24:I[7638,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/136wug8odqdqr.js"],"SampleDetailWrapper"] 3c:I[27201,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 23:T433,{"@context":"https://schema.org","@type":"TechArticle","headline":"Suspicious Sample a94f8bc24901… — Score 35/100 — Hybrid Analysis","description":"Suspicious verdict for sample a94f8bc24901…. Threat score 35/100. 0/24 AV engines flagged this file. 1 malicious and 12 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/a94f8bc24901e6d52b03c79342b6ff38c7b5e486fd109d7cd1327c76f5604936","keywords":["Suspicious","malware analysis","sandbox report","threat intelligence","a94f8bc24901e6d52b03c79342b6ff38c7b5e486fd109d7cd1327c76f5604936"],"about":{"@type":"SoftwareApplication","name":"Tekken3Recomp.exe","applicationCategory":["peexe","64bits","executable"],"identifier":"a94f8bc24901e6d52b03c79342b6ff38c7b5e486fd109d7cd1327c76f5604936","additionalType":"Suspicious sample"},"threatScore":35,"antivirusDetections":{"malicious":0,"total":24},"behavioralIndicators":{"malicious":1,"suspicious":12},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}25:T81c,Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; File: "Tekken3Recomp.exe") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; File: "Tekken3Recomp.exe") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; File: "Tekken3Recomp.exe") Found reference to API "SetWaitableTimer" (Indicator: "SetWaitableTimer"; File: "Tekken3Recomp.exe") Found reference to API "QueryPerformanceFrequency" (Indicator: "QueryPerformanceFrequency"; File: "Tekken3Recomp.exe") Found reference to API "WaitForMultipleObjects" (Indicator: "WaitForMultipleObjects"; File: "Tekken3Recomp.exe") Found reference to API "GetTickCount64" (Indicator: "GetTickCount64"; File: "Tekken3Recomp.exe") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObject"; File: "Tekken3Recomp.exe") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObjectEx"; File: "Tekken3Recomp.exe") Found reference to API "SetTimer" (Indicator: "SetTimer"; File: "Tekken3Recomp.exe") Found reference to API "MsgWaitForMultipleObjects" (Indicator: "WaitForMultipleObjects"; File: "Tekken3Recomp.exe") Found reference to API "hid_write/WaitForSingleObject" (Indicator: "WaitForSingleObject"; File: "Tekken3Recomp.exe") Found reference to API "hid_write/WaitForSingleObject" (Indicator: "WaitForSingleObject"; Source: "00000000-00000584.00000000.95771.7A93C000.00000002.mdmp") Found reference to API "SetWaitableTimerEx" (Indicator: "SetWaitableTimer"; Source: "00000000-00000584.00000000.95771.7A93C000.00000002.mdmp") Found reference to API "SetWaitableTimer" (Indicator: "SetWaitableTimer"; Source: "00000000-00000584.00000000.95771.7A93C000.00000002.mdmp") Found reference to API "WaitForSingleObject(hProcess) returned WAIT_FAILED" (Indicator: "WaitForSingleObject"; Source: "00000000-00000584.00000000.95771.7A93C000.00000002.mdmp") Found reference to API "GetTickCount64" (Indicator: "GetTickCount64"; Source: "00000000-00000584.00000000.95771.7A93C000.00000002.mdmp")26:T498,Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; File: "Tekken3Recomp.exe") Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; File: "Tekken3Recomp.exe") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; File: "Tekken3Recomp.exe") Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; File: "Tekken3Recomp.exe") Found reference to API "SDL_Vulkan_LoadLibrary failed (no Vulkan ICD?)" (Indicator: "LoadLibrary"; Source: "00000000-00000584.00000000.95771.7A93C000.00000002.mdmp") Found reference to API "LoadLibrary(%s) failed: %lu" (Indicator: "LoadLibrary"; Source: "00000000-00000584.00000000.95771.7A93C000.00000002.mdmp") Found reference to API "SDL_Vulkan_LoadLibrary failed" (Indicator: "LoadLibrary"; Source: "00000000-00000584.00000000.95771.7A93C000.00000002.mdmp") Found reference to API "Vulkan: SDL_Vulkan_LoadLibrary failed!" (Indicator: "LoadLibrary"; Source: "00000000-00000584.00000000.95771.7A93C000.00000002.mdmp") Found reference to API "SDL_EGL_LoadLibraryOnly() has not been called or has failed." (Indicator: "LoadLibrary"; Source: "00000000-00000584.00000000.95771.7A93C000.00000002.mdmp")27:T2a4b,"Tekken3Recomp.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00000584) "Tekken3Recomp.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f000002000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000c42927a4d825000000000000000000000000000000000000000000000000000020a7ad7bfe7f000000009d9afe7f0000d8a2af7bfe7f000000000000000000000000ad7bfe7f00000000000000000000b2c8398bfe7f000085a9a799fe7f0000000000000000000000000000000000009a5ed39b5bd5000000000000000000000000ad7bfe7f0000010000000000000001000000000000000c6d9f9afe7f00000000000000000000fe819f9afe7f0000d8a2af7bfe7f0000901a9f9afe7f000044004600 (UID: 00000000-00000584) "Tekken3Recomp.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f000002000000000000000050d34a7000000002000000000000000100000007000000400e247ca601000085aaaa99fe7f000048000000000000000100000070000000000000000000000000000000000000000000000000000000000000000000000000000000000000000050d34a700000003400000000000000d08edf4e7000000050c4327ca6010000b5bf6c99fe7f00000000000000000000d08edf4e7000000050c4327ca6010000b5bf6c99fe7f000000000000000000000000000000000000000000000000000001000000000000009a8bdf4e700000002d000000000000002d000000000000009b000000000000009a8bdf4e700000002d0000002e000000d08b387c (UID: 00000000-00000584) "Tekken3Recomp.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f000002000000000000000000000000000000020000000000000060bc357ca60100003f00030001000000030000000000000000000000000000000000000000000000020000000000000080c2357ca60100003f000300010000000300000000000000000000000000000000000000000000000200000000000000c0bb357ca601000050c4327ca6010000b5bf6c99fe7f00000000000000000000d08edf4e7000000050c4327ca6010000b5bf6c99fe7f000000000000000000000000000000000000000000000000000001000000000000009a8bdf4e700000002d000000000000002d000000000000009b000000000000009a8bdf4e700000002d0000002e000000d08b387c (UID: 00000000-00000584) "Tekken3Recomp.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f000002000000000000000000000000000000020000000000000040be357ca60100003f00030001000000030000000000000000000000000000000000000000000000020000000000000060be357ca60100003f00030001000000030000000000000000000000000000000000000000000000020000000000000060c0357ca601000050c4327ca6010000b5bf6c99fe7f00000000000000000000d08edf4e7000000050c4327ca6010000b5bf6c99fe7f000000000000000000000000000000000000000000000000000001000000000000009a8bdf4e700000002d000000000000002d000000000000009b000000000000009a8bdf4e700000002d0000002e000000d08b387c (UID: 00000000-00000584) "Tekken3Recomp.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f000002000000000000000000000000000000020000000000000040c1357ca60100003f00030001000000030000000000000056d4714f11a3000000000000000000000000000000000000a08bdf4e700000004091df4e70000000118edf4e700000000000000000000000608bdf4e70000000708adf4e70000000fca0ff9afe7f000050c4327ca6010000b5bf6c99fe7f0000608bdf4e70000000d08edf4e7000000050c4327ca6010000b5bf6c99fe7f0000638bdf4e700000000000000000000000608bdf4e7000000042000000000000009a8bdf4e700000002d00000000000000008cdf4e7000000061a0ff9afe7f000002000000000000000000000000000000d08b387c (UID: 00000000-00000584) "Tekken3Recomp.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f000002000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000842427a4d82500000000000000000000a08bdf4e70000000e4030000000000007891df4e700000000000000000000000008cdf4e (UID: 00000000-00000584) "Tekken3Recomp.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f000002000000000000000050d34a7000000002000000000000000100000000000000042427a4d825000085aaaa99fe7f0000480000000000000001000000fe7f0000000000000000000000000000000000000000000000000000000000000000000000000000000000000050d34a700000003c00000000000000d08edf4e7000000050c4327ca6010000b5bf6c99fe7f00000000000000000000d08edf4e7000000050c4327ca6010000b5bf6c99fe7f00000000000000000000000000000000000000000000000000000100000000000000988bdf4e700000002c000000000000002c000000000000009c00000000000000988bdf4e700000002c0000002d000000508c387c (UID: 00000000-00000584) "Tekken3Recomp.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f000002000000000000000050d34a7000000002000000000000000100000000000000042427a4d825000085aaaa99fe7f000056d4714f11a3000001000000fe7f00000000000000000000a08bdf4e700000004091df4e70000000118edf4e700000000000000000000000608bdf4e70000000708adf4e70000000fca0ff9afe7f000050c4327ca6010000b5bf6c99fe7f0000608bdf4e70000000d08edf4e7000000050c4327ca6010000b5bf6c99fe7f0000638bdf4e700000000000000000000000608bdf4e700000004200000000000000988bdf4e700000002c00000000000000008cdf4e7000000061a0ff9afe7f000002000000000000000000000000000000508c387c (UID: 00000000-00000584) "Tekken3Recomp.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f000002000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000842427a4d82500002c00000000000000a08bdf4e70000000e0030000000000007891df4e700000000000000000000000008cdf4e (UID: 00000000-00000584) "Tekken3Recomp.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f000002000000000000000050d34a7000000002000000000000000100000000000000400e247ca601000085aaaa99fe7f000048000000000000000100000070000000000000000000000000000000000000000000000000000000000000000000000000000000000000000050d34a700000003400000000000000a0acdf4e7000000050c4327ca6010000b5bf6c99fe7f00000000000000000000a0acdf4e7000000050c4327ca6010000b5bf6c99fe7f000000000000000000000000000000000000000000000000000001000000000000006aa9df4e700000002d000000000000002d000000000000009b000000000000006aa9df4e700000002d0000002e000000d08b387c (UID: 00000000-00000584) "Tekken3Recomp.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f000002000000000000000050d34a7000000002000000000000000100000000000000400e247ca601000085aaaa99fe7f000086f3714f11a300000100000070000000000000000000000070a9df4e7000000010afdf4e70000000e1abdf4e70000000000000000000000030a9df4e7000000040a8df4e70000000fca0ff9afe7f000050c4327ca6010000b5bf6c99fe7f000030a9df4e70000000a0acdf4e7000000050c4327ca6010000b5bf6c99fe7f000033a9df4e70000000000000000000000030a9df4e7000000042000000000000006aa9df4e700000002d00000000000000d0a9df4e7000000061a0ff9afe7f000002000000000000000000000000000000d08b387c (UID: 00000000-00000584) "Tekken3Recomp.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f000002000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000540b27a4d82500002d0000000000000070a9df4e70000000040400000000000048afdf4e700000000000000000000000d0a9df4e (UID: 00000000-00000584) "Tekken3Recomp.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f000002000000000000000050d34a7000000002000000000000000100000000000000d40a27a4d825000085aaaa99fe7f0000480000000000000001000000fe7f0000000000000000000000000000000000000000000000000000000000000000000000000000000000000050d34a700000003c00000000000000a0acdf4e7000000050c4327ca6010000b5bf6c99fe7f00000000000000000000a0acdf4e7000000050c4327ca6010000b5bf6c99fe7f0000000000000000000000000000000000000000000000000000010000000000000068a9df4e700000002c000000000000002c000000000000009c0000000000000068a9df4e700000002c0000002d000000508c387c (UID: 00000000-00000584) "Tekken3Recomp.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f000002000000000000000050d34a7000000002000000000000000100000000000000d40a27a4d825000085aaaa99fe7f000086f3714f11a3000001000000fe7f0000000000000000000070a9df4e7000000010afdf4e70000000e1abdf4e70000000000000000000000030a9df4e7000000040a8df4e70000000fca0ff9afe7f000050c4327ca6010000b5bf6c99fe7f000030a9df4e70000000a0acdf4e7000000050c4327ca6010000b5bf6c99fe7f000033a9df4e70000000000000000000000030a9df4e70000000420000000000000068a9df4e700000002c00000000000000d0a9df4e7000000061a0ff9afe7f000002000000000000000000000000000000508c387c (UID: 00000000-00000584) "Tekken3Recomp.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f000002000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000540b27a4d82500002c0000000000000070a9df4e70000000bc0300000000000048afdf4e700000000000000000000000d0a9df4e (UID: 00000000-00000584) "Tekken3Recomp.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00000584)28:T9ec,"Tekken3Recomp.exe" called "LoadLibrary" with a parameter USER32.DLL (UID: 00000000-00000584) "Tekken3Recomp.exe" called "LoadLibrary" with a parameter SHCORE.DLL (UID: 00000000-00000584) "Tekken3Recomp.exe" called "LoadLibrary" with a parameter DWMAPI.DLL (UID: 00000000-00000584) "Tekken3Recomp.exe" called "LoadLibrary" with a parameter DXGI.DLL (UID: 00000000-00000584) "Tekken3Recomp.exe" called "LoadLibrary" with a parameter dxgi.dll (UID: 00000000-00000584) "Tekken3Recomp.exe" called "LoadLibrary" with a parameter cfgmgr32.dll (UID: 00000000-00000584) "Tekken3Recomp.exe" called "LoadLibrary" with a parameter hid.dll (UID: 00000000-00000584) "Tekken3Recomp.exe" called "LoadLibrary" with a parameter XInput1_4.dll (UID: 00000000-00000584) "Tekken3Recomp.exe" called "LoadLibrary" with a parameter HID.DLL (UID: 00000000-00000584) "Tekken3Recomp.exe" called "LoadLibrary" with a parameter ext-ms-win-mininput-inputhost-l1-1-1.dll (UID: 00000000-00000584) "Tekken3Recomp.exe" called "LoadLibrary" with a parameter SETUPAPI.DLL (UID: 00000000-00000584) "Tekken3Recomp.exe" called "LoadLibrary" with a parameter WINMM.DLL (UID: 00000000-00000584) "Tekken3Recomp.exe" called "LoadLibrary" with a parameter ext-ms-win-mininput-inputhost-l1-1-0.dll (UID: 00000000-00000584) "Tekken3Recomp.exe" called "LoadLibrary" with a parameter OPENGL32.DLL (UID: 00000000-00000584) "Tekken3Recomp.exe" called "LoadLibrary" with a parameter gdi32 (UID: 00000000-00000584) "Tekken3Recomp.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00000584) "Tekken3Recomp.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00000584) "Tekken3Recomp.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-2 (UID: 00000000-00000584) "Tekken3Recomp.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00000584) "Tekken3Recomp.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00000584) "Tekken3Recomp.exe" called "LoadLibrary" with a parameter vm3dgl64.dll (UID: 00000000-00000584) "Tekken3Recomp.exe" called "LoadLibrary" with a parameter vm3dglhelper64.dll (UID: 00000000-00000584) "Tekken3Recomp.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00000584) "Tekken3Recomp.exe" called "LoadLibrary" with a parameter gdi32.dll (UID: 00000000-00000584) "Tekken3Recomp.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2 (UID: 00000000-00000584)29:T5a38,"Tekken3Recomp.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00000584) "Tekken3Recomp.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00000584) "Tekken3Recomp.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00000584) "Tekken3Recomp.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00000584) "Tekken3Recomp.exe" called "GetProcAddress" with a parameter CoGetInstanceFromFile (UID: 00000000-00000584) "Tekken3Recomp.exe" called "GetProcAddress" with a parameter CoGetInstanceFromIStorage (UID: 00000000-00000584) "Tekken3Recomp.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00000584) "Tekken3Recomp.exe" called "GetProcAddress" with a parameter AddVectoredExceptionHandler (UID: 00000000-00000584) "Tekken3Recomp.exe" called "GetProcAddress" with a parameter RemoveVectoredExceptionHandler (UID: 00000000-00000584) "Tekken3Recomp.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00000584) "Tekken3Recomp.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00000584) "Tekken3Recomp.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00000584) "Tekken3Recomp.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00000584) "Tekken3Recomp.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00000584) "Tekken3Recomp.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00000584) "Tekken3Recomp.exe" called "GetProcAddress" with a parameter ReleaseSRWLockShared (UID: 00000000-00000584) "Tekken3Recomp.exe" called "GetProcAddress" with a parameter AcquireSRWLockShared (UID: 00000000-00000584) "Tekken3Recomp.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockShared (UID: 00000000-00000584) "Tekken3Recomp.exe" called "GetProcAddress" with a parameter CloseTouchInputHandle (UID: 00000000-00000584) "Tekken3Recomp.exe" called "GetProcAddress" with a parameter GetTouchInputInfo (UID: 00000000-00000584) "Tekken3Recomp.exe" called "GetProcAddress" with a parameter RegisterTouchWindow (UID: 00000000-00000584) "Tekken3Recomp.exe" called "GetProcAddress" with a parameter SetProcessDPIAware (UID: 00000000-00000584) "Tekken3Recomp.exe" called "GetProcAddress" with a parameter SetProcessDpiAwarenessContext (UID: 00000000-00000584) "Tekken3Recomp.exe" called "GetProcAddress" with a parameter SetThreadDpiAwarenessContext (UID: 00000000-00000584) "Tekken3Recomp.exe" called "GetProcAddress" with a parameter GetThreadDpiAwarenessContext (UID: 00000000-00000584) "Tekken3Recomp.exe" called "GetProcAddress" with a parameter GetAwarenessFromDpiAwarenessContext (UID: 00000000-00000584) "Tekken3Recomp.exe" called "GetProcAddress" with a parameter EnableNonClientDpiScaling (UID: 00000000-00000584) "Tekken3Recomp.exe" called "GetProcAddress" with a parameter AdjustWindowRectExForDpi (UID: 00000000-00000584) "Tekken3Recomp.exe" called "GetProcAddress" with a parameter GetDpiForWindow (UID: 00000000-00000584) "Tekken3Recomp.exe" called "GetProcAddress" with a parameter AreDpiAwarenessContextsEqual (UID: 00000000-00000584) "Tekken3Recomp.exe" called "GetProcAddress" with a parameter IsValidDpiAwarenessContext (UID: 00000000-00000584) "Tekken3Recomp.exe" called "GetProcAddress" with a parameter GetDisplayConfigBufferSizes (UID: 00000000-00000584) "Tekken3Recomp.exe" called "GetProcAddress" with a parameter QueryDisplayConfig (UID: 00000000-00000584) "Tekken3Recomp.exe" called "GetProcAddress" with a parameter DisplayConfigGetDeviceInfo (UID: 00000000-00000584) "Tekken3Recomp.exe" called "GetProcAddress" with a parameter GetPointerType (UID: 00000000-00000584) "Tekken3Recomp.exe" called "GetProcAddress" with a parameter GetPointerPenInfo (UID: 00000000-00000584) "Tekken3Recomp.exe" called "GetProcAddress" with a parameter GetPointerDeviceRects (UID: 00000000-00000584) "Tekken3Recomp.exe" called "GetProcAddress" with a parameter GetDpiForMonitor (UID: 00000000-00000584) "Tekken3Recomp.exe" called "GetProcAddress" with a parameter SetProcessDpiAwareness (UID: 00000000-00000584) "Tekken3Recomp.exe" called "GetProcAddress" with a parameter DwmFlush (UID: 00000000-00000584) "Tekken3Recomp.exe" called "GetProcAddress" with a parameter DwmEnableBlurBehindWindow (UID: 00000000-00000584) "Tekken3Recomp.exe" called "GetProcAddress" with a parameter DwmSetWindowAttribute (UID: 00000000-00000584) "Tekken3Recomp.exe" called "GetProcAddress" with a parameter CreateDXGIFactory (UID: 00000000-00000584) "Tekken3Recomp.exe" called "GetProcAddress" with a parameter CreateDXGIFactory1 (UID: 00000000-00000584) "Tekken3Recomp.exe" called "GetProcAddress" with a parameter SetThreadDescription (UID: 00000000-00000584) "Tekken3Recomp.exe" called "GetProcAddress" with a parameter HidD_GetAttributes (UID: 00000000-00000584) "Tekken3Recomp.exe" called "GetProcAddress" with a parameter HidD_GetManufacturerString (UID: 00000000-00000584) "Tekken3Recomp.exe" called "GetProcAddress" with a parameter HidD_GetProductString (UID: 00000000-00000584) "Tekken3Recomp.exe" called "GetProcAddress" with a parameter HidP_GetCaps (UID: 00000000-00000584) "Tekken3Recomp.exe" called "GetProcAddress" with a parameter HidP_GetButtonCaps (UID: 00000000-00000584) "Tekken3Recomp.exe" called "GetProcAddress" with a parameter HidP_GetValueCaps (UID: 00000000-00000584) "Tekken3Recomp.exe" called "GetProcAddress" with a parameter HidP_MaxDataListLength (UID: 00000000-00000584) "Tekken3Recomp.exe" called "GetProcAddress" with a parameter HidP_GetData (UID: 00000000-00000584) "Tekken3Recomp.exe" called "GetProcAddress" with a parameter CM_Register_Notification (UID: 00000000-00000584) "Tekken3Recomp.exe" called "GetProcAddress" with a parameter CM_Unregister_Notification (UID: 00000000-00000584) "Tekken3Recomp.exe" called "GetProcAddress" with a parameter HidD_GetHidGuid (UID: 00000000-00000584) "Tekken3Recomp.exe" called "GetProcAddress" with a parameter HidD_GetSerialNumberString (UID: 00000000-00000584) "Tekken3Recomp.exe" called "GetProcAddress" with a parameter HidD_SetFeature (UID: 00000000-00000584) "Tekken3Recomp.exe" called "GetProcAddress" with a parameter HidD_GetFeature (UID: 00000000-00000584) "Tekken3Recomp.exe" called "GetProcAddress" with a parameter HidD_GetInputReport (UID: 00000000-00000584) "Tekken3Recomp.exe" called "GetProcAddress" with a parameter HidD_GetIndexedString (UID: 00000000-00000584) "Tekken3Recomp.exe" called "GetProcAddress" with a parameter HidD_GetPreparsedData (UID: 00000000-00000584) "Tekken3Recomp.exe" called "GetProcAddress" with a parameter HidD_FreePreparsedData (UID: 00000000-00000584) "Tekken3Recomp.exe" called "GetProcAddress" with a parameter HidD_SetNumInputBuffers (UID: 00000000-00000584) "Tekken3Recomp.exe" called "GetProcAddress" with a parameter HidD_SetOutputReport (UID: 00000000-00000584) "Tekken3Recomp.exe" called "GetProcAddress" with a parameter CM_Locate_DevNodeW (UID: 00000000-00000584) "Tekken3Recomp.exe" called "GetProcAddress" with a parameter CM_Get_Parent (UID: 00000000-00000584) "Tekken3Recomp.exe" called "GetProcAddress" with a parameter CM_Get_DevNode_PropertyW (UID: 00000000-00000584) "Tekken3Recomp.exe" called "GetProcAddress" with a parameter CM_Get_Device_Interface_PropertyW (UID: 00000000-00000584) "Tekken3Recomp.exe" called "GetProcAddress" with a parameter CM_Get_Device_Interface_List_SizeW (UID: 00000000-00000584) "Tekken3Recomp.exe" called "GetProcAddress" with a parameter CM_Get_Device_Interface_ListW (UID: 00000000-00000584) "Tekken3Recomp.exe" called "GetProcAddress" with a parameter XInputSetState (UID: 00000000-00000584) "Tekken3Recomp.exe" called "GetProcAddress" with a parameter XInputGetCapabilities (UID: 00000000-00000584) "Tekken3Recomp.exe" called "GetProcAddress" with a parameter XInputGetBatteryInformation (UID: 00000000-00000584) "Tekken3Recomp.exe" called "GetProcAddress" with a parameter CancelIo (UID: 00000000-00000584) "Tekken3Recomp.exe" called "GetProcAddress" with a parameter MsgWaitForMultipleObjectsEx (UID: 00000000-00000584) "Tekken3Recomp.exe" called "GetProcAddress" with a parameter HidD_FlushQueue (UID: 00000000-00000584) "Tekken3Recomp.exe" called "GetProcAddress" with a parameter HidP_GetLinkCollectionNodes (UID: 00000000-00000584) "Tekken3Recomp.exe" called "GetProcAddress" with a parameter HidP_GetUsagesEx (UID: 00000000-00000584) "Tekken3Recomp.exe" called "GetProcAddress" with a parameter HidP_GetScaledUsageValue (UID: 00000000-00000584) "Tekken3Recomp.exe" called "GetProcAddress" with a parameter HidP_SetData (UID: 00000000-00000584) "Tekken3Recomp.exe" called "GetProcAddress" with a parameter HidP_GetUsageValue (UID: 00000000-00000584) "Tekken3Recomp.exe" called "GetProcAddress" with a parameter HidP_MaxUsageListLength (UID: 00000000-00000584) "Tekken3Recomp.exe" called "GetProcAddress" with a parameter HidP_GetSpecificButtonCaps (UID: 00000000-00000584) "Tekken3Recomp.exe" called "GetProcAddress" with a parameter HidP_TranslateUsagesToI8042ScanCodes (UID: 00000000-00000584) "Tekken3Recomp.exe" called "GetProcAddress" with a parameter SetupDiGetClassDevsW (UID: 00000000-00000584) "Tekken3Recomp.exe" called "GetProcAddress" with a parameter SetupDiDestroyDeviceInfoList (UID: 00000000-00000584) "Tekken3Recomp.exe" called "GetProcAddress" with a parameter SetupDiGetDeviceInterfaceDetailW (UID: 00000000-00000584) "Tekken3Recomp.exe" called "GetProcAddress" with a parameter SetupDiEnumDeviceInterfaces (UID: 00000000-00000584) "Tekken3Recomp.exe" called "GetProcAddress" with a parameter SetupDiCreateDeviceInterfaceRegKeyW (UID: 00000000-00000584) "Tekken3Recomp.exe" called "GetProcAddress" with a parameter SetupDiCallClassInstaller (UID: 00000000-00000584) "Tekken3Recomp.exe" called "GetProcAddress" with a parameter SetupDiGetDeviceRegistryPropertyW (UID: 00000000-00000584) "Tekken3Recomp.exe" called "GetProcAddress" with a parameter SetupDiSetDeviceRegistryPropertyW (UID: 00000000-00000584) "Tekken3Recomp.exe" called "GetProcAddress" with a parameter SetupDiGetDeviceInstanceIdW (UID: 00000000-00000584) "Tekken3Recomp.exe" called "GetProcAddress" with a parameter SetupDiOpenDeviceInfoW (UID: 00000000-00000584) "Tekken3Recomp.exe" called "GetProcAddress" with a parameter SetupDiCreateDeviceInfoList (UID: 00000000-00000584) "Tekken3Recomp.exe" called "GetProcAddress" with a parameter SetupDiOpenDevRegKey (UID: 00000000-00000584) "Tekken3Recomp.exe" called "GetProcAddress" with a parameter CM_Get_Child (UID: 00000000-00000584) "Tekken3Recomp.exe" called "GetProcAddress" with a parameter CM_Get_Sibling (UID: 00000000-00000584) "Tekken3Recomp.exe" called "GetProcAddress" with a parameter CM_Get_DevNode_Registry_PropertyW (UID: 00000000-00000584) "Tekken3Recomp.exe" called "GetProcAddress" with a parameter CM_Set_DevNode_Registry_PropertyW (UID: 00000000-00000584) "Tekken3Recomp.exe" called "GetProcAddress" with a parameter CM_Get_Device_IDW (UID: 00000000-00000584) "Tekken3Recomp.exe" called "GetProcAddress" with a parameter mmioClose (UID: 00000000-00000584) "Tekken3Recomp.exe" called "GetProcAddress" with a parameter mmioOpenA (UID: 00000000-00000584) "Tekken3Recomp.exe" called "GetProcAddress" with a parameter mmioDescend (UID: 00000000-00000584) "Tekken3Recomp.exe" called "GetProcAddress" with a parameter mmioCreateChunk (UID: 00000000-00000584) "Tekken3Recomp.exe" called "GetProcAddress" with a parameter mmioRead (UID: 00000000-00000584) "Tekken3Recomp.exe" called "GetProcAddress" with a parameter mmioWrite (UID: 00000000-00000584) "Tekken3Recomp.exe" called "GetProcAddress" with a parameter mmioAscend (UID: 00000000-00000584) "Tekken3Recomp.exe" called "GetProcAddress" with a parameter RegisterRawInputDevices (UID: 00000000-00000584) "Tekken3Recomp.exe" called "GetProcAddress" with a parameter GetRawInputData (UID: 00000000-00000584) "Tekken3Recomp.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00000584) "Tekken3Recomp.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00000584) "Tekken3Recomp.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00000584) "Tekken3Recomp.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00000584) "Tekken3Recomp.exe" called "GetProcAddress" with a parameter CreateInputHostForProcess (UID: 00000000-00000584) "Tekken3Recomp.exe" called "GetProcAddress" with a parameter CreateGenericInputHost (UID: 00000000-00000584) "Tekken3Recomp.exe" called "GetProcAddress" with a parameter wglGetProcAddress (UID: 00000000-00000584) "Tekken3Recomp.exe" called "GetProcAddress" with a parameter wglCreateContext (UID: 00000000-00000584) "Tekken3Recomp.exe" called "GetProcAddress" with a parameter wglDeleteContext (UID: 00000000-00000584) "Tekken3Recomp.exe" called "GetProcAddress" with a parameter wglMakeCurrent (UID: 00000000-00000584) "Tekken3Recomp.exe" called "GetProcAddress" with a parameter wglShareLists (UID: 00000000-00000584) "Tekken3Recomp.exe" called "GetProcAddress" with a parameter D3DKMTOpenAdapterFromHdc (UID: 00000000-00000584) "Tekken3Recomp.exe" called "GetProcAddress" with a parameter D3DKMTQueryAdapterInfo (UID: 00000000-00000584) "Tekken3Recomp.exe" called "GetProcAddress" with a parameter D3DKMTCloseAdapter (UID: 00000000-00000584) "Tekken3Recomp.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00000584) "Tekken3Recomp.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00000584) "Tekken3Recomp.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00000584) "Tekken3Recomp.exe" called "GetProcAddress" with a parameter FlsGetValue2 (UID: 00000000-00000584) "Tekken3Recomp.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00000584) "Tekken3Recomp.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00000584) "Tekken3Recomp.exe" called "GetProcAddress" with a parameter GetTempPath2W (UID: 00000000-00000584) "Tekken3Recomp.