File scan report
Verdict Safe
Is Tenkaichi3
Only MaxSecure flagged this archive with a generic label, while 18 major antivirus engines and the available evidence from the test run supplied no corroborating threat indicators.
Read the whole reasonShow less
Moderate evidence · No engine flags it, but no publisher signature confirms who made it.
Good practice2 tips
We found nothing harmful in this file.
Open it only if you trust the person or website you got it from.
Keep your security software and system updates switched on.
No scanner can promise a file is 100% safe.
Antivirus results
1 of 67 flagged
- Flagged 1
- No detection 66
- No result 8
- Code signing Not applicable
- Test run Completed
- First seen 10d ago
Chapter 02
Why we think so
2 points against it and 5 in its favour, checked against the scan evidence.
The reasoning behind this verdict
Only 1 of the 67 antivirus engines that checked it flagged the archive, and that result came from less reliable MaxSecure using a generic label. The major antivirus engines were silent, while observed execution showed no malicious sandbox assessment, named injection target, hostile contacted host, or malicious dropped component.
The sole detection among 75 engines came from MaxSecure and used a generic trojan label rather than a recognized malware family. The sandbox runs recorded no malicious assessment or high-risk technique backed by a concrete artifact. Although was mapped, no target process was identified, so it does not establish process injection. Reputation checks covered all four listed domains without finding a known hostile host, and no inspected child carried a malicious determination. The file is recently observed, but that limited history does not outweigh the strong less reliable-only false-positive pattern.
What We Detected
Only 1 of the 67 antivirus engines that checked it flagged the archive. MaxSecure supplied a generic trojan label, while none of the 18 reporting major antivirus engines produced a detection and no recognized malware family was identified.
Threat Behavior
The sandbox runs did not return a malicious assessment. T1055 was mapped, but no target process was recorded, so the evidence does not show actual process injection. All four listed domains were covered by the available reputation check without a known hostile result, and no inspected dropped component had a malicious determination.
What To Do Now
The isolated generic detection is most consistent with a false positive. Obtain the archive from the project's official release channel, keep security software enabled, and rescan if the contents or hash differ from the expected download.
Where this verdict could be wrong2 caveats
- MaxSecure reported a generic Trojan.Malware.300983.susgen detection.
- The archive was first observed on Oct 15, 2026, so its longer-term reputation is not yet established.
These are the assessment's weak points. If you believe one applies to your file, report the verdict and we'll re-review it.
- Only 1 of the 67 antivirus engines that checked it flagged the archive, and the detector was less reliable.
- None of the 18 reporting major antivirus engines produced a detection.
- Observed execution received no malicious sandbox assessment and identified no concrete process-injection target.
- The reputation check covered all four listed domains without finding a known hostile host.
- No inspected dropped component had a malicious determination.
- MaxSecure reported a generic trojan detection.
- The archive was first observed on Oct 15, 2026, leaving limited long-term reputation.
6 sources checked · all complete. See every source
Chapter 03
What it did in our test
It ran in our isolated test environment; no test environment rated what it did as risky.
Test run summary
Capture complete- 8sandbox rule tags
- 5spawned processes
- 2network contacts
- 15filesystem & mutex artifacts
What this file did when executed
This file was run in a sandbox and its runtime behaviour was observed.
Sandbox verdicts
1- VT: CLEANclean
Techniques observed in the sandbox
8MITRE ATT&CK techniques the sandbox mapped. Highlighted ones are rare in normal software; the others are common in legitimate programs too.
- T1012
- T1033· Reads user info
- T1055· Process injection
- T1056· Keylogging
- T1082· System recon
- T1497· Sandbox evasion
- T1562· Disables security
- T1574· Execution hijack
Observed activity
Processes started
5Programs the file ran, with their command lines.
