74405c6442cbf02e9d3792909e51cb345237f1f0818849f8873dabb79f528c19

Analysis

user interaction
yes
max time kernel
92s
max time network
66s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
24/10/2026, 10:20

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Tekken 3.exe
Size 26.3MB
Sample261024-mc49nahs6v
SHA256 74405c6442cbf02e9d3792909e51cb345237f1f0818849f8873dabb79f528c19
MD5 a030fec64e9416c2983e2038cec052c8
SHA1 123a81951628396da21b586f4b47626662df6b0d
SHA512 a5cf5907492340a1985127caa31fa94349912208832d4443e87f70c62e25f703c700e254b85e846a7e3ff2dce63752f57a78fd13af9133e736b394319a72205c
SSDEEP 786432:EKYwKdmclOTTckEKciA6dsNq1HFyLjOqzz:GdWTZPciA6dyeFyLj1zz
TLSH
T1FB573306B703C437EAAA16764C214BE84F31BDB1677DE1F79B807AADD9303D1943258A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution upx

Malware Config

Signatures

ACProtect 1.3x - 1.4x DLL software 2 IoCs

Detects file using ACProtect software.

resource	yara_rule
behavioral2/files/0x000c00000001c5a1-352.dat	acprotect
behavioral2/files/0x000c00000001c5d7-366.dat	acprotect

Executes dropped EXE 2 IoCs

pid	Process
3708	irsetup.exe
4552	ePSXe.exe

Loads dropped DLL 6 IoCs

pid	Process
3708	irsetup.exe
4552	ePSXe.exe
4552	ePSXe.exe
4552	ePSXe.exe
4552	ePSXe.exe
4552	ePSXe.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