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00000584) "Tekken3Recomp.exe" called "GetProcAddress" with a parameter IsWow64Process (UID: 00000000-00000584) "Tekken3Recomp.exe" called "GetProcAddress" with a parameter DrvValidateVersion (UID: 00000000-00000584) "Tekken3Recomp.exe" called "GetProcAddress" with a parameter DrvSetCallbackProcs (UID: 00000000-00000584) "Tekken3Recomp.exe" called "GetProcAddress" with a parameter DrvCreateContext (UID: 00000000-00000584) "Tekken3Recomp.exe" called "GetProcAddress" with a parameter DrvDeleteContext (UID: 00000000-00000584) "Tekken3Recomp.exe" called "GetProcAddress" with a parameter DrvSetContext (UID: 00000000-00000584) "Tekken3Recomp.exe" called "GetProcAddress" with a parameter DrvReleaseContext (UID: 00000000-00000584) "Tekken3Recomp.exe" called "GetProcAddress" with a parameter DrvCopyContext (UID: 00000000-00000584) "Tekken3Recomp.exe" called "GetProcAddress" with a parameter DrvCreateLayerContext (UID: 00000000-00000584) "Tekken3Recomp.exe" called "GetProcAddress" with a parameter DrvShareLists (UID: 00000000-00000584) "Tekken3Recomp.exe" called "GetProcAddress" with a parameter DrvGetProcAddress (UID: 00000000-00000584) "Tekken3Recomp.exe" called "GetProcAddress" with a parameter DrvDescribeLayerPlane (UID: 00000000-00000584) "Tekken3Recomp.exe" called "GetProcAddress" with a parameter DrvSetLayerPaletteEntries (UID: 00000000-00000584) "Tekken3Recomp.exe" called "GetProcAddress" with a parameter DrvGetLayerPaletteEntries (UID: 00000000-00000584) "Tekken3Recomp.exe" called "GetProcAddress" with a parameter DrvRealizeLayerPalette (UID: 00000000-00000584) "Tekken3Recomp.exe" called "GetProcAddress" with a parameter DrvSwapLayerBuffers (UID: 00000000-00000584) "Tekken3Recomp.exe" called "GetProcAddress" with a parameter DrvSwapMultipleBuffers (UID: 00000000-00000584) "Tekken3Recomp.exe" called "GetProcAddress" with a parameter DrvDescribePixelFormat (UID: 00000000-00000584) "Tekken3Recomp.exe" called "GetProcAddress" with a parameter DrvSetPixelFormat (UID: 00000000-00000584) "Tekken3Recomp.exe" called "GetProcAddress" with a parameter DrvSwapBuffers (UID: 00000000-00000584) "Tekken3Recomp.exe" called "GetProcAddress" with a parameter DrvPresentBuffers (UID: 00000000-00000584) "Tekken3Recomp.exe" called "GetProcAddress" with a parameter VM3DGLHelperInit (UID: 00000000-00000584) "Tekken3Recomp.exe" called "GetProcAddress" with a parameter VM3DGLHelperCleanup (UID: 00000000-00000584) "Tekken3Recomp.exe" called "GetProcAddress" with a parameter VM3DGLHelperGetDevCapMaxCount (UID: 00000000-00000584) "Tekken3Recomp.exe" called "GetProcAddress" with a parameter IsWow64Process2 (UID: 00000000-00000584) "Tekken3Recomp.exe" called "GetProcAddress" with a parameter VM3DGLHelperSetLogLevels (UID: 00000000-00000584) "Tekken3Recomp.exe" called "GetProcAddress" with a parameter VM3DGLHelperLog (UID: 00000000-00000584) "Tekken3Recomp.exe" called "GetProcAddress" with a parameter D3DKMTCreateAllocation (UID: 00000000-00000584) "Tekken3Recomp.exe" called "GetProcAddress" with a parameter D3DKMTDestroyAllocation (UID: 00000000-00000584) "Tekken3Recomp.exe" called "GetProcAddress" with a parameter D3DKMTSetAllocationPriority (UID: 00000000-00000584) "Tekken3Recomp.exe" called "GetProcAddress" with a parameter D3DKMTQueryAllocationResidency (UID: 00000000-00000584) "Tekken3Recomp.exe" called "GetProcAddress" with a parameter D3DKMTQueryResourceInfo (UID: 00000000-00000584) "Tekken3Recomp.exe" called "GetProcAddress" with a parameter D3DKMTOpenResource (UID: 00000000-00000584) "Tekken3Recomp.exe" called "GetProcAddress" with a parameter D3DKMTCreateDevice (UID: 00000000-00000584) "Tekken3Recomp.exe" called "GetProcAddress" with a parameter D3DKMTDestroyDevice (UID: 00000000-00000584) "Tekken3Recomp.exe" called "GetProcAddress" with a parameter D3DKMTLock (UID: 00000000-00000584) "Tekken3Recomp.exe" called "GetProcAddress" with a parameter D3DKMTUnlock (UID: 00000000-00000584) "Tekken3Recomp.exe" called "GetProcAddress" with a parameter D3DKMTGetDisplayModeList (UID: 00000000-00000584) "Tekken3Recomp.exe" called "GetProcAddress" with a parameter D3DKMTSetDisplayMode (UID: 00000000-00000584) "Tekken3Recomp.exe" called "GetProcAddress" with a parameter D3DKMTGetMultisampleMethodList (UID: 00000000-00000584) "Tekken3Recomp.exe" called "GetProcAddress" with a parameter D3DKMTPresent (UID: 00000000-00000584) "Tekken3Recomp.exe" called "GetProcAddress" with a parameter D3DKMTRender (UID: 00000000-00000584) "Tekken3Recomp.exe" called "GetProcAddress" with a parameter D3DKMTOpenAdapterFromDeviceName (UID: 00000000-00000584) "Tekken3Recomp.exe" called "GetProcAddress" with a parameter D3DKMTGetSharedPrimaryHandle (UID: 00000000-00000584) "Tekken3Recomp.exe" called "GetProcAddress" with a parameter D3DKMTEscape (UID: 00000000-00000584) "Tekken3Recomp.exe" called "GetProcAddress" with a parameter D3DKMTSetVidPnSourceOwner (UID: 00000000-00000584) "Tekken3Recomp.exe" called "GetProcAddress" with a parameter D3DKMTCreateOverlay (UID: 00000000-00000584) "Tekken3Recomp.exe" called "GetProcAddress" with a parameter D3DKMTUpdateOverlay (UID: 00000000-00000584) "Tekken3Recomp.exe" called "GetProcAddress" with a parameter D3DKMTFlipOverlay (UID: 00000000-00000584) "Tekken3Recomp.exe" called "GetProcAddress" with a parameter D3DKMTDestroyOverlay (UID: 00000000-00000584) "Tekken3Recomp.exe" called "GetProcAddress" with a parameter D3DKMTWaitForVerticalBlankEvent (UID: 00000000-00000584) "Tekken3Recomp.exe" called "GetProcAddress" with a parameter D3DKMTSetGammaRamp (UID: 00000000-00000584) "Tekken3Recomp.exe" called "GetProcAddress" with a parameter D3DKMTGetDeviceState (UID: 00000000-00000584) "Tekken3Recomp.exe" called "GetProcAddress" with a parameter D3DKMTCreateDCFromMemory (UID: 00000000-00000584) "Tekken3Recomp.exe" called "GetProcAddress" with a parameter D3DKMTDestroyDCFromMemory (UID: 00000000-00000584) "Tekken3Recomp.exe" called "GetProcAddress" with a parameter D3DKMTSetContextSchedulingPriority (UID: 00000000-00000584) "Tekken3Recomp.exe" called "GetProcAddress" with a parameter D3DKMTGetContextSchedulingPriority (UID: 00000000-00000584) "Tekken3Recomp.exe" called "GetProcAddress" with a parameter D3DKMTSetProcessSchedulingPriorityClass (UID: 00000000-00000584) "Tekken3Recomp.exe" called "GetProcAddress" with a parameter D3DKMTGetProcessSchedulingPriorityClass (UID: 00000000-00000584) "Tekken3Recomp.exe" called "GetProcAddress" with a parameter D3DKMTReleaseProcessVidPnSourceOwners (UID: 00000000-00000584) "Tekken3Recomp.exe" called "GetProcAddress" with a parameter D3DKMTGetScanLine (UID: 00000000-00000584) "Tekken3Recomp.exe" called "GetProcAddress" with a parameter D3DKMTPollDisplayChildren (UID: 00000000-00000584) "Tekken3Recomp.exe" called "GetProcAddress" with a parameter D3DKMTSetQueuedLimit (UID: 00000000-00000584) "Tekken3Recomp.exe" called "GetProcAddress" with a parameter D3DKMTInvalidateActiveVidPn (UID: 00000000-00000584) "Tekken3Recomp.exe" called "GetProcAddress" with a parameter D3DKMTCheckOcclusion (UID: 00000000-00000584) "Tekken3Recomp.exe" called "GetProcAddress" with a parameter D3DKMTCreateContext (UID: 00000000-00000584) "Tekken3Recomp.exe" called "GetProcAddress" with a parameter D3DKMTDestroyContext (UID: 00000000-00000584) "Tekken3Recomp.exe" called "GetProcAddress" with a parameter D3DKMTCreateSynchronizationObject (UID: 00000000-00000584) "Tekken3Recomp.exe" called "GetProcAddress" with a parameter D3DKMTDestroySynchronizationObject (UID: 00000000-00000584) "Tekken3Recomp.exe" called "GetProcAddress" with a parameter D3DKMTWaitForSynchronizationObject (UID: 00000000-00000584) "Tekken3Recomp.exe" called "GetProcAddress" with a parameter D3DKMTSignalSynchronizationObject (UID: 00000000-00000584) "Tekken3Recomp.exe" called "GetProcAddress" with a parameter D3DKMTCheckMonitorPowerState (UID: 00000000-00000584) "Tekken3Recomp.exe" called "GetProcAddress" with a parameter D3DKMTOpenAdapterFromGdiDisplayName (UID: 00000000-00000584) "Tekken3Recomp.exe" called "GetProcAddress" with a parameter D3DKMTCheckExclusiveOwnership (UID: 00000000-00000584) "Tekken3Recomp.exe" called "GetProcAddress" with a parameter D3DKMTSetDisplayPrivateDriverFormat (UID: 00000000-00000584) "Tekken3Recomp.exe" called "GetProcAddress" with a parameter D3DKMTSharedPrimaryLockNotification (UID: 00000000-00000584) "Tekken3Recomp.exe" called "GetProcAddress" with a parameter D3DKMTSharedPrimaryUnLockNotification (UID: 00000000-00000584) "Tekken3Recomp.exe" called "GetProcAddress" with a parameter AppPolicyGetThreadInitializationType (UID: 00000000-00000584)2a:T8c2b,Found reference to API (Indicator: "RegCloseKey"; File: "Tekken3Recomp.exe") Found reference to API (Indicator: "RegQueryValueExW"; File: "Tekken3Recomp.exe") Found reference to API (Indicator: "RegOpenKeyExW"; File: "Tekken3Recomp.exe") Found reference to API (Indicator: "CreateCompatibleDC"; File: "Tekken3Recomp.exe") Found reference to API (Indicator: "SelectObject"; File: "Tekken3Recomp.exe") Found reference to API (Indicator: "DeleteDC"; File: "Tekken3Recomp.exe") Found reference to API (Indicator: "CreateCompatibleBitmap"; File: "Tekken3Recomp.exe") Found reference to API (Indicator: "CreateSolidBrush"; File: "Tekken3Recomp.exe") Found reference to API (Indicator: "GetDeviceCaps"; File: "Tekken3Recomp.exe") Found reference to API (Indicator: "GetTextExtentPoint32A"; File: "Tekken3Recomp.exe") Found reference to API (Indicator: "GetDIBits"; File: "Tekken3Recomp.exe") Found reference to API (Indicator: "CreateFontIndirectW"; File: "Tekken3Recomp.exe") Found reference to API (Indicator: "DeleteObject"; File: "Tekken3Recomp.exe") Found reference to API (Indicator: "BitBlt"; File: "Tekken3Recomp.exe") Found reference to API (Indicator: "GetAdaptersAddresses"; File: "Tekken3Recomp.exe") Found reference to API (Indicator: "CreateEventW"; File: "Tekken3Recomp.exe") Found reference to API (Indicator: "ReleaseMutex"; File: "Tekken3Recomp.exe") Found reference to API (Indicator: "SuspendThread"; File: "Tekken3Recomp.exe") Found reference to API (Indicator: "SetErrorMode"; File: "Tekken3Recomp.exe") Found reference to API (Indicator: "DuplicateHandle"; File: "Tekken3Recomp.exe") Found reference to API (Indicator: "GetModuleFileNameW"; File: "Tekken3Recomp.exe") Found reference to API (Indicator: "WaitForSingleObject"; File: "Tekken3Recomp.exe") Found reference to API (Indicator: "AttachConsole"; File: "Tekken3Recomp.exe") Found reference to API (Indicator: "GetFullPathNameW"; File: "Tekken3Recomp.exe") Found reference to API (Indicator: "SetConsoleCtrlHandler"; File: "Tekken3Recomp.exe") Found reference to API (Indicator: "GetConsoleWindow"; File: "Tekken3Recomp.exe") Found reference to API (Indicator: "SleepConditionVariableCS"; File: "Tekken3Recomp.exe") Found reference to API (Indicator: "CreateWaitableTimerW"; File: "Tekken3Recomp.exe") Found reference to API (Indicator: "GetCurrentDirectoryW"; File: "Tekken3Recomp.exe") Found reference to API (Indicator: "CancelIo"; File: "Tekken3Recomp.exe") Found reference to API (Indicator: "LoadLibraryExW"; File: "Tekken3Recomp.exe") Found reference to API (Indicator: "GetThreadContext"; File: "Tekken3Recomp.exe") Found reference to API (Indicator: "EnumResourceNamesW"; File: "Tekken3Recomp.exe") Found reference to API (Indicator: "CloseHandle"; File: "Tekken3Recomp.exe") Found reference to API (Indicator: "RtlVirtualUnwind"; File: "Tekken3Recomp.exe") Found reference to API (Indicator: "SetHandleInformation"; File: "Tekken3Recomp.exe") Found reference to API (Indicator: "SetProcessAffinityMask"; File: "Tekken3Recomp.exe") Found reference to API (Indicator: "SwitchToFiber"; File: "Tekken3Recomp.exe") Found reference to API (Indicator: "QueryPerformanceCounter"; File: "Tekken3Recomp.exe") Found reference to API (Indicator: "GlobalUnlock"; File: "Tekken3Recomp.exe") Found reference to API (Indicator: "GetFileSizeEx"; File: "Tekken3Recomp.exe") Found reference to API (Indicator: "GetLocaleInfoW"; File: "Tekken3Recomp.exe") Found reference to API (Indicator: "GetExitCodeProcess"; File: "Tekken3Recomp.exe") Found reference to API (Indicator: "CreateSemaphoreW"; File: "Tekken3Recomp.exe") Found reference to API (Indicator: "ReadConsoleW"; File: "Tekken3Recomp.exe") Found reference to API (Indicator: "WideCharToMultiByte"; File: "Tekken3Recomp.exe") Found reference to API (Indicator: "GetModuleFileNameA"; File: "Tekken3Recomp.exe") Found reference to API (Indicator: "FormatMessageW"; File: "Tekken3Recomp.exe") Found reference to API (Indicator: "GetFileTime"; File: "Tekken3Recomp.exe") Found reference to API (Indicator: "FindClose"; File: "Tekken3Recomp.exe") Found reference to API (Indicator: "GetSystemPowerStatus"; File: "Tekken3Recomp.exe") Found reference to API (Indicator: "LoadLibraryW"; File: "Tekken3Recomp.exe") Found reference to API (Indicator: "ResetEvent"; File: "Tekken3Recomp.exe") Found reference to API (Indicator: "MoveFileExW"; File: "Tekken3Recomp.exe") Found reference to API (Indicator: "VerifyVersionInfoW"; File: "Tekken3Recomp.exe") Found reference to API (Indicator: "GetFileInformationByHandle"; File: "Tekken3Recomp.exe") Found reference to API (Indicator: "GetThreadPriority"; File: "Tekken3Recomp.exe") Found reference to API (Indicator: "SetThreadContext"; File: "Tekken3Recomp.exe") Found reference to API (Indicator: "WakeAllConditionVariable"; File: "Tekken3Recomp.exe") Found reference to API (Indicator: "InitializeConditionVariable"; File: "Tekken3Recomp.exe") Found reference to API (Indicator: "GetCurrentThreadId"; File: "Tekken3Recomp.exe") Found reference to API (Indicator: "GetSystemTimeAsFileTime"; File: "Tekken3Recomp.exe") Found reference to API (Indicator: "MultiByteToWideChar"; File: "Tekken3Recomp.exe") Found reference to API (Indicator: "FreeLibrary"; File: "Tekken3Recomp.exe") Found reference to API (Indicator: "CreateMutexA"; File: "Tekken3Recomp.exe") Found reference to API (Indicator: "ExitProcess"; File: "Tekken3Recomp.exe") Found reference to API (Indicator: "SetUnhandledExceptionFilter"; File: "Tekken3Recomp.exe") Found reference to API (Indicator: "SystemTimeToFileTime"; File: "Tekken3Recomp.exe") Found reference to API (Indicator: "SetEndOfFile"; File: "Tekken3Recomp.exe") Found reference to API (Indicator: "FindFirstVolumeW"; File: "Tekken3Recomp.exe") Found reference to API (Indicator: "RaiseException"; File: "Tekken3Recomp.exe") Found reference to API (Indicator: "AssignProcessToJobObject"; File: "Tekken3Recomp.exe") Found reference to API (Indicator: "MulDiv"; File: "Tekken3Recomp.exe") Found reference to API (Indicator: "TlsGetValue"; File: "Tekken3Recomp.exe") Found reference to API (Indicator: "TlsAlloc"; File: "Tekken3Recomp.exe") Found reference to API (Indicator: "AddVectoredExceptionHandler"; File: "Tekken3Recomp.exe") Found reference to API (Indicator: "FindVolumeClose"; File: "Tekken3Recomp.exe") Found reference to API (Indicator: "IsDBCSLeadByteEx"; File: "Tekken3Recomp.exe") Found reference to API (Indicator: "WriteFile"; File: "Tekken3Recomp.exe") Found reference to API (Indicator: "FindFirstFileA"; File: "Tekken3Recomp.exe") Found reference to API (Indicator: "VerSetConditionMask"; File: "Tekken3Recomp.exe") Found reference to API (Indicator: "GetConsoleCP"; File: "Tekken3Recomp.exe") Found reference to API (Indicator: "FindNextFileA"; File: "Tekken3Recomp.exe") Found reference to API (Indicator: "CreateFileW"; File: "Tekken3Recomp.exe") Found reference to API (Indicator: "GetModuleHandleW"; File: "Tekken3Recomp.exe") Found reference to API (Indicator: "ReleaseSemaphore"; File: "Tekken3Recomp.exe") Found reference to API (Indicator: "GlobalMemoryStatusEx"; File: "Tekken3Recomp.exe") Found reference to API (Indicator: "GetConsoleOutputCP"; File: "Tekken3Recomp.exe") Found reference to API (Indicator: "GetModuleHandleExW"; File: "Tekken3Recomp.exe") Found reference to API (Indicator: "SearchPathA"; File: "Tekken3Recomp.exe") Found reference to API (Indicator: "LocalFree"; File: "Tekken3Recomp.exe") Found reference to API (Indicator: "SetEnvironmentVariableA"; File: "Tekken3Recomp.exe") Found reference to API (Indicator: "LeaveCriticalSection"; File: "Tekken3Recomp.exe") Found reference to API (Indicator: "TryEnterCriticalSection"; File: "Tekken3Recomp.exe") Found reference to API (Indicator: "GetCommandLineW"; File: "Tekken3Recomp.exe") Found reference to API (Indicator: "HeapFree"; File: "Tekken3Recomp.exe") Found reference to API (Indicator: "SetThreadExecutionState"; File: "Tekken3Recomp.exe") Found reference to API (Indicator: "CreateJobObjectA"; File: "Tekken3Recomp.exe") Found reference to API (Indicator: "FindFirstFileExW"; File: "Tekken3Recomp.exe") Found reference to API (Indicator: "WriteConsoleW"; File: "Tekken3Recomp.exe") Found reference to API (Indicator: "MoveFileA"; File: "Tekken3Recomp.exe") Found reference to API (Indicator: "CreateEventA"; File: "Tekken3Recomp.exe") Found reference to API (Indicator: "GlobalAlloc"; File: "Tekken3Recomp.exe") Found reference to API (Indicator: "RemoveDirectoryW"; File: "Tekken3Recomp.exe") Found reference to API (Indicator: "TerminateProcess"; File: "Tekken3Recomp.exe") Found reference to API (Indicator: "CompareStringA"; File: "Tekken3Recomp.exe") Found reference to API (Indicator: "SetWaitableTimer"; File: "Tekken3Recomp.exe") Found reference to API (Indicator: "OutputDebugStringA"; File: "Tekken3Recomp.exe") Found reference to API (Indicator: "GetEnvironmentVariableA"; File: "Tekken3Recomp.exe") Found reference to API (Indicator: "GetSystemInfo"; File: "Tekken3Recomp.exe") Found reference to API (Indicator: "QueryPerformanceFrequency"; File: "Tekken3Recomp.exe") Found reference to API (Indicator: "GetEnvironmentStringsW"; File: "Tekken3Recomp.exe") Found reference to API (Indicator: "SetEvent"; File: "Tekken3Recomp.exe") Found reference to API (Indicator: "CreateProcessA"; File: "Tekken3Recomp.exe") Found reference to API (Indicator: "FileTimeToSystemTime"; File: "Tekken3Recomp.exe") Found reference to API (Indicator: "CreateFileA"; File: "Tekken3Recomp.exe") Found reference to API (Indicator: "GetProcessHeap"; File: "Tekken3Recomp.exe") Found reference to API (Indicator: "SetConsoleMode"; File: "Tekken3Recomp.exe") Found reference to API (Indicator: "SetConsoleOutputCP"; File: "Tekken3Recomp.exe") Found reference to API (Indicator: "RemoveVectoredExceptionHandler"; File: "Tekken3Recomp.exe") Found reference to API (Indicator: "CreateHardLinkW"; File: "Tekken3Recomp.exe") Found reference to API (Indicator: "WakeConditionVariable"; File: "Tekken3Recomp.exe") Found reference to API (Indicator: "ConvertThreadToFiber"; File: "Tekken3Recomp.exe") Found reference to API (Indicator: "GenerateConsoleCtrlEvent"; File: "Tekken3Recomp.exe") Found reference to API (Indicator: "GetCurrentDirectoryA"; File: "Tekken3Recomp.exe") Found reference to API (Indicator: "WaitForMultipleObjects"; File: "Tekken3Recomp.exe") Found reference to API (Indicator: "IsWow64Process"; File: "Tekken3Recomp.exe") Found reference to API (Indicator: "IsDebuggerPresent"; File: "Tekken3Recomp.exe") Found reference to API (Indicator: "GlobalLock"; File: "Tekken3Recomp.exe") Found reference to API (Indicator: "SetFilePointer"; File: "Tekken3Recomp.exe") Found reference to API (Indicator: "GetVolumeInformationW"; File: "Tekken3Recomp.exe") Found reference to API (Indicator: "ReadFile"; File: "Tekken3Recomp.exe") Found reference to API (Indicator: "GetProcAddress"; File: "Tekken3Recomp.exe") Found reference to API (Indicator: "InitializeCriticalSection"; File: "Tekken3Recomp.exe") Found reference to API (Indicator: "GetFileAttributesExA"; File: "Tekken3Recomp.exe") Found reference to API (Indicator: "OpenProcess"; File: "Tekken3Recomp.exe") Found reference to API (Indicator: "TerminateJobObject"; File: "Tekken3Recomp.exe") Found reference to API (Indicator: "SetConsoleCP"; File: "Tekken3Recomp.exe") Found reference to API (Indicator: "FreeEnvironmentStringsW"; File: "Tekken3Recomp.exe") Found reference to API (Indicator: "GetFileAttributesW"; File: "Tekken3Recomp.exe") Found reference to API (Indicator: "SetNamedPipeHandleState"; File: "Tekken3Recomp.exe") Found reference to API (Indicator: "GlobalSize"; File: "Tekken3Recomp.exe") Found reference to API (Indicator: "DeleteCriticalSection"; File: "Tekken3Recomp.exe") Found reference to API (Indicator: "GetStdHandle"; File: "Tekken3Recomp.exe") Found reference to API (Indicator: "CreateThread"; File: "Tekken3Recomp.exe") Found reference to API (Indicator: "GetCurrentProcessId"; File: "Tekken3Recomp.exe") Found reference to API (Indicator: "HeapAlloc"; File: "Tekken3Recomp.exe") Found reference to API (Indicator: "GetFinalPathNameByHandleA"; File: "Tekken3Recomp.exe") Found reference to API (Indicator: "CreatePipe"; File: "Tekken3Recomp.exe") Found reference to API (Indicator: "DeviceIoControl"; File: "Tekken3Recomp.exe") Found reference to API (Indicator: "GetTempPathW"; File: "Tekken3Recomp.exe") Found reference to API (Indicator: "SetFilePointerEx"; File: "Tekken3Recomp.exe") Found reference to API (Indicator: "SetInformationJobObject"; File: "Tekken3Recomp.exe") Found reference to API (Indicator: "MoveFileExA"; File: "Tekken3Recomp.exe") Found reference to API (Indicator: "SetLastError"; File: "Tekken3Recomp.exe") Found reference to API (Indicator: "VirtualProtect"; File: "Tekken3Recomp.exe") Found reference to API (Indicator: "GetTickCount64"; File: "Tekken3Recomp.exe") Found reference to API (Indicator: "SetThreadPriority"; File: "Tekken3Recomp.exe") Found reference to API (Indicator: "GetFullPathNameA"; File: "Tekken3Recomp.exe") Found reference to API (Indicator: "DeleteFileW"; File: "Tekken3Recomp.exe") Found reference to API (Indicator: "InitializeCriticalSectionAndSpinCount"; File: "Tekken3Recomp.exe") Found reference to API (Indicator: "GetFileType"; File: "Tekken3Recomp.exe") Found reference to API (Indicator: "FindNextFileW"; File: "Tekken3Recomp.exe") Found reference to API (Indicator: "VirtualQuery"; File: "Tekken3Recomp.exe") Found reference to API (Indicator: "CreateFiber"; File: "Tekken3Recomp.exe") Found reference to API (Indicator: "CreateProcessW"; File: "Tekken3Recomp.exe") Found reference to API (Indicator: "DeleteFiber"; File: "Tekken3Recomp.exe") Found reference to API (Indicator: "GetLocaleInfoA"; File: "Tekken3Recomp.exe") Found reference to API (Indicator: "RtlLookupFunctionEntry"; File: "Tekken3Recomp.exe") Found reference to API (Indicator: "CreateWaitableTimerExW"; File: "Tekken3Recomp.exe") Found reference to API (Indicator: "FormatMessageA"; File: "Tekken3Recomp.exe") Found reference to API (Indicator: "EnterCriticalSection"; File: "Tekken3Recomp.exe") Found reference to API (Indicator: "GetDiskFreeSpaceExW"; File: "Tekken3Recomp.exe") Found reference to API (Indicator: "SystemTimeToTzSpecificLocalTime"; File: "Tekken3Recomp.exe") Found reference to API (Indicator: "RtlCaptureContext"; File: "Tekken3Recomp.exe") Found reference to API (Indicator: "WaitForSingleObjectEx"; File: "Tekken3Recomp.exe") Found reference to API (Indicator: "GetConsoleMode"; File: "Tekken3Recomp.exe") Found reference to API (Indicator: "CopyFileExW"; File: "Tekken3Recomp.exe") Found reference to API (Indicator: "FindNextVolumeW"; File: "Tekken3Recomp.exe") Found reference to API (Indicator: "GetTickCount"; File: "Tekken3Recomp.exe") Found reference to API (Indicator: "GetOverlappedResult"; File: "Tekken3Recomp.exe") Found reference to API (Indicator: "Sleep"; File: "Tekken3Recomp.exe") Found reference to API (Indicator: "ResumeThread"; File: "Tekken3Recomp.exe") Found reference to API (Indicator: "GetModuleHandleA"; File: "Tekken3Recomp.exe") Found reference to API (Indicator: "FlushFileBuffers"; File: "Tekken3Recomp.exe") Found reference to API (Indicator: "GetHandleInformation"; File: "Tekken3Recomp.exe") Found reference to API (Indicator: "GetFileAttributesA"; File: "Tekken3Recomp.exe") Found reference to API (Indicator: "GetProcessAffinityMask"; File: "Tekken3Recomp.exe") Found reference to API (Indicator: "TlsFree"; File: "Tekken3Recomp.exe") Found reference to API (Indicator: "LoadLibraryA"; File: "Tekken3Recomp.exe") Found reference to API (Indicator: "CreateSemaphoreA"; File: "Tekken3Recomp.exe") Found reference to API (Indicator: "CreateDirectoryW"; File: "Tekken3Recomp.exe") Found reference to API (Indicator: "GetLogicalDrives"; File: "Tekken3Recomp.exe") Found reference to API (Indicator: "GetCurrentThread"; File: "Tekken3Recomp.exe") Found reference to API (Indicator: "GlobalFree"; File: "Tekken3Recomp.exe") Found reference to API (Indicator: "TlsSetValue"; File: "Tekken3Recomp.exe") Found reference to API (Indicator: "GetCurrentProcess"; File: "Tekken3Recomp.exe") Found reference to API (Indicator: "GetLastError"; File: "Tekken3Recomp.exe") Found reference to API (Indicator: "OutputDebugStringW"; File: "Tekken3Recomp.exe") Found reference to API (Indicator: "GetACP"; File: "Tekken3Recomp.exe") Found reference to API (Indicator: "GetFileAttributesExW"; File: "Tekken3Recomp.exe") Found reference to API (Indicator: "SysFreeString"; File: "Tekken3Recomp.exe") Found reference to API (Indicator: "SetupDiDestroyDeviceInfoList"; File: "Tekken3Recomp.exe") Found reference to API (Indicator: "SetupDiGetDeviceRegistryPropertyW"; File: "Tekken3Recomp.exe") Found reference to API (Indicator: "SetupDiEnumDeviceInfo"; File: "Tekken3Recomp.exe") Found reference to API (Indicator: "SetupDiGetDeviceInstanceIdA"; File: "Tekken3Recomp.exe") Found reference to API (Indicator: "SetupDiGetClassDevsA"; File: "Tekken3Recomp.exe") Found reference to API (Indicator: "Shell_NotifyIconW"; File: "Tekken3Recomp.exe") Found reference to API (Indicator: "SHGetPathFromIDListW"; File: "Tekken3Recomp.exe") Found reference to API (Indicator: "ShellExecuteW"; File: "Tekken3Recomp.exe") Found reference to API (Indicator: "SHGetFolderPathW"; File: "Tekken3Recomp.exe") Found reference to API (Indicator: "CommandLineToArgvW"; File: "Tekken3Recomp.exe") Found reference to API (Indicator: "SHBrowseForFolderW"; File: "Tekken3Recomp.exe") Found reference to API (Indicator: "SetCapture"; File: "Tekken3Recomp.exe") Found reference to API (Indicator: "GetForegroundWindow"; File: "Tekken3Recomp.exe") Found reference to API (Indicator: "GetSystemMetrics"; File: "Tekken3Recomp.exe") Found reference to API (Indicator: "DestroyWindow"; File: "Tekken3Recomp.exe") Found reference to API (Indicator: "SetActiveWindow"; File: "Tekken3Recomp.exe") Found reference to API (Indicator: "MessageBoxA"; File: "Tekken3Recomp.exe") Found reference to API (Indicator: "GetWindowPlacement"; File: "Tekken3Recomp.exe") Found reference to API (Indicator: "GetClipboardData"; File: "Tekken3Recomp.exe") Found reference to API (Indicator: "SetWindowPos"; File: "Tekken3Recomp.exe") Found reference to API (Indicator: "MessageBeep"; File: "Tekken3Recomp.exe") Found reference to API (Indicator: "EnableMenuItem"; File: "Tekken3Recomp.exe") Found reference to API (Indicator: "ClipCursor"; File: "Tekken3Recomp.exe") Found reference to API (Indicator: "RegisterClassW"; File: "Tekken3Recomp.exe") Found reference to API (Indicator: "GetWindowThreadProcessId"; File: "Tekken3Recomp.exe") Found reference to API (Indicator: "AttachThreadInput"; File: "Tekken3Recomp.exe") Found reference to API (Indicator: "RegisterClassExA"; File: "Tekken3Recomp.exe") Found reference to API (Indicator: "PeekMessageW"; File: "Tekken3Recomp.exe") Found reference to API (Indicator: "SystemParametersInfoW"; File: "Tekken3Recomp.exe") Found reference to API (Indicator: "ClientToScreen"; File: "Tekken3Recomp.exe") Found reference to API (Indicator: "DefWindowProcW"; File: "Tekken3Recomp.exe") Found reference to API (Indicator: "GetRawInputData"; File: "Tekken3Recomp.exe") Found reference to API (Indicator: "DeleteMenu"; File: "Tekken3Recomp.exe") Found reference to API (Indicator: "ReleaseCapture"; File: "Tekken3Recomp.exe") Found reference to API (Indicator: "GetMessageTime"; File: "Tekken3Recomp.exe") Found reference to API (Indicator: "SetFocus"; File: "Tekken3Recomp.exe") Found reference to API (Indicator: "ShowWindow"; File: "Tekken3Recomp.exe") Found reference to API (Indicator: "DestroyIcon"; File: "Tekken3Recomp.exe") Found reference to API (Indicator: "GetMenu"; File: "Tekken3Recomp.exe") Found reference to API (Indicator: "GetMenuItemInfoW"; File: "Tekken3Recomp.exe") Found reference to API (Indicator: "SetCursor"; File: "Tekken3Recomp.exe") Found reference to API (Indicator: "CreateWindowExA"; File: "Tekken3Recomp.exe") Found reference to API (Indicator: "CreateWindowExW"; File: "Tekken3Recomp.exe") Found reference to API (Indicator: "GetClipCursor"; File: "Tekken3Recomp.exe") Found reference to API (Indicator: "CreateIconFromResource"; File: "Tekken3Recomp.exe") Found reference to API (Indicator: "PtInRect"; File: "Tekken3Recomp.exe") Found reference to API (Indicator: "AdjustWindowRectEx"; File: "Tekken3Recomp.exe") Found reference to API (Indicator: "CloseClipboard"; File: "Tekken3Recomp.exe") Found reference to API (Indicator: "IsWindow"; File: "Tekken3Recomp.exe") Found reference to API (Indicator: "IntersectRect"; File: "Tekken3Recomp.exe") Found reference to API (Indicator: "SetWindowRgn"; File: "Tekken3Recomp.exe") Found reference to API (Indicator: "GetDC"; File: "Tekken3Recomp.exe") Found reference to API (Indicator: "UnregisterClassA"; File: "Tekken3Recomp.exe") Found reference to API (Indicator: "BeginPaint"; File: "Tekken3Recomp.exe") Found reference to API (Indicator: "LoadCursorW"; File: "Tekken3Recomp.exe") Found reference to API (Indicator: "GetFocus"; File: "Tekken3Recomp.exe") Found reference to API (Indicator: "OpenClipboard"; File: "Tekken3Recomp.exe") Found reference to API (Indicator: "GetCursorPos"; File: "Tekken3Recomp.exe") Found reference to API (Indicator: "GetKeyboardState"; File: "Tekken3Recomp.exe") Found reference to API (Indicator: "SetCursorPos"; File: "Tekken3Recomp.exe") Found reference to API (Indicator: "TranslateMessage"; File: "Tekken3Recomp.exe") Found reference to API (Indicator: "IsIconic"; File: "Tekken3Recomp.exe") Found reference to API (Indicator: "LoadIconW"; File: "Tekken3Recomp.exe") Found reference to API (Indicator: "EmptyClipboard"; File: "Tekken3Recomp.exe") Found reference to API (Indicator: "CreateIconIndirect"; File: "Tekken3Recomp.exe") Found