rundll32.exe"C:\Windows\system32\rundll32.exe" "C:\Users\<USER>\AppData\Local\Temp\Tenkaichi3Decomp/SDL3.dll",#1Tenkaichi3Decomp-setup.exe"C:\Users\<USER>\AppData\Local\Temp\Tenkaichi3Decomp/Tenkaichi3Decomp-setup.exe"Tenkaichi3Decomp.exe"C:\Users\<USER>\AppData\Local\Temp\Tenkaichi3Decomp/Tenkaichi3Decomp.exe"unarchiver.exe"C:\Windows\System32\unarchiver.exe" "C:\Users\user\Desktop\Tenkaichi3Decomp-windows-x64.zip"7za.exeC:\Windows\SysWOW64\7za.exe "C:\Windows\System32\7za.exe" x -pinfected -y -o"C:\Users\user\AppData\Local\Temp\rzplgzqx.gup" "C:\Users\user\Desktop\Tenkaichi3Decomp-windows-x64.zip"
Network contacts
22 hosts, listed as 2 domains. Links show the host and path only.
- Domain
www.msn.com.edgekey.net - Domain
e592.d.akamaiedge.net
Files
15Files the file created, changed or deleted.
- Written
C:\Users\<USER>\AppData\Local\D3DSCache - Written
C:\Users\<USER>\AppData\Local\D3DSCache\ce5592d2a61f22c7\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.lock - Written
C:\Users\<USER>\AppData\Local\D3DSCache\ce5592d2a61f22c7\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.idx - Written
C:\Users\<USER>\AppData\Local\D3DSCache\ce5592d2a61f22c7\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.val - Written
\Device\ConDrv\Connect - Written
C:\Users\user\AppData\Local\Temp\rzplgzqx.gup
Show all 15 entries for files
- Written
C:\Users\user\AppData\Local\Temp\rzplgzqx.gup\Tenkaichi3Decomp - Written
C:\Users\user\AppData\Local\Temp\rzplgzqx.gup\Tenkaichi3Decomp\README.txt - Written
C:\Users\user\AppData\Local\Temp\rzplgzqx.gup\Tenkaichi3Decomp\SDL3.dll - Written
C:\Users\user\AppData\Local\Temp\rzplgzqx.gup\Tenkaichi3Decomp\Tenkaichi3Decomp-setup.exe - Written
C:\Users\user\AppData\Local\Temp\rzplgzqx.gup\Tenkaichi3Decomp\Tenkaichi3Decomp.dat - Written
C:\Users\user\AppData\Local\Temp\rzplgzqx.gup\Tenkaichi3Decomp\Tenkaichi3Decomp.exe - Written
C:\Users\user\AppData\Local\Temp\rzplgzqx.gup\Tenkaichi3Decomp\Tenkaichi3Decomp.exe.mem - Written
C:\Users\user\AppData\Local\Temp\rzplgzqx.gup\Tenkaichi3Decomp\a11y_es.txt - Written
C:\Users\user\AppData\Local\Temp\rzplgzqx.gup\Tenkaichi3Decomp\fonts
Sandbox background — not the file
3The analysis machine's own processes and connections, recorded in every run.
- VM process
conhost.exeC:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 - VM host
www.msn.com - VM host
assets.msn.com
Files this sample writes at runtime
This file drops 10 children at runtime. None are currently flagged malicious in our cache. 10 have no saved verdict and were not checked; that is missing coverage, not a finding.
- 4217dc767a9c3c520caa…44fc91Not checkedno saved verdict
- 86c3d99954fd790944b1…947071Not checkedno saved verdict
- a04f12d49cdb7af094b1…08aefcNot checkedno saved verdict
- 3d7291b0ff34dd95bc62…8f752dNot checkedno saved verdict
- 5a3bb1f72d8861c27249…b0286eNot checkedno saved verdict
- 0d7cfc162f3a321fdf9e…9b7f96Not checkedno saved verdict
- ba251a8ddea5260882ea…90ecc7Not checkedno saved verdict
- 4ea27765e14543d4d905…2f50fcNot checkedno saved verdict
- 5c29650250730778eccb…f8e9ebNot checkedno saved verdict
- 9c9b496cda2e0388581a…1809b2Not checkedno saved verdict
Chapter 04
Technical details
1 of the 67 antivirus engines that checked it flags it.
Sources checked
Every check behind this verdict
6 sources checked · all complete. Complete means the check returned a usable result; it does not mean the file is safe.
Engines that flagged it 1
The saved verdict treats these detections as likely false positives.
