Overview
overview
5Static
static
3Reclaiming...rms.py
windows10-2004-x64
3Reclaiming...rms.py
windows11-ltsc_2024-x64
3Reclaiming...heLost
ubuntu-18.04-amd64
4Reclaiming...hon.so
ubuntu-18.04-amd64
1Reclaiming...python
ubuntu-18.04-amd64
1Reclaiming...ythonw
ubuntu-18.04-amd64
1Reclaiming.../zsync
ubuntu-18.04-amd64
1Reclaiming...ncmake
ubuntu-18.04-amd64
1Reclaiming...47.dll
windows10-2004-x64
1Reclaiming...GL.dll
windows10-2004-x64
1Reclaiming...GL.dll
windows11-ltsc_2024-x64
1Reclaiming...v2.dll
windows10-2004-x64
1Reclaiming...v2.dll
windows11-ltsc_2024-x64
1Reclaiming....9.dll
windows10-2004-x64
1Reclaiming....9.dll
windows11-ltsc_2024-x64
1Reclaiming...on.dll
windows10-2004-x64
1Reclaiming...on.dll
windows11-ltsc_2024-x64
1Reclaiming...-1.dll
windows10-2004-x64
1Reclaiming...-1.dll
windows11-ltsc_2024-x64
1Reclaiming...rs.dll
windows10-2004-x64
1Reclaiming...rs.dll
windows11-ltsc_2024-x64
1Reclaiming...on.exe
windows10-2004-x64
1Reclaiming...on.exe
windows11-ltsc_2024-x64
1Reclaiming...nw.exe
windows10-2004-x64
1Reclaiming...nw.exe
windows11-ltsc_2024-x64
1Reclaiming...ay.vbs
windows10-2004-x64
5Reclaiming...ay.vbs
windows11-ltsc_2024-x64
5Reclaiming...nc.exe
windows10-2004-x64
3Reclaiming...nc.exe
windows11-ltsc_2024-x64
3Reclaiming...ke.exe
windows10-2004-x64
3Reclaiming...ke.exe
windows11-ltsc_2024-x64
3Reclaiming...__.pyc
windows10-2004-x64
3Analysis
- max time kernel
299s - max time network
265s - platform
ubuntu-18.04_amd64 - resource
ubuntu1804-amd64-20260513-en - resource tags
arch:amd64arch:i386image:ubuntu1804-amd64-20260513-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system - submitted
15/10/2026, 15:19
Static task
static1
Behavioral task
behavioral1
Sample
ReclaimingtheLost-DEMO-pc/game/dynamic_transforms.py
Resource
win10v2004-20260911-en
windows10-2004-x64
Behavioral task
behavioral2
Sample
ReclaimingtheLost-DEMO-pc/game/dynamic_transforms.py
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
Behavioral task
behavioral3
Sample
ReclaimingtheLost-DEMO-pc/lib/py3-linux-x86_64/ReclaimingtheLost
Resource
ubuntu1804-amd64-20260513-en
ubuntu-18.04-amd64
Behavioral task
behavioral4
Sample
ReclaimingtheLost-DEMO-pc/lib/py3-linux-x86_64/librenpython.so
Resource
ubuntu1804-amd64-20260513-en
ubuntu-18.04-amd64
Behavioral task
behavioral5
Sample
ReclaimingtheLost-DEMO-pc/lib/py3-linux-x86_64/python
Resource
ubuntu1804-amd64-20260513-en
ubuntu-18.04-amd64
Behavioral task
behavioral6
Sample
ReclaimingtheLost-DEMO-pc/lib/py3-linux-x86_64/pythonw
Resource
ubuntu1804-amd64-20260513-en
ubuntu-18.04-amd64
Behavioral task
behavioral7
Sample
ReclaimingtheLost-DEMO-pc/lib/py3-linux-x86_64/zsync
Resource
ubuntu1804-amd64-20260513-en
ubuntu-18.04-amd64
Behavioral task
behavioral8
Sample
ReclaimingtheLost-DEMO-pc/lib/py3-linux-x86_64/zsyncmake
Resource
ubuntu1804-amd64-20260513-en
ubuntu-18.04-amd64
Behavioral task
behavioral9
Sample
ReclaimingtheLost-DEMO-pc/lib/py3-windows-x86_64/d3dcompiler_47.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
