File scan report
Verdict Safe
Is project-
None of the 69 antivirus engines that checked it flagged the executable, and its completed sandbox run returned clean, though its unsigned, status warrants source verification.
Read the whole reasonShow less
Moderate evidence · No engine flags it, but no publisher signature confirms who made it.
Good practice2 tips
We found nothing harmful in this file.
Run it only if it came from the developer's own website or an official app store.
Keep your antivirus and Windows updates switched on.
No scanner can promise a file is 100% safe.
Reads the latest antivirus results for this file's hash. Nothing is uploaded.
Antivirus results
0 of 69 flagged
- Flagged 0
- No detection 69
- No result 6
- Code signing Unsigned
- Test run Completed
- First seen 17d ago
Chapter 02
Why we think so
4 points against it and 5 in its favour, checked against the scan evidence.
The reasoning behind this verdict
None of the 69 antivirus engines that checked it reported a detection, including all reporting major antivirus engines, and the completed sandbox run returned clean. The unsigned executable is and carries unconfirmed and mappings, so obtain it only from the expected project source and keep security software enabled.
No antivirus engine among the 75 returned a malicious or suspicious result, and there is no family consensus. One completed sandbox run returned clean and showed no network contacts, persistence indicators, or named injected process. The and mappings are cautionary, but the saved evidence does not prove an injection target or malicious intent. The antivirus analysis found neither high-entropy code nor an identified packer. Confidence is moderated because the executable is unsigned, and six dropped files lack saved verdicts; additionally, no complete contacted-host reputation result is available.
What We Detected
None of the 69 antivirus engines that checked it flagged the executable, including the reporting major antivirus engines. No named malware family, hacking tool label, external research rule, packing indicator, or malicious child verdict was present.
Threat Behavior
One completed sandbox run returned clean. The run recorded no sample network contacts or persistence indicators. Six dropped files have no saved verdicts, so their status remains unresolved, and no complete contacted-host reputation result is available.
What To Do Now
Confirm the file came from the expected project or developer because it is unsigned and newly observed. Keep antivirus and security software enabled, and rescan after reputation has had time to develop if the source cannot be independently verified.
Where this verdict could be wrong3 caveats
- The executable is unsigned and so its publisher and longer-term reputation are not established.
- The sandbox mapped possible process injection and privilege escalation, although it identified no injected process and returned a clean verdict.
- Six dropped files lack saved verdicts, and no complete contacted-host reputation result is available.
These are the assessment's weak points. If you believe one applies to your file, report the verdict and we'll re-review it.
- None of the 69 antivirus engines that checked it flagged the file.
- The completed sandbox run returned clean.
- No persistence indicators or sample network contacts were recorded during the run.
- The antivirus analysis found no packer or high-entropy code.
- No malicious file it created was identified among the inspected files.
- The Windows executable is unsigned, leaving no verified publisher identity.
- It was first observed very recently, so long-term reputation is limited.
- The sandbox mapped possible process injection and privilege escalation, without identifying an injection target.
- Six dropped files do not yet have saved verdicts.
6 sources checked · 5 complete · 1 not needed or not applicable. See every source
Chapter 03
What it did in our test
It ran in our isolated test environment; no test environment rated what it did as risky.
Test run summary
Capture complete- 13sandbox rule tags
- 2spawned processes
- 0network contacts
- 20filesystem & mutex artifacts
What this file did when executed
This file was run in a sandbox and its runtime behaviour was observed.
Sandbox verdicts
1- VT: CLEANclean
Techniques observed in the sandbox
13MITRE ATT&CK techniques the sandbox mapped. Highlighted ones are rare in normal software; the others are common in legitimate programs too.