UPX packed file 16 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/0x002100000001c4b3-4.dat	upx
behavioral2/memory/3708-10-0x0000000000E50000-0x0000000001237000-memory.dmp	upx
behavioral2/memory/3708-22-0x0000000000E50000-0x0000000001237000-memory.dmp	upx
behavioral2/memory/3708-28-0x0000000000E50000-0x0000000001237000-memory.dmp	upx
behavioral2/memory/3708-337-0x0000000000E50000-0x0000000001237000-memory.dmp	upx
behavioral2/memory/3708-341-0x0000000000E50000-0x0000000001237000-memory.dmp	upx
behavioral2/files/0x000d00000001c55f-345.dat	upx
behavioral2/memory/4552-346-0x0000000000400000-0x00000000008E4000-memory.dmp	upx
behavioral2/files/0x000c00000001c5a1-352.dat	upx
behavioral2/memory/4552-356-0x0000000003440000-0x000000000366F000-memory.dmp	upx
behavioral2/memory/4552-357-0x0000000003440000-0x000000000366F000-memory.dmp	upx
behavioral2/files/0x000c00000001c5d7-366.dat	upx
behavioral2/memory/4552-369-0x0000000004D80000-0x0000000004E4B000-memory.dmp	upx
behavioral2/memory/4552-386-0x0000000004D80000-0x0000000004E4B000-memory.dmp	upx
behavioral2/memory/4552-384-0x0000000000400000-0x00000000008E4000-memory.dmp	upx
behavioral2/memory/4552-387-0x0000000003440000-0x000000000366F000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Tekken 3\sstates\SLPM_866.00.000	irsetup.exe
File opened for modification	C:\Program Files (x86)\Tekken 3\plugins\cdrBarrett.dll	irsetup.exe
File created	C:\Program Files (x86)\Tekken 3\plugins\cdrSeguASPI.dll	irsetup.exe
File opened for modification	C:\Program Files (x86)\Tekken 3\plugins\cdrTsgMSCD.dll	irsetup.exe
File opened for modification	C:\Program Files (x86)\Tekken 3\plugins\gpuKazOpenGL.dll	irsetup.exe
File created	C:\Program Files (x86)\Tekken 3\plugins\subTsgMSCD32.dll	irsetup.exe
File created	C:\Program Files (x86)\Tekken 3\Uninstall\IRIMG1.JPG	irsetup.exe
File opened for modification	C:\Program Files (x86)\Tekken 3\plugins\cdrTrxASPI.dll	irsetup.exe
File opened for modification	C:\Program Files (x86)\Tekken 3\plugins\gpuDudSoft.dll	irsetup.exe
File opened for modification	C:\Program Files (x86)\Tekken 3\Uninstall\uni4F.tmp	irsetup.exe
File created	C:\Program Files (x86)\Tekken 3\sstates\SLPM_866.00.000.pic	irsetup.exe
File created	C:\Program Files (x86)\Tekken 3\plugins\padDIJoy.dll	irsetup.exe
File opened for modification	C:\Program Files (x86)\Tekken 3\plugins\padHellMM.dll	irsetup.exe
File created	C:\Program Files (x86)\Tekken 3\plugins\SmartIO.dll	irsetup.exe
File opened for modification	C:\Program Files (x86)\Tekken 3\plugins\spuEternalL.dll	irsetup.exe
File opened for modification	C:\Program Files (x86)\Tekken 3\plugins\gpuHellGDIP.dll	irsetup.exe
File opened for modification	C:\Program Files (x86)\Tekken 3\plugins\spuNull2Mixer.dll	irsetup.exe
File opened for modification	C:\Program Files (x86)\Tekken 3\plugins\gpuDemoHardOptimized.dll	irsetup.exe
File opened for modification	C:\Program Files (x86)\Tekken 3\snap\kill.me	irsetup.exe
File opened for modification	C:\Program Files (x86)\Tekken 3\sstates\SLPM_866.00.000.pic	irsetup.exe
File opened for modification	C:\Program Files (x86)\Tekken 3\Uninstall\uninstall.xml	irsetup.exe
File created	C:\Program Files (x86)\Tekken 3\plugins\cdrBarrett.dll	irsetup.exe
File created	C:\Program Files (x86)\Tekken 3\plugins\gpuKazOpenGL.dll	irsetup.exe
File created	C:\Program Files (x86)\Tekken 3\plugins\gpuNextGL_MMX.dll	irsetup.exe
File created	C:\Program Files (x86)\Tekken 3\plugins\gpuRecorder.dll	irsetup.exe
File created	C:\Program Files (x86)\Tekken 3\plugins\padHarakiri.dll	irsetup.exe
File opened for modification	C:\Program Files (x86)\Tekken 3\plugins\SmartIO2.cfg	irsetup.exe
File created	C:\Program Files (x86)\Tekken 3\plugins\spuAndy.dll	irsetup.exe
File opened for modification	C:\Program Files (x86)\Tekken 3\docs\ePSXe_sp.txt	irsetup.exe
File opened for modification	C:\Program Files (x86)\Tekken 3\plugins\spuIori.dll	irsetup.exe
File created	C:\Program Files (x86)\Tekken 3\plugins\padDudDIKeys.dll	irsetup.exe
File created	C:\Program Files (x86)\Tekken 3\plugins\padSeguDIJoy.dll	irsetup.exe
File created	C:\Program Files (x86)\Tekken 3\Tekken.bat	irsetup.exe
File opened for modification	C:\Program Files (x86)\Tekken 3\patches\erase.me	irsetup.exe
File created	C:\Program Files (x86)\Tekken 3\plugins\gpuTrxGlide.dll	irsetup.exe
File created	C:\Program Files (x86)\Tekken 3\plugins\gpu_fast.dll	irsetup.exe
File created	C:\Program Files (x86)\Tekken 3\plugins\padHellMM.dll	irsetup.exe
File opened for modification	C:\Program Files (x86)\Tekken 3\plugins\gpuRaw.dll	irsetup.exe
File created	C:\Program Files (x86)\Tekken 3\3xhumed-Mega-Games-Pack-25-Tekken-3-2.ico	irsetup.exe
File opened for modification	C:\Program Files (x86)\Tekken 3\ePSXe.exe	irsetup.exe
File opened for modification	C:\Program Files (x86)\Tekken 3\plugins\cdrXeven.dll	irsetup.exe
File created	C:\Program Files (x86)\Tekken 3\plugins\gpuImpactD3D.dll	irsetup.exe
File created	C:\Program Files (x86)\Tekken 3\bios\erase.me	irsetup.exe
File created	C:\Program Files (x86)\Tekken 3\memcards\epsxe000.mcr	irsetup.exe
File opened for modification	C:\Program Files (x86)\Tekken 3\plugins\gpuHellAR.dll	irsetup.exe
File opened for modification	C:\Program Files (x86)\Tekken 3\plugins\gpuNakSoft.dll	irsetup.exe
File opened for modification	C:\Program Files (x86)\Tekken 3\plugins\gpuNull.dll	irsetup.exe
File created	C:\Program Files (x86)\Tekken 3\plugins\spuIori.dll	irsetup.exe
File opened for modification	C:\Program Files (x86)\Tekken 3\plugins\AUDIOW32.DLL	irsetup.exe
File created	C:\Program Files (x86)\Tekken 3\plugins\cdrDudAspi.dll	irsetup.exe
File created	C:\Program Files (x86)\Tekken 3\plugins\cdrNull.dll	irsetup.exe
File created	C:\Program Files (x86)\Tekken 3\plugins\gpuDemoHardOptimized.dll	irsetup.exe
File opened for modification	C:\Program Files (x86)\Tekken 3\plugins\gpuNext3D.dll	irsetup.exe
File created	C:\Program Files (x86)\Tekken 3\Tekken.iso	irsetup.exe
File created	C:\Program Files (x86)\Tekken 3\plugins\spuPeopsDSound.dll	irsetup.exe
File opened for modification	C:\Program Files (x86)\Tekken 3\plugins\subTsgMSCD16.dll	irsetup.exe
File opened for modification	C:\Program Files (x86)\Tekken 3\plugins\gpuEZHsoft_nc.dll	irsetup.exe
File opened for modification	C:\Program Files (x86)\Tekken 3\plugins\padSeguDPP.dll	irsetup.exe
File created	C:\Program Files (x86)\Tekken 3\plugins\spuPeteMidas.dll	irsetup.exe
File opened for modification	C:\Program Files (x86)\Tekken 3\plugins\cdrDudAspi.dll	irsetup.exe
File created	C:\Program Files (x86)\Tekken 3\plugins\gpuGlide.dll	irsetup.exe
File opened for modification	C:\Program Files (x86)\Tekken 3\plugins\gpuImpactOGL.dll	irsetup.exe
File created	C:\Program Files (x86)\Tekken 3\plugins\gpuPeteOpenGL.dll	irsetup.exe
File opened for modification	C:\Program Files (x86)\Tekken 3\plugins\padHarakiri.dll	irsetup.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5388	cmd.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1492	4552	WerFault.exe	96