Behavioral task
behavioral10
Sample
ReclaimingtheLost-DEMO-pc/lib/py3-windows-x86_64/libEGL.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
Behavioral task
behavioral11
Sample
ReclaimingtheLost-DEMO-pc/lib/py3-windows-x86_64/libEGL.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
Behavioral task
behavioral12
Sample
ReclaimingtheLost-DEMO-pc/lib/py3-windows-x86_64/libGLESv2.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
Behavioral task
behavioral13
Sample
ReclaimingtheLost-DEMO-pc/lib/py3-windows-x86_64/libGLESv2.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
Behavioral task
behavioral14
Sample
ReclaimingtheLost-DEMO-pc/lib/py3-windows-x86_64/libpython3.9.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
Behavioral task
behavioral15
Sample
ReclaimingtheLost-DEMO-pc/lib/py3-windows-x86_64/libpython3.9.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
Behavioral task
behavioral16
Sample
ReclaimingtheLost-DEMO-pc/lib/py3-windows-x86_64/librenpython.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
Behavioral task
behavioral17
Sample
ReclaimingtheLost-DEMO-pc/lib/py3-windows-x86_64/librenpython.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
Behavioral task
behavioral18
Sample
ReclaimingtheLost-DEMO-pc/lib/py3-windows-x86_64/libwinpthread-1.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
Behavioral task
behavioral19
Sample
ReclaimingtheLost-DEMO-pc/lib/py3-windows-x86_64/libwinpthread-1.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
Behavioral task
behavioral20
Sample
ReclaimingtheLost-DEMO-pc/lib/py3-windows-x86_64/nvdrs.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
Behavioral task
behavioral21
Sample
ReclaimingtheLost-DEMO-pc/lib/py3-windows-x86_64/nvdrs.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
Behavioral task
behavioral22
Sample
ReclaimingtheLost-DEMO-pc/lib/py3-windows-x86_64/python.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
Behavioral task
behavioral23
Sample
ReclaimingtheLost-DEMO-pc/lib/py3-windows-x86_64/python.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
Behavioral task
behavioral24
Sample
ReclaimingtheLost-DEMO-pc/lib/py3-windows-x86_64/pythonw.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
Behavioral task
behavioral25
Sample
ReclaimingtheLost-DEMO-pc/lib/py3-windows-x86_64/pythonw.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
Behavioral task
behavioral26
Sample
ReclaimingtheLost-DEMO-pc/lib/py3-windows-x86_64/say.vbs
Resource
win10v2004-20260911-en
windows10-2004-x64
Behavioral task
behavioral27
Sample
ReclaimingtheLost-DEMO-pc/lib/py3-windows-x86_64/say.vbs
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
Behavioral task
behavioral28
Sample
ReclaimingtheLost-DEMO-pc/lib/py3-windows-x86_64/zsync.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
Behavioral task
behavioral29
Sample
ReclaimingtheLost-DEMO-pc/lib/py3-windows-x86_64/zsync.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