- T1027· Obfuscated code
- T1027.002· Obfuscated code
- T1033· Reads user info
- T1036
- T1055· Process injection
- T1056· Keylogging
- T1071· Application protocol
- T1082· System recon
- T1497· Sandbox evasion
- T1548
- T1553
- T1553.002
- T1574· Execution hijack
Observed activity
Processes started
2Programs the file ran, with their command lines.
project-reclaimer-v0.9.12.exe"C:\Users\<USER>\Desktop\project-reclaimer-v0.9.12.exe"project-reclaimer-v0.9.12.exe"C:\Users\user\Desktop\project-reclaimer-v0.9.12.exe"
Files
15Files the file created, changed or deleted.
- Written
C:\Users\<USER>\Documents\My Games\Project Reclaimer\Logs\client.previous.log - Written
C:\Users\<USER>\Documents\My Games\Project Reclaimer\Logs\client.log - Written
C:\Users\<USER>\Documents\My Games\Project Reclaimer\Logs\client.open - Written
C:\Users\<USER>\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db - Written
C:\Users\<USER>\AppData\Local\Microsoft\Windows\Explorer\iconcache_16.db - Written
C:\Users\<USER>\Documents\New folder
Show all 15 entries for files
- Written
C:\Users\<USER>\Documents\New folder (2) - Written
C:\Users\user\Documents - Written
C:\Users\user\Documents\My Games - Written
C:\Users\user\Documents\My Games\Project Reclaimer - Written
C:\Users\user\Documents\My Games\Project Reclaimer\Logs - Written
C:\Users\user\Documents\My Games\Project Reclaimer\Logs\client.log - Written
C:\Users\user\Documents\My Games\Project Reclaimer\Logs\client.open - Written
\Device\ConDrv\\Connect - Deleted
C:\Users\<USER>\Documents\My Games\Project Reclaimer\Logs\client.log
Registry and auto-start
16Settings the file changed, including ways to start again after a restart.
- Set
HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots - Set
HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx - Set
HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\MRUListEx - Set
HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell\SniffedFolderType - Set
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SlowContextMenuEntries - Set
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Discardable\PostSetup\ShellNew\Classes
Show all 16 entries for registry and auto-start
- Set
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Discardable\PostSetup\ShellNew\~reserved~ - Set
HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\Mode - Set
HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\LogicalViewMode - Set
HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\FFlags - Set
HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\IconSize - Set
HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\Sort - Set
HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\ColInfo - Set
HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupView - Set
HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupByKey:FMTID - Deleted
HKEY_CURRENT_USER\Software\Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupCollapseState
Mutexes
5Named locks a program uses so only one copy runs; malware families often reuse them.
Local\Shell.CMruPidlListLocal\SessionImmersiveColorMutexGlobal\SyncRootManagerLocal\Mutexf01b4d95cf55d32a.automaticDestinations-msShellNewConsolidationMutex64
Sandbox background — not the file
3The analysis machine's own processes and connections, recorded in every run.
- VM process
services.exeC:\Windows\system32\services.exe - VM process
Explorer.EXEC:\Windows\Explorer.EXE - VM process
conhost.exeC:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Files this sample writes at runtime
This file drops 6 children at runtime. None are currently flagged malicious in our cache. 6 have no saved verdict and were not checked; that is missing coverage, not a finding.
- 48eeef9b8ee6dfa2d398…c7efc1Not checkedno saved verdict
- e460b7d9542253dc7286…85159eNot checkedno saved verdict
- bd0fbd6b462b0836de6f…2e2ea9Not checkedno saved verdict
- 05ae02b76d82b5576156…2cc38cNot checkedno saved verdict
- f885aee048f46000535b…740050Not checkedno saved verdict
- 7ff01d923640e2d0f662…1689a5Not checkedno saved verdict
Chapter 04
Technical details
None of the 69 antivirus engines that checked it flag it; no publisher signature.
Sources checked
Every check behind this verdict
6 sources checked · 5 complete · 1 not needed or not applicable. Complete means the check returned a usable result; it does not mean the file is safe.