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regedit.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ePSXe.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Tekken 3.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	irsetup.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	svchost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	svchost.exe

Modifies registry class 6 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1CF1260C-4DD0-4ebb-811F-33C572699FDE}\Instance\	irsetup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3ADD1653-EB32-4cb0-BBD7-DFA0ABB5ACCA}\Instance\	irsetup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A0953C92-50DC-43bf-BE83-3742FED03C9C}\Instance\	irsetup.exe
Key created	\REGISTRY\USER\S-1-5-21-4057491610-3392471755-192832105-1000_Classes\Local Settings	irsetup.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-4057491610-3392471755-192832105-1000\{78A2FA54-9CB0-48ED-9413-93CCA104C25B}	svchost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	irsetup.exe

Runs .reg file with regedit 1 IoCs

pid	Process
2824	regedit.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4552	ePSXe.exe
4552	ePSXe.exe

Suspicious use of SetWindowsHookEx 7 IoCs

pid	Process
3708	irsetup.exe
3708	irsetup.exe
3708	irsetup.exe
4552	ePSXe.exe
3560	OpenWith.exe
4552	ePSXe.exe
4552	ePSXe.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1384 wrote to memory of 3708	1384	Tekken 3.exe	90
PID 3708 wrote to memory of 2824	3708	irsetup.exe	92
PID 5388 wrote to memory of 4552	5388	cmd.exe	96

C:\Users\Admin\AppData\Local\Temp\Tekken 3.exe
"C:\Users\Admin\AppData\Local\Temp\Tekken 3.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1384
- C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe
  "C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe" __IRAOFF:1948930 "__IRAFN:C:\Users\Admin\AppData\Local\Temp\Tekken 3.exe" "__IRCT:0" "__IRTSS:0" "__IRSID:S-1-5-21-4057491610-3392471755-192832105-1000"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3708
- - C:\Windows\SysWOW64\regedit.exe
    "regedit.exe" "C:\Program Files (x86)\Tekken 3\Tekken Register.reg"
    3⤵
    - System Location Discovery: System Language Discovery
    - Runs .reg file with regedit
    PID:2824