Behavioral task
behavioral30
Sample
ReclaimingtheLost-DEMO-pc/lib/py3-windows-x86_64/zsyncmake.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
Behavioral task
behavioral31
Sample
ReclaimingtheLost-DEMO-pc/lib/py3-windows-x86_64/zsyncmake.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
Behavioral task
behavioral32
Sample
ReclaimingtheLost-DEMO-pc/lib/python3.9/__future__.pyc
Resource
win10v2004-20260911-en
windows10-2004-x64
General
- Target ReclaimingtheLost-DEMO-pc/lib/py3-linux-x86_64/ReclaimingtheLost
- Size 5KB
- Sample261015-sql8wshv4l
- SHA256 3e450f4e703fcee6894d3d3e3f67962b3ac3f2c5813b8e8391bb4fd1a008972f
- MD5 abc9051c978a745154aff7bc25539210
- SHA1 24c3a3a26fc9a7fd0621b7a47c480294a3103a13
- SHA512 178ec979160e4e1dad34dafb6801751350fb7816448b7b58b5ae2e1ed397630de2be67769e52443a6f02c88892031a42f6c6bd43c4a463b9545338428afc928e
- SSDEEP 96:RI+TsnMBWBPUtsMR0wn+045Vg4Em0RVY5A:R7V8pUts++7i4
- TLSH T13EB1112AF3A2CD7FD8A883745057073873B1AD50231207A31746B2723D673EC5B266DA
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Changes its process name 2 IoCs
description ioc pid Process Changes the process name, possibly in an attempt to hide itself SDLHotplugALSA 1514 ReclaimingtheLost Changes the process name, possibly in an attempt to hide itself SDLTimer 1516 ReclaimingtheLost - Checks CPU configuration 1 TTPs 1 IoCs
Checks CPU information which indicate if the system is a virtual machine.
description ioc Process File opened for reading /proc/cpuinfo ReclaimingtheLost - Reads CPU attributes 1 TTPs 1 IoCs
description ioc Process File opened for reading /sys/devices/system/cpu/online ReclaimingtheLost - Enumerates kernel/hardware configuration 1 TTPs 30 IoCs
Reads contents of /sys virtual filesystem to enumerate system information.
description ioc Process File opened for reading /sys/class/input ReclaimingtheLost File opened for reading /sys/devices/platform/i8042/serio1/input/input3/uevent ReclaimingtheLost File opened for reading /sys/devices/platform/i8042/serio1/input/input3/mouse1/uevent ReclaimingtheLost File opened for reading /sys/devices/LNXSYSTM:00/LNXPWRBN:00/input/input0/event0/uevent ReclaimingtheLost File opened for reading /sys/devices/platform/i8042/serio0/input/input1/uevent ReclaimingtheLost File opened for reading /sys/devices/pci0000:00/0000:00:02.0/uevent ReclaimingtheLost File opened for reading /sys/devices/pci0000:00/0000:00:02.0/subsystem_vendor ReclaimingtheLost File opened for reading /sys/devices/pci0000:00/0000:00:02.0/subsystem_device ReclaimingtheLost File opened for reading /sys/devices/LNXSYSTM:00/LNXPWRBN:00/input/input0/uevent ReclaimingtheLost File opened for reading /sys/devices/platform/i8042/serio1/input/input3/event3/uevent ReclaimingtheLost File opened for reading /sys/devices/pci0000:00/0000:00:05.0/usb1/1-1/1-1:1.0/0003:0222:0001.0001/input/input4/uevent ReclaimingtheLost File opened for reading /sys/devices/pci0000:00/0000:00:05.0/usb1/1-1/1-1:1.0/0003:0222:0001.0001/hidraw/hidraw0/uevent