again, so disable and remove entries that run an .exe from AppData, ProgramData, Temp or C:\Users\Public that you do not recognise, after the scan.
Change passwords and secure crypto wallets if the file was malicious. The campaign documented with this file aimed at stealing cryptocurrency wallets. From another, clean device, change the passwords of your email and important accounts, and move funds from any wallet that was used on the PC to a new wallet.

Warning signs

What you see	What it means
UnityPlayer.dll in Temp, AppData, Downloads or C:\Users\Public	No installed game loads it there. Find out where it came from and scan.
An .exe and UnityPlayer.dll in a folder with no <game>_Data folder	Not a complete Unity game. The pattern of a sideloading package that borrows a signed .exe.
The signature check shows NotSigned, HashMismatch or another signer	The file is not an unmodified Unity build.
A UnityPlayer.dll of less than a few megabytes	Far too small to be the engine. Treat it as a loader and scan.
The folder appeared after installing a messaging app, VPN or other tool from an unofficial site	The lure used in the documented campaign. Remove the program and scan.
Many copies, each in the install folder of a game or app you installed	Normal. Every Unity program ships its own copy.

Documented abuse of UnityPlayer.dll

Security researchers have documented UnityPlayer.dll being replaced by a malicious file and loaded through a genuine, signed Unity executable.

Malware	How it used the file	Source
Dragon Breath, also called APT-Q-27 or Golden Eye Dog	Trojanized installers for Telegram, LetsVPN and WhatsApp started a chain of clean programs; one second-stage loader was a Unity player whose dependency UnityPlayer.dll was replaced with a malicious loader DLL that decrypted the next stage. The payloads aimed at cryptocurrency wallet theft. Targets were Chinese-speaking Windows users engaged in online gambling.	Sophos X-Ops, 3 May 2023

The signed .exe proves nothing about the DLL next to it. Judge the UnityPlayer.dll by its own signature and by the folder it is in.

Programs that have been made to load a fake unityplayer.dll

Each program below is genuine and signed, and security researchers have documented that it can be made to load a planted unityplayer.dll. Usually the attacker copies the program into another folder and puts a fake unityplayer.dll next to it: Windows looks in the program's own folder first. A unityplayer.dll next to one of these programs, outside the folders below, is the copy to check.

Where the genuine unityplayer.dll belongs: C:\Users\<you>\AppData\Local\Temp\<version>\Windows

The genuine unityplayer.dll is signed by: Unity Technologies ApS, a signature in the file itself (Properties, Digital Signatures)

Program	How
`KingdomTwoCrowns.exe` SHA-256 of the genuine program: `03b1df2b08999262c772b67a7bd65e9e8f6058036b5e7a382f06d3aa672854d0`	Side-loading

Source: the HijackLibs entry for unityplayer.dll, 1 public report.

Known versions of unityplayer.dll

A public DLL catalogue lists 11 versions of unityplayer.dll, from 5.6.0.0 to 2019.4.7.37553, by Unknown. Its copies are uploaded by users and not verified, so a checksum match identifies the version, while the digital signature tells you whether the file is genuine. Even a genuine file clears only the file, not the folder: attackers ship genuine libraries next to a program they abuse, so where the copy sits still decides whether it is safe.

Every version with its checksums, and how to fix unityplayer.dll errors on uGetFix

Questions people ask

Is UnityPlayer.dll a virus?

No. The genuine UnityPlayer.dll is the Unity engine, and every Unity game ships it in its own install folder. Attackers have used the name, though: they put a malicious UnityPlayer.dll next to a genuine Unity .exe so the trusted program loads their code. A copy in a game you installed, signed by Unity Technologies ApS, is the real file. A copy anywhere else needs the checks on this page.

Why is UnityPlayer.dll flagged in a game I bought?

Some detections hit genuine engine files, especially right after an update of detection rules. Check the signature: a valid Unity Technologies ApS signature on a file inside the game's install folder means it is the real engine and the detection is likely false. Report it to the maker of your security program, and let the game's launcher restore the file through its verify or repair command.

How can I tell Unity's UnityPlayer.dll from a planted one?

Check four things. The folder: an install folder of a game you chose, with a <game>_Data folder next to the .exe. The signature: Get-AuthenticodeSignature should show Valid and Unity Technologies ApS. The size: the engine is tens of megabytes, so a small file under this name is not it. And the neighbours: an extra encrypted data or text file next to a lone .exe is a warning sign.

What is DLL sideloading with UnityPlayer.dll?

A Unity game's .exe is signed and loads the UnityPlayer.dll from its own folder without checking who made it. An attacker copies that genuine .exe into a folder of their choice, puts a malicious file named UnityPlayer.dll next to it and starts the .exe. Security tools see a signed program, while the code that runs is the attacker's. Sophos documented exactly this in 2023.

Can I delete UnityPlayer.dll?

You can, but the game it belongs to stops starting, because every Unity game loads it at start-up. Deleting it from an installed game gains nothing. If you found it outside any game folder, or in a folder you do not recognise, delete that whole folder after a Microsoft Defender full scan, and check Startup apps and Task Scheduler for what started it.

Why are there so many copies of UnityPlayer.dll on my PC?

Each Windows game or app built with Unity ships its own copy, in the Unity release it was made with, so ten installed Unity games can mean ten copies of different sizes and versions. That is by design. What matters is that each copy sits in the install folder of a program you chose and carries Unity's signature, not how many there are.

Does a Unity game need the Unity Editor or Unity Hub installed?

No. A Unity game carries the whole engine in UnityPlayer.dll and the files next to it, so it runs without any Unity software installed. The Unity Editor and Unity Hub are tools for developers. A UnityPlayer.dll found outside a game's or an app's install folder is therefore not explained by having Unity installed, and it deserves the checks on this page.

Sources

Version data read on Oct 17, 2026.

Questions and experiences

Ask about this page: members and our editors answer. Reading is open; writing needs a free account.

0 comments

…

5,584 members already hereReading, writing, commenting and voting. 0 verified · 309 joined this year

All members Join