reference to API (Indicator: "EnumWindows"; File: "Tekken3Recomp.exe") Found reference to API (Indicator: "GetDesktopWindow"; File: "Tekken3Recomp.exe") Found reference to API (Indicator: "MessageBoxW"; File: "Tekken3Recomp.exe") Found reference to API (Indicator: "GetAsyncKeyState"; File: "Tekken3Recomp.exe") Found reference to API (Indicator: "KillTimer"; File: "Tekken3Recomp.exe") Found reference to API (Indicator: "SetTimer"; File: "Tekken3Recomp.exe") Found reference to API (Indicator: "UnregisterClassW"; File: "Tekken3Recomp.exe") Found reference to API (Indicator: "UnhookWindowsHookEx"; File: "Tekken3Recomp.exe") Found reference to API (Indicator: "CreateIconFromResourceEx"; File: "Tekken3Recomp.exe") Found reference to API (Indicator: "FillRect"; File: "Tekken3Recomp.exe") Found reference to API (Indicator: "GetWindowTextW"; File: "Tekken3Recomp.exe") Found reference to API (Indicator: "DestroyMenu"; File: "Tekken3Recomp.exe") Found reference to API (Indicator: "GetWindowRect"; File: "Tekken3Recomp.exe") Found reference to API (Indicator: "IsZoomed"; File: "Tekken3Recomp.exe") Found reference to API (Indicator: "EnableWindow"; File: "Tekken3Recomp.exe") Found reference to API (Indicator: "CreatePopupMenu"; File: "Tekken3Recomp.exe") Found reference to API (Indicator: "DestroyCursor"; File: "Tekken3Recomp.exe") Found reference to API (Indicator: "ScreenToClient"; File: "Tekken3Recomp.exe") Found reference to API (Indicator: "SetMenuItemInfoW"; File: "Tekken3Recomp.exe") Found reference to API (Indicator: "CheckMenuItem"; File: "Tekken3Recomp.exe") Found reference to API (Indicator: "SetWindowTextW"; File: "Tekken3Recomp.exe") Found reference to API (Indicator: "RegisterRawInputDevices"; File: "Tekken3Recomp.exe") Found reference to API (Indicator: "SendMessageA"; File: "Tekken3Recomp.exe") Found reference to API (Indicator: "GetClientRect"; File: "Tekken3Recomp.exe") Found reference to API (Indicator: "GetMessageA"; File: "Tekken3Recomp.exe") Found reference to API (Indicator: "SetParent"; File: "Tekken3Recomp.exe") Found reference to API (Indicator: "GetWindowTextLengthW"; File: "Tekken3Recomp.exe") Found reference to API (Indicator: "SetForegroundWindow"; File: "Tekken3Recomp.exe") Found reference to API (Indicator: "SetClipboardData"; File: "Tekken3Recomp.exe") Found reference to API (Indicator: "MsgWaitForMultipleObjects"; File: "Tekken3Recomp.exe") Found reference to API (Indicator: "TrackPopupMenu"; File: "Tekken3Recomp.exe") Found reference to API (Indicator: "ReleaseDC"; File: "Tekken3Recomp.exe") Found reference to API (Indicator: "CallNextHookEx"; File: "Tekken3Recomp.exe") Found reference to API (Indicator: "SystemParametersInfoA"; File: "Tekken3Recomp.exe") Found reference to API (Indicator: "InsertMenuW"; File: "Tekken3Recomp.exe") Found reference to API (Indicator: "DispatchMessageW"; File: "Tekken3Recomp.exe") Found reference to API (Indicator: "GetKeyboardLayout"; File: "Tekken3Recomp.exe") Found reference to API (Indicator: "RegisterWindowMessageA"; File: "Tekken3Recomp.exe") Found reference to API (Indicator: "GetKeyState"; File: "Tekken3Recomp.exe") Found reference to API (Indicator: "EnumChildWindows"; File: "Tekken3Recomp.exe") Found reference to API (Indicator: "GetFileVersionInfoSizeA"; File: "Tekken3Recomp.exe") Found reference to API (Indicator: "GetFileVersionInfoA"; File: "Tekken3Recomp.exe") Found reference to API (Indicator: "VerQueryValueA"; File: "Tekken3Recomp.exe") Found reference to API (Indicator: "getsockname"; File: "Tekken3Recomp.exe") Found reference to API (Indicator: "WSAStartup"; File: "Tekken3Recomp.exe") Found reference to API (Indicator: "ntohs"; File: "Tekken3Recomp.exe") Found reference to API (Indicator: "getpeername"; File: "Tekken3Recomp.exe") Found reference to API (Indicator: "WSACleanup"; File: "Tekken3Recomp.exe") Found reference to API (Indicator: "WSAGetLastError"; File: "Tekken3Recomp.exe") Found reference to API (Indicator: "closesocket"; File: "Tekken3Recomp.exe") Found reference to API (Indicator: "WSAIoctl"; File: "Tekken3Recomp.exe") Found reference to API (Indicator: "htons"; File: "Tekken3Recomp.exe") Found reference to API (Indicator: "getsockopt"; File: "Tekken3Recomp.exe") Found reference to API (Indicator: "htonl"; File: "Tekken3Recomp.exe") Found reference to API (Indicator: "recvfrom"; File: "Tekken3Recomp.exe") Found reference to API (Indicator: "ioctlsocket"; File: "Tekken3Recomp.exe") Found reference to API (Indicator: "ntohl"; File: "Tekken3Recomp.exe") Found reference to API (Indicator: "BCryptGenRandom"; File: "Tekken3Recomp.exe") Found reference to API (Indicator: "GetSaveFileNameW"; File: "Tekken3Recomp.exe") Found reference to API (Indicator: "GetOpenFileNameW"; File: "Tekken3Recomp.exe") Found reference to API (Indicator: "CLSIDFromString"; File: "Tekken3Recomp.exe") Found reference to API (Indicator: "CoUninitialize"; File: "Tekken3Recomp.exe") Found reference to API (Indicator: "OleInitialize"; File: "Tekken3Recomp.exe") Found reference to API (Indicator: "CoCreateInstance"; File: "Tekken3Recomp.exe") Found reference to API (Indicator: "CoTaskMemFree"; File: "Tekken3Recomp.exe") Found reference to API (Indicator: "OleUninitialize"; File: "Tekken3Recomp.exe") Found reference to API (Indicator: "CoInitializeEx"; File: "Tekken3Recomp.exe") Found reference to API (Indicator: "WriteFile"; Source: "00000000-00000584.00000000.95771.7A93C000.00000002.mdmp") Found reference to API (Indicator: "ReadFile"; Source: "00000000-00000584.00000000.95771.7A93C000.00000002.mdmp") Found reference to API (Indicator: "RtlGetVersion"; Source: "00000000-00000584.00000000.95771.7A93C000.00000002.mdmp") Found reference to API (Indicator: "Sleep"; Source: "00000000-00000584.00000000.95771.7A93C000.00000002.mdmp") Found reference to API (Indicator: "CancelIoEx"; Source: "00000000-00000584.00000000.95771.7A93C000.00000002.mdmp") Found reference to API (Indicator: "CreateEventExW"; Source: "00000000-00000584.00000000.95771.7A93C000.00000002.mdmp") Found reference to API (Indicator: "CreateEvent"; Source: "00000000-00000584.00000000.95771.7A93C000.00000002.mdmp") Found reference to API (Indicator: "CreateThread"; Source: "00000000-00000584.00000000.95771.7A93C000.00000002.mdmp") Found reference to API (Indicator: "SetProcessDpiAwarenessContext"; Source: "00000000-00000584.00000000.95771.7A93C000.00000002.mdmp") Found reference to API (Indicator: "WakeConditionVariable"; Source: "00000000-00000584.00000000.95771.7A93C000.00000002.mdmp") Found reference to API (Indicator: "WakeAllConditionVariable"; Source: "00000000-00000584.00000000.95771.7A93C000.00000002.mdmp") Found reference to API (Indicator: "SleepConditionVariableSRW"; Source: "00000000-00000584.00000000.95771.7A93C000.00000002.mdmp") Found reference to API (Indicator: "SleepConditionVariableCS"; Source: "00000000-00000584.00000000.95771.7A93C000.00000002.mdmp") Found reference to API (Indicator: "InitializeSRWLock"; Source: "00000000-00000584.00000000.95771.7A93C000.00000002.mdmp") Found reference to API (Indicator: "ReleaseSRWLockExclusive"; Source: "00000000-00000584.00000000.95771.7A93C000.00000002.mdmp") Found reference to API (Indicator: "AcquireSRWLockExclusive"; Source: "00000000-00000584.00000000.95771.7A93C000.00000002.mdmp") Found reference to API (Indicator: "TryAcquireSRWLockExclusive"; Source: "00000000-00000584.00000000.95771.7A93C000.00000002.mdmp") Found reference to API (Indicator: "ReleaseSRWLockShared"; Source: "00000000-00000584.00000000.95771.7A93C000.00000002.mdmp") Found reference to API (Indicator: "AcquireSRWLockShared"; Source: "00000000-00000584.00000000.95771.7A93C000.00000002.mdmp") Found reference to API (Indicator: "TryAcquireSRWLockShared"; Source: "00000000-00000584.00000000.95771.7A93C000.00000002.mdmp") Found reference to API (Indicator: "SetThreadDescription"; Source: "00000000-00000584.00000000.95771.7A93C000.00000002.mdmp") Found reference to API (Indicator: "GetUserPreferredUILanguages"; Source: "00000000-00000584.00000000.95771.7A93C000.00000002.mdmp") Found reference to API (Indicator: "SHGetKnownFolderPath"; Source: "00000000-00000584.00000000.95771.7A93C000.00000002.mdmp") Found reference to API (Indicator: "GetSystemTimePreciseAsFileTime"; Source: "00000000-00000584.00000000.95771.7A93C000.00000002.mdmp") Found reference to API (Indicator: "CreateWaitableTimerExW"; Source: "00000000-00000584.00000000.95771.7A93C000.00000002.mdmp") Found reference to API (Indicator: "CreateWaitableTimerW"; Source: "00000000-00000584.00000000.95771.7A93C000.00000002.mdmp") Found reference to API (Indicator: "SetWaitableTimerEx"; Source: "00000000-00000584.00000000.95771.7A93C000.00000002.mdmp") Found reference to API (Indicator: "SetWaitableTimer"; Source: "00000000-00000584.00000000.95771.7A93C000.00000002.mdmp") Found reference to API (Indicator: "CoCreateInstance"; Source: "00000000-00000584.00000000.95771.7A93C000.00000002.mdmp") Found reference to API (Indicator: "GetSaveFileNameW"; Source: "00000000-00000584.00000000.95771.7A93C000.00000002.mdmp, 00000000-00000584.00000000.95771.A2B51000.00000004.mdmp") Found reference to API (Indicator: "GetOpenFileNameW"; Source: "00000000-00000584.00000000.95771.7A93C000.00000002.mdmp, 00000000-00000584.00000000.95771.A2B51000.00000004.mdmp") Found reference to API (Indicator: "CreateProcess"; Source: "00000000-00000584.00000000.95771.7A93C000.00000002.mdmp") Found reference to API (Indicator: "GetExitCodeProcess"; Source: "00000000-00000584.00000000.95771.7A93C000.00000002.mdmp") Found reference to API (Indicator: "CoInitialize"; Source: "00000000-00000584.00000000.95771.7A93C000.00000002.mdmp") Found reference to API (Indicator: "GetTickCount64"; Source: "00000000-00000584.00000000.95771.7A93C000.00000002.mdmp") Found reference to API (Indicator: "AddVectoredExceptionHandler"; Source: "00000000-00000584.00000000.95771.7A93C000.00000002.mdmp, 00000000-00000584.00000000.95771.A2B51000.00000004.mdmp") Found reference to API (Indicator: "RemoveVectoredExceptionHandler"; Source: "00000000-00000584.00000000.95771.7A93C000.00000002.mdmp") Found reference to API (Indicator: "RegCloseKey"; Source: "00000000-00000584.00000000.95771.A2B51000.00000004.mdmp") Found reference to API (Indicator: "RegOpenKeyExW"; Source: "00000000-00000584.00000000.95771.A2B51000.00000004.mdmp") Found reference to API (Indicator: "RegQueryValueExW"; Source: "00000000-00000584.00000000.95771.A2B51000.00000004.mdmp") Found reference to API (Indicator: "BCryptGenRandom"; Source: "00000000-00000584.00000000.95771.A2B51000.00000004.mdmp") Found reference to API (Indicator: "BitBlt"; Source: "00000000-00000584.00000000.95771.A2B51000.00000004.mdmp") Found reference to API (Indicator: "CreateCompatibleBitmap"; Source: "00000000-00000584.00000000.95771.A2B51000.00000004.mdmp") Found reference to API (Indicator: "CreateCompatibleDC"; Source: "00000000-00000584.00000000.95771.A2B51000.00000004.mdmp") Found reference to API (Indicator: "CreateFontIndirectW"; Source: "00000000-00000584.00000000.95771.A2B51000.00000004.mdmp") Found reference to API (Indicator: "CreateSolidBrush"; Source: "00000000-00000584.00000000.95771.A2B51000.00000004.mdmp") Found reference to API (Indicator: "DeleteDC"; Source: "00000000-00000584.00000000.95771.A2B51000.00000004.mdmp") Found reference to API (Indicator: "DeleteObject"; Source: "00000000-00000584.00000000.95771.A2B51000.00000004.mdmp") Found reference to API (Indicator: "GetDIBits"; Source: "00000000-00000584.00000000.95771.A2B51000.00000004.mdmp") Found reference to API (Indicator: "GetDeviceCaps"; Source: "00000000-00000584.00000000.95771.A2B51000.00000004.mdmp") Found reference to API (Indicator: "GetTextExtentPoint32A"; Source: "00000000-00000584.00000000.95771.A2B51000.00000004.mdmp") Found reference to API (Indicator: "SelectObject"; Source: "00000000-00000584.00000000.95771.A2B51000.00000004.mdmp") Found reference to API (Indicator: "GetAdaptersAddresses"; Source: "00000000-00000584.00000000.95771.A2B51000.00000004.mdmp") Found reference to API (Indicator: "AssignProcessToJobObject"; Source: "00000000-00000584.00000000.95771.A2B51000.00000004.mdmp") Found reference to API (Indicator: "AttachConsole"; Source: "00000000-00000584.00000000.95771.A2B51000.00000004.mdmp") Found reference to API (Indicator: "Beep"; Source: "00000000-00000584.00000000.95771.A2B51000.00000004.mdmp") Found reference to API (Indicator: "CancelIo"; Source: "00000000-00000584.00000000.95771.A2B51000.00000004.mdmp") Found reference to API (Indicator: "CloseHandle"; Source: "00000000-00000584.00000000.95771.A2B51000.00000004.mdmp") Found reference to API (Indicator: "CompareStringA"; Source: "00000000-00000584.00000000.95771.A2B51000.00000004.mdmp") Found reference to API (Indicator: "ConvertThreadToFiber"; Source: "00000000-00000584.00000000.95771.A2B51000.00000004.mdmp") Found reference to API (Indicator: "CopyFileExW"; Source: "00000000-00000584.00000000.95771.A2B51000.00000004.mdmp") Found reference to API (Indicator: "CreateDirectoryW"; Source: "00000000-00000584.00000000.95771.A2B51000.00000004.mdmp") Found reference to API (Indicator: "CreateEventA"; Source: "00000000-00000584.00000000.95771.A2B51000.00000004.mdmp") Found reference to API (Indicator: "CreateEventW"; Source: "00000000-00000584.00000000.95771.A2B51000.00000004.mdmp") Found reference to API (Indicator: "CreateFiber"; Source: "00000000-00000584.00000000.95771.A2B51000.00000004.mdmp") Found reference to API (Indicator: "CreateFileA"; Source: "00000000-00000584.00000000.95771.A2B51000.00000004.mdmp") Found reference to API (Indicator: "CreateFileW"; Source: "00000000-00000584.00000000.95771.A2B51000.00000004.mdmp")2b:Taab,"Tekken3Recomp.exe" loaded module "%WINDIR%\TEMP\VXOLE64.DLL" at base 7ffe6ac60000 "Tekken3Recomp.exe" loaded module "USER32.DLL" at base 7ffe9a9d0000 "Tekken3Recomp.exe" loaded module "SHCORE.DLL" at base 7ffe9c730000 "Tekken3Recomp.exe" loaded module "DWMAPI.DLL" at base 7ffe974a0000 "Tekken3Recomp.exe" loaded module "GDI32.DLL" at base 7ffe9c840000 "Tekken3Recomp.exe" loaded module "DXGI.DLL" at base 7ffe97a60000 "Tekken3Recomp.exe" loaded module "EXT-MS-WIN-CORE-RESOURCEPOLICY-L1-1-0.DLL" at base 7ffe97590000 "Tekken3Recomp.exe" loaded module "RPCRT4.DLL" at base 7ffe9b160000 "Tekken3Recomp.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 7ffe97270000 "Tekken3Recomp.exe" loaded module "KERNEL32.DLL" at base 7ffe9a910000 "Tekken3Recomp.exe" loaded module "CFGMGR32.DLL" at base 7ffe996c0000 "Tekken3Recomp.exe" loaded module "HID.DLL" at base 7ffe979d0000 "Tekken3Recomp.exe" loaded module "XINPUT1_4.DLL" at base 7ffe83c40000 "Tekken3Recomp.exe" loaded module "EXT-MS-WIN-MININPUT-INPUTHOST-L1-1-1.DLL" at base 7ffe944c0000 "Tekken3Recomp.exe" loaded module "EXT-MS-WIN-RTCORE-NTUSER-WINDOW-EXT-L1-1-0.DLL" at base 7ffe9a9d0000 "Tekken3Recomp.exe" loaded module "API-MS-WIN-CORE-COM-L1-1-0.DLL" at base 7ffe9ac00000 "Tekken3Recomp.exe" loaded module "EXT-MS-WIN-MININPUT-INPUTHOST-L1-1-0.DLL" at base 7ffe944c0000 "Tekken3Recomp.exe" loaded module "%WINDIR%\SYSTEM32\DINPUT8.DLL" at base 7ffe7bad0000 "Tekken3Recomp.exe" loaded module "SETUPAPI.DLL" at base 7ffe9a0d0000 "Tekken3Recomp.exe" loaded module "WINMM.DLL" at base 7ffe90040000 "Tekken3Recomp.exe" loaded module "%WINDIR%\SYSTEM32\SENSORSAPI.DLL" at base 7ffe6abf0000 "Tekken3Recomp.exe" loaded module "%WINDIR%\SYSTEM32\PORTABLEDEVICETYPES.DLL" at base 7ffe8a1a0000 "Tekken3Recomp.exe" loaded module "%WINDIR%\SYSTEM32\DEVICEACCESS.DLL" at base 7ffe85150000 "Tekken3Recomp.exe" loaded module "OPENGL32.DLL" at base 7ffe6ad00000 "Tekken3Recomp.exe" loaded module "OPENGL32" at base 7ffe6ad00000 "Tekken3Recomp.exe" loaded module "GDI32" at base 7ffe9c840000 "Tekken3Recomp.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 7ffe99a50000 "Tekken3Recomp.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 7ffe99a50000 "Tekken3Recomp.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-2" at base 7ffe99a50000 "Tekken3Recomp.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 7ffe99a50000 "Tekken3Recomp.exe" loaded module "KERNEL32" at base 7ffe9a910000 "Tekken3Recomp.exe" loaded module "VM3DGL64.DLL" at base 7ffe68000000 "Tekken3Recomp.exe" loaded module "VM3DGLHELPER64.DLL" at base 7ffe759f0000 "Tekken3Recomp.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-2" at base 7ffe98c800002c:T43c,Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; File: "Tekken3Recomp.exe") Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; File: "Tekken3Recomp.exe") Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; File: "Tekken3Recomp.exe") Found reference to API "SDL_Vulkan_LoadLibrary failed (no Vulkan ICD?)" (Indicator: "LoadLibrary"; Source: "00000000-00000584.00000000.95771.7A93C000.00000002.mdmp") Found reference to API "LoadLibrary(%s) failed: %lu" (Indicator: "LoadLibrary"; Source: "00000000-00000584.00000000.95771.7A93C000.00000002.mdmp") Found reference to API "SDL_Vulkan_LoadLibrary failed" (Indicator: "LoadLibrary"; Source: "00000000-00000584.00000000.95771.7A93C000.00000002.mdmp") Found reference to API "Vulkan: SDL_Vulkan_LoadLibrary failed!" (Indicator: "LoadLibrary"; Source: "00000000-00000584.00000000.95771.7A93C000.00000002.mdmp") Found reference to API "SDL_EGL_LoadLibraryOnly() has not been called or has failed." (Indicator: "LoadLibrary"; Source: "00000000-00000584.00000000.95771.7A93C000.00000002.mdmp")2d:T87e,"Tekken3Recomp.exe" (Access type: "OPEN"; Path: "HKLM"; Key: ""; Value: "") "Tekken3Recomp.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\SETUP"; Key: ""; Value: "") "Tekken3Recomp.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\ENUM\ACPI\PNP0303\4&25EE97C0&0"; Key: ""; Value: "") "Tekken3Recomp.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\ENUM\ACPI\VMW0003\4&25EE97C0&0"; Key: ""; Value: "") "Tekken3Recomp.exe" (Access type: "OPEN"; Path: "HKCU\CLSID\{0000032A-0000-0000-C000-000000000046}"; Key: ""; Value: "") "Tekken3Recomp.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{0000032A-0000-0000-C000-000000000046}"; Key: ""; Value: "") "Tekken3Recomp.exe" (Access type: "OPEN"; Path: "HKCU\WOW6432NODE\CLSID\{0000032A-0000-0000-C000-000000000046}"; Key: ""; Value: "") "Tekken3Recomp.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{0000032A-0000-0000-C000-000000000046}"; Key: ""; Value: "") "Tekken3Recomp.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\PACKAGEDCOM"; Key: ""; Value: "") "Tekken3Recomp.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\PACKAGEDCOM\TREATASCLASSINDEX"; Key: ""; Value: "") "Tekken3Recomp.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\PACKAGEDCOM\CLASSINDEX"; Key: ""; Value: "") "Tekken3Recomp.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\PACKAGEDCOM\CLASSINDEX\{0000032A-0000-0000-C000-000000000046}"; Key: ""; Value: "") "Tekken3Recomp.exe" (Access type: "OPEN"; Path: "HKCU\CLSID\{00000344-0000-0000-C000-000000000046}"; Key: ""; Value: "") "Tekken3Recomp.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{00000344-0000-0000-C000-000000000046}"; Key: ""; Value: "") "Tekken3Recomp.exe" (Access type: "OPEN"; Path: "HKCU\WOW6432NODE\CLSID\{00000344-0000-0000-C000-000000000046}"; Key: ""; Value: "") "Tekken3Recomp.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{00000344-0000-0000-C000-000000000046}"; Key: ""; Value: "") "Tekken3Recomp.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\PACKAGEDCOM\CLASSINDEX\{00000344-0000-0000-C000-000000000046}"; Key: ""; Value: "")2e:Ta48,"Tekken3Recomp.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\SETUP"; Key: "SYSTEMSETUPINPROGRESS"; Value: "") "Tekken3Recomp.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\ENUM\ACPI\PNP0303\4&25EE97C0&0"; Key: "DEVICEDESC"; Value: "") "Tekken3Recomp.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\ENUM\ACPI\VMW0003\4&25EE97C0&0"; Key: "DEVICEDESC"; Value: "") "Tekken3Recomp.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{77A1C827-FCD2-4689-8915-9D613CC5FA3E}"; Key: ""; Value: "") "Tekken3Recomp.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{77A1C827-FCD2-4689-8915-9D613CC5FA3E}\INPROCSERVER32"; Key: "INPROCSERVER32"; Value: "") "Tekken3Recomp.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{77A1C827-FCD2-4689-8915-9D613CC5FA3E}\INPROCSERVER32"; Key: ""; Value: "") "Tekken3Recomp.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{77A1C827-FCD2-4689-8915-9D613CC5FA3E}\INPROCSERVER32"; Key: "THREADINGMODEL"; Value: "") "Tekken3Recomp.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{77A1C827-FCD2-4689-8915-9D613CC5FA3E}"; Key: "APPID"; Value: "") "Tekken3Recomp.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\WMI\SECURITY"; Key: "C88B592B-6090-480F-A839-CA2434DE5844"; Value: "") "Tekken3Recomp.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\WMI\SECURITY"; Key: "B12F2C9F-D3A1-447B-92F8-DCA5F6C31429"; Value: "") "Tekken3Recomp.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\WMI\SECURITY"; Key: "096772BA-B6D9-4C54-B776-3D070EFB40EC"; Value: "") "Tekken3Recomp.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\WMI\SECURITY"; Key: "D8900E18-36CB-4548-966F-13F068D1F78E"; Value: "") "Tekken3Recomp.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\WMI\SECURITY"; Key: "E5468423-A26C-5D0B-BBD5-24F8A8935C34"; Value: "") "Tekken3Recomp.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{0B91A74B-AD7C-4A9D-B563-29EEF9167172}"; Key: ""; Value: "") "Tekken3Recomp.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{0B91A74B-AD7C-4A9D-B563-29EEF9167172}\INPROCSERVER32"; Key: "INPROCSERVER32"; Value: "") "Tekken3Recomp.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{0B91A74B-AD7C-4A9D-B563-29EEF9167172}\INPROCSERVER32"; Key: ""; Value: "") "Tekken3Recomp.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{0B91A74B-AD7C-4A9D-B563-29EEF9167172}\INPROCSERVER32"; Key: "THREADINGMODEL"; Value: "")2f:T532,The analysis shows indicators which can be used as execution guardrails to ensure that payload only executes against intended targets/system. Matched sigs: Contains ability to delay execution by waiting for signal/timeout (API string) Matched sigs: Able to identify virtual environment by using user activity (API string) Matched sigs: Contains ability to retrieve the time elapsed since the system was started (API string) Matched sigs: Contains ability to detect presence of virtual environment (API string) Matched sigs: Able to retrieve information set for devices (API string) Matched sigs: Able to detect virtual machine (string) Matched sigs: Reference to an external IP address lookup service identified Matched sigs: Contains a Wine emulator-related string Matched sigs: Queries process mitigation policy via NtQueryInformationProcess Matched sigs: Calls an API typically used to find device information Matched sigs: Calls an API typically used to enumerate device information Matched sigs: Calls an API typically used to retrieve a specified Plug and Play device property (anti-VM) Matched sigs: Attempts to call APIs commonly associated with anti-analysis and evasion techniques Matched sigs: Attempts to detect virtual machine (file access) Matched sigs: Contains ability to detect sandbox (imports API)30:T6eb,"Tekken3Recomp.exe" trying to access non-existent file "C:\BCRYPT.DLL" "Tekken3Recomp.exe" trying to access non-existent file "C:\bcrypt.dll" "Tekken3Recomp.exe" trying to access non-existent file "C:\DBGHELP.DLL" "Tekken3Recomp.exe" trying to access non-existent file "C:\dbghelp.dll" "Tekken3Recomp.exe" trying to access non-existent file "C:\IPHLPAPI.DLL" "Tekken3Recomp.exe" trying to access non-existent file "C:\OPENGL32.DLL" "Tekken3Recomp.exe" trying to access non-existent file "C:\OPENGL32.dll" "Tekken3Recomp.exe" trying to access non-existent file "C:\VERSION.DLL" "Tekken3Recomp.exe" trying to access non-existent file "C:\VERSION.dll" "Tekken3Recomp.exe" trying to access non-existent file "C:\WINMM.DLL" "Tekken3Recomp.exe" trying to access non-existent file "C:\WINMM.dll" "Tekken3Recomp.exe" trying to access non-existent file "C:\WINMMBASE.DLL" "Tekken3Recomp.exe" trying to access non-existent file "C:\WINMMBASE.dll" "Tekken3Recomp.exe" trying to access non-existent file "C:\GLU32.DLL" "Tekken3Recomp.exe" trying to access non-existent file "C:\GLU32.dll" "Tekken3Recomp.exe" trying to access non-existent file "C:\FLTLIB.DLL" "Tekken3Recomp.exe" trying to access non-existent file "C:\MSVCP140.DLL" "Tekken3Recomp.exe" trying to access non-existent file "C:\MSVCP140.dll" "Tekken3Recomp.exe" trying to access non-existent file "C:\VCRUNTIME140.DLL" "Tekken3Recomp.exe" trying to access non-existent file "C:\VCRUNTIME140.dll" "Tekken3Recomp.exe" trying to access non-existent file "C:\VCRUNTIME140_1.DLL" "Tekken3Recomp.exe" trying to access non-existent file "C:\VCRUNTIME140_1.dll" "Tekken3Recomp.exe" trying to access non-existent file "C:\CRYPTSP.DLL" "Tekken3Recomp.exe" trying to access non-existent file "C:\DWMAPI.DLL"31:Tf5e,Found reference to API "WSAStartup" (Indicator: "wsastartup"; File: "Tekken3Recomp.exe") Found reference to API "WSACleanup" (Indicator: "wsacleanup"; File: "Tekken3Recomp.exe") Found reference to API "WSAGetLastError" (Indicator: "wsagetlasterror"; File: "Tekken3Recomp.exe") Found reference to API "empty bind (bind='%s' peer='%s' session=%u)" (Indicator: " bind "; Source: "00000000-00000584.00000000.95771.7A93C000.00000002.mdmp") Found reference to API "psxrecomp: rb verify accept peer RESOLVED tip=%u (local_post=%u" (Indicator: " accept "; Source: "00000000-00000584.00000000.95771.7A93C000.00000002.mdmp") Found reference to API "psxrecomp: ERROR: outgoing overlay snapshot could not be retained after shutdown retries" (Indicator: " shutdown "; Source: "00000000-00000584.00000000.95771.7A93C000.00000002.mdmp") Found reference to API "psxrecomp: ERROR: periodic overlay snapshot could not be queued for shutdown retry" (Indicator: " shutdown "; Source: "00000000-00000584.00000000.95771.7A93C000.00000002.mdmp") Found reference to API "Waiting for the other player to accept the seat swap" (Indicator: " accept "; Source: "00000000-00000584.00000000.95771.7A93C000.00000002.mdmp") Found reference to API "Downloading runs the host's code on your machine. Only accept mods from a host you trust." (Indicator: " accept "; Source: "00000000-00000584.00000000.95771.7A93C000.00000002.mdmp") Found reference to API "Forgot to shutdown Platform backend?" (Indicator: " shutdown "; Source: "00000000-00000584.00000000.95771.7A93C000.00000002.mdmp") Found reference to API "Forgot to shutdown Renderer backend?" (Indicator: " shutdown "; Source: "00000000-00000584.00000000.95771.7A93C000.00000002.mdmp") Found reference to API "!"Cannot bind a depth texture with more than 255 layers!"" (Indicator: " bind "; Source: "00000000-00000584.00000000.95771.7A93C000.00000002.mdmp") Found reference to API ". In Accept Drag and Drop, window %u, enabled Full OLE IDropTarget" (Indicator: " accept "; Source: "00000000-00000584.00000000.95771.7A93C000.00000002.mdmp") Found reference to API ". In Accept Drag and Drop, window %u, disabled Full OLE IDropTarget" (Indicator: " accept "; Source: "00000000-00000584.00000000.95771.7A93C000.00000002.mdmp") Found reference to API ". In Accept Drag and Drop, window %u, %s Fallback WM_DROPFILES" (Indicator: " accept "; Source: "00000000-00000584.00000000.95771.7A93C000.00000002.mdmp") Found reference to API "Unable to bind memory for texture!" (Indicator: " bind "; Source: "00000000-00000584.00000000.95771.7A93C000.00000002.mdmp") Found reference to API "Failed to bind memory for buffer!" (Indicator: " bind "; Source: "00000000-00000584.00000000.95771.7A93C000.00000002.mdmp") Found reference to API "Device was already lost and can't accept new opens" (Indicator: " accept "; Source: "00000000-00000584.00000000.95771.7A93C000.00000002.mdmp") Found reference to API "Could not bind EGL API" (Indicator: " bind "; Source: "00000000-00000584.00000000.95771.7A93C000.00000002.mdmp") Found reference to API "Couldn't send rumble packet" (Indicator: " send "; Source: "00000000-00000584.00000000.95771.7A93C000.00000002.mdmp") Found reference to API "Couldn't send acquire command" (Indicator: " send "; Source: "00000000-00000584.00000000.95771.7A93C000.00000002.mdmp") Found reference to API "Couldn't send LED packet" (Indicator: " send "; Source: "00000000-00000584.00000000.95771.7A93C000.00000002.mdmp") Found reference to API "Couldn't send rumble, size %d is greater than %d" (Indicator: " send "; Source: "00000000-00000584.00000000.95771.7A93C000.00000002.mdmp") Found reference to API "Tried to send rumble with invalid size" (Indicator: " send "; Source: "00000000-00000584.00000000.95771.7A93C000.00000002.mdmp") Found reference to API "Couldn't send command packet" (Indicator: " send "; Source: "00000000-00000584.00000000.95771.7A93C000.00000002.mdmp")32:T538,Heuristic match: "system.ch" Heuristic match: "api.ipify.org" Heuristic match: "compile_overlays.py" Heuristic match: "stun.l.google.com" Heuristic match: "psxrecomp/psxrecomp_cli.py" Pattern match: "https://github.com/technicallycomputers/retcomm-toolchains" Pattern match: "https://github.com/technicallycomputers/retcomm-toolchains/releases" Pattern