ReclaimingtheLost File opened for reading /sys/devices/pci0000:00/0000:00:05.0/usb1/1-1/1-1:1.0/0003:0222:0001.0001/uevent ReclaimingtheLost File opened for reading /sys/devices/pci0000:00/0000:00:05.0/usb1/1-1/1-1:1.0/0003:0222:0001.0001/input/input4/js0/uevent ReclaimingtheLost File opened for reading /sys/devices/pci0000:00/0000:00:02.0/vendor ReclaimingtheLost File opened for reading /sys/devices/pci0000:00/0000:00:02.0/device ReclaimingtheLost File opened for reading /sys/devices/platform/i8042/serio0/input/input1/event1/uevent ReclaimingtheLost File opened for reading /sys/class/hidraw ReclaimingtheLost File opened for reading /sys/devices/pci0000:00/0000:00:05.0/usb1/1-1/1-1:1.0/uevent ReclaimingtheLost File opened for reading /sys/devices/pci0000:00/0000:00:05.0/usb1/1-1/1-1:1.0/bInterfaceNumber ReclaimingtheLost File opened for reading /sys/devices/pci0000:00/0000:00:05.0/usb1/1-1/product ReclaimingtheLost File opened for reading /sys/devices/pci0000:00/0000:00:05.0/usb1/1-1/bcdDevice ReclaimingtheLost File opened for reading /sys/devices/pci0000:00/0000:00:05.0/usb1/1-1/manufacturer ReclaimingtheLost File opened for reading /sys/kernel/security/apparmor/features/dbus/mask dbus-daemon File opened for reading /sys/bus ReclaimingtheLost File opened for reading /sys/devices/pci0000:00/0000:00:05.0/usb1/1-1/1-1:1.0/0003:0222:0001.0001/input/input4/mouse0/uevent ReclaimingtheLost File opened for reading /sys/devices/virtual/input/mice/uevent ReclaimingtheLost File opened for reading /sys/class ReclaimingtheLost File opened for reading /sys/devices/pci0000:00/0000:00:05.0/usb1/1-1/1-1:1.0/0003:0222:0001.0001/input/input4/event2/uevent ReclaimingtheLost File opened for reading /sys/devices/pci0000:00/0000:00:05.0/usb1/1-1/uevent ReclaimingtheLost -
description ioc Process File opened for reading /proc/1513/attr/current dbus-daemon File opened for reading /proc/1500/cmdline dbus-daemon File opened for reading /proc/sys/vm/overcommit_memory ReclaimingtheLost File opened for reading /proc/self/fd ReclaimingtheLost File opened for reading /proc/filesystems dbus-daemon File opened for reading /proc/mounts dbus-daemon File opened for reading /proc/sys/kernel/cap_last_cap dbus-daemon File opened for reading /proc/1513/status dbus-daemon - Writes file to tmp directory 64 IoCs
Malware often drops required files in the /tmp directory.
description ioc Process File opened for modification /tmp/ReclaimingtheLost-DEMO-pc/renpy/__pycache__/parser.cpython-39.pyc.140048510588208 ReclaimingtheLost File opened for modification /tmp/ReclaimingtheLost-DEMO-pc/renpy/__pycache__/versions.cpython-39.pyc.140048510134192 ReclaimingtheLost File opened for modification /tmp/ReclaimingtheLost-DEMO-pc/renpy/display/__pycache__/swdraw.cpython-39.pyc.140048509529904 ReclaimingtheLost File opened for modification /tmp/ReclaimingtheLost-DEMO-pc/renpy/exports/__pycache__/sayexports.cpython-39.pyc.140048494452432 