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Program Files (x86)\Tekken 3\Tekken.bat" "
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5388
- C:\Program Files (x86)\Tekken 3\ePSXe.exe
  ePSXe.exe -loadbin Tekken.iso -nogui
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  PID:4552
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4552 -s 1288
    3⤵
    - Program crash
    PID:1492

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:3560

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k BcastDVRUserService -s BcastDVRUserService
1⤵
- Checks processor information in registry
- Modifies registry class
PID:5756

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 4552 -ip 4552
1⤵
PID:5976

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Tekken Register.reg

Path C:\Program Files (x86)\Tekken 3\Tekken Register.reg
Size 975B
SHA256 dac0e2d79f77928eb3ea6f7bfb6e2fc54bb49333835e1cca6f3f0354a0c2a025
MD5 6d0b1c3ecf324266316725d5531ca127
SHA1 18d19c2a16f0c5cec9b15ea257c34ce95d0c7305
SHA512 311ba73d0d2f995b5e6e31bc022374568bd1d2ce4546f04bb88237d408c2502249031c7a035941b95fb814c0b647615e6d300ba56ca2b5b2d1285bf6d76bd1cf
TLSH
T12E11DCB4800029D962BFF39286D49953229C6327321B8A59279AB18B0F3F0DFF32453C
MD5 SHA1 SHA512 TLSH

Submit Download

Tekken.bat

Path C:\Program Files (x86)\Tekken 3\Tekken.bat
Size 36B
SHA256 e12f18391d126f79ca0702266bc40b0bb411b3bc5c6059f5baca74a97978d791
MD5 10a1456db164e63aeae86358f37a7499
SHA1 05e8ae1ad8935c7257085353b0bbdbde42053555
SHA512 3fccf3db842eb8f6e6c0fae8e001e796192fb0975577e64a5ab977d33986a29f6a7a88e2e1e98cbf1e1e60204b36fb50b07d1c046d997a6187e96af6e75b967f
MD5 SHA1 SHA512

Submit Download

Tekken.iso

Path C:\Program Files (x86)\Tekken 3\Tekken.iso
Size 43.0MB
SHA256 0f059c80b9477940f3bca0be680caae4497d0c71d74a7876f6fef5879bfd9813
MD5 e1cd804832603c904b388f85598f45b8
SHA1 e4f86a977fe34e2cf199094b747feb266dfc15ce
SHA512 f2c96c9039059ba09b01063875c0944eba6e522ced98ae470c6090c52d73c62dbf598b5a9b3379ad18e2c5f4d1479f0ea3850bd242430731fbd83a80a1e5ab66
SSDEEP 786432:d6s3SU2xNLq1YbBEQIbVMES6xy4Bcft0bP2iPCmLcFYmtAlGDSW9DhpSRNuILR4Q:dfShiQMq+
TLSH
T18FA7BE02B552DAC3ECED12354CA295986310BC19DF4187E37D62B73EB9B32D09E2179B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

uninstall.xml

Path C:\Program Files (x86)\Tekken 3\Uninstall\uninstall.xml
Size 29KB
SHA256 e77049f9a5658328b8ce41db1bb206ea4294d877df52853a7b9a181c269d27c3
MD5 cb8a3cb81b807b370a1f2c751db546d9
SHA1 c665d79a9371dfe6eb2f8ad9dae98668e448b5b5
SHA512 a13c9c927e4de855197c5f63461a86341b2e89eac31fec9847f2b204ed76cd2703b79eddb6b612666a01d1cea45e719ae4719e0877811055b984bcefc61664cc
SSDEEP 192:eZVFHLVFHpVFHioVFHDVFH9VFHRVFHlVFHOVFHVVFH+VFHmVFH5VFHZVFH4VFHGW:aezdck0GG
TLSH
T156D2C82CD89CDD5B9ED9B6FB35C0393C5C12C29916A60492C291C1CB8AD3871B9F6FB4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