match: "https://github.com/superg/redumper" Pattern match: "https://github.com/ocornut/imgui/blob/master/docs/faq.md#qa-usage" Heuristic match: "sdl.gpu.buffer.create.name" Heuristic match: "sdl.gpu.transferbuffer.create.name" Heuristic match: "sdl.gpu.device.create.name" Heuristic match: "sdl.renderer.create.name" Heuristic match: "sdl.renderer.name" Heuristic match: "sdl.thread.create.name" Pattern match: "https://devblogs.microsoft.com/pix/winpixeventruntime/" Heuristic match: "sdl.gpu.device.name" Heuristic match: "sdl.gpu.computepipeline.create.name" Heuristic match: "sdl.gpu.graphicspipeline.create.name" Heuristic match: "sdl.gpu.texture.create.name" Heuristic match: "sdl.gpu.sampler.create.name" Heuristic match: "sdl.gpu.shader.create.name" Heuristic match: "sdl.app.metadata.name" Pattern match: "https://gcc.gnu.org/bugs/" Pattern match: "http://www.w3.org/2001/xmlschema-instance" Heuristic match: "t .qa" Heuristic match: ".data.rel.ro"33:T434,Found URL "https://http://author" - Source: "00000000-00000584.00000000.95771.7A93C000.00000002.mdmp") Found URL "https://github.com/technicallycomputers/retcomm-toolchainstechnicallycomputers/retcomm-toolchainstoolchain" - Source: "00000000-00000584.00000000.95771.7A93C000.00000002.mdmp") Found URL "https://github.com/technicallycomputers/retcomm-toolchains/releasesopen" - Source: "00000000-00000584.00000000.95771.7A93C000.00000002.mdmp") Found URL "https://github.com/superg/redumper)." - Source: "00000000-00000584.00000000.95771.7A93C000.00000002.mdmp") Found URL "https://github.com/superg/redumperopen" - Source: "00000000-00000584.00000000.95771.7A93C000.00000002.mdmp") Found URL "https://github.com/ocornut/imgui/blob/master/docs/faq.md" - Source: "00000000-00000584.00000000.95771.7A93C000.00000002.mdmp") Found URL "https://devblogs.microsoft.com/pix/winpixeventruntime/could" - Source: "00000000-00000584.00000000.95771.7A93C000.00000002.mdmp") Found URL "https://gcc.gnu.org/bugs/):" - Source: "00000000-00000584.00000000.95771.7A93C000.00000002.mdmp")34:T536,Found reference to API "CreateCompatibleDC" (Indicator: "CreateCompatibleDC"; File: "Tekken3Recomp.exe") Found reference to API "CreateDCW" (Indicator: "CreateDC"; File: "Tekken3Recomp.exe") Found reference to API "CreateCompatibleBitmap" (Indicator: "CreateCompatibleBitmap"; File: "Tekken3Recomp.exe") Found reference to API "GetDIBits" (Indicator: "GetDIBits"; File: "Tekken3Recomp.exe") Found reference to API "BitBlt" (Indicator: "BitBlt"; File: "Tekken3Recomp.exe") Found reference to API "GetDC" (Indicator: "GetDC"; File: "Tekken3Recomp.exe") Found reference to API "GetDesktopWindow" (Indicator: "GetDesktopWindow"; File: "Tekken3Recomp.exe") Found reference to API "BitBlt" (Indicator: "BitBlt"; Source: "00000000-00000584.00000000.95771.A2B51000.00000004.mdmp") Found reference to API "CreateCompatibleBitmap" (Indicator: "CreateCompatibleBitmap"; Source: "00000000-00000584.00000000.95771.A2B51000.00000004.mdmp") Found reference to API "CreateCompatibleDC" (Indicator: "CreateCompatibleDC"; Source: "00000000-00000584.00000000.95771.A2B51000.00000004.mdmp") Found reference to API "CreateDCW" (Indicator: "CreateDC"; Source: "00000000-00000584.00000000.95771.A2B51000.00000004.mdmp") Found reference to API "GetDIBits" (Indicator: "GetDIBits"; Source: "00000000-00000584.00000000.95771.A2B51000.00000004.mdmp")35:T586,Found reference to API "GetProcAddress" (Indicator: "GetProcAddress"; File: "Tekken3Recomp.exe") Found reference to API "wglGetProcAddress" (Indicator: "GetProcAddress"; Source: "00000000-00000584.00000000.95771.7A93C000.00000002.mdmp") Found reference to API "GetProcAddress failed for CoIncrementMTAUsage" (Indicator: "GetProcAddress"; Source: "00000000-00000584.00000000.95771.7A93C000.00000002.mdmp") Found reference to API "GetProcAddress failed for RoGetActivationFactory" (Indicator: "GetProcAddress"; Source: "00000000-00000584.00000000.95771.7A93C000.00000002.mdmp") Found reference to API "GetProcAddress failed for WindowsCreateStringReference" (Indicator: "GetProcAddress"; Source: "00000000-00000584.00000000.95771.7A93C000.00000002.mdmp") Found reference to API "GetProcAddress failed for WindowsDeleteString" (Indicator: "GetProcAddress"; Source: "00000000-00000584.00000000.95771.7A93C000.00000002.mdmp") Found reference to API "GetProcAddress failed for WindowsGetStringRawBuffer" (Indicator: "GetProcAddress"; Source: "00000000-00000584.00000000.95771.7A93C000.00000002.mdmp") Found reference to API "eglGetProcAddress" (Indicator: "GetProcAddress"; Source: "00000000-00000584.00000000.95771.7A93C000.00000002.mdmp") Found reference to API "Could not retrieve EGL function eglGetProcAddress" (Indicator: "GetProcAddress"; Source: "00000000-00000584.00000000.95771.7A93C000.00000002.mdmp")36:T6f8,Found reference to API "GetCurrentDirectoryW" (Indicator: "GetCurrentDirectory"; File: "Tekken3Recomp.exe") Found reference to API "GetFileSizeEx" (Indicator: "GetFileSize"; File: "Tekken3Recomp.exe") Found reference to API "GetFileInformationByHandle" (Indicator: "GetFileInformationByHandle"; File: "Tekken3Recomp.exe") Found reference to API "GetCurrentDirectoryA" (Indicator: "GetCurrentDirectory"; File: "Tekken3Recomp.exe") Found reference to API "GetFileAttributesExA" (Indicator: "GetFileAttributes"; File: "Tekken3Recomp.exe") Found reference to API "GetFileAttributesW" (Indicator: "GetFileAttributes"; File: "Tekken3Recomp.exe") Found reference to API "GetTempPathW" (Indicator: "GetTempPath"; File: "Tekken3Recomp.exe") Found reference to API "GetFileAttributesA" (Indicator: "GetFileAttributes"; File: "Tekken3Recomp.exe") Found reference to API "GetFileAttributesExW" (Indicator: "GetFileAttributes"; File: "Tekken3Recomp.exe") Found reference to API "GetFileVersionInfoSizeA" (Indicator: "GetFileVersionInfo"; File: "Tekken3Recomp.exe") Found reference to API "GetFileVersionInfoSizeA" (Indicator: "GetFileVersionInfoSize"; File: "Tekken3Recomp.exe") Found reference to API "GetFileVersionInfoA" (Indicator: "GetFileVersionInfo"; File: "Tekken3Recomp.exe") Found reference to API "GetCurrentDirectoryW failed" (Indicator: "GetCurrentDirectory"; Source: "00000000-00000584.00000000.95771.7A93C000.00000002.mdmp") Found reference to API "SteamAPI_ISteamRemoteStorage_GetFileSize" (Indicator: "GetFileSize"; Source: "00000000-00000584.00000000.95771.7A93C000.00000002.mdmp") Found reference to API "Could not load function SteamAPI_ISteamRemoteStorage_GetFileSize" (Indicator: "GetFileSize"; Source: "00000000-00000584.00000000.95771.7A93C000.00000002.mdmp")37:Te8e,Found string "

" (Indicator: "password"; File: "Tekken3Recomp.exe") Found string " granting current route" (Indicator: "route"; Source: "00000000-00000584.00000000.95771.7A93C000.00000002.mdmp") Found string "PING" (Indicator: "ping"; Source: "00000000-00000584.00000000.95771.7A93C000.00000002.mdmp")39:T1389,"Tekken3Recomp.exe" (Access type: "SETVAL"; Path: "HKCU\SYSTEM\CURRENTCONTROLSET\CONTROL\MEDIAPROPERTIES\PRIVATEPROPERTIES\DIRECTINPUT\VID_0E0F&PID_0003\CALIBRATION\0"; Key: "GUID"; Value: "7051DC0E63C5F111800144455354000000") "Tekken3Recomp.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\VMWARE, INC.\GUESTGLDRIVER\APPLICATION SETTINGS\SLDWORKS"; Key: "EXTENSION:GL_NV_PRIMITIVE_RESTART"; Value: "disable") "Tekken3Recomp.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\VMWARE, INC.\GUESTGLDRIVER\APPLICATION SETTINGS\HEAVEN"; Key: "EXTENSION:GL_EXT_FRAMEBUFFER_MULTISAMPLE"; Value: "enable") "Tekken3Recomp.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\VMWARE, INC.\GUESTGLDRIVER\APPLICATION SETTINGS\HEAVEN"; Key: "ALLOWGLSLEXTENSIONDIRECTIVEMIDSHADER"; Value: "enable") "Tekken3Recomp.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\VMWARE, INC.\GUESTGLDRIVER\APPLICATION SETTINGS\HEAVEN64"; Key: "EXTENSION:GL_EXT_FRAMEBUFFER_MULTISAMPLE"; Value: "enable") "Tekken3Recomp.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\VMWARE, INC.\GUESTGLDRIVER\APPLICATION SETTINGS\HEAVEN64"; Key: "ALLOWGLSLEXTENSIONDIRECTIVEMIDSHADER"; Value: "enable") "Tekken3Recomp.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\VMWARE, INC.\GUESTGLDRIVER\APPLICATION SETTINGS\UNIGINE"; Key: "EXTENSION:GL_EXT_FRAMEBUFFER_MULTISAMPLE"; Value: "enable") "Tekken3Recomp.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\VMWARE, INC.\GUESTGLDRIVER\APPLICATION SETTINGS\UNIGINE"; Key: "ALLOWGLSLEXTENSIONDIRECTIVEMIDSHADER"; Value: "enable") "Tekken3Recomp.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\VMWARE, INC.\GUESTGLDRIVER\APPLICATION SETTINGS\VALLEY"; Key: "EXTENSION:GL_EXT_FRAMEBUFFER_MULTISAMPLE"; Value: "enable") "Tekken3Recomp.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\VMWARE, INC.\GUESTGLDRIVER\APPLICATION SETTINGS\VALLEY"; Key: "ALLOWGLSLEXTENSIONDIRECTIVEMIDSHADER"; Value: "enable") "Tekken3Recomp.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\VMWARE, INC.\GUESTGLDRIVER\APPLICATION SETTINGS\JK2SP"; Key: "EXTENSIONMAXYEAR"; Value: "D807000000") "Tekken3Recomp.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\VMWARE, INC.\GUESTGLDRIVER\APPLICATION SETTINGS\CODSP"; Key: "EXTENSIONMAXYEAR"; Value: "D807000000") "Tekken3Recomp.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\VMWARE, INC.\GUESTGLDRIVER\APPLICATION SETTINGS\CODSP_NOCD"; Key: "EXTENSIONMAXYEAR"; Value: "D807000000") "Tekken3Recomp.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\VMWARE, INC.\GUESTGLDRIVER\APPLICATION SETTINGS\VIEWPERF"; Key: "GLSLVERSION"; Value: "7800000000") "Tekken3Recomp.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\VMWARE, INC.\GUESTGLDRIVER\APPLICATION SETTINGS\GPUTEST"; Key: "GLSLVERSION"; Value: "8200000000") "Tekken3Recomp.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\VMWARE, INC.\GUESTGLDRIVER\APPLICATION SETTINGS\GPUTESTGUI"; Key: "GLSLVERSION"; Value: "8200000000") "Tekken3Recomp.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\VMWARE, INC.\GUESTGLDRIVER\APPLICATION SETTINGS\NOBELCLINICIANVIEWER"; Key: "EXTENSION:GL_ARB_TEXTURE_RG"; Value: "enable") "Tekken3Recomp.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\VMWARE, INC.\GUESTGLDRIVER\APPLICATION SETTINGS\PHOTOSHOP"; Key: "ALLOWGLSLEXTENSIONDIRECTIVEMIDSHADER"; Value: "enable") "Tekken3Recomp.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\VMWARE, INC.\GUESTGLDRIVER\APPLICATION SETTINGS\RECAP"; Key: "OPENGLPROFILE"; Value: "Compat") "Tekken3Recomp.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\VMWARE, INC.\GUESTGLDRIVER\APPLICATION SETTINGS\RECAP"; Key: "OPENGLVERSION"; Value: "2000000000") "Tekken3Recomp.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\VMWARE, INC.\GUESTGLDRIVER\APPLICATION SETTINGS\RECAP"; Key: "GLSLVERSION"; Value: "8200000000") "Tekken3Recomp.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\VMWARE, INC.\GUESTGLDRIVER\APPLICATION SETTINGS\SHADERTOYMARK"; Key: "OPENGLVERSION"; Value: "1E00000000") "Tekken3Recomp.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\VMWARE, INC.\GUESTGLDRIVER\APPLICATION SETTINGS\SWKOTOR"; Key: "EXTENSION:GL_ATI_FRAGMENT_SHADER"; Value: "disable") "Tekken3Recomp.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\VMWARE, INC.\GUESTGLDRIVER\APPLICATION SETTINGS\SPAZIO3D"; Key: "USE_SOFTWARE_XOR_COPYPIXELS"; Value: "0100000000") "Tekken3Recomp.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\VMWARE, INC.\GUESTGLDRIVER\APPLICATION SETTINGS\GLOBAL_MAPPER"; Key: "OPENGLPROFILE"; Value: "Compat") "Tekken3Recomp.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\VMWARE, INC.\GUESTGLDRIVER\APPLICATION SETTINGS\GLOBAL_MAPPER"; Key: "OPENGLVERSION"; Value: "2100000000") "Tekken3Recomp.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\VMWARE, INC.\GUESTGLDRIVER\APPLICATION SETTINGS\GLOBAL_MAPPER"; Key: "GLSLVERSION"; Value: "4A01000000") "Tekken3Recomp.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\VMWARE, INC.\GUESTGLDRIVER\APPLICATION SETTINGS"; Key: "SETTINGS.VERSION"; Value: "6B00000000")3a:T872,"Tekken3Recomp.exe" (Path: "HKCU\SOFTWARE\VMWARE, INC.\GUESTGLDRIVER\APPLICATION SETTINGS\") "Tekken3Recomp.exe" (Path: "HKCU\SOFTWARE\VMWARE, INC.\GUESTGLDRIVER\APPLICATION SETTINGS\SLDWORKS") "Tekken3Recomp.exe" (Path: "HKCU\SOFTWARE\VMWARE, INC.") "Tekken3Recomp.exe" (Path: "HKCU\SOFTWARE\VMWARE, INC.\GUESTGLDRIVER") "Tekken3Recomp.exe" (Path: "HKCU\SOFTWARE\VMWARE, INC.\GUESTGLDRIVER\APPLICATION SETTINGS") "Tekken3Recomp.exe" (Path: "HKCU\SOFTWARE\VMWARE, INC.\GUESTGLDRIVER\APPLICATION SETTINGS\HEAVEN") "Tekken3Recomp.exe" (Path: "HKCU\SOFTWARE\VMWARE, INC.\GUESTGLDRIVER\APPLICATION SETTINGS\HEAVEN64") "Tekken3Recomp.exe" (Path: "HKCU\SOFTWARE\VMWARE, INC.\GUESTGLDRIVER\APPLICATION SETTINGS\UNIGINE") "Tekken3Recomp.exe" (Path: "HKCU\SOFTWARE\VMWARE, INC.\GUESTGLDRIVER\APPLICATION SETTINGS\VALLEY") "Tekken3Recomp.exe" (Path: "HKCU\SOFTWARE\VMWARE, INC.\GUESTGLDRIVER\APPLICATION SETTINGS\JK2SP") "Tekken3Recomp.exe" (Path: "HKCU\SOFTWARE\VMWARE, INC.\GUESTGLDRIVER\APPLICATION SETTINGS\CODSP") "Tekken3Recomp.exe" (Path: "HKCU\SOFTWARE\VMWARE, INC.\GUESTGLDRIVER\APPLICATION SETTINGS\CODSP_NOCD") "Tekken3Recomp.exe" (Path: "HKCU\SOFTWARE\VMWARE, INC.\GUESTGLDRIVER\APPLICATION SETTINGS\VIEWPERF") "Tekken3Recomp.exe" (Path: "HKCU\SOFTWARE\VMWARE, INC.\GUESTGLDRIVER\APPLICATION SETTINGS\GPUTEST") "Tekken3Recomp.exe" (Path: "HKCU\SOFTWARE\VMWARE, INC.\GUESTGLDRIVER\APPLICATION SETTINGS\GPUTESTGUI") "Tekken3Recomp.exe" (Path: "HKCU\SOFTWARE\VMWARE, INC.\GUESTGLDRIVER\APPLICATION SETTINGS\NOBELCLINICIANVIEWER") "Tekken3Recomp.exe" (Path: "HKCU\SOFTWARE\VMWARE, INC.\GUESTGLDRIVER\APPLICATION SETTINGS\PHOTOSHOP") "Tekken3Recomp.exe" (Path: "HKCU\SOFTWARE\VMWARE, INC.\GUESTGLDRIVER\APPLICATION SETTINGS\RECAP") "Tekken3Recomp.exe" (Path: "HKCU\SOFTWARE\VMWARE, INC.\GUESTGLDRIVER\APPLICATION SETTINGS\SHADERTOYMARK") "Tekken3Recomp.exe" (Path: "HKCU\SOFTWARE\VMWARE, INC.\GUESTGLDRIVER\APPLICATION SETTINGS\SWKOTOR") "Tekken3Recomp.exe" (Path: "HKCU\SOFTWARE\VMWARE, INC.\GUESTGLDRIVER\APPLICATION SETTINGS\SPAZIO3D") "Tekken3Recomp.exe" (Path: "HKCU\SOFTWARE\VMWARE, INC.\GUESTGLDRIVER\APPLICATION SETTINGS\GLOBAL_MAPPER")3b:T400,AAABAAEAICAQnAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAAAAABgAAAGbmYAAAAAAAAAAABm5mAABu7mBmZmZmZmZmZgbu5gAAbu7m7u7u7u7u7u5u7uYAAG7u7u7u7u7u7u7u7u7mAAAG7u7u7u7u7u7u7u7uYAAABu7u7u7mZmZu7u7u7mAAAABu7u7u5gAAbu7u7uYAAAAAbu7u7uZmZm7u7u7mAAAAAG7u5m7u7u7uZm7u5gAAAABu5mAGbu7u7mBu7uYAAAAAbuYAAG5mZmZmZm7mAAAAAG7mYAZmZmZgbmBu5gAAAAAG7mAG7u7u5mZm7mAAAAAABG7mbu7u7u5gbuZAAAAAAAAGZmZmZmZmZmZgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==1b:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$23"}}],["$","$L24",null,{"initialData":{"schema_version":"1.0.15","sha256":"a94f8bc24901e6d52b03c79342b6ff38c7b5e486fd109d7cd1327c76f5604936","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"SUCCESS","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"suspicious","threat_score":35,"unified_at_epoch_ms":1791741773321,"unified_at":"2026-10-11T18:02:53.321Z","metadata":{"hashes":{"sha256":"a94f8bc24901e6d52b03c79342b6ff38c7b5e486fd109d7cd1327c76f5604936","sha1":"16f2f643cdbaa679e5068484120e5ee3aec5e06a","md5":"bb0ecb65250595a40662f9afe8f4b179","sha512":"38189164ca188151f6fbc00f3a9dfb19348f23fbe4b5f6f28f2519c5820e1d33d01e5fabae8ec7dd190df83a6d8b02a95ab26b4f02f1befb2f746083f6bcd824","ssdeep":"786432:dzwETg8Hop1zYMCCBvvvvv8vvvvvAvvvvvvvvvgvvvvv0vLoi4RjaiVSDgQJzRQn:dzwE08HorUMaiK","ssdeep_chunks":["786432:dzwETg8","786432:zwETg8H","786432:wETg8Ho","786432:ETg8Hop","786432:Tg8Hop1","786432:g8Hop1z","786432:8Hop1zY","786432:Hop1zYM","786432:op1zYMC","786432:p1zYMCC","786432:1zYMCCB","786432:zYMCCBv","786432:YMCCBvv","786432:MCCBvvv","786432:CCBvvvv","786432:CBvvvvv","786432:Bvvvvv8","786432:vvvvv8v","786432:vvvv8vv","786432:vvv8vvv","786432:vv8vvvv","786432:v8vvvvv","786432:8vvvvvA","786432:vvvvvAv","786432:vvvvAvv","786432:vvvAvvv","786432:vvAvvvv","786432:vAvvvvv","786432:Avvvvvv","786432:vvvvvvv","786432:vvvvvvg","786432:vvvvvgv","786432:vvvvgvv","786432:vvvgvvv","786432:vvgvvvv","786432:vgvvvvv","786432:gvvvvv0","786432:vvvvv0v","786432:vvvv0vL","786432:vvv0vLo","786432:vv0vLoi","786432:v0vLoi4","786432:0vLoi4R","786432:vLoi4Rj","786432:Loi4Rja","786432:oi4Rjai","786432:i4RjaiV","786432:4RjaiVS","786432:RjaiVSD","786432:jaiVSDg","786432:aiVSDgQ","786432:iVSDgQJ","786432:VSDgQJz","786432:SDgQJzR","786432:DgQJzRQ","786432:gQJzRQn","1572864:dzwETg8","1572864:zwETg8H","1572864:wETg8Ho","1572864:ETg8Hop","1572864:Tg8Hop1","1572864:g8Hop1z","1572864:8Hop1zY","1572864:Hop1zYM","1572864:op1zYMC","1572864:p1zYMCC","1572864:1zYMCCB","1572864:zYMCCBv","1572864:YMCCBvv","1572864:MCCBvvv","1572864:CCBvvvv","1572864:CBvvvvv","1572864:Bvvvvv8","1572864:vvvvv8v","1572864:vvvv8vv","1572864:vvv8vvv","1572864:vv8vvvv","1572864:v8vvvvv","1572864:8vvvvvA","1572864:vvvvvAv","1572864:vvvvAvv","1572864:vvvAvvv","1572864:vvAvvvv","1572864:vAvvvvv","1572864:Avvvvvv","1572864:vvvvvvv","1572864:vvvvvvg","1572864:vvvvvgv","1572864:vvvvgvv","1572864:vvvgvvv","1572864:vvgvvvv","1572864:vgvvvvv","1572864:gvvvvv0","1572864:vvvvv0v","1572864:vvvv0vL","1572864:vvv0vLo","1572864:vv0vLoi","1572864:v0vLoi4","1572864:0vLoi4R","1572864:vLoi4Rj","1572864:Loi4Rja","1572864:oi4Rjai","1572864:i4RjaiV","1572864:4RjaiVS","1572864:RjaiVSD","1572864:jaiVSDg","1572864:aiVSDgQ","1572864:iVSDgQJ","1572864:VSDgQJz","1572864:SDgQJzR","1572864:DgQJzRQ","1572864:gQJzRQn","786432:dzwE08H","786432:zwE08Ho","786432:wE08Hor","786432:E08HorU","786432:08HorUM","786432:8HorUMa","786432:HorUMai","786432:orUMaiK"],"imphash":"a7f131ccd7dea39ca9d651e8503b0834"},"file_info":{"file_name":"Tekken3Recomp.exe","file_type":["peexe","64bits","executable"],"file_type_id":"64-bit exe","file_size":28039889,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1791741645000,"last_seen":1791741645000,"last_multi_scan":1791741645000}},"detections":{"summary":{"verdict":"suspicious","score":35,"tags":["evasive"]},"stats":{"av":{"malicious_count":0,"suspicious_count":0,"total_engines":24},"attributions":{"malware_families_count":0,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":75},"sandbox_signatures":{"informative_count":160,"suspicious_count":12,"malicious_count":1,"total":173},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"ahnlab":{"name":"AhnLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"aurora":{"name":"Aurora","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"cmc":{"name":"CMC","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"undetected","status":"clean","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"gridinsoft":{"name":"Gridinsoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"lionic":{"name":"Lionic","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sentinelone":{"name":"SentinelOne","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trellix":{"name":"Trellix","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"varist":{"name":"Varist","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"xcitium":{"name":"Xcitium","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{},"mitre_attacks":[{"tactic":"Reconnaissance","technique":"Gather Victim Network Information","attack_id":"T1590","attack_id_wiki":"https://attack.mitre.org/techniques/T1590","identifiers":[{"type":"informative","value":"Able to access user sensitive domain"}],"sources":[{"report_type":"sandbox","report_id":"6acbcec9c40418cb9d07122c"}]},{"tactic":"Execution","technique":"Native API","attack_id":"T1106","attack_id_wiki":"https://attack.mitre.org/techniques/T1106","identifiers":[{"type":"informative","value":"Contains ability to execute an application (API string)"},{"type":"informative","value":"Calls an API typically used to find a resource in a module"},{"type":"suspicious","value":"Imports suspicious APIs"},{"type":"informative","value":"Contains ability to retrieve the fully qualified path of module (API string)"},{"type":"informative","value":"Contains ability to create/open files (API string)"},{"type":"informative","value":"Contains ability to retrieve address of exported function from a DLL (API string)"},{"type":"informative","value":"Contains ability to set/get the last-error code for a calling thread (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve function addresses"},{"type":"informative","value":"Calls an API typically used to load a resource in memory"},{"type":"informative","value":"Contains ability to execute Windows APIs"},{"type":"informative","value":"Contains ability to retrieve/modify process thread (API string)"},{"type":"informative","value":"Contains ability to load modules (API string)"},{"type":"informative","value":"Contains ability to create a new process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6acbcec9c40418cb9d07122c"}]},{"tactic":"Execution","technique":"Windows Command Shell","attack_id":"T1059.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/003","identifiers":[{"type":"informative","value":"Contains ability to executes commands or batch file"},{"type":"informative","value":"Contains ability to retrieve the command-line string for the current process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6acbcec9c40418cb9d07122c"}]},{"tactic":"Execution","technique":"Inter-Process Communication","attack_id":"T1559","attack_id_wiki":"https://attack.mitre.org/techniques/T1559","identifiers":[{"type":"informative","value":"Contains ability to create/connect to a named pipe (API string)"},{"type":"informative","value":"Found named pipe like strings"}],"sources":[{"report_type":"sandbox","report_id":"6acbcec9c40418cb9d07122c"}]},{"tactic":"Execution","technique":"Shared Modules","attack_id":"T1129","attack_id_wiki":"https://attack.mitre.org/techniques/T1129","identifiers":[{"type":"informative","value":"Loads modules at runtime"},{"type":"informative","value":"Calls an API typically used to load libraries"},{"type":"informative","value":"Looks up procedures from modules (excluding apphelp.dll, kernel32.dll, user32.dll, gdi32.dll, ole32.dll, comctl32.dll, uxtheme.dll, oleaut32.dll, version.dll, msctfime.ime)"},{"type":"informative","value":"Loads the RPC (Remote Procedure Call) module DLL"}],"sources":[{"report_type":"sandbox","report_id":"6acbcec9c40418cb9d07122c"}]},{"tactic":"Persistence","technique":"Modify Registry","attack_id":"T1112","attack_id_wiki":"https://attack.mitre.org/techniques/T1112","identifiers":[{"type":"informative","value":"Contains ability to disable/close registry key (API string)"},{"type":"informative","value":"Writes registry keys"}],"sources":[{"report_type":"sandbox","report_id":"6acbcec9c40418cb9d07122c"}]},{"tactic":"Persistence","technique":"Windows Service","attack_id":"T1543.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1543/003","identifiers":[{"type":"informative","value":"Contains ability to create/control drivers (API string)"},{"type":"informative","value":"Contains ability to access device drivers"}],"sources":[{"report_type":"sandbox","report_id":"6acbcec9c40418cb9d07122c"}]},{"tactic":"Persistence","technique":"Account Manipulation","attack_id":"T1098","attack_id_wiki":"https://attack.mitre.org/techniques/T1098","identifiers":[{"type":"informative","value":"Contains ability to modify the user configuration/privilege (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6acbcec9c40418cb9d07122c"}]},{"tactic":"Persistence","technique":"Device Registration","attack_id":"T1098.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1098/005","identifiers":[{"type":"informative","value":"Contains ability to register device notification handler (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6acbcec9c40418cb9d07122c"}]},{"tactic":"Persistence","technique":"Socket Filters","attack_id":"T1205.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1205/002","identifiers":[{"type":"informative","value":"Able to monitor socket connection"}],"sources":[{"report_type":"sandbox","report_id":"6acbcec9c40418cb9d07122c"}]},{"tactic":"Persistence","technique":"Transport Agent","attack_id":"T1505.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1505/002","identifiers":[{"type":"informative","value":"Able to establish persistence using Exchange transport agent (.NET)"}],"sources":[{"report_type":"sandbox","report_id":"6acbcec9c40418cb9d07122c"}]},{"tactic":"Persistence","technique":"Component Object Model Hijacking","attack_id":"T1546.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1546/015","identifiers":[{"type":"informative","value":"Overview of unique CLSIDs touched in registry"}],"sources":[{"report_type":"sandbox","report_id":"6acbcec9c40418cb9d07122c"}]},{"tactic":"Privilege Escalation","technique":"Thread Execution Hijacking","attack_id":"T1055.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/003","identifiers":[{"type":"informative","value":"Creates a thread in a self process"},{"type":"informative","value":"Able to modify thread functionality – possible hijack (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6acbcec9c40418cb9d07122c"}]},{"tactic":"Privilege Escalation","technique":"Dynamic-link Library Injection","attack_id":"T1055.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/001","identifiers":[{"type":"informative","value":"Contains ability to load/free library (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6acbcec9c40418cb9d07122c"}]},{"tactic":"Privilege Escalation","technique":"Process Injection","attack_id":"T1055","attack_id_wiki":"https://attack.mitre.org/techniques/T1055","identifiers":[{"type":"informative","value":"Able to inject code into another process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6acbcec9c40418cb9d07122c"}]},{"tactic":"Privilege Escalation","technique":"ListPlanting","attack_id":"T1055.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/015","identifiers":[{"type":"informative","value":"Able to visualize and control listed components (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6acbcec9c40418cb9d07122c"}]},{"tactic":"Privilege Escalation","technique":"Exploitation for Privilege Escalation","attack_id":"T1068","attack_id_wiki":"https://attack.mitre.org/techniques/T1068","identifiers":[{"type":"informative","value":"Opens the Kernel Security Device Driver (KsecDD) of Windows"}],"sources":[{"report_type":"sandbox","report_id":"6acbcec9c40418cb9d07122c"}]},{"tactic":"Privilege Escalation","technique":"Thread Local Storage","attack_id":"T1055.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/005","identifiers":[{"type":"suspicious","value":"Found TLS callbacks"}],"sources":[{"report_type":"sandbox","report_id":"6acbcec9c40418cb9d07122c"}]},{"tactic":"Credential Access","technique":"Keylogging","attack_id":"T1056.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1056/001","identifiers":[{"type":"suspicious","value":"Calls an API typically used for keylogging"},{"type":"informative","value":"Able to retrieve information about pressed keystrokes (API string)"},{"type":"informative","value":"Contains ability to hook/unhook windows functions (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6acbcec9c40418cb9d07122c"}]},{"tactic":"Credential Access","technique":"Input Capture","attack_id":"T1056","attack_id_wiki":"https://attack.mitre.org/techniques/T1056","identifiers":[{"type":"informative","value":"Contains ability to register/read input devices (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6acbcec9c40418cb9d07122c"}]},{"tactic":"Credential Access","technique":"Credentials from Password Stores","attack_id":"T1555","attack_id_wiki":"https://attack.mitre.org/techniques/T1555","identifiers":[{"type":"informative","value":"Contains string like password/secret"}],"sources":[{"report_type":"sandbox","report_id":"6acbcec9c40418cb9d07122c"}]},{"tactic":"Credential Access","technique":"OS Credential Dumping","attack_id":"T1003","attack_id_wiki":"https://attack.mitre.org/techniques/T1003","identifiers":[{"type":"informative","value":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality"}],"sources":[{"report_type":"sandbox","report_id":"6acbcec9c40418cb9d07122c"}]},{"tactic":"Credential Access","technique":"Credential API Hooking","attack_id":"T1056.