ReclaimingtheLost File opened for modification /tmp/ReclaimingtheLost-DEMO-pc/renpy/display/__pycache__/model.cpython-39.pyc.140048508006832 ReclaimingtheLost File opened for modification /tmp/ReclaimingtheLost-DEMO-pc/renpy/display/__pycache__/error.cpython-39.pyc.140048508006832 ReclaimingtheLost File opened for modification /tmp/ReclaimingtheLost-DEMO-pc/renpy/sl2/__pycache__/slast.cpython-39.pyc.140048506440368 ReclaimingtheLost File opened for modification /tmp/ReclaimingtheLost-DEMO-pc/renpy/__pycache__/util.cpython-39.pyc.140048510134192 ReclaimingtheLost File opened for modification /tmp/ReclaimingtheLost-DEMO-pc/renpy/display/__pycache__/tts.cpython-39.pyc.140048508006832 ReclaimingtheLost File opened for modification /tmp/ReclaimingtheLost-DEMO-pc/renpy/exports/__pycache__/restartexports.cpython-39.pyc.140048494449408 ReclaimingtheLost File opened for modification /tmp/ReclaimingtheLost-DEMO-pc/renpy/test/__pycache__/testmouse.cpython-39.pyc.140048494251696 ReclaimingtheLost File opened for modification /tmp/ReclaimingtheLost-DEMO-pc/renpy/compat/__pycache__/pickle.cpython-39.pyc.140048514353456 ReclaimingtheLost File opened for modification /tmp/ReclaimingtheLost-DEMO-pc/renpy/translation/__pycache__/scanstrings.cpython-39.pyc.140048509449392 ReclaimingtheLost File opened for modification /tmp/ReclaimingtheLost-DEMO-pc/renpy/display/__pycache__/motion.cpython-39.pyc.140048509279664 ReclaimingtheLost File opened for modification /tmp/ReclaimingtheLost-DEMO-pc/renpy/__pycache__/lint.cpython-39.pyc.140048508522800 ReclaimingtheLost File opened for modification /tmp/ReclaimingtheLost-DEMO-pc/renpy/__pycache__/parameter.cpython-39.pyc.140048512348336 ReclaimingtheLost File opened for modification /tmp/ReclaimingtheLost-DEMO-pc/renpy/__pycache__/loadsave.cpython-39.pyc.140048511922224 ReclaimingtheLost File opened for modification /tmp/ReclaimingtheLost-DEMO-pc/renpy/display/__pycache__/pgrender.cpython-39.pyc.140048509488560 ReclaimingtheLost File opened for modification /tmp/ReclaimingtheLost-DEMO-pc/renpy/test/__pycache__/testkey.cpython-39.pyc.140048494198960 ReclaimingtheLost File opened for modification /tmp/ReclaimingtheLost-DEMO-pc/renpy/__pycache__/main.cpython-39.pyc.140048494202032 ReclaimingtheLost File opened for modification /tmp/ReclaimingtheLost-DEMO-pc/renpy/gl/__pycache__/glfunctions.cpython-39.pyc.140048394618288 ReclaimingtheLost File opened for modification /tmp/ReclaimingtheLost-DEMO-pc/renpy/__pycache__/curry.cpython-39.pyc.140048512023856 ReclaimingtheLost File opened for modification /tmp/ReclaimingtheLost-DEMO-pc/renpy/__pycache__/color.cpython-39.pyc.140048511990832 ReclaimingtheLost File opened for modification /tmp/ReclaimingtheLost-DEMO-pc/renpy/display/__pycache__/focus.cpython-39.pyc.140048509008048 ReclaimingtheLost File opened for modification /tmp/ReclaimingtheLost-DEMO-pc/renpy/display/__pycache__/gesture.cpython-39.pyc.140048508006832 ReclaimingtheLost File opened for