uninstall.xml

Path C:\Program Files (x86)\Tekken 3\Uninstall\uninstall.xml
Size 35KB
SHA256 39d140f06066c847acb0b6d4cc39a297c10a6b929ccf94d222e954c6c8f1a6ba
MD5 4b433b2a28e9d5f74a1d36fef31beefa
SHA1 9c6f596f0bd32414fbb42c535632a763ac2994ef
SHA512 d55452f33c3d97bff7301aa0cf3b23f5588cf4428652f0833d9f64b740046f13b073c107d008aa75456102cb4f94f95de4fe5b4f7a3b4303ac80e7426391e07f
SSDEEP 192:eoVFHLVFHpVFHioVFHDVFH9VFHRVFHlVFHOVFHVVFH+VFHmVFH5VFHZVFH4VFHGl:/ezdck0Gn8Cf
TLSH
T113F2092CD8DCDE6BAED5B5FB35C0392C1C12C29916A10492C2A1C18B96C3971B9F6FF5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

scph1001.bin

Path C:\Program Files (x86)\Tekken 3\bios\scph1001.bin
Size 512KB
SHA256 71af94d1e47a68c11e8fdb9f8368040601514a42a5a399cda48c7d3bff1e99d3
MD5 924e392ed05558ffdb115408c263dccf
SHA1 10155d8d6e6e832d6ea66db9bc098321fb5e8ebf
SHA512 ea097d56a3a6fa41e23908fbf73fab555c951059280d229815a15d79a168285c4bf993c8be43275912c2eccd40a0c76c797a95c13e82d532e0d48aaba6597430
SSDEEP 6144:zwVEUh2bpsPvayTPW1r9kGl5qpDVRVYsxaaxaeMzi71+3zsrgUc+i1:Mabp2akPYkGOnOGZ+3zsrlW1
TLSH
T135B46C03B5D38D15FC3A5F3085A61B90C6F54D0559A063EB126CB26CAFB71A18F93EE8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

burutter.dll

Path C:\Program Files (x86)\Tekken 3\burutter.dll
Size 28KB
SHA256 d8cc111a51ffbbb0ea9c15375ff998392d16df3adeb85a26ce00dc5e7111cee1
MD5 9701637f8473975e7a8472d462b32cc5
SHA1 85a7b135834c3f47a71b84ed9e005b8fbfb68572
SHA512 f6b6c557ca5c4bf020c76bde718497f9f5223593d5a38fb83296861436851065629c66ef132ddfa4367a635f77a2096e7c9c6dceb15c262fa556fdc3d8b3c8fe
SSDEEP 384:nd9bjxxTx7ucskhnRCml4L6yX7gSa7oIo92m:nrNxTxiXmnRxAasIo92
TLSH
T127D25CA179C141B3E25980317DF6271B69FE2C5109E404938FF0AD9B2F35296BA2FB17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ePSXe.exe

Path C:\Program Files (x86)\Tekken 3\ePSXe.exe
Size 158KB
SHA256 f2f635dfb6c97aa02a653c435726c908860163e48a834ff6606f5450686ffe18
MD5 861fe2f10e899afadd5a806a80611c2b
SHA1 5b374e343858e2061eb909036f13578ee321ef9c
SHA512 2065512ee9c3b2644a55647b22bff6b3bcb8cdd0dc9d84ad052f57d39495fc61fc64c023901b09f1ab0222b91291730fc7f0cf25bfcaca1a759865ea9e2265b5
SSDEEP 3072:SH2jSyjn7JHWB7wjKlVQgJgPIsl3a43vDmdze0Uo3:SWu6JWBxVAwslq43ydi0Uo3
TLSH
T158F312CA37DA1E2AD31A0A704B03476A6104B11E271BA373E7F8C39C6EF776575904AC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

erase.me

Path C:\Program Files (x86)\Tekken 3\patches\erase.me
Size 25B
SHA256 5fdaaf58ab8eb5cb7c00fd1a261af2221f6805aa191d8541dbeecbc57a27d99b
MD5 47295ab66edd6cb81e19148f68b9e3ea
SHA1 4349f8178595b3afe443c487f01b189437360870
SHA512 a82024bc55e9e1ca8ccf1c3c30fd7890331904f69b36419773d99920aa58a8245b62107baa89ab90b05174e786283aafc322b44b44d7dfb920d36b5794c7db1c
MD5 SHA1 SHA512