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1056/004","identifiers":[{"type":"malicious","value":"Sets a global windows hook to intercept mouse events"},{"type":"informative","value":"Sets a windows hook"}],"sources":[{"report_type":"sandbox","report_id":"6acbcec9c40418cb9d07122c"}]},{"tactic":"Discovery","technique":"Query Registry","attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/techniques/T1012","identifiers":[{"type":"informative","value":"Contains registry location strings"},{"type":"informative","value":"Found registry location strings in memory"},{"type":"informative","value":"Opens registry keys"},{"type":"informative","value":"Queries registry keys"},{"type":"suspicious","value":"Reads VM-specific registry key"},{"type":"informative","value":"Able to query registry keys (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6acbcec9c40418cb9d07122c"}]},{"tactic":"Discovery","technique":"System Network Configuration Discovery","attack_id":"T1016","attack_id_wiki":"https://attack.mitre.org/techniques/T1016","identifiers":[{"type":"informative","value":"Contains ability to retrieve the local name for a socket (API string)"},{"type":"informative","value":"Contains ability to query network adapter information (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6acbcec9c40418cb9d07122c"}]},{"tactic":"Discovery","technique":"System Information Discovery","attack_id":"T1082","attack_id_wiki":"https://attack.mitre.org/techniques/T1082","identifiers":[{"type":"informative","value":"Found system command-related strings"},{"type":"informative","value":"Calls an API typically used to get system version information"},{"type":"informative","value":"Attempts to call APIs to gather system and hardware detail"},{"type":"informative","value":"Reads information about supported languages"},{"type":"informative","value":"Calls an API used to retrieve geographical location information"},{"type":"informative","value":"Contains reference to mutex-related activity (API string)"},{"type":"informative","value":"Able to retrieve logical drive information (API string)"},{"type":"informative","value":"Contains ability to retrieve the specified system metric or system configuration setting (API string)"},{"type":"informative","value":"Able to discover operating system information (API string)"},{"type":"informative","value":"Reads system mouse configuration"},{"type":"informative","value":"Contains ability to retrieve the OS information (API string)"},{"type":"informative","value":"Contains ability to retrieve a module handle (API string)"},{"type":"informative","value":"Contains ability to retrieve volume information (API string)"},{"type":"informative","value":"Contains ability to retrieve environment variable settings"},{"type":"informative","value":"Reads the active computer name"},{"type":"informative","value":"Reads system-defined device setup information from registry"},{"type":"informative","value":"Able to query volume/memory size (API string)"},{"type":"informative","value":"Contains ability to retrieve the host's architecture (API string)"},{"type":"informative","value":"Able to retrieve information about the current system (API string)"},{"type":"informative","value":"Able to retrieve geographical location information"},{"type":"informative","value":"Calls an API typically used to get product type"},{"type":"informative","value":"Contains ability to read software policies"}],"sources":[{"report_type":"sandbox","report_id":"6acbcec9c40418cb9d07122c"}]},{"tactic":"Discovery","technique":"Time Based Checks","attack_id":"T1497.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/003","identifiers":[{"type":"informative","value":"Contains ability to delay execution by waiting for signal/timeout (API string)"},{"type":"informative","value":"Contains ability to retrieve the time elapsed since the system was started (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6acbcec9c40418cb9d07122c"}]},{"tactic":"Discovery","technique":"File and Directory Discovery","attack_id":"T1083","attack_id_wiki":"https://attack.mitre.org/techniques/T1083","identifiers":[{"type":"informative","value":"Contains ability to retrieve list of files and subdirectories"},{"type":"informative","value":"Contains references to file movement (imports API)"},{"type":"informative","value":"Contains ability to retrieve file and directory information (API string)"},{"type":"informative","value":"Contains ability to retrieve files based on search patterns"},{"type":"informative","value":"Touches files"},{"type":"informative","value":"Tries to access non-existent files (executable)"},{"type":"informative","value":"Tries to access non-existent files (non-executable)"},{"type":"informative","value":"Able to rename or move file/directory (API string)"},{"type":"informative","value":"Contains ability to enumerate files on disk (API string)"},{"type":"informative","value":"Contains ability to read files (API string)"},{"type":"informative","value":"References Windows file paths for DLLs (possible dropped files)"}],"sources":[{"report_type":"sandbox","report_id":"6acbcec9c40418cb9d07122c"}]},{"tactic":"Discovery","technique":"Debugger Evasion","attack_id":"T1622","attack_id_wiki":"https://attack.mitre.org/techniques/T1622","identifiers":[{"type":"informative","value":"Contains ability to check debugger is running (API string)"},{"type":"informative","value":"Contains ability to register a top-level exception handler (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6acbcec9c40418cb9d07122c"}]},{"tactic":"Discovery","technique":"System Location Discovery","attack_id":"T1614","attack_id_wiki":"https://attack.mitre.org/techniques/T1614","identifiers":[{"type":"informative","value":"Able to query system locale information (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6acbcec9c40418cb9d07122c"}]},{"tactic":"Discovery","technique":"Process Discovery","attack_id":"T1057","attack_id_wiki":"https://attack.mitre.org/techniques/T1057","identifiers":[{"type":"informative","value":"Calls an API typically used for taking snapshot of the specified processes"},{"type":"informative","value":"Queries basic information of the specified process"},{"type":"informative","value":"Calls an API typically used to determine if process is running under WOW64"},{"type":"informative","value":"Contains ability to enumerate process and/or its information (API string)"},{"type":"informative","value":"Able to retrieve/open a process (API string)"},{"type":"informative","value":"Contains ability to determine if process is running under WOW64 (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6acbcec9c40418cb9d07122c"}]},{"tactic":"Discovery","technique":"User Activity Based Checks","attack_id":"T1497.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/002","identifiers":[{"type":"informative","value":"Able to identify virtual environment by using user activity (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6acbcec9c40418cb9d07122c"}]},{"tactic":"Discovery","technique":"Local Storage Discovery","attack_id":"T1680","attack_id_wiki":"https://attack.mitre.org/techniques/T1680","identifiers":[{"type":"informative","value":"Able to enumerate disk drives (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6acbcec9c40418cb9d07122c"}]},{"tactic":"Discovery","technique":"Virtualization/Sandbox Evasion","attack_id":"T1497","attack_id_wiki":"https://attack.mitre.org/techniques/T1497","identifiers":[{"type":"informative","value":"Contains ability to detect presence of virtual environment (API string)"},{"type":"informative","value":"Able to detect virtual machine (string)"},{"type":"informative","value":"Attempts to call APIs commonly associated with anti-analysis and evasion techniques"},{"type":"informative","value":"Contains ability to detect sandbox (imports API)"}],"sources":[{"report_type":"sandbox","report_id":"6acbcec9c40418cb9d07122c"}]},{"tactic":"Discovery","technique":"System Checks","attack_id":"T1497.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/001","identifiers":[{"type":"informative","value":"Able to retrieve information set for devices (API string)"},{"type":"informative","value":"Contains a Wine emulator-related string"}],"sources":[{"report_type":"sandbox","report_id":"6acbcec9c40418cb9d07122c"}]},{"tactic":"Discovery","technique":"Application Window Discovery","attack_id":"T1010","attack_id_wiki":"https://attack.mitre.org/techniques/T1010","identifiers":[{"type":"informative","value":"Contains ability to retrieve open application windows (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6acbcec9c40418cb9d07122c"}]},{"tactic":"Discovery","technique":"System Language Discovery","attack_id":"T1614.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1614/001","identifiers":[{"type":"informative","value":"Able to retrieve system language (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6acbcec9c40418cb9d07122c"}]},{"tactic":"Discovery","technique":"Remote System Discovery","attack_id":"T1018","attack_id_wiki":"https://attack.mitre.org/techniques/T1018","identifiers":[{"type":"informative","value":"Able to identify remote systems"}],"sources":[{"report_type":"sandbox","report_id":"6acbcec9c40418cb9d07122c"}]},{"tactic":"Discovery","technique":"Security Software Discovery","attack_id":"T1518.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1518/001","identifiers":[{"type":"suspicious","value":"Possibly checks for known debuggers/analysis tools"},{"type":"suspicious","value":"May attempt to implement anti-virtualization techniques using MAC address detection"},{"type":"informative","value":"Loads the debugger/analysis tool module"}],"sources":[{"report_type":"sandbox","report_id":"6acbcec9c40418cb9d07122c"}]},{"tactic":"Discovery","technique":"Internet Connection Discovery","attack_id":"T1016.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1016/001","sources":[{"report_type":"sandbox","report_id":"6acbcec9c40418cb9d07122c"}]},{"tactic":"Lateral Movement","technique":"Lateral Tool Transfer","attack_id":"T1570","attack_id_wiki":"https://attack.mitre.org/techniques/T1570","identifiers":[{"type":"informative","value":"Contains ability to move file or directory (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6acbcec9c40418cb9d07122c"}]},{"tactic":"Collection","technique":"Screen Capture","attack_id":"T1113","attack_id_wiki":"https://attack.mitre.org/techniques/T1113","identifiers":[{"type":"suspicious","value":"Calls an API that may be used to take screenshots"},{"type":"informative","value":"Able to capture screen (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6acbcec9c40418cb9d07122c"}]},{"tactic":"Collection","technique":"Local Data Staging","attack_id":"T1074.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1074/001","identifiers":[{"type":"informative","value":"Contains ability to create directories (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6acbcec9c40418cb9d07122c"}]},{"tactic":"Collection","technique":"Clipboard Data","attack_id":"T1115","attack_id_wiki":"https://attack.mitre.org/techniques/T1115","identifiers":[{"type":"informative","value":"Able to capture drag-drop file operations"},{"type":"informative","value":"Contains ability to access clipboard data (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6acbcec9c40418cb9d07122c"}]},{"tactic":"Collection","technique":"Archive via Library","attack_id":"T1560.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1560/002","identifiers":[{"type":"suspicious","value":"Uses bzip2 compression library to compress data"},{"type":"informative","value":"Able to compress/decompress content at runtime"}],"sources":[{"report_type":"sandbox","report_id":"6acbcec9c40418cb9d07122c"}]},{"tactic":"Collection","technique":"Local Email Collection","attack_id":"T1114.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1114/001","identifiers":[{"type":"informative","value":"Found string that contains outlook file extensions .ost/.pst"}],"sources":[{"report_type":"sandbox","report_id":"6acbcec9c40418cb9d07122c"}]},{"tactic":"Collection","technique":"Data from Information Repositories","attack_id":"T1213","attack_id_wiki":"https://attack.mitre.org/techniques/T1213","identifiers":[{"type":"informative","value":"Contains SQL queries"}],"sources":[{"report_type":"sandbox","report_id":"6acbcec9c40418cb9d07122c"}]},{"tactic":"Collection","technique":"Archive Collected Data","attack_id":"T1560","attack_id_wiki":"https://attack.mitre.org/techniques/T1560","identifiers":[{"type":"informative","value":"YARA signature match - Zlib compression"}],"sources":[{"report_type":"sandbox","report_id":"6acbcec9c40418cb9d07122c"}]},{"tactic":"Collection","technique":"Automated Collection","attack_id":"T1119","attack_id_wiki":"https://attack.mitre.org/techniques/T1119","identifiers":[{"type":"informative","value":"Shows ability to send encrypted data to the internet"}],"sources":[{"report_type":"sandbox","report_id":"6acbcec9c40418cb9d07122c"}]},{"tactic":"Command and Control","technique":"Ingress Tool Transfer","attack_id":"T1105","attack_id_wiki":"https://attack.mitre.org/techniques/T1105","identifiers":[{"type":"informative","value":"Contains ability to write files (API string)"},{"type":"informative","value":"Contains ability to retrieve remote user information"},{"type":"informative","value":"Dropped files"}],"sources":[{"report_type":"sandbox","report_id":"6acbcec9c40418cb9d07122c"}]},{"tactic":"Command and Control","technique":"Non-Standard Port","attack_id":"T1571","attack_id_wiki":"https://attack.mitre.org/techniques/T1571","identifiers":[{"type":"informative","value":"Contains ability to open a port and listen for incoming connection (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6acbcec9c40418cb9d07122c"}]},{"tactic":"Command and Control","technique":"Application Layer Protocol","attack_id":"T1071","attack_id_wiki":"https://attack.mitre.org/techniques/T1071","identifiers":[{"type":"informative","value":"Contains ability to communicate with network (API string)"},{"type":"informative","value":"Found potential URL in binary/memory"},{"type":"informative","value":"Found potential URLs in memory dumps"},{"type":"informative","value":"Found potential IP address in binary/memory"},{"type":"informative","value":"Contains references to network communication API (string)"}],"sources":[{"report_type":"sandbox","report_id":"6acbcec9c40418cb9d07122c"}]},{"tactic":"Command and Control","technique":"Non-Application Layer Protocol","attack_id":"T1095","attack_id_wiki":"https://attack.mitre.org/techniques/T1095","identifiers":[{"type":"informative","value":"Contains ability to communicate with C2 using Sockets (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6acbcec9c40418cb9d07122c"}]},{"tactic":"Command and Control","technique":"Encrypted Channel","attack_id":"T1573","attack_id_wiki":"https://attack.mitre.org/techniques/T1573","identifiers":[{"type":"informative","value":"Able to use Microsoft's Enhanced Cryptographic Provider"}],"sources":[{"report_type":"sandbox","report_id":"6acbcec9c40418cb9d07122c"}]},{"tactic":"Command and Control","technique":"Web Protocols","attack_id":"T1071.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/001","identifiers":[{"type":"informative","value":"Found string related to HTTP headers"}],"sources":[{"report_type":"sandbox","report_id":"6acbcec9c40418cb9d07122c"}]},{"tactic":"Command and Control","technique":"Data Encoding","attack_id":"T1132","attack_id_wiki":"https://attack.mitre.org/techniques/T1132","identifiers":[{"type":"informative","value":"Contains ability to perform Base64 encoding/decoding"}],"sources":[{"report_type":"sandbox","report_id":"6acbcec9c40418cb9d07122c"}]},{"tactic":"Command and Control","technique":"Proxy","attack_id":"T1090","attack_id_wiki":"https://attack.mitre.org/techniques/T1090","identifiers":[{"type":"informative","value":"Contains references to RPC protocol sequence strings"}],"sources":[{"report_type":"sandbox","report_id":"6acbcec9c40418cb9d07122c"}]},{"tactic":"Command and Control","technique":"Standard Encoding","attack_id":"T1132.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1132/001","identifiers":[{"type":"informative","value":"YARA signature match – Zlib compression file detected"}],"sources":[{"report_type":"sandbox","report_id":"6acbcec9c40418cb9d07122c"}]},{"tactic":"Exfiltration","technique":"Exfiltration Over C2 Channel","attack_id":"T1041","attack_id_wiki":"https://attack.mitre.org/techniques/T1041","identifiers":[{"type":"suspicious","value":"Contains indicators of bot communication commands"}],"sources":[{"report_type":"sandbox","report_id":"6acbcec9c40418cb9d07122c"}]},{"tactic":"Impact","technique":"Service Stop","attack_id":"T1489","attack_id_wiki":"https://attack.mitre.org/techniques/T1489","identifiers":[{"type":"informative","value":"Contains ability to terminate a process (API string)"},{"type":"informative","value":"Calls an API used to open a process handle"}],"sources":[{"report_type":"sandbox","report_id":"6acbcec9c40418cb9d07122c"}]},{"tactic":"Impact","technique":"Data Destruction","attack_id":"T1485","attack_id_wiki":"https://attack.mitre.org/techniques/T1485","identifiers":[{"type":"informative","value":"Contains ability to delete device information set (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6acbcec9c40418cb9d07122c"}]},{"tactic":"Impact","technique":"Data Encrypted for Impact","attack_id":"T1486","attack_id_wiki":"https://attack.mitre.org/techniques/T1486","identifiers":[{"type":"informative","value":"Contains reference to crypto DLLs"}],"sources":[{"report_type":"sandbox","report_id":"6acbcec9c40418cb9d07122c"}]},{"tactic":"Stealth","technique":"Timestomp","attack_id":"T1070.006","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/006","identifiers":[{"type":"informative","value":"Contains ability to retrieve file time (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6acbcec9c40418cb9d07122c"}]},{"tactic":"Stealth","technique":"Direct Volume Access","attack_id":"T1006","attack_id_wiki":"https://attack.mitre.org/techniques/T1006","identifiers":[{"type":"informative","value":"Contains ability to enumerate volumes (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6acbcec9c40418cb9d07122c"}]},{"tactic":"Stealth","technique":"File Deletion","attack_id":"T1070.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/004","identifiers":[{"type":"informative","value":"Contains ability to delete files/directories (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6acbcec9c40418cb9d07122c"}]},{"tactic":"Stealth","technique":"Hidden Window","attack_id":"T1564.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1564/003","identifiers":[{"type":"informative","value":"Contains ability to show a graphical window (API string)"},{"type":"informative","value":"Contains ability to pass information to a window procedure (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6acbcec9c40418cb9d07122c"}]},{"tactic":"Stealth","technique":"Obfuscated Files or Information","attack_id":"T1027","attack_id_wiki":"https://attack.mitre.org/techniques/T1027","identifiers":[{"type":"informative","value":"Contains CRYPTO related strings"},{"type":"informative","value":"Contains ability to use Cryptographic classes"},{"type":"informative","value":"Loads the Bcrypt module DLL"},{"type":"informative","value":"PE file contains zero-sized sections"},{"type":"informative","value":"YARA signature match - Djb2 Hash Algorithm"},{"type":"informative","value":"Shows ability to obfuscate file or information"}],"sources":[{"report_type":"sandbox","report_id":"6acbcec9c40418cb9d07122c"}]},{"tactic":"Stealth","technique":"Hide Artifacts","attack_id":"T1564","attack_id_wiki":"https://attack.mitre.org/techniques/T1564","identifiers":[{"type":"informative","value":"Found virtual disk drive like strings"}],"sources":[{"report_type":"sandbox","report_id":"6acbcec9c40418cb9d07122c"}]},{"tactic":"Stealth","technique":"Mutual Exclusion","attack_id":"T1480.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1480/002","identifiers":[{"type":"informative","value":"Creates mutants"}],"sources":[{"report_type":"sandbox","report_id":"6acbcec9c40418cb9d07122c"}]},{"tactic":"Stealth","technique":"Indicator Removal","attack_id":"T1070","attack_id_wiki":"https://attack.mitre.org/techniques/T1070","identifiers":[{"type":"suspicious","value":"Deletes registry keys"}],"sources":[{"report_type":"sandbox","report_id":"6acbcec9c40418cb9d07122c"}]},{"tactic":"Stealth","technique":"Dynamic API Resolution","attack_id":"T1027.007","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/007","identifiers":[{"type":"informative","value":"Contains ability to dynamically determine API calls"}],"sources":[{"report_type":"sandbox","report_id":"6acbcec9c40418cb9d07122c"}]},{"tactic":"Stealth","technique":"Junk Code Insertion","attack_id":"T1027.016","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/016","identifiers":[{"type":"suspicious","value":"File exhibits characteristics of junk code obfuscation"}],"sources":[{"report_type":"sandbox","report_id":"6acbcec9c40418cb9d07122c"}]},{"tactic":"Stealth","technique":"Software Packing","attack_id":"T1027.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/002","identifiers":[{"type":"suspicious","value":"PE file contains unusual section name"}],"sources":[{"report_type":"sandbox","report_id":"6acbcec9c40418cb9d07122c"}]},{"tactic":"Stealth","technique":"Execution Guardrails","attack_id":"T1480","attack_id_wiki":"https://attack.mitre.org/techniques/T1480","identifiers":[{"type":"informative","value":"Shows ability to use execution guardrails"}],"sources":[{"report_type":"sandbox","report_id":"6acbcec9c40418cb9d07122c"}]},{"tactic":"Stealth","technique":"Deobfuscate/Decode Files or Information","attack_id":"T1140","attack_id_wiki":"https://attack.mitre.org/techniques/T1140","identifiers":[{"type":"informative","value":"Shows ability to deobfuscate/decode files or information"}],"sources":[{"report_type":"sandbox","report_id":"6acbcec9c40418cb9d07122c"}]}],"sandbox_signatures":[{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to compress/decompress content at runtime","description":"Found string \"bad compression\" (Source: \"00000000-00000584.00000000.95771.7A93C000.00000002.mdmp\")\n Found string \"ZIP compression method is not supported\" (Source: \"00000000-00000584.00000000.95771.7A93C000.00000002.mdmp\")\n Found string \"decompression error\" (Source: \"00000000-00000584.00000000.95771.7A93C000.00000002.mdmp\")\n Found string \"compression error\" (Source: \"00000000-00000584.00000000.95771.7A93C000.00000002.mdmp\")\n Found string \"VK_EXT_texture_compression_astc_hdr\" (Source: \"00000000-00000584.00000000.95771.7A93C000.00000002.mdmp\")\n Found string \"unknown compression method\" (Source: \"00000000-00000584.00000000.95771.7A93C000.00000002.mdmp\")\n Found string \"enable-name-compression\" (Source: \"00000000-00000584.00000000.95771.7C320000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1560.002","relevance":1,"id":"string-935","sources":[{"report_type":"sandbox","report_id":"6acbcec9c40418cb9d07122c"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to inject code into another process (API string)","description":"Found reference to API \"CreateThread\" (Indicator: \"CreateThread\"; File: \"Tekken3Recomp.exe\")\n Found reference to API \"vkFreeMemory\" (Indicator: \"FreeMemory\"; Source: \"00000000-00000584.00000000.95771.7A93C000.00000002.mdmp\")\n Found reference to API \"missing vkFreeMemory\" (Indicator: \"FreeMemory\"; Source: \"00000000-00000584.00000000.95771.7A93C000.00000002.mdmp\")\n Found reference to API \"vkGetDeviceProcAddr(device, \"vkFreeMemory\") failed\" (Indicator: \"FreeMemory\"; Source: \"00000000-00000584.00000000.95771.7A93C000.00000002.mdmp\")\n Found reference to API \"CreateThread\" (Indicator: \"CreateThread\"; Source: \"00000000-00000584.00000000.95771.7A93C000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055","relevance":1,"id":"string-92","sources":[{"report_type":"sandbox","report_id":"6acbcec9c40418cb9d07122c"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to modify thread functionality – possible hijack (API string)","description":"Found reference to API \"SuspendThread\" (Indicator: \"SuspendThread\"; File: \"Tekken3Recomp.exe\")\n Found reference to API \"GetThreadContext\" (Indicator: \"GetThreadContext\"; File: \"Tekken3Recomp.exe\")\n Found reference to API \"SetThreadContext\" (Indicator: \"SetThreadContext\"; File: \"Tekken3Recomp.exe\")\n Found reference to API \"ResumeThread\" (Indicator: \"ResumeThread\"; File: \"Tekken3Recomp.exe\")","origin":"File/Memory","mitre_attack_id":"T1055.003","relevance":3,"id":"string-309","sources":[{"report_type":"sandbox","report_id":"6acbcec9c40418cb9d07122c"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Calls an API typically used to find a resource in a module","description":"\"Tekken3Recomp.exe\" called \"FindResourceW\" with parameter \"6\" - (UID: 00000000-00000584)","origin":"API Call","mitre_attack_id":"T1106","relevance":3,"id":"api-140","sources":[{"report_type":"sandbox","report_id":"6acbcec9c40418cb9d07122c"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Calls an API typically used to load a resource in memory","description":"\"Tekken3Recomp.exe\" called \"LoadResource with parameter {'hModule': '140730973356032', 'hResInfo': '140730973622808'}\" (UID: 00000000-00000584)","origin":"API Call","mitre_attack_id":"T1106","relevance":3,"id":"api-139","sources":[{"report_type":"sandbox","report_id":"6acbcec9c40418cb9d07122c"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to delay execution by waiting for signal/timeout (API string)","description":"$25","origin":"File/Memory","mitre_attack_id":"T1497.003","relevance":1,"id":"string-226","sources":[{"report_type":"sandbox","report_id":"6acbcec9c40418cb9d07122c"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to detect presence of virtual environment (API string)","description":"Found reference to API \"SetupDiGetDeviceRegistryPropertyW\" (Indicator: \"SetupDiGetDeviceRegistryProperty\"; File: \"Tekken3Recomp.exe\")\n Found reference to API \"SetupDiEnumDeviceInfo\" (Indicator: \"SetupDiEnumDeviceInfo\"; File: \"Tekken3Recomp.exe\")\n Found reference to API \"SetupDiGetClassDevsA\" (Indicator: \"SetupDiGetClassDevs\"; File: \"Tekken3Recomp.exe\")","origin":"File/Memory","mitre_attack_id":"T1497","relevance":1,"id":"string-253","sources":[{"report_type":"sandbox","report_id":"6acbcec9c40418cb9d07122c"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to load/free library (API string)","description":"$26","origin":"File/Memory","mitre_attack_id":"T1055.001","relevance":1,"id":"string-318","sources":[{"report_type":"sandbox","report_id":"6acbcec9c40418cb9d07122c"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to pass information to a window procedure (API string)","description":"Found reference to API \"CallWindowProcW\" (Indicator: \"CallWindowProc\"; File: \"Tekken3Recomp.exe\")","origin":"File/Memory","mitre_attack_id":"T1564.003","relevance":1,"id":"string-320","sources":[{"report_type":"sandbox","report_id":"6acbcec9c40418cb9d07122c"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to perform Base64 encoding/decoding","description":"Found string \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/\" (Indicator: \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+\"; Source: \"00000000-00000584.00000000.95771.7A93C000.00000002.mdmp\")\n Found string \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/\" (Indicator: \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/\"; Source: \"00000000-00000584.00000000.95771.7A93C000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1132","relevance":1,"id":"string-338","sources":[{"report_type":"sandbox","report_id":"6acbcec9c40418cb9d07122c"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to use Cryptographic classes","description":"Found reference to \"Generating HMAC key for long-term credentials with empty STUN username\" (Indicator: \"HMAC\"; Source: \"00000000-00000584.00000000.95771.7A93C000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":2,"id":"string-138","sources":[{"report_type":"sandbox","report_id":"6acbcec9c40418cb9d07122c"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Found virtual disk drive like strings","description":"Found string - \\\\.\\NUL; Source: \"Tekken3Recomp.exe\")\n Found string - \\\\.\\NUL; Source: \"00000000-00000584.00000000.95771.7A93C000.00000002.mdmp\")\n Found string - \\.\\DISPLAY1; Source: \"00000000-00000584.00000000.95771.7C310000.00000004.mdmp\")\n Found string - \\\\.\\DISPLAY1; Source: \"00000000-00000584.00000000.95771.7C320000.00000004.mdmp\")\n Found string - \\\\.\\DISPLAY2; Source: \"00000000-00000584.00000000.95771.7C320000.00000004.mdmp\")\n Found string - \\\\.\\DISPLAY3; Source: \"00000000-00000584.00000000.95771.7C320000.00000004.mdmp\")\n Found string - \\\\.\\DISPLAY4; Source: \"00000000-00000584.00000000.95771.7C320000.00000004.mdmp\")\n Found string - \\\\.\\DISPLAY5; Source: \"00000000-00000584.00000000.95771.7C320000.00000004.mdmp\")\n Found string - \\\\.\\DISPLAY6; Source: \"00000000-00000584.00000000.95771.7C320000.00000004.mdmp\")\n Found string - \\\\.\\DISPLAY7; Source: \"00000000-00000584.00000000.95771.7C320000.00000004.mdmp\")\n Found string - \\\\.