modification /tmp/ReclaimingtheLost-DEMO-pc/renpy/exports/__pycache__/menuexports.cpython-39.pyc.140048494336880 ReclaimingtheLost File opened for modification /tmp/ReclaimingtheLost-DEMO-pc/renpy/__pycache__/script.cpython-39.pyc.140048510588208 ReclaimingtheLost File opened for modification /tmp/ReclaimingtheLost-DEMO-pc/renpy/display/__pycache__/viewport.cpython-39.pyc.140048508179344 ReclaimingtheLost File opened for modification /tmp/ReclaimingtheLost-DEMO-pc/renpy/sl2/__pycache__/slproperties.cpython-39.pyc.140048507298704 ReclaimingtheLost File opened for modification /tmp/ReclaimingtheLost-DEMO-pc/renpy/__pycache__/persistent.cpython-39.pyc.140048511518000 ReclaimingtheLost File opened for modification /tmp/ReclaimingtheLost-DEMO-pc/renpy/display/__pycache__/joystick.cpython-39.pyc.140048507475408 ReclaimingtheLost File opened for modification /tmp/ReclaimingtheLost-DEMO-pc/renpy/display/__pycache__/controller.cpython-39.pyc.140048507475840 ReclaimingtheLost File opened for modification /tmp/ReclaimingtheLost-DEMO-pc/renpy/gl2/__pycache__/gl2shadercache.cpython-39.pyc.140048496928784 ReclaimingtheLost File opened for modification /tmp/ReclaimingtheLost-DEMO-pc/renpy/audio/__pycache__/sound.cpython-39.pyc.140048508010160 ReclaimingtheLost File opened for modification /tmp/ReclaimingtheLost-DEMO-pc/renpy/exports/__pycache__/loaderexports.cpython-39.pyc.140048494334432 ReclaimingtheLost File opened for modification /tmp/ReclaimingtheLost-DEMO-pc/renpy/compat/__pycache__/fixes.cpython-39.pyc.140048514108336 ReclaimingtheLost File opened for modification /tmp/ReclaimingtheLost-DEMO-pc/renpy/__pycache__/bootstrap.cpython-39.pyc.140048513782576 ReclaimingtheLost File opened for modification /tmp/ReclaimingtheLost-DEMO-pc/renpy/styledata/__pycache__/__init__.cpython-39.pyc.140048510000272 ReclaimingtheLost File opened for modification /tmp/ReclaimingtheLost-DEMO-pc/renpy/sl2/__pycache__/sldisplayables.cpython-39.pyc.140048507298992 ReclaimingtheLost File opened for modification /tmp/ReclaimingtheLost-DEMO-pc/renpy/uguu/__pycache__/__init__.cpython-39.pyc.140048496974128 ReclaimingtheLost File opened for modification /tmp/ReclaimingtheLost-DEMO-pc/renpy/exports/__pycache__/persistentexports.cpython-39.pyc.140048494337744 ReclaimingtheLost File opened for modification /tmp/ReclaimingtheLost-DEMO-pc/renpy/test/__pycache__/__init__.cpython-39.pyc.140048494251696 ReclaimingtheLost File opened for modification /tmp/ReclaimingtheLost-DEMO-pc/renpy/display/__pycache__/presplash.cpython-39.pyc.140048516055232 ReclaimingtheLost File opened for modification /tmp/ReclaimingtheLost-DEMO-pc/renpy/__pycache__/statements.cpython-39.pyc.140048510134192 ReclaimingtheLost File opened for modification /tmp/ReclaimingtheLost-DEMO-pc/renpy/sl2/__pycache__/__init__.cpython-39.pyc.140048506440368 ReclaimingtheLost File opened for modification /tmp/ReclaimingtheLost-DEMO-pc/renpy/__pycache__/warp.cpython-39.pyc.140048506459568 ReclaimingtheLost File