Submit Download

D3D.CFG

Path C:\Program Files (x86)\Tekken 3\plugins\D3D.CFG
Size 216B
SHA256 1444f55aeb0b112e8458700a6bd2398264edf2f04daccf61b12e390e3808b091
MD5 a8cce884f71590fb35f5f34894f006d5
SHA1 4bdf4106d2ecefbff88ebe3222d644a6bc467692
SHA512 682f1cc0672b9a5d139e75a63c9c2a0c1e878ee8395a9d0968d1ad8eb3031b9a49af0c53956fff9ea996f29c6cc6a9a96bcffed45a61f85c43bc3c19612434ff
TLSH
T118D002A5F3414491D190F130454E0B55E3A4CC2011AB1757DC45377C8DA5344E9974A7
MD5 SHA1 SHA512 TLSH

Submit Download

gpuImpactD3D.dll

Path C:\Program Files (x86)\Tekken 3\plugins\gpuImpactD3D.dll
Size 57KB
SHA256 29f24e5f4f2df06ba152dde04500817530c5b80c730a9fafce09a3bb04eda641
MD5 9dc5dc370dbc5b49a0cf2fd3b72207c7
SHA1 12eec3c7596ec99288ed02e24908804fd3c38d0f
SHA512 0f155bd6fa7a3058a4a2d75c7e84f56bc3531b865b164ad30cbdf4cea293c3023a6f64758e21dfa5166a7b158324eb55d382f28bc9abc5725fee258e92fbb8f1
SSDEEP 768:FpgR/jeiNHsGvnZeFl0Y7jLBR3aO/aVBfwPJvcSadwZQqZPcjCUdpkgD4OMr8Kc7:7gRrZNbn6++RwGiSIuZMTd+CMBcv7ae
TLSH
T1AD43025E93E45C87CC6B2A70963E4E49A050E1378527DFEE435DE10E9EB4FB01836E64
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

spuEternal.dll

Path C:\Program Files (x86)\Tekken 3\plugins\spuEternal.dll
Size 21KB
SHA256 f915c37f5e4427bcc0198f1544aab9311da8bfe6d87e1628e06131140e16f1ba
MD5 0ba8441737057c5b14ccddf155d50a87
SHA1 1dabfeff44dd0f5a744c4fdcc7be2d692926495e
SHA512 e6e741bfadd5bf612bd1467f06ded5c836cd61c1ab3139a7fa4bf9d8ce5c9349c08def1a6195223fa3b3cdb71cfb1a7a13a3dcf630e6951939dcfa70102e3c39
SSDEEP 384:u6VlfPrKTgdBYcAvxK11IsQhIAKf8MxaDWCwhCMRauMBSOE:u0fPGMccSK1eISMxbCwMTfE
TLSH
T1D6A2C153B2EC0956FA2A213F155381329227B653D296C6578C6C925FF97FB10AC1CF2C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IRIMG1.JPG

Path C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\IRIMG1.JPG
Size 3KB
SHA256 b701ec39ccb465f39b99adc2d9e5464cdeff36cea6037a9fe611454df2f93c84
MD5 1c3910e33cfa34b42758e38b11bcfa6e
SHA1 2d8e1d12e42f6959aaca634de4771c4f6c2a78de
SHA512 d37c29b2a75328dc085bce18886fb057308dfbe452eb250af6e4a64d6d1d596284a10f646db12a4d22d8090bdfc5933dcd072def777d75c9f77a88299384148c
TLSH
T1BF6180880FC9A8414F073DBAE9115535909193419F008E303573B7B1D421DFDEBD7565
MD5 SHA1 SHA512 TLSH