\\DISPLAY8; Source: \"00000000-00000584.00000000.95771.7C320000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1564","relevance":1,"id":"string-145","sources":[{"report_type":"sandbox","report_id":"6acbcec9c40418cb9d07122c"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Loads the debugger/analysis tool module","description":"\"Tekken3Recomp.exe\" loaded module \"%WINDIR%\\System32\\dbghelp.dll\" at 8FE70000","origin":"Loaded Module","mitre_attack_id":"T1518.001","relevance":3,"id":"module-16","sources":[{"report_type":"sandbox","report_id":"6acbcec9c40418cb9d07122c"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to check debugger is running (API string)","description":"Found reference to API \"QueryPerformanceCounter\" (Indicator: \"QueryPerformanceCounter\"; File: \"Tekken3Recomp.exe\")\n Found reference to API \"OutputDebugStringA\" (Indicator: \"OutputDebugString\"; File: \"Tekken3Recomp.exe\")\n Found reference to API \"IsDebuggerPresent\" (Indicator: \"IsDebuggerPresent\"; File: \"Tekken3Recomp.exe\")\n Found reference to API \"GetTickCount64\" (Indicator: \"GetTickCount\"; File: \"Tekken3Recomp.exe\")\n Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; File: \"Tekken3Recomp.exe\")\n Found reference to API \"OutputDebugStringW\" (Indicator: \"OutputDebugString\"; File: \"Tekken3Recomp.exe\")","origin":"File/Memory","mitre_attack_id":"T1622","relevance":1,"id":"string-183","sources":[{"report_type":"sandbox","report_id":"6acbcec9c40418cb9d07122c"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to register a top-level exception handler (API string)","description":"Found reference to API \"SetUnhandledExceptionFilter\" (Indicator: \"SetUnhandledExceptionFilter\"; File: \"Tekken3Recomp.exe\")\n Found reference to API \"SetUnhandledExceptionFilter\" (Indicator: \"UnhandledExceptionFilter\"; File: \"Tekken3Recomp.exe\")","origin":"File/Memory","mitre_attack_id":"T1622","relevance":1,"id":"string-148","sources":[{"report_type":"sandbox","report_id":"6acbcec9c40418cb9d07122c"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"PE file contains zero-sized sections","description":"Raw size of \".bss\" is zero","origin":"Static Parser","mitre_attack_id":"T1027","relevance":10,"id":"static-5","sources":[{"report_type":"sandbox","report_id":"6acbcec9c40418cb9d07122c"}]},{"level":"informative","category":"Cryptographic Related","name":"Able to use Microsoft's Enhanced Cryptographic Provider","description":"Found api reference \"BCryptGenRandom\" (Indicator: \"BCryptGenRandom\"; File: \"Tekken3Recomp.exe\")\n Found api reference \"BCryptGenRandom\" (Indicator: \"CryptGenRandom\"; File: \"Tekken3Recomp.exe\")\n Found api reference \"BCryptGenRandom\" (Indicator: \"BCryptGenRandom\"; Source: \"00000000-00000584.00000000.95771.A2B51000.00000004.mdmp\")\n Found api reference \"BCryptGenRandom\" (Indicator: \"CryptGenRandom\"; Source: \"00000000-00000584.00000000.95771.A2B51000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1573","relevance":1,"id":"string-602","sources":[{"report_type":"sandbox","report_id":"6acbcec9c40418cb9d07122c"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains reference to crypto DLLs","description":"Found string \":\\WINDOWS\\SYSTEM32\\MSVCP140.dll\" (Indicator: \"\\msvcp140.dll\"; Source: \"00000000-00000584.00000000.95771.7C320000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-493","sources":[{"report_type":"sandbox","report_id":"6acbcec9c40418cb9d07122c"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to deobfuscate/decode files or information","description":"The analysis shows use of encryption and can be used to decode file or information. Matched sigs: Contains ability to perform Base64 encoding/decoding","origin":"Indicator Combinations","mitre_attack_id":"T1140","relevance":1,"id":"summary-32","sources":[{"report_type":"sandbox","report_id":"6acbcec9c40418cb9d07122c"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to obfuscate file or information","description":"The analysis contains indicators for crypto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: Able to use Microsoft's Enhanced Cryptographic Provider\n Matched sigs: Contains CRYPTO related strings\n Matched sigs: Contains ability to perform Base64 encoding/decoding\n Matched sigs: Contains ability to use Cryptographic classes\n Matched sigs: Contains reference to crypto DLLs","origin":"Indicator Combinations","mitre_attack_id":"T1027","relevance":1,"id":"summary-28","sources":[{"report_type":"sandbox","report_id":"6acbcec9c40418cb9d07122c"}]},{"level":"informative","category":"Environment Awareness","name":"Able to access user sensitive domain","description":"Found string \"https://github.com/TechnicallyComputers/retcomm-toolchains\" (Indicator: \"github.com\"; Source: \"00000000-00000584.00000000.95771.7A93C000.00000002.mdmp\")\n Found string \"https://github.com/TechnicallyComputers/retcomm-toolchains/releases\" (Indicator: \"github.com\"; Source: \"00000000-00000584.00000000.95771.7A93C000.00000002.mdmp\")\n file/memory contains long string with (Indicator: \"github.com\"; Source: \"00000000-00000584.00000000.95771.7A93C000.00000002.mdmp\")\n Found string \"https://github.com/superg/redumper\" (Indicator: \"github.com\"; Source: \"00000000-00000584.00000000.95771.7A93C000.00000002.mdmp\")\n Found string \"https://github.com/ocornut/imgui/blob/master/docs/FAQ.md#qa-usage\" (Indicator: \"github.com\"; Source: \"00000000-00000584.00000000.95771.7A93C000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1590","relevance":1,"id":"string-761","sources":[{"report_type":"sandbox","report_id":"6acbcec9c40418cb9d07122c"}]},{"level":"informative","category":"Environment Awareness","name":"Able to detect virtual machine (string)","description":"file/memory contains long string(File: \"psx_last_run_report.json\")\n Found string \":\\WINDOWS\\SYSTEM32\\vm3dglhelper64.dll\" (Source: \"00000000-00000584.00000000.95771.7C320000.00000004.mdmp\")\n Found string \":\\WINDOWS\\SYSTEM32\\vm3dgl64.dll\" (Source: \"00000000-00000584.00000000.95771.7C320000.00000004.mdmp, 00000000-00000584.00000000.95771.7F2F0000.00000004.mdmp\")\n Found string \"\"module\": \"C:\\\\WINDOWS\\\\SYSTEM32\\\\vm3dgl64.dll\",\" (Source: \"00000000-00000584.00000000.95771.9752C000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497","relevance":1,"id":"string-989","sources":[{"report_type":"sandbox","report_id":"6acbcec9c40418cb9d07122c"}]},{"level":"informative","category":"Environment Awareness","name":"Able to enumerate disk drives (API string)","description":"Found reference to API \"GetLogicalDrives\" (Indicator: \"GetLogicalDrives\"; File: \"Tekken3Recomp.exe\")","origin":"File/Memory","mitre_attack_id":"T1680","relevance":5,"id":"string-998","sources":[{"report_type":"sandbox","report_id":"6acbcec9c40418cb9d07122c"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment by using user activity (API string)","description":"Found string \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; File: \"Tekken3Recomp.exe\")\n Found string \"GetCursorPos\" (Indicator: \"GetCursorPos\"; File: \"Tekken3Recomp.exe\")","origin":"File/Memory","mitre_attack_id":"T1497.002","relevance":1,"id":"string-661","sources":[{"report_type":"sandbox","report_id":"6acbcec9c40418cb9d07122c"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query system locale information (API string)","description":"Found reference to API \"GetLocaleInfoW\" (Indicator: \"GetLocaleInfo\"; File: \"Tekken3Recomp.exe\")\n Found reference to API \"GetLocaleInfoA\" (Indicator: \"GetLocaleInfo\"; File: \"Tekken3Recomp.exe\")","origin":"File/Memory","mitre_attack_id":"T1614","relevance":1,"id":"string-201","sources":[{"report_type":"sandbox","report_id":"6acbcec9c40418cb9d07122c"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query volume/memory size (API string)","description":"Found reference to API \"GlobalMemoryStatusEx\" (Indicator: \"GlobalMemoryStatus\"; File: \"Tekken3Recomp.exe\")\n Found reference to API \"GlobalMemoryStatusEx\" (Indicator: \"GlobalMemoryStatusEx\"; File: \"Tekken3Recomp.exe\")\n Found reference to API \"GetDiskFreeSpaceExW\" (Indicator: \"GetDiskFreeSpace\"; File: \"Tekken3Recomp.exe\")\n Found reference to API \"GetDiskFreeSpaceExW\" (Indicator: \"GetDiskFreeSpaceEx\"; File: \"Tekken3Recomp.exe\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-193","sources":[{"report_type":"sandbox","report_id":"6acbcec9c40418cb9d07122c"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve geographical location information","description":"Found reference to API \"getaddrinfo\" (Indicator: \"getaddrinfo\"; File: \"Tekken3Recomp.exe\")\n Found reference to API \"getaddrinfo for binding address failed, errno=%d\" (Indicator: \"getaddrinfo\"; Source: \"00000000-00000584.00000000.95771.7A93C000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-739","sources":[{"report_type":"sandbox","report_id":"6acbcec9c40418cb9d07122c"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve information about the current system (API string)","description":"Found system information discovery API: \"GetSystemInfo\" in file \"Tekken3Recomp.exe\"\n Found system information discovery API: \"GetEnvironmentStringsW\" in file \"Tekken3Recomp.exe\"\n Found system information discovery API: \"GetMonitorInfoW\" in file \"Tekken3Recomp.exe\"\n Found system information discovery API: \"ExpandEnvironmentStrings (in long string)\" in file \"Tekken3Recomp.exe\"\n Found system information discovery API: \"strTempFolder = oShell.ExpandEnvironmentStrings(\"%TEMP%\")\" in \"00000000-00000584.00000000.95771.7A93C000.00000002.mdmp\"\n Found system information discovery API: \"GetMonitorInfo failed\" in \"00000000-00000584.00000000.95771.7A93C000.00000002.mdmp\"","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-89","sources":[{"report_type":"sandbox","report_id":"6acbcec9c40418cb9d07122c"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve information set for devices (API string)","description":"Found reference to API \"SetupDiGetDeviceRegistryPropertyW\" (Indicator: \"setupdigetdeviceregistryproperty\"; File: \"Tekken3Recomp.exe\")\n Found reference to API \"SetupDiEnumDeviceInfo\" (Indicator: \"setupdienumdeviceinfo\"; File: \"Tekken3Recomp.exe\")\n Found reference to API \"SetupDiGetClassDevsA\" (Indicator: \"setupdigetclassdevs\"; File: \"Tekken3Recomp.exe\")","origin":"File/Memory","mitre_attack_id":"T1497.001","relevance":1,"id":"string-533","sources":[{"report_type":"sandbox","report_id":"6acbcec9c40418cb9d07122c"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve system language (API string)","description":"Found reference to API \"GetKeyboardLayout\" (Indicator: \"GetKeyboardLayout\"; File: \"Tekken3Recomp.exe\")\n Found reference to API \"GetUserPreferredUILanguages\" (Indicator: \"GetUserPreferredUILanguages\"; Source: \"00000000-00000584.00000000.95771.7A93C000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1614.001","relevance":1,"id":"string-143","sources":[{"report_type":"sandbox","report_id":"6acbcec9c40418cb9d07122c"}]},{"level":"informative","category":"Environment Awareness","name":"Able to visualize and control listed components (API string)","description":"Found reference to API \"SendMessageW\" (Indicator: \"sendmessage\"; File: \"Tekken3Recomp.exe\")\n Found reference to API \"PostMessageW\" (Indicator: \"postmessage\"; File: \"Tekken3Recomp.exe\")\n Found reference to API \"EnumWindows\" (Indicator: \"enumwindows\"; File: \"Tekken3Recomp.exe\")\n Found reference to API \"SendMessageA\" (Indicator: \"sendmessage\"; File: \"Tekken3Recomp.exe\")\n Found reference to API \"EnumChildWindows\" (Indicator: \"enumchildwindows\"; File: \"Tekken3Recomp.exe\")","origin":"File/Memory","mitre_attack_id":"T1055.015","relevance":1,"id":"string-721","sources":[{"report_type":"sandbox","report_id":"6acbcec9c40418cb9d07122c"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to call APIs commonly associated with anti-analysis and evasion techniques","description":"\"Tekken3Recomp.exe\" called \"GetTickCount\" with parameters (UID: 00000000-00000584)","origin":"API Call","mitre_attack_id":"T1497","relevance":3,"id":"api-296","sources":[{"report_type":"sandbox","report_id":"6acbcec9c40418cb9d07122c"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to call APIs to gather system and hardware detail","description":"\"Tekken3Recomp.exe\" called \"EnumDisplayMonitors\" with parameters (UID: 00000000-00000584)\n \"Tekken3Recomp.exe\" called \"GetSystemInfo\" with parameters (UID: 00000000-00000584)\n \"Tekken3Recomp.exe\" called \"QueryPerformanceCounter\" (UID: 00000000-00000584)\n \"Tekken3Recomp.exe\" called \"SetupDiGetClassDevsA\" with parameters (UID: 00000000-00000584)\n \"Tekken3Recomp.exe\" called \"SetupDiGetDeviceRegistryPropertyW\" with parameters (UID: 00000000-00000584)\n \"Tekken3Recomp.exe\" called \"SetupDiGetClassDevsW\" with parameters (UID: 00000000-00000584)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-294","sources":[{"report_type":"sandbox","report_id":"6acbcec9c40418cb9d07122c"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality","description":"\"Tekken3Recomp.exe\" called \"GetMonitorInfoW\" with parameters (UID: 00000000-00000584)\n \"Tekken3Recomp.exe\" called \"NtQueryInformationToken\" with parameters (UID: 00000000-00000584)","origin":"API Call","mitre_attack_id":"T1003","relevance":3,"id":"api-297","sources":[{"report_type":"sandbox","report_id":"6acbcec9c40418cb9d07122c"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to determine if process is running under WOW64","description":"\"Tekken3Recomp.exe\" called \"IsWow64Process\" with parameter \"584\" - (UID: 00000000-00000584)","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-146","sources":[{"report_type":"sandbox","report_id":"6acbcec9c40418cb9d07122c"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get product type","description":"\"Tekken3Recomp.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00000584)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-124","sources":[{"report_type":"sandbox","report_id":"6acbcec9c40418cb9d07122c"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get system version information","description":"$27","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-125","sources":[{"report_type":"sandbox","report_id":"6acbcec9c40418cb9d07122c"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API used to retrieve geographical location information","description":"Observed import api \"getaddrinfo\" which can be \"used to convert host name to address\" [Source: Tekken3Recomp.exe]","origin":"Static Parser","mitre_attack_id":"T1082","relevance":5,"id":"static-190","sources":[{"report_type":"sandbox","report_id":"6acbcec9c40418cb9d07122c"}]},{"level":"informative","category":"Environment Awareness","name":"Contains a Wine emulator-related string","description":"\"wine_get_version\" (Indicator: \"wine_get_version\")","origin":"File/Memory","mitre_attack_id":"T1497.001","relevance":5,"id":"string-62","sources":[{"report_type":"sandbox","report_id":"6acbcec9c40418cb9d07122c"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to determine if process is running under WOW64 (API string)","description":"Found reference to API \"IsWow64Process\" (Indicator: \"IsWow64Process\"; File: \"Tekken3Recomp.exe\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-450","sources":[{"report_type":"sandbox","report_id":"6acbcec9c40418cb9d07122c"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to enumerate volumes (API string)","description":"Found reference to API \"FindFirstVolumeW\" (Indicator: \"FindFirstVolume\"; File: \"Tekken3Recomp.exe\")\n Found reference to API \"FindVolumeClose\" (Indicator: \"FindVolumeClose\"; File: \"Tekken3Recomp.exe\")\n Found reference to API \"FindNextVolumeW\" (Indicator: \"FindNextVolume\"; File: \"Tekken3Recomp.exe\")","origin":"File/Memory","mitre_attack_id":"T1006","relevance":1,"id":"string-194","sources":[{"report_type":"sandbox","report_id":"6acbcec9c40418cb9d07122c"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to read software policies","description":"\"Tekken3Recomp.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":1,"id":"registry-78","sources":[{"report_type":"sandbox","report_id":"6acbcec9c40418cb9d07122c"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve environment variable settings","description":"Found string \"set input buffers\" (Indicator: \"set \"; File: \"Tekken3Recomp.exe\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-326","sources":[{"report_type":"sandbox","report_id":"6acbcec9c40418cb9d07122c"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve file time (API string)","description":"Found reference to API \"GetFileTime\" (Indicator: \"GetFileTime\"; File: \"Tekken3Recomp.exe\")\n Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTimeAsFileTime\"; File: \"Tekken3Recomp.exe\")\n Found reference to API \"SystemTimeToFileTime\" (Indicator: \"SystemTimeToFileTime\"; File: \"Tekken3Recomp.exe\")\n Found reference to API \"FileTimeToSystemTime\" (Indicator: \"FileTimeToSystemTime\"; File: \"Tekken3Recomp.exe\")\n Found reference to API \"SteamAPI_ISteamRemoteStorage_GetFileTimestamp\" (Indicator: \"GetFileTime\"; Source: \"00000000-00000584.00000000.95771.7A93C000.00000002.mdmp\")\n Found reference to API \"Could not load function SteamAPI_ISteamRemoteStorage_GetFileTimestamp\" (Indicator: \"GetFileTime\"; Source: \"00000000-00000584.00000000.95771.7A93C000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1070.006","relevance":1,"id":"string-249","sources":[{"report_type":"sandbox","report_id":"6acbcec9c40418cb9d07122c"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve open application windows (API string)","description":"Found reference to API \"GetForegroundWindow\" (Indicator: \"GetForegroundWindow\"; File: \"Tekken3Recomp.exe\")\n Found reference to API \"EnumWindows\" (Indicator: \"EnumWindows\"; File: \"Tekken3Recomp.exe\")\n Found reference to API \"GetWindowTextW\" (Indicator: \"GetWindowText\"; File: \"Tekken3Recomp.exe\")\n Found reference to API \"GetWindowTextLengthW\" (Indicator: \"GetWindowText\"; File: \"Tekken3Recomp.exe\")","origin":"File/Memory","mitre_attack_id":"T1010","relevance":1,"id":"string-141","sources":[{"report_type":"sandbox","report_id":"6acbcec9c40418cb9d07122c"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve the OS information (API string)","description":"Found reference to API \"VerifyVersionInfoW\" (Indicator: \"VerifyVersionInfo\"; File: \"Tekken3Recomp.exe\")\n Found reference to API \"VerSetConditionMask\" (Indicator: \"VerSetConditionMask\"; File: \"Tekken3Recomp.exe\")\n Found reference to API \"RtlGetVersion\" (Indicator: \"GetVersion\"; Source: \"00000000-00000584.00000000.95771.7A93C000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-171","sources":[{"report_type":"sandbox","report_id":"6acbcec9c40418cb9d07122c"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve volume information (API string)","description":"Found reference to API \"GetVolumeInformationW\" (Indicator: \"GetVolumeInformation\"; File: \"Tekken3Recomp.exe\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-162","sources":[{"report_type":"sandbox","report_id":"6acbcec9c40418cb9d07122c"}]},{"level":"informative","category":"Environment Awareness","name":"Reads system mouse configuration","description":"\"Tekken3Recomp.exe\" (Access type: \"OPEN\"; Path: \"HKCU\\CONTROL PANEL\\MOUSE\";)\n \"Tekken3Recomp.exe\" (Access type: \"QUERYVAL\"; Path: \"HKCU\\CONTROL PANEL\\MOUSE\";)","origin":"Registry Access","mitre_attack_id":"T1082","relevance":3,"id":"registry-202","sources":[{"report_type":"sandbox","report_id":"6acbcec9c40418cb9d07122c"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the active computer name","description":"\"Tekken3Recomp.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"6acbcec9c40418cb9d07122c"}]},{"level":"informative","category":"External Systems","name":"Sample was identified as clean by Antivirus engines","description":"0/23 Antivirus vendors marked sample as clean (0% detection rate)","origin":"External System","relevance":10,"id":"avtest-1","sources":[{"report_type":"sandbox","report_id":"6acbcec9c40418cb9d07122c"}]},{"level":"informative","category":"General","name":"Able to rename or move file/directory (API string)","description":"Found string \"MoveFileExW\" (Indicator: \"MoveFileExW\"; File: \"Tekken3Recomp.exe\")\n Found string \"MoveFileA\" (Indicator: \"MoveFileA\"; File: \"Tekken3Recomp.exe\")\n Found string \"MoveFileExA\" (Indicator: \"MoveFileExA\"; File: \"Tekken3Recomp.exe\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-884","sources":[{"report_type":"sandbox","report_id":"6acbcec9c40418cb9d07122c"}]},{"level":"informative","category":"General","name":"Able to retrieve/open a process (API string)","description":"Found reference to API \"GetProcessHeap\" (Indicator: \"GetProcessHeap\"; File: \"Tekken3Recomp.exe\")\n Found reference to API \"OpenProcess\" (Indicator: \"OpenProcess\"; File: \"Tekken3Recomp.exe\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-272","sources":[{"report_type":"sandbox","report_id":"6acbcec9c40418cb9d07122c"}]},{"level":"informative","category":"General","name":"Calls an API typically used to load libraries","description":"$28","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-175","sources":[{"report_type":"sandbox","report_id":"6acbcec9c40418cb9d07122c"}]},{"level":"informative","category":"General","name":"Calls an API typically used to retrieve function addresses","description":"$29","origin":"API Call","mitre_attack_id":"T1106","relevance":1,"id":"api-176","sources":[{"report_type":"sandbox","report_id":"6acbcec9c40418cb9d07122c"}]},{"level":"informative","category":"General","name":"Contains SQL queries","description":"\"Select a lobby from the server list.\" (Source: 00000000-00000584.00000000.95771.7A93C000.00000002.mdmp, Indicator: \"select a lobby from the server list.\")\n \"Select a cmake-clang-v1-*.zip from TechnicallyComputers/retcomm-toolchains releases.\" (Source: 00000000-00000584.00000000.95771.7A93C000.00000002.mdmp, Indicator: \"select a cmake-clang-v1-*.zip from technicallycomputers/retcomm-toolchains releases.\")","origin":"File/Memory","mitre_attack_id":"T1213","relevance":2,"id":"string-16","sources":[{"report_type":"sandbox","report_id":"6acbcec9c40418cb9d07122c"}]},{"level":"informative","category":"General","name":"Contains ability to create a new process (API string)","description":"Found reference to API \"CreateProcessA\" (Indicator: \"CreateProcess\"; File: \"Tekken3Recomp.exe\")\n Found reference to API \"CreateProcessW\" (Indicator: \"CreateProcess\"; File: \"Tekken3Recomp.exe\")\n Found reference to API \"psxrecomp-codegen: CreateProcess failed\" (Indicator: \"CreateProcess\"; Source: \"00000000-00000584.00000000.95771.7A93C000.00000002.mdmp\")\n Found reference to API \"CreateProcess\" (Indicator: \"CreateProcess\"; Source: \"00000000-00000584.00000000.95771.7A93C000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-204","sources":[{"report_type":"sandbox","report_id":"6acbcec9c40418cb9d07122c"}]},{"level":"informative","category":"General","name":"Contains ability to create directories (API string)","description":"Found reference to API \"CreateDirectoryW\" (Indicator: \"CreateDirectory\"; File: \"Tekken3Recomp.exe\")\n Found reference to API \"CreateDirectoryW\" (Indicator: \"CreateDirectory\"; Source: \"00000000-00000584.00000000.95771.A2B51000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1074.001","relevance":1,"id":"string-423","sources":[{"report_type":"sandbox","report_id":"6acbcec9c40418cb9d07122c"}]},{"level":"informative","category":"General","name":"Contains ability to create/control drivers (API string)","description":"Found reference to API \"DeviceIoControl\" (Indicator: \"DeviceIoControl\"; File: \"Tekken3Recomp.exe\")\n Found reference to API \"Get Input/Feature Report DeviceIoControl\" (Indicator: \"DeviceIoControl\"; File: \"Tekken3Recomp.exe\")\n Found reference to API \"Get Input/Feature Report DeviceIoControl\" (Indicator: \"DeviceIoControl\"; Source: \"00000000-00000584.00000000.95771.7A93C000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-220","sources":[{"report_type":"sandbox","report_id":"6acbcec9c40418cb9d07122c"}]},{"level":"informative","category":"General","name":"Contains ability to create/open files (API string)","description":"Found reference to API \"CreateFileW\" (Indicator: \"CreateFile\"; File: \"Tekken3Recomp.exe\")\n Found reference to API \"CreateFileA\" (Indicator: \"CreateFile\"; File: \"Tekken3Recomp.exe\")\n Found reference to API \"CreateFileA\" (Indicator: \"CreateFile\"; Source: \"00000000-00000584.00000000.95771.A2B51000.00000004.mdmp\")\n Found reference to API \"CreateFileW\" (Indicator: \"CreateFile\"; Source: \"00000000-00000584.00000000.95771.A2B51000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-315","sources":[{"report_type":"sandbox","report_id":"6acbcec9c40418cb9d07122c"}]},{"level":"informative","category":"General","name":"Contains ability to disable/close registry key (API string)","description":"Found reference to API \"RegCloseKey\" (Indicator: \"RegCloseKey\"; File: \"Tekken3Recomp.exe\")\n Found reference to API \"RegCloseKey\" (Indicator: \"RegCloseKey\"; Source: \"00000000-00000584.00000000.95771.A2B51000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-345","sources":[{"report_type":"sandbox","report_id":"6acbcec9c40418cb9d07122c"}]},{"level":"informative","category":"General","name":"Contains ability to dynamically determine API calls","description":"Found GetProcAddress() and LoadLibraryA() in an import section (Source: Tekken3Recomp.exe)","origin":"Static Parser","mitre_attack_id":"T1027.007","relevance":1,"id":"static-79","sources":[{"report_type":"sandbox","report_id":"6acbcec9c40418cb9d07122c"}]},{"level":"informative","category":"General","name":"Contains ability to execute Windows APIs","description":"$2a","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-101","sources":[{"report_type":"sandbox","report_id":"6acbcec9c40418cb9d07122c"}]},{"level":"informative","category":"General","name":"Contains ability to execute an application (API string)","description":"Found reference to API \"ShellExecuteW\" (Indicator: \"ShellExecute\"; File: \"Tekken3Recomp.exe\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-240","sources":[{"report_type":"sandbox","report_id":"6acbcec9c40418cb9d07122c"}]},{"level":"informative","category":"General","name":"Contains ability to executes commands or batch file","description":"Found string \"cmd.exe /c mshta.exe \"%TEMP%\\tinyfd.hta\"\" (Indicator: \"cmd.exe /c\"; File: \"Tekken3Recomp.exe\")\n Found string \"cmd.exe /c cscript.exe //U //Nologo\" (Indicator: \"cmd.exe /c\"; File: \"Tekken3Recomp.exe\")\n Found string \"cmd.exe /c mshta.exe \"%TEMP%\\tinyfd.hta\"\" (Indicator: \"cmd.exe /c\"; Source: \"00000000-00000584.00000000.95771.7A93C000.00000002.mdmp\")\n Found string \"cmd.exe /c cscript.exe //U //Nologo\" (Indicator: \"cmd.exe /c\"; Source: \"00000000-00000584.00000000.95771.7A93C000.00000002.mdmp\")\n Found string \"cmd.exe /C \"%s\"\" (Indicator: \"cmd.exe /c\"; Source: \"00000000-00000584.00000000.95771.7A93C000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1059.003","relevance":1,"id":"string-174","sources":[{"report_type":"sandbox","report_id":"6acbcec9c40418cb9d07122c"}]},{"level":"informative","category":"General","name":"Contains ability to move file or directory (API string)","description":"Found reference to API \"MoveFileExW\" (Indicator: \"MoveFile\"; File: \"Tekken3Recomp.exe\")\n Found reference to API \"MoveFileA\" (Indicator: \"MoveFile\"; File: \"Tekken3Recomp.exe\")\n Found reference to API \"MoveFileExA\" (Indicator: \"MoveFile\"; File: \"Tekken3Recomp.exe\")","origin":"File/Memory","mitre_attack_id":"T1570","relevance":1,"id":"string-322","sources":[{"report_type":"sandbox","report_id":"6acbcec9c40418cb9d07122c"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve the command-line string for the current process (API string)","description":"Found reference to API \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; File: \"Tekken3Recomp.exe\")\n Found reference to API \"CommandLineToArgvW\" (Indicator: \"CommandLineToArgv\"; File: \"Tekken3Recomp.exe\")","origin":"File/Memory","mitre_attack_id":"T1059.003","relevance":1,"id":"string-206","sources":[{"report_type":"sandbox","report_id":"6acbcec9c40418cb9d07122c"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve/modify process thread (API string)","description":"Found reference to API \"SuspendThread\" (Indicator: \"SuspendThread\"; File: \"Tekken3Recomp.exe\")\n Found reference to API \"GetThreadContext\" (Indicator: \"GetThreadContext\"; File: \"Tekken3Recomp.exe\")\n Found reference to API \"SetThreadContext\" (Indicator: \"SetThreadContext\"; File: \"Tekken3Recomp.exe\")\n Found reference to API \"CreateThread\" (Indicator: \"CreateThread\"; File: \"Tekken3Recomp.exe\")\n Found reference to API \"ResumeThread\" (Indicator: \"ResumeThread\"; File: \"Tekken3Recomp.exe\")\n Found reference to API \"CreateThread\" (Indicator: \"CreateThread\"; Source: \"00000000-00000584.00000000.95771.7A93C000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-161","sources":[{"report_type":"sandbox","report_id":"6acbcec9c40418cb9d07122c"}]},{"level":"informative","category":"General","name":"Contains ability to set/get the last-error code for a calling thread (API string)","description":"Found reference to API \"SetLastError\" (Indicator: \"SetLastError\"; File: \"Tekken3Recomp.exe\")\n Found reference to API \"GetLastError\" (Indicator: \"GetLastError\"; File: \"Tekken3Recomp.exe\")\n Found reference to API \"WSAGetLastError\" (Indicator: \"GetLastError\"; File: \"Tekken3Recomp.exe\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-319","sources":[{"report_type":"sandbox","report_id":"6acbcec9c40418cb9d07122c"}]},{"level":"informative","category":"General","name":"Contains ability to show a graphical window (API string)","description":"Found reference to API \"GetWindowThreadProcessId\" (Indicator: \"GetWindowThreadProcessId\"; File: \"Tekken3Recomp.exe\")\n Found reference to API \"ShowWindow\" (Indicator: \"ShowWindow\"; File: \"Tekken3Recomp.exe\")","origin":"File/Memory","mitre_attack_id":"T1564.003","relevance":1,"id":"string-208","sources":[{"report_type":"sandbox","report_id":"6acbcec9c40418cb9d07122c"}]},{"level":"informative","category":"General","name":"Contains references to file movement (imports API)","description":"Found MoveFileA in import section (Source: Tekken3Recomp.exe)","origin":"Static Parser","mitre_attack_id":"T1083","relevance":1,"id":"static-205","sources":[{"report_type":"sandbox","report_id":"6acbcec9c40418cb9d07122c"}]},{"level":"informative","category":"General","name":"Contains registry location strings","description":"\"Software\\Microsoft\\Windows\\CurrentVersion\\Themes\\Personalize\" in Source: Tekken3Recomp.exe\n \"Software\\Microsoft\\Windows\\CurrentVersion\\Themes\\Personalize\" in Source: 00000000-00000584.00000000.95771.7A93C000.00000002.mdmp\n \"System\\CurrentControlSet\\Control\\MediaCategories\\{%02X%02X%02X%02X-%02X%02X-%02X%02X-%02X%02X-%02X%02X%02X%02X%02X%02X}\" in Source: 00000000-00000584.00000000.95771.7A93C000.00000002.mdmp\n \"th=C:\\ProgramData\\Oracle\\Java\\javapath;C:\\WINDOWS\\system32;C:\\WINDOWS;C:\\WINDOWS\\System32\\Wbem;C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\\\Registry\\Machine\\Software\\Classes\\WOW6432Node\\CLSID\\{B91D5831-B1BD-4608\" in Source: 00000000-00000584.00000000.95771.7C320000.00000004.mdmp","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-120","sources":[{"report_type":"sandbox","report_id":"6acbcec9c40418cb9d07122c"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"Process Tekken3Recomp.exe created mutex with name \"\\Sessions\\1\\BaseNamedObjects\\SM0:584:304:WilStaging_02\"\n Process Tekken3Recomp.exe created mutex with name \"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:584:304:WilStaging_02\"\n Process Tekken3Recomp.exe created mutex with name \"Local\\SM0:584:304:WilStaging_02\"\n Process Tekken3Recomp.exe created mutex with name \"SM0:584:304:WilStaging_02\"","origin":"Created Mutant","mitre_attack_id":"T1480.002","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"6acbcec9c40418cb9d07122c"}]},{"level":"informative","category":"General","name":"File contains dynamic base/NX flags","description":"\"Tekken3Recomp.exe\" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA\n IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE\n IMAGE_DLLCHARACTERISTICS_NX_COMPAT","origin":"Static Parser","id":"static-154","sources":[{"report_type":"sandbox","report_id":"6acbcec9c40418cb9d07122c"}]},{"level":"informative","category":"General","name":"Found named pipe like strings","description":"Found string - \\\\.