We're sorry but any.run reports doesn't work properly without JavaScript enabled. Please enable it to continue.
Analysis result
Behavior activities
Threats
Find similar analyses in TI Lookup
Analysis date (UTC):
21 March 2025, 02:51
Analysis environment:
Windows 10 Pro, build 19045, x64
https://ankergames.net/game/r-e-p-o
MD5:
59382852230AAD61185D1134265008BA
SHA1:
12ED2D57EA93A5EF7F224546A6F142E7ABCF4601
SHA256:
9F6F771CF834768D5862D845CC6CE23FC42195AD4A1284EC4B7A983A5E44578C
Analysis result
Threat level:
Malicious activity
Full analysis:
Analysis https://ankergames.net/game/r-e-p-o Malicious activity - Interactive analysis ANY.RUN
Behavior activities
MALICIOUS
No malicious indicators.
SUSPICIOUS
Reads security settings of Internet Explorer
ShellExperienceHost.exe (PID: 5512)
The process creates files with name similar to system file names
WinRAR.exe (PID: 5384)
Process drops legitimate windows executable
WinRAR.exe (PID: 5384)
Probably uses Microsoft diagnostics tool to execute malicious payload
pcwrun.exe (PID: 8040)
Executable content was dropped or overwritten
csc.exe (PID: 7508)
csc.exe (PID: 7968)
csc.exe (PID: 4008)
Gets file extension (POWERSHELL)
sdiagnhost.exe (PID: 5360)
Converts a string into array of characters (POWERSHELL)
sdiagnhost.exe (PID: 5360)
Uses RUNDLL32.EXE to load library
msdt.exe (PID: 5576)
INFO
Checks supported languages
identity_helper.exe (PID: 4628)
ShellExperienceHost.exe (PID: 5512)
identity_helper.exe (PID: 2432)
REPO.exe (PID: 6892)
REPO.exe (PID: 7228)
REPO.exe (PID: 4980)
REPO.exe (PID: 3272)
csc.exe (PID: 7968)
csc.exe (PID: 7508)
cvtres.exe (PID: 7524)
cvtres.exe (PID: 7892)
csc.exe (PID: 4008)
REPO.exe (PID: 6640)
cvtres.exe (PID: 2840)
Reads Environment values
identity_helper.exe (PID: 4628)
identity_helper.exe (PID: 2432)
Reads security settings of Internet Explorer
BackgroundTransferHost.exe (PID: 5780)
BackgroundTransferHost.exe (PID: 7732)
BackgroundTransferHost.exe (PID: 4068)
BackgroundTransferHost.exe (PID: 1052)
BackgroundTransferHost.exe (PID: 4756)
msdt.exe (PID: 5576)
sdiagnhost.exe (PID: 5360)
rundll32.exe (PID: 6900)
Reads the software policy settings
BackgroundTransferHost.exe (PID: 7732)
slui.exe (PID: 5972)
slui.exe (PID: 7384)
msdt.exe (PID: 5576)
sdiagnhost.exe (PID: 5360)
Reads the computer name
identity_helper.exe (PID: 4628)
ShellExperienceHost.exe (PID: 5512)
identity_helper.exe (PID: 2432)
Checks proxy server information
BackgroundTransferHost.exe (PID: 7732)
slui.exe (PID: 7384)
sdiagnhost.exe (PID: 5360)
Creates files or folders in the user directory
BackgroundTransferHost.exe (PID: 7732)
sdiagnhost.exe (PID: 5360)
msdt.exe (PID: 5576)
Application launched itself
msedge.exe (PID: 1616)
msedge.exe (PID: 2236)
The sample compiled with english language support
msedge.exe (PID: 2960)
WinRAR.exe (PID: 5384)
msdt.exe (PID: 5576)
Executable content was dropped or overwritten
msedge.exe (PID: 2960)
WinRAR.exe (PID: 5384)
Manual execution by a user
WinRAR.exe (PID: 5384)
REPO.exe (PID: 6892)
REPO.exe (PID: 7228)
REPO.exe (PID: 4980)
REPO.exe (PID: 3272)
pcwrun.exe (PID: 8040)
The sample compiled with german language support
WinRAR.exe (PID: 5384)
Create files in a temporary directory
pcwrun.exe (PID: 8040)
cvtres.exe (PID: 7892)
msdt.exe (PID: 5576)
csc.exe (PID: 7508)
cvtres.exe (PID: 7524)
sdiagnhost.exe (PID: 5360)
csc.exe (PID: 7968)
csc.exe (PID: 4008)
cvtres.exe (PID: 2840)
Reads the machine GUID from the registry
csc.exe (PID: 7508)
csc.exe (PID: 7968)
csc.exe (PID: 4008)
Uses string split method (POWERSHELL)
sdiagnhost.exe (PID: 5360)
Uses string replace method (POWERSHELL)
sdiagnhost.exe (PID: 5360)
Threats
No threats detected