opened for modification /tmp/ReclaimingtheLost-DEMO-pc/renpy/exports/__pycache__/fetchexports.cpython-39.pyc.140048496543904 ReclaimingtheLost File opened for modification /tmp/ReclaimingtheLost-DEMO-pc/renpy/__pycache__/error.cpython-39.pyc.140048513782576 ReclaimingtheLost File opened for modification /tmp/ReclaimingtheLost-DEMO-pc/renpy/text/__pycache__/shader.cpython-39.pyc.140048509279536 ReclaimingtheLost File opened for modification /tmp/ReclaimingtheLost-DEMO-pc/renpy/audio/__pycache__/audio.cpython-39.pyc.140048508008752 ReclaimingtheLost File opened for modification /tmp/ReclaimingtheLost-DEMO-pc/renpy/sl2/__pycache__/slparser.cpython-39.pyc.140048507214256 ReclaimingtheLost File opened for modification /tmp/ReclaimingtheLost-DEMO-pc/renpy/exports/__pycache__/mediaexports.cpython-39.pyc.140048494336016 ReclaimingtheLost File opened for modification /tmp/ReclaimingtheLost-DEMO-pc/renpy/text/__pycache__/extras.cpython-39.pyc.140048508884784 ReclaimingtheLost File opened for modification /tmp/ReclaimingtheLost-DEMO-pc/renpy/__pycache__/add_from.cpython-39.pyc.140048494250544 ReclaimingtheLost File opened for modification /tmp/ReclaimingtheLost-DEMO-pc/renpy/__pycache__/python.cpython-39.pyc.140048515967152 ReclaimingtheLost File opened for modification /tmp/ReclaimingtheLost-DEMO-pc/renpy/__pycache__/savetoken.cpython-39.pyc.140048511188016 ReclaimingtheLost File opened for modification /tmp/ReclaimingtheLost-DEMO-pc/renpy/display/__pycache__/displayable.cpython-39.pyc.140048509531024 ReclaimingtheLost File opened for modification /tmp/ReclaimingtheLost-DEMO-pc/renpy/text/__pycache__/__init__.cpython-39.pyc.140048509529904 ReclaimingtheLost File opened for modification /tmp/ReclaimingtheLost-DEMO-pc/renpy/display/__pycache__/transition.cpython-39.pyc.140048507743520 ReclaimingtheLost File opened for modification /tmp/ReclaimingtheLost-DEMO-pc/renpy/display/__pycache__/predict.cpython-39.pyc.140048508006832 ReclaimingtheLost File opened for modification /tmp/ReclaimingtheLost-DEMO-pc/renpy/test/__pycache__/testfocus.cpython-39.pyc.140048494198960 ReclaimingtheLost File opened for modification /tmp/ReclaimingtheLost-DEMO-pc/renpy/gl2/__pycache__/__init__.cpython-39.pyc.140048508884784 ReclaimingtheLost File opened for modification /tmp/ReclaimingtheLost-DEMO-pc/renpy/__pycache__/screenlang.cpython-39.pyc.140048506437680 ReclaimingtheLost File opened for modification /tmp/ReclaimingtheLost-DEMO-pc/renpy/gl2/__pycache__/gl2functions.cpython-39.pyc.140048494414704 ReclaimingtheLost
Processes
-
/tmp/ReclaimingtheLost-DEMO-pc/lib/py3-linux-x86_64/ReclaimingtheLost/tmp/ReclaimingtheLost-DEMO-pc/lib/py3-linux-x86_64/ReclaimingtheLost1⤵
- Changes its process name
- Checks CPU configuration
- Reads CPU attributes
- Enumerates kernel/hardware configuration
- Reads runtime system information
- Writes file to tmp directory
PID:1500 -
/usr/local/sbin/unameuname -p2⤵PID:1506
-
-
/usr/local/bin/unameuname -p2⤵PID:1506
-
-