- MaxSecureTrojan.Malware.300983.susgen
File fingerprint
- Last analyzed
- Oct 15, 2026, 11:19 PM UTC
- SHA-256
6ca44348b488a558d24ddad18c5a5b2710ef20284326117192d68b9932a69206- SHA-1
7092142a95d5eabf635ae84ffc7bd50dbef88581- MD5
a7c489d263bd3beae1117b479e7f59e4
About this file
Tenkaichi3Decomp-windows-x64.zip is a ZIP file of 9.3 MB.
- Type and size
- ZIP · 9.3 MB
- Signer
- Not applicable
- First seen
- Oct 15, 2026On VirusTotal.
- Submitted by
- 16 distinct sources
First scanned Updated
Verdict history
- Not fully confirmed
- Safeafter the analysis was completed
Ratings change when antivirus engines, our checks or MalwareTips staff learn more about a file.
Antivirus consensus
1 of 67 engines flagged this file
8 of the 75 engines returned no result for this file (file type not supported, or the scan did not finish), so they did not check it.
- Tier-118 engines0flagged
- Tier-236 engines0flagged
- Low-trust13 engines1flagged
View all 75 engine results
- MaxSecureMalicious: Trojan.Malware.300983.susgen
- AcronisClean
- AhnLab-V3Clean
- AlibabaClean
- alibabacloudClean
- ALYacClean
- Antiy-AVLClean
- APEXNo result
- ArcabitClean
- AvastClean
- Avast-MobileClean
- AVGClean
- AviraClean
- BitDefenderClean
- BitDefenderFalxNo result
- BkavClean
- CAT-QuickHealClean
- ClamAVClean
- CMCClean
- CrowdStrikeClean
- CTXClean
- CylanceNo result
- CynetClean
- DeepInstinctClean
- DrWebClean
- ElasticClean
- EmsisoftClean
- ESET-NOD32Clean
- F-SecureClean
- FortinetClean
- GDataClean
- GoogleClean
- GridinsoftClean
- huorongClean
- IkarusClean
- JiangminClean
- K7AntiVirusClean
- K7GWClean
- KasperskyClean
- KingsoftClean
- LionicClean
- MalwarebytesClean
- McAfeeDClean
- MicrosoftClean
- MicroWorld-eScanClean
- NANO-AntivirusClean
- PaloaltoNo result
- PandaClean
- RisingClean
- SangforClean
- SentinelOneClean
- SkyhighClean
- SophosClean
- SUPERAntiSpywareClean
- SymantecClean
- SymantecMobileInsightNo result
- TACHYONClean
- tehtrisNo result
- TencentClean
- TrapmineNo result
- TrellixENSClean
- TrendMicroClean
- TrendMicro-HouseCallClean
- TrustlookNo result
- VaristClean
- VBA32Clean
- VIPREClean
- VirITClean
- ViRobotClean
- WebrootClean
- XcitiumClean
- YandexClean
- ZillyaClean
- ZoneAlarmClean
- ZonerClean
Signatures and behavior heuristics
Low-severity pattern matches — worth noting but not on their own cause for alarm.
VirusTotal's sandbox summary maps this run to MITRE T1055 (Process Injection), but no injected process of the sample's own was recorded (the analysis VM's own WMI adapter, crash handlers and Chrome updater are not counted). VirusTotal maps T1055 on about half of all files no engine flags, so the mapping alone is not evidence of injection.
EvidenceT1055 (sandbox MITRE mapping)
How widely this file has been seen
Moderate prevalence — neither rare nor common. No strong prior applies.
Chapter 05
Questions & answers
Short answers to the 6 questions people ask most about this file.
Is Tenkaichi3Decomp-windows-x64.zip safe?
What is Tenkaichi3Decomp-windows-x64.zip?
How many antivirus engines detected Tenkaichi3Decomp-windows-x64.zip?
What is the SHA-256 hash of Tenkaichi3Decomp-windows-x64.zip?
Is it safe to open or extract Tenkaichi3Decomp-windows-x64.zip?
How up to date is this analysis of Tenkaichi3Decomp-windows-x64.zip?
Community
Member reviews and reports for this exact file hash.