Submit Download

IRIMG2.JPG

Path C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\IRIMG2.JPG
Size 559KB
SHA256 c36342c3f87bda6085dfdee3e558c552f733f2c5e774980370dd1a8ac7e3a813
MD5 ea9e1f817887a5718d5ac706aee71e1c
SHA1 0584f519246e37129369a3f99479c09b093420a9
SHA512 606216d2608426888349cb90262b7fbe1cf0c68c4812b7088c6595ccfb04d488c38073bcb90da1e05f49f9ed6825857a16b788eb498aa349fdbeb96747be4a38
SSDEEP 6144:gequwWvJ/IV13U1RIw47cteS4o6dfXHB11iT0BoTyNATQF1CUye0iaPKaMa4/oyI:HElE1RE7Pzxn8T/yCTyJaS1n2fqQ
TLSH
T100C4010E61D38CD6DB91D73218E6DF3E85E4DD12ACA1EA1172FA3D5C31F79809A43229
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

irsetup.exe

Path C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\irsetup.exe
Size 1.3MB
SHA256 b15d67b4a57184e5202df3c25e20dc0b7f853f4d527d148b337138900989824a
MD5 9bdcf813d65265255b820bc7a704da3c
SHA1 dad6501711992ab874d778ece5a103e143fd42d7
SHA512 53cac68a57194ec33ccc5c212a6b82bc554e85c86faab4e095876f5c037f680c646ce8463857e61438b92cb7ca7c17efea1d713a9d772d9f2afeb5ddd17b6504
SSDEEP 24576:zzC25QqJNUXIaRks5D8hYm0bXixegr1+sIG6byK7ki6Nrimo8BiGxnJgYQp1:fC2lJmXbj5DIwbQea1LPEyK7r385JD
TLSH
T13E553353832B447BE8C91B72044B894B6F3BBC15F95D705B23EBBA936CB51338676488
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

lua5.1.dll

Path C:\Users\Admin\AppData\Local\Temp\_ir_sf_temp_0\lua5.1.dll
Size 322KB
SHA256 769416fa7edf38e91a55f4f7163914ee4aad9c8c890ed641c300b73157acac45
MD5 c3f5f4a1fb69b5889f0bbb313cf6017f
SHA1 e4f592cfbd62a3c3caf27177ccea5a77afa649bb
SHA512 e17d3be36fd2ba892d945f3737ebffdefe6d476224ef3459b567579971559a048a886941f57ae671b3df32844f99575a14c72ef8c49c2d4b1e8352204ccc05ab
SSDEEP 6144:+kn2LG5bwf92+0HiDhAqUS0aMkhwfDRAOj+JzOg7Fp:72x2cdUhZcIDR8xhp
TLSH
T18E64AE03B293C072D5A500B90569D7BA4E7A797157B6C4F7EBD01AAD8E203E0A73734E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

desktop.ini

Path C:\Users\Admin\Videos\Captures\desktop.ini
Size 190B
SHA256 86d9f822aeb989755fac82929e8db369b3f5f04117ef96fd76e3d5f920a501d2
MD5 b0d27eaec71f1cd73b015f5ceeb15f9d
SHA1 62264f8b5c2f5034a1e4143df6e8c787165fbc2f
SHA512 7b5c9783a0a14b600b156825639d24cbbc000f5066c48ce9fecc195255603fc55129aaaca336d7ce6ad4e941d5492b756562f2c7a1d151fcfc2dabac76f3946c
TLSH
T11EC0121892F93224A1728D12BD7460119AB1F4217C16CA9D1380508F08A1601E631B53
MD5 SHA1 SHA512 TLSH

Submit Download

memory/3708-341-0x0000000000E50000-0x0000000001237000-memory.dmp

Download

memory/3708-22-0x0000000000E50000-0x0000000001237000-memory.dmp

Download

memory/3708-28-0x0000000000E50000-0x0000000001237000-memory.dmp

Download

memory/3708-10-0x0000000000E50000-0x0000000001237000-memory.dmp

Download

memory/3708-337-0x0000000000E50000-0x0000000001237000-memory.dmp

Download

memory/4552-356-0x0000000003440000-0x000000000366F000-memory.dmp

Download

memory/4552-357-0x0000000003440000-0x000000000366F000-memory.dmp

Download

memory/4552-369-0x0000000004D80000-0x0000000004E4B000-memory.dmp

Download

memory/4552-346-0x0000000000400000-0x00000000008E4000-memory.dmp

Download

memory/4552-386-0x0000000004D80000-0x0000000004E4B000-memory.dmp

Download

memory/4552-384-0x0000000000400000-0x00000000008E4000-memory.dmp

Download

memory/4552-387-0x0000000003440000-0x000000000366F000-memory.dmp

Download