/usr/sbin/unameuname -p2⤵PID:1506
-
-
/usr/bin/unameuname -p2⤵PID:1506
-
-
/sbin/unameuname -p2⤵PID:1506
-
-
/bin/unameuname -p2⤵PID:1506
-
-
/usr/bin/dbus-launchdbus-launch --autolaunch 11c67417355f45d397f6be11f62e85a6 --binary-syntax --close-stderr2⤵PID:1509
-
/usr/bin/dbus-daemon/usr/bin/dbus-daemon --syslog-only --fork --print-pid 5 --print-address 7 --session3⤵
- Enumerates kernel/hardware configuration
- Reads runtime system information
PID:1511
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path /root/.renpy/ReclaimingtheLost-1672083320/text.txt
- Size 5B
- SHA256 314ad142957febe390cc7223b4deb1d1b21c187f84f6e7257a23fe46c27fcae3
- MD5 f4020e91252aafd4b18d8acd17f883db
- SHA1 748d77dbb8bdb0dd330c099e7fde82da053fb1ff
- SHA512 301ddd0e34cbd842dae99a2cc4ccbfeb6ee8b3def39c214a719fa9edc26d7142749bbe6e992d26353dc167febbab0dbc05476b68a86ad93cab5f299f0aaf916d
- MD5 SHA1 SHA512
- Path /root/.renpy/tokens/security_keys.txt
- Size 302B
- SHA256 05b9d4e771bf82a5d17aa06def4fbc025b8db9a9500348c59db6e9531984e19f
- MD5 b2c3aa77ad5f6f1cb3ac79b680ce5365
- SHA1 ff0b4f8ef25f73ca80947cdd208dfd890e3941ee
- SHA512 460cb1d0a156d4fa166c88c9756c4689fadda0ec147fe466c92a3157cfabb7b6380f539cf93a46d9837e3530b9aa8289ae13ffe74e9bfdedf82b6959fb505739
- TLSH T1E4E0C21FD28DC618B8CEC4A80AE4026E926A2201A9DB35B94018C50CA06614F1F6FA21
- MD5 SHA1 SHA512 TLSH
- Path /root/.renpy/tokens/upgraded.txt
- Size 29B
- SHA256 9517bc77fcff38a0dbdb08c5dce90d29603d6b00797ff8dd27e261ea9dc3581d
- MD5 a63c63b317ef91bbd377073e786a0327
- SHA1 c05d09089272a46968f6a36628f4d476f88461bc
- SHA512 66663341fac12c09a51aabcf09ca9202fca576e2637224f73ab32038fb38d56ccbe7a018314ac2da5b1628d8459a840e0e377ba7b24c72118030dc49fd9e8a4c
- MD5 SHA1 SHA512
- Path /tmp/ReclaimingtheLost-DEMO-pc/log.txt
- Size 2KB
- SHA256 1b356b09c9b90eea2d06f7c2eb48d1b989e5959fcce831c1b8050d1f2c0376e9
- MD5 cf895713f1a3f588eb8414d004532116
- SHA1 9fcd747d8fc9e66526a95bff0a5900f8bdd6e9b4
- SHA512 5c1e128f0e22f67e3be6d304ac094a3a5c74c3773689f49b8018e3a9e1aa6e79cd4d17ab0d5286d7d24a20dc05ef6d5be1dd4c59f58de2a06b92d64067dcd1e9
- TLSH T17C4141C6DD01683EF1828A495ED61B3A47744AD20FDC72E52490F12403C7938FABCB55
- MD5 SHA1 SHA512 TLSH
- Path /tmp/ReclaimingtheLost-DEMO-pc/log.txt
- Size 952B
- SHA256 148dac98fcd13320c3336f652131386506013ced46bc5f319fe6c1c3ee149514
- MD5 9ee6d8e8a31602e17a9247292176aafb
- SHA1 7104d578a0509d4fc292963f6fd915e5daac7483
- SHA512 60d4adbae917107e243ea17a02dbd271dafd037a4ddd7a3c1f899506fe637b75c0ec6923daab2a338960100bd0bf1ce82a8a8de40a78e855a25c901ee82bdeb4
- TLSH T18711CCD2ED00A036F4928F0E4DDAA77546206DD20FDCF2DA38A0F16485D72787B3E625
- MD5 SHA1 SHA512 TLSH
- Path /tmp/an200mto
- Size 4B
- SHA256 f02285fb90ed8c81531fe78cf4e2abb68a62be73ee7d317623e2c3e3aefdfff2
- MD5 3f1d1d8d87177d3d8d897d7e421f84d6
- SHA1 dd082d742a5cb751290f1db2bd519c286aa86d95
- SHA512 2ae2b3936f31756332ca7a4b877d18f3fcc50e41e9472b5cd45a70bea82e29a0fa956ee6a9ee0e02f23d9db56b41d19cb51d88aac06e9c923a820a21023752a9
- MD5 SHA1 SHA512