\\pipe\\HID#VID_045E&PID_028E&IG_00#%*X&%*X&%*X#%d#%*u","origin":"File/Memory","mitre_attack_id":"T1559","relevance":1,"id":"string-146","sources":[{"report_type":"sandbox","report_id":"6acbcec9c40418cb9d07122c"}]},{"level":"informative","category":"General","name":"Found registry location strings in memory","description":"\"System\\CurrentControlSet\\Control\\MediaCategories\\{%02X%02X%02X%02X-%02X%02X-%02X%02X-%02X%02X-%02X%02X%02X%02X%02X%02X}\" in Source: 00000000-00000584.00000000.95771.7A93C000.00000002.mdmp\n \"Software\\Microsoft\\Windows\\CurrentVersion\\Themes\\Personalize\" in Source: 00000000-00000584.00000000.95771.7A93C000.00000002.mdmp\n \"th=C:\\ProgramData\\Oracle\\Java\\javapath;C:\\WINDOWS\\system32;C:\\WINDOWS;C:\\WINDOWS\\System32\\Wbem;C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\\\Registry\\Machine\\Software\\Classes\\WOW6432Node\\CLSID\\{B91D5831-B1BD-4608\" in Source: 00000000-00000584.00000000.95771.7C320000.00000004.mdmp","origin":"Memory Dumps","mitre_attack_id":"T1012","relevance":1,"id":"memorydump-10","sources":[{"report_type":"sandbox","report_id":"6acbcec9c40418cb9d07122c"}]},{"level":"informative","category":"General","name":"Found string that contains outlook file extensions .ost/.pst","description":"\"migrated %d legacy .pst (skipped %d) under %s\" (Indicator: \".pst\") in Source: 00000000-00000584.00000000.95771.7A93C000.00000002.mdmp\n \"%s/state_*.pst\" (Indicator: \".pst\") in Source: 00000000-00000584.00000000.95771.7A93C000.00000002.mdmp\n \".pst\" (Indicator: \".pst\") in Source: 00000000-00000584.00000000.95771.7A93C000.00000002.mdmp\n \"%s%sstate_%08X_slot%02d.pst\" (Indicator: \".pst\") in Source: 00000000-00000584.00000000.95771.7A93C000.00000002.mdmp","origin":"File/Memory","mitre_attack_id":"T1114.001","relevance":1,"id":"string-179","sources":[{"report_type":"sandbox","report_id":"6acbcec9c40418cb9d07122c"}]},{"level":"informative","category":"General","name":"Found well known domains (string)","description":"\"https://github.com/TechnicallyComputers/retcomm-toolchains\" (Indicator: \"github.com\")\n \"https://github.com/TechnicallyComputers/retcomm-toolchains/releases\" (Indicator: \"github.com\")\n \"NOTE: psxrecomp games require a .cue + .bin dump of the disc, or an official re-release image (.car, e.g. from the Steam Special Edition). Note the number of tracks required by this project; multitrack discs are often Redump-formatted dumps. You can generate your own from the original disc with redumper (https://github.com/superg/redumper). You cannot convert a single-track .bin or .iso to multitrack.\" (Indicator: \"github.com\")\n \"https://github.com/superg/redumper\" (Indicator: \"github.com\")\n \"https://github.com/ocornut/imgui/blob/master/docs/FAQ.md#qa-usage\" (Indicator: \"github.com\")","origin":"File/Memory","relevance":1,"id":"string-135","sources":[{"report_type":"sandbox","report_id":"6acbcec9c40418cb9d07122c"}]},{"level":"informative","category":"General","name":"Loads modules at runtime","description":"$2b","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-7","sources":[{"report_type":"sandbox","report_id":"6acbcec9c40418cb9d07122c"}]},{"level":"informative","category":"General","name":"Loads the Bcrypt module DLL","description":"\"Tekken3Recomp.exe\" loaded module \"%WINDIR%\\System32\\bcrypt.dll\" at 98750000\n \"Tekken3Recomp.exe\" loaded module \"%WINDIR%\\System32\\bcryptprimitives.dll\" at 98D20000","origin":"Loaded Module","mitre_attack_id":"T1027","id":"module-9","sources":[{"report_type":"sandbox","report_id":"6acbcec9c40418cb9d07122c"}]},{"level":"informative","category":"General","name":"Loads the RPC (Remote Procedure Call) module DLL","description":"\"Tekken3Recomp.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at 9B160000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-10","sources":[{"report_type":"sandbox","report_id":"6acbcec9c40418cb9d07122c"}]},{"level":"informative","category":"General","name":"Looks up procedures from modules (excluding apphelp.dll, kernel32.dll, user32.dll, gdi32.dll, ole32.dll, comctl32.dll, uxtheme.dll, oleaut32.dll, version.dll, msctfime.ime)","description":"\"19001a000000000040c7bc99fe7f0000@ntdll.dll\"\n \"220023000000000018c7bc99fe7f0000@ntdll.dll\"","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-8","sources":[{"report_type":"sandbox","report_id":"6acbcec9c40418cb9d07122c"}]},{"level":"informative","category":"General","name":"Overview of unique CLSIDs touched in registry","description":"\"Tekken3Recomp.exe\" touched \"SensorManager Class\" (Path: \"HKCU\\CLSID\\{77A1C827-FCD2-4689-8915-9D613CC5FA3E}\")\n \"Tekken3Recomp.exe\" touched \"WpdSerializer Class\" (Path: \"HKCU\\CLSID\\{0B91A74B-AD7C-4A9D-B563-29EEF9167172}\\TREATAS\")\n \"Tekken3Recomp.exe\" touched \"DeviceBroker\" (Path: \"HKCU\\CLSID\\{ACC56A05-E277-4B1E-A43E-7A73E3CD6E6C}\\TREATAS\")\n \"Tekken3Recomp.exe\" touched \"PSFactoryBuffer\" (Path: \"HKCU\\CLSID\\{23571E11-E545-4DD8-A337-B89BF44B10DF}\\TREATAS\")\n \"Tekken3Recomp.exe\" touched \"Microsoft DirectInput8\" (Path: \"HKCU\\CLSID\\{25E609E4-B259-11CF-BFC7-444553540000}\\TREATAS\")","origin":"Registry Access","mitre_attack_id":"T1546.015","relevance":3,"id":"registry-72","sources":[{"report_type":"sandbox","report_id":"6acbcec9c40418cb9d07122c"}]},{"level":"informative","category":"General","name":"PE file contains executable sections","description":"\"Tekken3Recomp.exe\" has an executable section named \".text\"","origin":"Static Parser","relevance":1,"id":"static-80","sources":[{"report_type":"sandbox","report_id":"6acbcec9c40418cb9d07122c"}]},{"level":"informative","category":"General","name":"PE file contains writable sections","description":"\"Tekken3Recomp.exe\" has an writable section named \".data\"\n \"Tekken3Recomp.exe\" has an writable section named \"/4\"\n \"Tekken3Recomp.exe\" has an writable section named \".bss\"\n \"Tekken3Recomp.exe\" has an writable section named \".idata\"\n \"Tekken3Recomp.exe\" has an writable section named \".CRT\"\n \"Tekken3Recomp.exe\" has an writable section named \".tls\"","origin":"Static Parser","id":"static-95","sources":[{"report_type":"sandbox","report_id":"6acbcec9c40418cb9d07122c"}]},{"level":"informative","category":"General","name":"PE file entrypoint instructions","description":"\"Tekken3Recomp.exe\" file has an entrypoint instructions - \"push\trbp,mov\trbp, rsp,sub\trsp, 0x30,mov\tdword ptr [rbp - 4], 0xff,mov\trax, qword ptr [rip + 0x14c6cd4],mov\tdword ptr [rax], 1,call\t0x140001154,mov\tdword ptr [rbp - 4], eax,nop\t,nop\t,mov\teax, dword ptr [rbp - 4],add\trsp, 0x30,pop\trbp,ret\t,push\trbp,mov\trbp, rsp,sub\trsp, 0x30,mov\tdword ptr [rbp - 4], 0xff,mov\trax, qword ptr [rip + 0x14c6ca5],mov\tdword ptr [rax], 0,call\t0x140001154,mov\tdword ptr [rbp - 4], eax,nop\t,nop\t,mov\teax, dword ptr [rbp - 4],add\trsp, 0x30,pop\trbp,ret\t,push\trbp,mov\trbp, rsp,\"","origin":"Static Parser","id":"static-96","sources":[{"report_type":"sandbox","report_id":"6acbcec9c40418cb9d07122c"}]},{"level":"informative","category":"General","name":"PE file has a big raw size section","description":"Raw size of \".text\" is \"0x12d0600\" greater than 0x100000\n Raw size of \".rdata\" is \"0x1f1800\" greater than 0x100000","origin":"Static Parser","relevance":3,"id":"static-125","sources":[{"report_type":"sandbox","report_id":"6acbcec9c40418cb9d07122c"}]},{"level":"informative","category":"General","name":"PE file has a big virtual size section","description":"Virtual size of \".text\" is \"0x12d05a0\" greater than 0x100000\n Virtual size of \".rdata\" is \"0x1f1700\" greater than 0x100000\n Virtual size of \".bss\" is \"0x27f3191c\" greater than 0x100000","origin":"Static Parser","relevance":3,"id":"static-124","sources":[{"report_type":"sandbox","report_id":"6acbcec9c40418cb9d07122c"}]},{"level":"informative","category":"General","name":"PE file has a high image base","description":"\"Tekken3Recomp.exe\" has high imagebase \"0x140000000\"","origin":"Static Parser","relevance":1,"id":"static-93","sources":[{"report_type":"sandbox","report_id":"6acbcec9c40418cb9d07122c"}]},{"level":"informative","category":"General","name":"Reads information about supported languages","description":"\"Tekken3Recomp.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EN-US\")\n \"Tekken3Recomp.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"EN-US\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"6acbcec9c40418cb9d07122c"}]},{"level":"informative","category":"General","name":"References Windows file paths for DLLs (possible dropped files)","description":"Observed system executable string:\"%WINDIR%\\System32\\dinput8.dll\" [Source: 00000000-00000584-0000044E-664177945]","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-625","sources":[{"report_type":"sandbox","report_id":"6acbcec9c40418cb9d07122c"}]},{"level":"informative","category":"General","name":"Sets a windows hook","description":"\"Tekken3Recomp.exe\" sets a global windows hook with filter \"WH_MOUSE_LL\"","origin":"API Call","mitre_attack_id":"T1056.004","relevance":10,"id":"api-71","sources":[{"report_type":"sandbox","report_id":"6acbcec9c40418cb9d07122c"}]},{"level":"informative","category":"Installation/Persistence","name":"Able to establish persistence using Exchange transport agent (.NET)","description":"Found string \"vkCmdClearAttachments\" (Source: \"00000000-00000584.00000000.95771.7A93C000.00000002.mdmp\")\n Found string \"missing vkCmdClearAttachments\" (Source: \"00000000-00000584.00000000.95771.7A93C000.00000002.mdmp\")\n Found string \"glGetFramebufferAttachmentParameteriv\" (Source: \"00000000-00000584.00000000.95771.7A93C000.00000002.mdmp\")\n Found string \"SDL GPU Vulkan: Application requested unsupported physical device feature 'shaderInputAttachmentArrayDynamicIndexing'\" (Source: \"00000000-00000584.00000000.95771.7A93C000.00000002.mdmp\")\n Found string \"SDL GPU Vulkan: Application requested unsupported physical device feature 'shaderInputAttachmentArrayNonUniformIndexing'\" (Source: \"00000000-00000584.00000000.95771.7A93C000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1505.002","relevance":1,"id":"string-938","sources":[{"report_type":"sandbox","report_id":"6acbcec9c40418cb9d07122c"}]},{"level":"informative","category":"Installation/Persistence","name":"Contains ability to load modules (API string)","description":"$2c","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-310","sources":[{"report_type":"sandbox","report_id":"6acbcec9c40418cb9d07122c"}]},{"level":"informative","category":"Installation/Persistence","name":"Contains ability to register device notification handler (API string)","description":"Found reference to API \"RegisterDeviceNotificationW\" (Indicator: \"RegisterDeviceNotification\"; File: \"Tekken3Recomp.exe\")","origin":"File/Memory","mitre_attack_id":"T1098.005","relevance":1,"id":"string-543","sources":[{"report_type":"sandbox","report_id":"6acbcec9c40418cb9d07122c"}]},{"level":"informative","category":"Installation/Persistence","name":"Creates a thread in a self process","description":"\"Tekken3Recomp.exe\" creates a thread in process \"-1\" (Handle: FFFFFFFFFFFFFFFF)","origin":"API Call","mitre_attack_id":"T1055.003","relevance":3,"id":"api-264","sources":[{"report_type":"sandbox","report_id":"6acbcec9c40418cb9d07122c"}]},{"level":"informative","category":"Installation/Persistence","name":"Dropped files","description":"\"psx_last_run_report.json\" has type \"JSON text data\"- Location: [C:\\psx_last_run_report.json]- [targetUID: 00000000-00000584]\n \"psx_freeze_dump_psx-runtime_1791741668.json\" has type \"JSON text data\"- Location: [C:\\psx_freeze_dump_psx-runtime_1791741668.json]- [targetUID: 00000000-00000584]","origin":"Binary File","mitre_attack_id":"T1105","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"6acbcec9c40418cb9d07122c"}]},{"level":"informative","category":"Installation/Persistence","name":"Opens registry keys","description":"$2d","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-177","sources":[{"report_type":"sandbox","report_id":"6acbcec9c40418cb9d07122c"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries basic information of the specified process","description":"\"Tekken3Recomp.exe\" queries basic process information of the \"C:\\Tekken3Recomp.exe\" (UID: 584)","origin":"API Call","mitre_attack_id":"T1057","relevance":1,"id":"api-235","sources":[{"report_type":"sandbox","report_id":"6acbcec9c40418cb9d07122c"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries registry keys","description":"$2e","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-172","sources":[{"report_type":"sandbox","report_id":"6acbcec9c40418cb9d07122c"}]},{"level":"informative","category":"Installation/Persistence","name":"Shows ability to use execution guardrails","description":"$2f","origin":"Indicator Combinations","mitre_attack_id":"T1480","relevance":1,"id":"summary-29","sources":[{"report_type":"sandbox","report_id":"6acbcec9c40418cb9d07122c"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files","description":"\"Tekken3Recomp.exe\" trying to touch file \"C:\\Windows\\System32\\apphelp.dll\"\n \"Tekken3Recomp.exe\" trying to touch file \"C:\\WINDOWS\\SYSTEM32\\apphelp.dll\"\n \"Tekken3Recomp.exe\" trying to touch file \"C:\\Tekken3Recomp.exe\"\n \"Tekken3Recomp.exe\" trying to touch file \"C:\\Windows\\System32\\ntdll.dll\"\n \"Tekken3Recomp.exe\" trying to touch file \"C:\\Windows\\System32\\kernel32.dll\"\n \"Tekken3Recomp.exe\" trying to touch file \"C:\\Windows\\System32\\KernelBase.dll\"\n \"Tekken3Recomp.exe\" trying to touch file \"C:\\Windows\\apppatch\\sysmain.sdb\"\n \"Tekken3Recomp.exe\" trying to touch file \"C:\\BCRYPT.DLL\"\n \"Tekken3Recomp.exe\" trying to touch file \"C:\\bcrypt.dll\"\n \"Tekken3Recomp.exe\" trying to touch file \"C:\\Windows\\System32\\bcrypt.dll\"\n \"Tekken3Recomp.exe\" trying to touch file \"C:\\WINDOWS\\SYSTEM32\\bcrypt.dll\"\n \"Tekken3Recomp.exe\" trying to touch file \"C:\\TEKKEN3RECOMP.EXE.LOCAL\"\n \"Tekken3Recomp.exe\" trying to touch file \"C:\\Tekken3Recomp.exe.Local\\\"","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-263","sources":[{"report_type":"sandbox","report_id":"6acbcec9c40418cb9d07122c"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (executable)","description":"$30","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-126","sources":[{"report_type":"sandbox","report_id":"6acbcec9c40418cb9d07122c"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (non-executable)","description":"\"Tekken3Recomp.exe\" trying to access non-existent file \"C:\\TEKKEN3RECOMP.EXE.LOCAL\"\n \"Tekken3Recomp.exe\" trying to access non-existent file \"C:\\Tekken3Recomp.exe.Local\\\"\n \"Tekken3Recomp.exe\" trying to access non-existent file \"C:\\MODS\"\n \"Tekken3Recomp.exe\" trying to access non-existent file \"C:\\Windows\\System32\\DriverStore\\en-US\\OEM13.INF_LOC\"\n \"Tekken3Recomp.exe\" trying to access non-existent file \"C:\\Windows\\USB_VIBRATION\"\n \"Tekken3Recomp.exe\" trying to access non-existent file \"C:\\Windows\\USB VIBRATION\"\n \"Tekken3Recomp.exe\" trying to access non-existent file \"C:\\Windows\\System32\\DriverStore\\en-US\\OEM14.INF_LOC\"","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-161","sources":[{"report_type":"sandbox","report_id":"6acbcec9c40418cb9d07122c"}]},{"level":"informative","category":"Installation/Persistence","name":"Writes files","description":"\"Tekken3Recomp.exe\" writes file \"c:\\psx_last_run_report.json\"\n \"Tekken3Recomp.exe\" writes file \"c:\\psx_freeze_dump_psx-runtime_1791741668.json\"","origin":"API Call","relevance":1,"id":"api-242","sources":[{"report_type":"sandbox","report_id":"6acbcec9c40418cb9d07122c"}]},{"level":"informative","category":"Network Related","name":"Able to identify remote systems","description":"Found string \"\"ping\"\" (Indicator: \"\"ping\"; Source: \"00000000-00000584.00000000.95771.7A93C000.00000002.mdmp\")\n Found string \"ping\" (Indicator: \"ping\"; Source: \"00000000-00000584.00000000.95771.7A93C000.00000002.mdmp\")\n Found string \"PING\" (Indicator: \"ping\"; Source: \"00000000-00000584.00000000.95771.7A93C000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1018","relevance":7,"id":"string-417","sources":[{"report_type":"sandbox","report_id":"6acbcec9c40418cb9d07122c"}]},{"level":"informative","category":"Network Related","name":"Able to monitor socket connection","description":"Found reference to API \"setsockopt\" (Indicator: \"setsockopt\"; File: \"Tekken3Recomp.exe\")","origin":"File/Memory","mitre_attack_id":"T1205.002","relevance":1,"id":"string-879","sources":[{"report_type":"sandbox","report_id":"6acbcec9c40418cb9d07122c"}]},{"level":"informative","category":"Network Related","name":"Contains ability to communicate with C2 using Sockets (API string)","description":"Found reference to API \"WSAStartup\" (Indicator: \"WSAStartup\"; File: \"Tekken3Recomp.exe\")\n Found reference to API \"WSAStartup failed\" (Indicator: \"WSAStartup\"; Source: \"00000000-00000584.00000000.95771.7A93C000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1095","relevance":1,"id":"string-228","sources":[{"report_type":"sandbox","report_id":"6acbcec9c40418cb9d07122c"}]},{"level":"informative","category":"Network Related","name":"Contains ability to communicate with network (API string)","description":"Found reference to API \"WSAStartup\" (Indicator: \"WSAStartup\"; File: \"Tekken3Recomp.exe\")\n Found reference to API \"WSAStartup failed\" (Indicator: \"WSAStartup\"; Source: \"00000000-00000584.00000000.95771.7A93C000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-601","sources":[{"report_type":"sandbox","report_id":"6acbcec9c40418cb9d07122c"}]},{"level":"informative","category":"Network Related","name":"Contains ability to create/connect to a named pipe (API string)","description":"Found reference to API \"CreatePipe\" (Indicator: \"CreatePipe\"; File: \"Tekken3Recomp.exe\")\n Found reference to API \"vkCreatePipelineLayout\" (Indicator: \"CreatePipe\"; Source: \"00000000-00000584.00000000.95771.7A93C000.00000002.mdmp\")\n Found reference to API \"missing vkCreatePipelineLayout\" (Indicator: \"CreatePipe\"; Source: \"00000000-00000584.00000000.95771.7A93C000.00000002.mdmp\")\n Found reference to API \"vkCreatePipelineLayout()\" (Indicator: \"CreatePipe\"; Source: \"00000000-00000584.00000000.95771.7A93C000.00000002.mdmp\")\n Found reference to API \"vkGetDeviceProcAddr(device, \"vkCreatePipelineLayout\") failed\" (Indicator: \"CreatePipe\"; Source: \"00000000-00000584.00000000.95771.7A93C000.00000002.mdmp\")\n Found reference to API \"vkCreatePipelineCache\" (Indicator: \"CreatePipe\"; Source: \"00000000-00000584.00000000.95771.7A93C000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1559","relevance":1,"id":"string-210","sources":[{"report_type":"sandbox","report_id":"6acbcec9c40418cb9d07122c"}]},{"level":"informative","category":"Network Related","name":"Contains ability to open a port and listen for incoming connection (API string)","description":"Found reference to API \"setsockopt\" (Indicator: \"setsockopt\"; File: \"Tekken3Recomp.exe\")","origin":"File/Memory","mitre_attack_id":"T1571","relevance":1,"id":"string-419","sources":[{"report_type":"sandbox","report_id":"6acbcec9c40418cb9d07122c"}]},{"level":"informative","category":"Network Related","name":"Contains references to network communication API (string)","description":"$31","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-899","sources":[{"report_type":"sandbox","report_id":"6acbcec9c40418cb9d07122c"}]},{"level":"informative","category":"Network Related","name":"Found potential IP address in binary/memory","description":"\"0.0.0.0\"\n \"127.0.0.1\"\n \"0.0.0.0:%s\"\n \"0.0.0.0:0\"\n \"0.0.0.0:7778\"\n \"127.0.0.1:7777\"\n \"0.0.0.0:7777\"\n Potential IP \"127.0.0.1\" found in string \"psxrecomp: debug server LISTENING on 127.0.0.1:%d\"\n \"0.0.0.0:%d\"\n Potential IP \"0.0.0.0\" found in string \"raddr 0.0.0.0 rport 0\"\n \"192.168.0.2\"","origin":"File/Memory","mitre_attack_id":"T1071","id":"string-14","sources":[{"report_type":"sandbox","report_id":"6acbcec9c40418cb9d07122c"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"$32","origin":"File/Memory","mitre_attack_id":"T1071","relevance":3,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"6acbcec9c40418cb9d07122c"}]},{"level":"informative","category":"Network Related","name":"Found potential URLs in memory dumps","description":"$33","origin":"Memory Dumps","mitre_attack_id":"T1071","relevance":1,"id":"memorydump-2","sources":[{"report_type":"sandbox","report_id":"6acbcec9c40418cb9d07122c"}]},{"level":"informative","category":"Network Related","name":"Found string related to HTTP headers","description":"Found string \"GET %s HTTP/1.1\" (Indicator: \"HTTP/1.1\"; Source: \"00000000-00000584.00000000.95771.7A93C000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1071.001","relevance":1,"id":"string-457","sources":[{"report_type":"sandbox","report_id":"6acbcec9c40418cb9d07122c"}]},{"level":"informative","category":"Network Related","name":"Shows ability to send encrypted data to the internet","description":"Sample contains ability to use Microsoft's Enhanced Cryptographic Provider APIs and contains ability to communicate with network","origin":"Indicator Combinations","mitre_attack_id":"T1119","relevance":2,"id":"summary-27","sources":[{"report_type":"sandbox","report_id":"6acbcec9c40418cb9d07122c"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match - Djb2 Hash Algorithm","description":"YARA signature for Djb2 Hash Algorithm matched on file \"sample.bin\"","origin":"YARA Signature","mitre_attack_id":"T1027","relevance":5,"id":"yara-542","sources":[{"report_type":"sandbox","report_id":"6acbcec9c40418cb9d07122c"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match - Zlib compression","description":"YARA signature for zlib compression library used in file \"sample.bin\"","origin":"YARA Signature","mitre_attack_id":"T1560","relevance":2,"id":"yara-137","sources":[{"report_type":"sandbox","report_id":"6acbcec9c40418cb9d07122c"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match – Zlib compression file detected","description":"YARA signature for file using Zlib compression matched on file \"sample.bin\"\n YARA signature for file using Zlib compression matched on process \"00000000-00000584\"","origin":"YARA Signature","mitre_attack_id":"T1132.001","relevance":3,"id":"yara-161","sources":[{"report_type":"sandbox","report_id":"6acbcec9c40418cb9d07122c"}]},{"level":"informative","category":"Remote Access Related","name":"Contains ability to retrieve remote user information","description":"Observed string: \"finger\" (Indicator: \"finger\") in Source: 00000000-00000584.00000000.95771.7A93C000.00000002.mdmp\n Observed string: \"Finger\" (Indicator: \"finger\") in Source: 00000000-00000584.00000000.95771.7A93C000.00000002.mdmp\n Observed string: \"Invalid finger index\" (Indicator: \" finger \") in Source: 00000000-00000584.00000000.95771.7A93C000.00000002.mdmp","origin":"File/Memory","mitre_attack_id":"T1105","relevance":1,"id":"string-579","sources":[{"report_type":"sandbox","report_id":"6acbcec9c40418cb9d07122c"}]},{"level":"informative","category":"Remote Access Related","name":"Contains references to RPC protocol sequence strings","description":"Found string \"+ncalrpc:[OLE31333C092EC76733C84220F7EC42]\" (Indicator: \"ncalrpc\"; Source: \"00000000-00000584.00000000.95771.7C320000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1090","relevance":1,"id":"string-531","sources":[{"report_type":"sandbox","report_id":"6acbcec9c40418cb9d07122c"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to capture drag-drop file operations","description":"Found string \"DragQueryFileW\" (File: \"Tekken3Recomp.exe\")\n Found string \"GetClipboardData\" (File: \"Tekken3Recomp.exe\")","origin":"File/Memory","mitre_attack_id":"T1115","relevance":1,"id":"string-915","sources":[{"report_type":"sandbox","report_id":"6acbcec9c40418cb9d07122c"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to capture screen (API string)","description":"$34","origin":"File/Memory","mitre_attack_id":"T1113","relevance":1,"id":"string-78","sources":[{"report_type":"sandbox","report_id":"6acbcec9c40418cb9d07122c"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to discover operating system information (API string)","description":"Found reference to API \"RtlGetVersion\" (Indicator: \"RtlGetVersion\"; Source: \"00000000-00000584.00000000.95771.7A93C000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-86","sources":[{"report_type":"sandbox","report_id":"6acbcec9c40418cb9d07122c"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to query registry keys (API string)","description":"Found registry query API: \"RegQueryValueExW\" in file \"Tekken3Recomp.exe\"\n Found registry query API: \"RegOpenKeyExW\" in file \"Tekken3Recomp.exe\"\n Found registry query API: \"RegOpenKeyExW\" in \"00000000-00000584.00000000.95771.A2B51000.00000004.mdmp\"\n Found registry query API: \"RegQueryValueExW\" in \"00000000-00000584.00000000.95771.A2B51000.00000004.mdmp\"","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-229","sources":[{"report_type":"sandbox","report_id":"6acbcec9c40418cb9d07122c"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to retrieve information about pressed keystrokes (API string)","description":"Found reference to API \"AttachThreadInput\" (Indicator: \"AttachThreadInput\"; File: \"Tekken3Recomp.exe\")\n Found reference to API \"GetKeyboardState\" (Indicator: \"GetKeyboardState\"; File: \"Tekken3Recomp.exe\")\n Found reference to API \"GetAsyncKeyState\" (Indicator: \"GetAsyncKeyState\"; File: \"Tekken3Recomp.exe\")\n Found reference to API \"MapVirtualKeyW\" (Indicator: \"MapVirtualKey\"; File: \"Tekken3Recomp.exe\")\n Found reference to API \"GetKeyState\" (Indicator: \"GetKeyState\"; File: \"Tekken3Recomp.exe\")","origin":"File/Memory","mitre_attack_id":"T1056.001","relevance":1,"id":"string-88","sources":[{"report_type":"sandbox","report_id":"6acbcec9c40418cb9d07122c"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to retrieve logical drive information (API string)","description":"Found reference to API \"GetLogicalDrives\" (Indicator: \"GetLogicalDrives\"; File: \"Tekken3Recomp.exe\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-80","sources":[{"report_type":"sandbox","report_id":"6acbcec9c40418cb9d07122c"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for taking snapshot of the specified processes","description":"\"Tekken3Recomp.