File fingerprint
- Last analyzed
- Oct 10, 2026, 7:12 PM UTC
- SHA-256
db92d82f489e59a9edf078c738e37916316658690c817754a108c6c7d64a9acf- SHA-1
11d0fcaa3d9e5c7e992860e192a7336eeccfcc54- MD5
ffbaf84ed8e1694d20d7a80e93d7a82c
About this file
project-reclaimer.exe is a Win32 EXE file of 36.8 MB.
- Type and size
- Win32 EXE · 36.8 MB
- Signer
- UnsignedNo code signature.
- First seen
- Oct 10, 2026On VirusTotal.
- Submitted by
- 13 distinct sources
- Packer
- None detected
- Entropy
- 6.26 of 8
First scanned
Antivirus consensus
0 of 69 engines flagged this file
6 of the 75 engines returned no result for this file (file type not supported, or the scan did not finish), so they did not check it.
- Tier-118 engines0flagged
- Tier-234 engines0flagged
- Low-trust17 engines0flagged
View all 75 engine results
- AcronisClean
- AhnLab-V3Clean
- AlibabaClean
- alibabacloudClean
- ALYacClean
- Antiy-AVLClean
- APEXClean
- ArcabitClean
- AvastClean
- Avast-MobileNo result
- AVGClean
- AviraClean
- BitDefenderClean
- BitDefenderFalxNo result
- BkavClean
- CAT-QuickHealClean
- ClamAVNo result
- CMCClean
- CrowdStrikeClean
- CTXClean
- CylanceClean
- CynetClean
- DeepInstinctClean
- DrWebClean
- ElasticClean
- EmsisoftClean
- ESET-NOD32Clean
- F-SecureClean
- FortinetClean
- GDataClean
- GoogleClean
- GridinsoftClean
- huorongClean
- IkarusClean
- JiangminClean
- K7AntiVirusClean
- K7GWClean
- KasperskyClean
- KingsoftClean
- LionicClean
- MalwarebytesClean
- MaxSecureClean
- McAfeeDClean
- MicrosoftClean
- MicroWorld-eScanClean
- NANO-AntivirusClean
- PaloaltoClean
- PandaClean
- RisingClean
- SangforClean
- SentinelOneClean
- SkyhighNo result
- SophosClean
- SUPERAntiSpywareClean
- SymantecClean
- SymantecMobileInsightNo result
- TACHYONClean
- tehtrisClean
- TencentClean
- TrapmineClean
- TrellixENSClean
- TrendMicroClean
- TrendMicro-HouseCallClean
- TrustlookNo result
- VaristClean
- VBA32Clean
- VIPREClean
- VirITClean
- ViRobotClean
- WebrootClean
- XcitiumClean
- YandexClean
- ZillyaClean
- ZoneAlarmClean
- ZonerClean
Signatures and behavior heuristics
Low-severity pattern matches — worth noting but not on their own cause for alarm.
VirusTotal's sandbox summary maps this run to MITRE T1055 (Process Injection), but no injected process of the sample's own was recorded (the analysis VM's own WMI adapter, crash handlers and Chrome updater are not counted). VirusTotal maps T1055 on about half of all files no engine flags, so the mapping alone is not evidence of injection.
EvidenceT1055 (sandbox MITRE mapping)
Section entropy & packers
No high-entropy executable section or known packer signature was detected. Data and resource sections can still have high entropy without indicating packed code.
How widely this file has been seen
Moderate prevalence — neither rare nor common. No strong prior applies.
Chapter 05
Questions & answers
Short answers to the 6 questions people ask most about this file.
Is project-reclaimer.exe safe?
What is project-reclaimer.exe?
How many antivirus engines detected project-reclaimer.exe?
What is the SHA-256 hash of project-reclaimer.exe?
Is it safe to run project-reclaimer.exe?
How up to date is this analysis of project-reclaimer.exe?
Community
Member reviews and reports for this exact file hash.