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}\n \"Tekken3Recomp.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"584\"}","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-103","sources":[{"report_type":"sandbox","report_id":"6acbcec9c40418cb9d07122c"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains CRYPTO related strings","description":"Found string \"SymGetModuleBase64\" (Indicator: \"base64\"; File: \"Tekken3Recomp.exe\")\n Found string \"SymGetModuleBase64\" (Indicator: \"base64\"; Source: \"00000000-00000584.00000000.95771.A2B51000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":3,"id":"string-57","sources":[{"report_type":"sandbox","report_id":"6acbcec9c40418cb9d07122c"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to access clipboard data (API string)","description":"Found reference to API \"GetClipboardData\" (Indicator: \"GetClipboardData\"; File: \"Tekken3Recomp.exe\")\n Found reference to API \"OpenClipboard\" (Indicator: \"OpenClipboard\"; File: \"Tekken3Recomp.exe\")\n Found reference to API \"GetClipboardFormatNameA\" (Indicator: \"GetClipboardFormatName\"; File: \"Tekken3Recomp.exe\")","origin":"File/Memory","mitre_attack_id":"T1115","relevance":1,"id":"string-188","sources":[{"report_type":"sandbox","report_id":"6acbcec9c40418cb9d07122c"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to detect sandbox (imports API)","description":"Found GetCursorPos() in an import section (Source: Tekken3Recomp.exe)","origin":"Static Parser","mitre_attack_id":"T1497","relevance":1,"id":"static-132","sources":[{"report_type":"sandbox","report_id":"6acbcec9c40418cb9d07122c"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate files on disk (API string)","description":"Found reference to API \"FindFirstFileA\" (Indicator: \"FindFirstFile\"; File: \"Tekken3Recomp.exe\")\n Found reference to API \"FindNextFileA\" (Indicator: \"FindNextFile\"; File: \"Tekken3Recomp.exe\")\n Found reference to API \"FindFirstFileExW\" (Indicator: \"FindFirstFile\"; File: \"Tekken3Recomp.exe\")\n Found reference to API \"FindNextFileW\" (Indicator: \"FindNextFile\"; File: \"Tekken3Recomp.exe\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-83","sources":[{"report_type":"sandbox","report_id":"6acbcec9c40418cb9d07122c"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate process and/or its information (API string)","description":"Found reference to API \"GetModuleHandleW\" (Indicator: \"GetModuleHandle\"; File: \"Tekken3Recomp.exe\")\n Found reference to API \"GetModuleHandleExW\" (Indicator: \"GetModuleHandle\"; File: \"Tekken3Recomp.exe\")\n Found reference to API \"GetEnvironmentStringsW\" (Indicator: \"GetEnvironmentStrings\"; File: \"Tekken3Recomp.exe\")\n Found reference to API \"GetCurrentProcessId\" (Indicator: \"GetCurrentProcess\"; File: \"Tekken3Recomp.exe\")\n Found reference to API \"GetModuleHandleA\" (Indicator: \"GetModuleHandle\"; File: \"Tekken3Recomp.exe\")\n Found reference to API \"GetCurrentProcess\" (Indicator: \"GetCurrentProcess\"; File: \"Tekken3Recomp.exe\")\n Found reference to API \"GetModuleHandle() failed with error code %lu.\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00000584.00000000.95771.7A93C000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-85","sources":[{"report_type":"sandbox","report_id":"6acbcec9c40418cb9d07122c"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to query network adapter information (API string)","description":"Found reference to API \"GetAdaptersAddresses\" (Indicator: \"GetAdaptersAddresses\"; File: \"Tekken3Recomp.exe\")\n Found reference to API \"GetAdaptersAddresses\" (Indicator: \"GetAdaptersAddresses\"; Source: \"00000000-00000584.00000000.95771.A2B51000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1016","relevance":1,"id":"string-118","sources":[{"report_type":"sandbox","report_id":"6acbcec9c40418cb9d07122c"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to read files (API string)","description":"Found reference to API \"ReadFile\" (Indicator: \"ReadFile\"; File: \"Tekken3Recomp.exe\")\n Found reference to API \"ReadFile\" (Indicator: \"ReadFile\"; Source: \"00000000-00000584.00000000.95771.7A93C000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","id":"string-534","sources":[{"report_type":"sandbox","report_id":"6acbcec9c40418cb9d07122c"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to register/read input devices (API string)","description":"Found reference to API \"GetRawInputData\" (Indicator: \"GetRawInputData\"; File: \"Tekken3Recomp.exe\")\n Found reference to API \"RegisterRawInputDevices\" (Indicator: \"RegisterRawInputDevices\"; File: \"Tekken3Recomp.exe\")","origin":"File/Memory","mitre_attack_id":"T1056","relevance":1,"id":"string-403","sources":[{"report_type":"sandbox","report_id":"6acbcec9c40418cb9d07122c"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve a module handle (API string)","description":"Found reference to API \"GetModuleHandleW\" (Indicator: \"GetModuleHandle\"; File: \"Tekken3Recomp.exe\")\n Found reference to API \"GetModuleHandleExW\" (Indicator: \"GetModuleHandle\"; File: \"Tekken3Recomp.exe\")\n Found reference to API \"GetModuleHandleA\" (Indicator: \"GetModuleHandle\"; File: \"Tekken3Recomp.exe\")\n Found reference to API \"GetModuleHandle() failed with error code %lu.\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00000584.00000000.95771.7A93C000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-427","sources":[{"report_type":"sandbox","report_id":"6acbcec9c40418cb9d07122c"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve address of exported function from a DLL (API string)","description":"$35","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-317","sources":[{"report_type":"sandbox","report_id":"6acbcec9c40418cb9d07122c"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve file and directory information (API string)","description":"$36","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-207","sources":[{"report_type":"sandbox","report_id":"6acbcec9c40418cb9d07122c"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve files based on search patterns","description":"Found string \"where powershell.exe\" (Indicator: \"where \"; Source: \"00000000-00000584.00000000.95771.7A93C000.00000002.mdmp\")\n Found string \"where dialog.exe\" (Indicator: \"where \"; Source: \"00000000-00000584.00000000.95771.7A93C000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-484","sources":[{"report_type":"sandbox","report_id":"6acbcec9c40418cb9d07122c"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve list of files and subdirectories","description":"Found string \"dir = \"\" (Indicator: \"dir \"; Source: \"00000000-00000584.00000000.95771.7A93C000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-328","sources":[{"report_type":"sandbox","report_id":"6acbcec9c40418cb9d07122c"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the fully qualified path of module (API string)","description":"Found reference to API \"GetModuleFileNameW\" (Indicator: \"GetModuleFileName\"; File: \"Tekken3Recomp.exe\")\n Found reference to API \"GetModuleFileNameA\" (Indicator: \"GetModuleFileName\"; File: \"Tekken3Recomp.exe\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-164","sources":[{"report_type":"sandbox","report_id":"6acbcec9c40418cb9d07122c"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the host's architecture (API string)","description":"Found reference to API \"GetEnvironmentVariableA\" (Indicator: \"GetEnvironmentVariable\"; File: \"Tekken3Recomp.exe\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-107","sources":[{"report_type":"sandbox","report_id":"6acbcec9c40418cb9d07122c"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the local name for a socket (API string)","description":"Found reference to API \"getsockname\" (Indicator: \"getsockname\"; File: \"Tekken3Recomp.exe\")\n Found reference to API \"getsockname failed, errno=%d\" (Indicator: \"getsockname\"; Source: \"00000000-00000584.00000000.95771.7A93C000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1016","relevance":1,"id":"string-224","sources":[{"report_type":"sandbox","report_id":"6acbcec9c40418cb9d07122c"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the specified system metric or system configuration setting (API string)","description":"Found reference to API \"GetSystemMetrics\" (Indicator: \"GetSystemMetrics\"; File: \"Tekken3Recomp.exe\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-131","sources":[{"report_type":"sandbox","report_id":"6acbcec9c40418cb9d07122c"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the time elapsed since the system was started (API string)","description":"Found reference to API \"GetTickCount64\" (Indicator: \"GetTickCount\"; File: \"Tekken3Recomp.exe\")\n Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; File: \"Tekken3Recomp.exe\")\n Found reference to API \"GetTickCount64\" (Indicator: \"GetTickCount\"; Source: \"00000000-00000584.00000000.95771.7A93C000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497.003","relevance":1,"id":"string-205","sources":[{"report_type":"sandbox","report_id":"6acbcec9c40418cb9d07122c"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains string like password/secret","description":"$37","origin":"File/Memory","mitre_attack_id":"T1555","relevance":1,"id":"string-475","sources":[{"report_type":"sandbox","report_id":"6acbcec9c40418cb9d07122c"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Found system command-related strings","description":"$38","origin":"File/Memory","mitre_attack_id":"T1082","relevance":7,"id":"string-126","sources":[{"report_type":"sandbox","report_id":"6acbcec9c40418cb9d07122c"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Reads system-defined device setup information from registry","description":"\"Tekken3Recomp.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\CLASS\\{4D36E968-E325-11CE-BFC1-08002BE10318}\\0002\"; Key: \"PRUNINGMODE\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":3,"id":"registry-106","sources":[{"report_type":"sandbox","report_id":"6acbcec9c40418cb9d07122c"}]},{"level":"informative","category":"System Security","name":"Calls an API used to open a process handle","description":"Observed import api \"OpenProcess\" which can be \"used to open a process handle\" [Source: Tekken3Recomp.exe]","origin":"Static Parser","mitre_attack_id":"T1489","relevance":5,"id":"static-191","sources":[{"report_type":"sandbox","report_id":"6acbcec9c40418cb9d07122c"}]},{"level":"informative","category":"System Security","name":"Contains ability to access device drivers","description":"Found string \":\\WINDOWS\\system32\\DRIVERS\" (Indicator: \"system32\\drivers\"; Source: \"00000000-00000584.00000000.95771.7C320000.00000004.mdmp\")\n Found string \":\\WINDOWS\\system32\\DriverStore\\FileRepository\" (Indicator: \"system32\\drivers\"; Source: \"00000000-00000584.00000000.95771.7C320000.00000004.mdmp\")\n Found string \"\\Device\\HarddiskVolume2\\Tekken3Recomp.exe\" (Indicator: \"\\Device\\\"; Source: \"00000000-00000584.00000000.95771.7C320000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-474","sources":[{"report_type":"sandbox","report_id":"6acbcec9c40418cb9d07122c"}]},{"level":"informative","category":"System Security","name":"Contains ability to delete device information set (API string)","description":"Found reference to API \"SetupDiDestroyDeviceInfoList\" (Indicator: \"SetupDiDestroyDeviceInfoList\"; File: \"Tekken3Recomp.exe\")","origin":"File/Memory","mitre_attack_id":"T1485","relevance":1,"id":"string-442","sources":[{"report_type":"sandbox","report_id":"6acbcec9c40418cb9d07122c"}]},{"level":"informative","category":"System Security","name":"Contains ability to delete files/directories (API string)","description":"Found reference to API \"RemoveDirectoryW\" (Indicator: \"RemoveDirectory\"; File: \"Tekken3Recomp.exe\")\n Found reference to API \"DeleteFileW\" (Indicator: \"DeleteFile\"; File: \"Tekken3Recomp.exe\")","origin":"File/Memory","mitre_attack_id":"T1070.004","relevance":1,"id":"string-308","sources":[{"report_type":"sandbox","report_id":"6acbcec9c40418cb9d07122c"}]},{"level":"informative","category":"System Security","name":"Contains ability to hook/unhook windows functions (API string)","description":"Found reference to API \"UnhookWindowsHookEx\" (Indicator: \"UnhookWindowsHook\"; File: \"Tekken3Recomp.exe\")\n Found reference to API \"SetWindowsHookExW\" (Indicator: \"SetWindowsHook\"; File: \"Tekken3Recomp.exe\")\n Found reference to API \"CallNextHookEx\" (Indicator: \"CallNextHook\"; File: \"Tekken3Recomp.exe\")","origin":"File/Memory","mitre_attack_id":"T1056.001","relevance":1,"id":"string-91","sources":[{"report_type":"sandbox","report_id":"6acbcec9c40418cb9d07122c"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify the user configuration/privilege (API string)","description":"Found reference to API \"SystemParametersInfoW\" (Indicator: \"SystemParametersInfo\"; File: \"Tekken3Recomp.exe\")\n Found reference to API \"SystemParametersInfoA\" (Indicator: \"SystemParametersInfo\"; File: \"Tekken3Recomp.exe\")","origin":"File/Memory","mitre_attack_id":"T1098","relevance":1,"id":"string-132","sources":[{"report_type":"sandbox","report_id":"6acbcec9c40418cb9d07122c"}]},{"level":"informative","category":"System Security","name":"Contains ability to terminate a process (API string)","description":"Found reference to API \"ExitProcess\" (Indicator: \"ExitProcess\"; File: \"Tekken3Recomp.exe\")\n Found reference to API \"TerminateProcess\" (Indicator: \"TerminateProcess\"; File: \"Tekken3Recomp.exe\")\n Found reference to API \"TerminateProcess failed\" (Indicator: \"TerminateProcess\"; Source: \"00000000-00000584.00000000.95771.7A93C000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1489","relevance":1,"id":"string-316","sources":[{"report_type":"sandbox","report_id":"6acbcec9c40418cb9d07122c"}]},{"level":"informative","category":"System Security","name":"Contains ability to write files (API string)","description":"Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; File: \"Tekken3Recomp.exe\")\n Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; Source: \"00000000-00000584.00000000.95771.7A93C000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1105","id":"string-535","sources":[{"report_type":"sandbox","report_id":"6acbcec9c40418cb9d07122c"}]},{"level":"informative","category":"System Security","name":"Opens the Kernel Security Device Driver (KsecDD) of Windows","description":"\"Tekken3Recomp.exe\" opened \"\\Device\\KsecDD\"","origin":"API Call","mitre_attack_id":"T1068","relevance":10,"id":"api-37","sources":[{"report_type":"sandbox","report_id":"6acbcec9c40418cb9d07122c"}]},{"level":"informative","category":"System Security","name":"Writes registry keys","description":"$39","origin":"Registry Access","mitre_attack_id":"T1112","relevance":3,"id":"registry-136","sources":[{"report_type":"sandbox","report_id":"6acbcec9c40418cb9d07122c"}]},{"level":"informative","category":"Unusual Characteristics","name":"Contains reference to mutex-related activity (API string)","description":"Found reference to API \"ReleaseMutex\" (Indicator: \"ReleaseMutex\"; File: \"Tekken3Recomp.exe\")\n Found reference to API \"CreateMutexA\" (Indicator: \"CreateMutex\"; File: \"Tekken3Recomp.exe\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-354","sources":[{"report_type":"sandbox","report_id":"6acbcec9c40418cb9d07122c"}]},{"level":"suspicious","category":"Anti-Detection/Stealthiness","name":"File exhibits characteristics of junk code obfuscation","description":"File has excessive sections (21)\n common in obfuscated files\n Section \".text\" unusually large (19727776 bytes)\n possible junk padding\n Section \".bss\" unusually large (670243100 bytes)\n possible junk padding","origin":"Static Parser","mitre_attack_id":"T1027.016","relevance":3,"id":"static-9001","sources":[{"report_type":"sandbox","report_id":"6acbcec9c40418cb9d07122c"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Possibly checks for known debuggers/analysis tools","description":"Found string \":\\WINDOWS\\SYSTEM32\\dbghelp.dll\" (Indicator: \"dbghelp.dll\"; Source: \"00000000-00000584.00000000.95771.7C320000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1518.001","relevance":2,"id":"string-5","sources":[{"report_type":"sandbox","report_id":"6acbcec9c40418cb9d07122c"}]},{"level":"suspicious","category":"Cryptographic Related","name":"Uses bzip2 compression library to compress data","description":"Found CRC table used in bzip2 compression \"00000000-00000584.00000000.95771.7A93C000.00000002.mdmp\" at offset 1269252; code bytes = b71dc1046e3b8209d926430ddc7604136b6bc517b24d861a0550471eb8ed08260ff0c922d6d68a2f61cb4b2b649b0c35d386cd310aa08e3cbdbd4f3870db114cc7c6d0481ee09345a9fd5241acad155f1bb0d45bc2969756758b5652c836196a7f2bd86ea60d","origin":"Memory Dumps","mitre_attack_id":"T1560.002","relevance":3,"id":"memorydump-20","sources":[{"report_type":"sandbox","report_id":"6acbcec9c40418cb9d07122c"}]},{"level":"suspicious","category":"Environment Awareness","name":"May attempt to implement anti-virtualization techniques using MAC address detection","description":"\"CI\\VEN_15AD&DEV_07C0&SUBSYS_07C015AD&REV_02\\8EF62E605005056200\" (Indicator: \"005056\")","origin":"File/Memory","mitre_attack_id":"T1518.001","relevance":3,"id":"string-2","sources":[{"report_type":"sandbox","report_id":"6acbcec9c40418cb9d07122c"}]},{"level":"suspicious","category":"Environment Awareness","name":"Reads VM-specific registry key","description":"$3a","origin":"Registry Access","mitre_attack_id":"T1012","relevance":5,"id":"registry-33","sources":[{"report_type":"sandbox","report_id":"6acbcec9c40418cb9d07122c"}]},{"level":"suspicious","category":"Remote Access Related","name":"Contains indicators of bot communication commands","description":"file/memory contains long string with (Indicator: \"cmd=\"; Source: \"00000000-00000584.00000000.95771.7A93C000.00000002.mdmp\")\n Found string \"cdrom: savestate clamped pending cmd=0x%02X delay %d -> %d\" (Indicator: \"cmd=\"; Source: \"00000000-00000584.00000000.95771.7A93C000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1041","relevance":3,"id":"string-29","sources":[{"report_type":"sandbox","report_id":"6acbcec9c40418cb9d07122c"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Calls an API that may be used to take screenshots","description":"\"Tekken3Recomp.exe\" called \"CreateCompatibleBitmap\" with parameters {\"hdc\": \"690108f3\"\n \"cx\": \"1\"\n \"cy\": \"1\"}\n \"Tekken3Recomp.exe\" called \"CreateCompatibleBitmap\" with parameters {\"hdc\": \"6b0108f3\"\n \"cx\": \"1\"\n \"cy\": \"1\"}\n \"Tekken3Recomp.exe\" called \"CreateCompatibleBitmap\" with parameters {\"hdc\": \"14010822\"\n \"cx\": \"1\"\n \"cy\": \"1\"}","origin":"API Call","mitre_attack_id":"T1113","relevance":1,"id":"api-105","sources":[{"report_type":"sandbox","report_id":"6acbcec9c40418cb9d07122c"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Calls an API typically used for keylogging","description":"\"Tekken3Recomp.exe\" called \"GetKeyState\" with parameters {\"nVirtKey\": \"20\"}\n \"Tekken3Recomp.exe\" called \"GetKeyState\" with parameters {\"nVirtKey\": \"144\"}\n \"Tekken3Recomp.exe\" called \"GetKeyState\" with parameters {\"nVirtKey\": \"145\"}","origin":"API Call","mitre_attack_id":"T1056.001","relevance":5,"id":"api-40","sources":[{"report_type":"sandbox","report_id":"6acbcec9c40418cb9d07122c"}]},{"level":"suspicious","category":"System Security","name":"Deletes registry keys","description":"\"Tekken3Recomp.exe\" (Access type: \"DELETEVAL\"; Path: \"HKCU\\SOFTWARE\\VMWARE, INC.\\GUESTGLDRIVER\\APPLICATION SETTINGS\\GPUTEST\"; Key: \"GLSLVERSION\"; Value: \"\")\n \"Tekken3Recomp.exe\" (Access type: \"DELETEVAL\"; Path: \"HKCU\\SOFTWARE\\VMWARE, INC.\\GUESTGLDRIVER\\APPLICATION SETTINGS\\GPUTESTGUI\"; Key: \"GLSLVERSION\"; Value: \"\")","origin":"Registry Access","mitre_attack_id":"T1070","relevance":3,"id":"registry-170","sources":[{"report_type":"sandbox","report_id":"6acbcec9c40418cb9d07122c"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Found TLS callbacks","description":"\"Tekken3Recomp.exe\" has a TLS callback with entrypoint at 0x141119770\n \"Tekken3Recomp.exe\" has a TLS callback with entrypoint at 0x141119830\n \"Tekken3Recomp.exe\" has a TLS callback with entrypoint at 0x1411336ef","origin":"Static Parser","mitre_attack_id":"T1055.005","relevance":10,"id":"static-17","sources":[{"report_type":"sandbox","report_id":"6acbcec9c40418cb9d07122c"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Imports suspicious APIs","description":"RegCloseKey\n RegOpenKeyExW\n GetModuleFileNameW\n SleepConditionVariableCS\n LoadLibraryExW\n GetThreadContext\n GetFileSizeEx\n GetModuleFileNameA\n LoadLibraryW\n WriteFile\n FindFirstFileA\n FindNextFileA\n CreateFileW\n GetModuleHandleW\n GetModuleHandleExW\n GetCommandLineW\n FindFirstFileExW\n TerminateProcess\n OutputDebugStringA\n GetSystemInfo\n CreateProcessA\n CreateFileA\n IsDebuggerPresent\n GetProcAddress\n GetFileAttributesExA\n OpenProcess\n GetFileAttributesW\n CreateThread\n DeviceIoControl\n GetTempPathW\n VirtualProtect\n GetTickCount64\n DeleteFileW\n FindNextFileW\n CreateProcessW\n CopyFileExW\n GetTickCount\n Sleep\n GetModuleHandleA\n GetFileAttributesA\n LoadLibraryA\n CreateDirectoryW\n GetLogicalDrives\n OutputDebugStringW\n GetFileAttributesExW\n ShellExecuteW\n GetUpdateRect\n GetClipboardData\n GetWindowThreadProcessId\n GetCursorPos\n SetWindowsHookExW\n listen\n send\n connect\n socket\n accept\n WSAStartup\n recv\n closesocket\n bind\n sendto\n recvfrom","origin":"Static Parser","mitre_attack_id":"T1106","relevance":1,"id":"static-1","sources":[{"report_type":"sandbox","report_id":"6acbcec9c40418cb9d07122c"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"PE file contains unusual section name","description":"\"Tekken3Recomp.exe\" has a section named \"/4\"\n \"Tekken3Recomp.exe\" has a section named \"/14\"\n \"Tekken3Recomp.exe\" has a section named \"/29\"\n \"Tekken3Recomp.exe\" has a section named \"/41\"\n \"Tekken3Recomp.exe\" has a section named \"/55\"\n \"Tekken3Recomp.exe\" has a section named \"/67\"\n \"Tekken3Recomp.exe\" has a section named \"/80\"\n \"Tekken3Recomp.exe\" has a section named \"/91\"\n \"Tekken3Recomp.exe\" has a section named \"/107\"\n \"Tekken3Recomp.exe\" has a section named \"/123\"","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":10,"id":"static-60","sources":[{"report_type":"sandbox","report_id":"6acbcec9c40418cb9d07122c"}]},{"level":"malicious","category":"Environment Awareness","name":"Sets a global windows hook to intercept mouse events","description":"\"Tekken3Recomp.exe\" set a windows hook with filter \"WH_MOUSE_LL\"","origin":"API Call","mitre_attack_id":"T1056.004","relevance":10,"id":"api-73","sources":[{"report_type":"sandbox","report_id":"6acbcec9c40418cb9d07122c"}]}],"intel_graph":{"map":{"File:1c095f7dda806af36d2c5598257353b2712739263c2d07d2c461f5bda72cdf6c":{"type":"File","value":"1c095f7dda806af36d2c5598257353b2712739263c2d07d2c461f5bda72cdf6c"},"File:a94f8bc24901e6d52b03c79342b6ff38c7b5e486fd109d7cd1327c76f5604936":{"type":"File","value":"a94f8bc24901e6d52b03c79342b6ff38c7b5e486fd109d7cd1327c76f5604936"},"File:e0fe2f7b4518b52580e98788d4f6893b3b23235cda5553029464e343b8f7da7e":{"type":"File","value":"e0fe2f7b4518b52580e98788d4f6893b3b23235cda5553029464e343b8f7da7e"}},"chains":[{"id":"sandbox_files","root":"File:a94f8bc24901e6d52b03c79342b6ff38c7b5e486fd109d7cd1327c76f5604936","edges":[{"edge_kind":"extracted","from_key":"File:a94f8bc24901e6d52b03c79342b6ff38c7b5e486fd109d7cd1327c76f5604936","to_key":"File:e0fe2f7b4518b52580e98788d4f6893b3b23235cda5553029464e343b8f7da7e"},{"edge_kind":"extracted","from_key":"File:a94f8bc24901e6d52b03c79342b6ff38c7b5e486fd109d7cd1327c76f5604936","to_key":"File:1c095f7dda806af36d2c5598257353b2712739263c2d07d2c461f5bda72cdf6c"}],"verdict":{"verdict":"unknown","verdict_source":"sandbox"}}]}},"activity":{"stats":{"process_count":1,"spawned_processes_count":1,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":4,"imported_dlls_count":71,"dropped_files_count":0,"extracted_files_count":2,"files_written_count":2,"files_deleted_count":0,"registry_keys_created_count":0,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":0,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":0,"dns_resolutions_count":0,"contacted_urls_count":0,"http_requests_count":0},"behavior_tags":["evasive"],"sample_flags":["Extracted Files"],"sandbox_reports":[{"id":"6acbcec9c40418cb9d07122c","environment_id":160,"environment_description":"Windows 10 64 bit","state":"SUCCESS","verdict":"suspicious","threat_score":35,"submit_name":"Tekken3Recomp.exe","analysis_start_time":"2026-10-11T18:00:46+00:00","indicators_count":{"informative":160,"suspicious":22,"malicious":1},"tags":["Extracted Files"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":null,"dns_resolutions":null,"http_requests":null},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"6acbcec9c40418cb9d07122c"}],"processes":[{"pid":584,"ppid":0,"name":"Tekken3Recomp.exe","command_line":"","sha256":"a94f8bc24901e6d52b03c79342b6ff38c7b5e486fd109d7cd1327c76f5604936","normalized_path":"C:\\Tekken3Recomp.exe","uid":"00000000-00000584","icon":"$3b"}],"all_imported_dlls":["comctl32.dll","VxSSL64.dll","cfgmgr32.dll","oleaut32.dll","winmm.dll","InputHost.dll","CoreMessaging.dll","ucrtbase.dll","powrprof.dll","bcrypt.dll","hid.dll","SensorsNativeApi.V2.dll","dbghelp.dll","vm3dgl64.dll","SHCore.dll","shell32.dll","ws2_32.dll","version.dll","vcruntime140.dll","msasn1.dll","comdlg32.dll","gdi32full.dll","ole32.dll","CoreUIComponents.dll","WinTypes.dll","crypt32.dll","ntmarta.dll","windows.storage.dll","winmmbase.dll","cryptsp.dll","dwmapi.dll","XInput1_4.dll","ntdll.dll","msvcrt.dll","combase.dll","bcryptprimitives.dll","ResourcePolicyClient.dll","propsys.dll","deviceaccess.dll","sechost.dll","wintrust.dll","SensorsApi.dll","KernelBase.dll","imm32.dll","glu32.dll","dxgi.dll","PortableDeviceTypes.dll","vm3dglhelper64.dll","msvcp_win.dll","profapi.dll","msvcp140.dll","devobj.dll","shlwapi.dll","IPHLPAPI.DLL","opengl32.dll","fltLib.dll","msctf.dll","uxtheme.dll","apphelp.dll","advapi32.dll","win32u.dll","gdi32.dll","setupapi.dll","clbcatq.dll","dinput8.dll","user32.dll","kernel.appcore.dll","vcruntime140_1.dll","kernel32.dll","rpcrt4.dll","SensorsUtilsV2.dll"]},"file_activity":{"dropped_files":null,"extracted_files":[{"name":"psx_freeze_dump_psx-runtime_1791741668.json","sha256":"e0fe2f7b4518b52580e98788d4f6893b3b23235cda5553029464e343b8f7da7e","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6acbcec9c40418cb9d07122c"}]},{"name":"psx_last_run_report.json","sha256":"1c095f7dda806af36d2c5598257353b2712739263c2d07d2c461f5bda72cdf6c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6acbcec9c40418cb9d07122c"}]}],"files_written":[{"path":"C:\\psx_last_run_report.json","sources":[{"report_type":"sandbox","report_id":"6acbcec9c40418cb9d07122c"}]},{"path":"C:\\psx_freeze_dump_psx-runtime_1791741668.json","sources":[{"report_type":"sandbox","report_id":"6acbcec9c40418cb9d07122c"}]}],"files_deleted":null},"registry_activity":{"keys_created":null,"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":[{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:584:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6acbcec9c40418cb9d07122c"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:584:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6acbcec9c40418cb9d07122c"}]},{"name":"Local\\SM0:584:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6acbcec9c40418cb9d07122c"}]},{"name":"SM0:584:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6acbcec9c40418cb9d07122c"}]}]}},"report_ids":{"sandbox_job_ids":["6acbcec9c40418cb9d07122c"]}}}]]}] 1e:null 22:[["$","title","0",{"children":"Suspicious Sample a94f8bc24901… — Score 35/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Suspicious verdict for sample a94f8bc24901…. Threat score 35/100. 0/24 AV engines flagged this file. 1 malicious and 12 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/a94f8bc24901e6d52b03c79342b6ff38c7b5e486fd109d7cd1327c76f5604936"}],["$","meta","4",{"property":"og:title","content":"Suspicious Sample a94f8bc24901… — Score 35/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Suspicious verdict for sample a94f8bc24901…. Threat score 35/100. 0/24 AV engines flagged this file. 1 malicious and 12 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/a94f8bc24901e6d52b03c79342b6ff38c7b5e486fd109d7cd1327c76f5604936"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Suspicious Sample a94f8bc24901… — Score 35/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Suspicious verdict for sample a94f8bc24901…. Threat score 35/100. 0/24 AV engines flagged this file. 1 malicious and 12 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L3c","11",{}]]