File name:

setup.msi

Full analysis: https://app.any.run/tasks/8c112183-a6e5-4078-9ce4-5e64b5bd248a
Verdict: Malicious activity
Analysis date: May 10, 2025, 15:32:44
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
generated-doc
Indicators:
MIME: application/x-msi
File info: Composite Document File V2 Document, Little Endian, Os: Windows, Version 10.0, MSI Installer, Security: 0, Code page: 1252, Revision Number: {972B95C0-29F7-4011-8CC3-CEC6A761B704}, Number of Words: 10, Subject: Koqlpo Cynav Tool, Author: Niviqol Raisox, Name of Creating Application: Koqlpo Cynav Tool, Template: x64;1033, Comments: This installer database contains the logic and data required to install Koqlpo Cynav Tool., Title: Installation Database, Keywords: Installer, MSI, Database, Create Time/Date: Sat May 10 14:02:21 2025, Last Saved Time/Date: Sat May 10 14:02:21 2025, Last Printed: Sat May 10 14:02:21 2025, Number of Pages: 450
MD5:

BCB8EB774F5CA52C95411F06C3324638

SHA1:

92D8685E19473382E35066278A11B784C9F37CE7

SHA256:

7189B6C8229FB6FADB84B673804AC9B494F41045191BE1BB92EA271865A470AE

SSDEEP:

393216:2JAZhndyL/8/aDzj9U82/PVoATjN2h0objZMdmYxIg2Pnl:7dij9RcVoATjN2h0objZB2IfP

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    No malicious indicators.

  • SUSPICIOUS

    • Reads the Windows owner or organization settings

      • msiexec.exe (PID: 7584)

    • Reads security settings of Internet Explorer

      • msiexec.exe (PID: 7636)

    • Process drops python dynamic module

      • msiexec.exe (PID: 7584)

    • Process drops legitimate windows executable

      • msiexec.exe (PID: 7584)

    • The process drops C-runtime libraries

      • msiexec.exe (PID: 7584)

    • Drops 7-zip archiver for unpacking

      • msiexec.exe (PID: 7584)

  • INFO

    • Checks supported languages

      • msiexec.exe (PID: 7584)
      • msiexec.exe (PID: 7636)
      • taskcoach.exe (PID: 7948)

    • An automatically generated document

      • msiexec.exe (PID: 7504)

    • Reads the computer name

      • msiexec.exe (PID: 7584)
      • msiexec.exe (PID: 7636)
      • taskcoach.exe (PID: 7948)

    • Reads Environment values

      • msiexec.exe (PID: 7636)

    • Executable content was dropped or overwritten

      • msiexec.exe (PID: 7584)

    • The sample compiled with english language support

      • msiexec.exe (PID: 7584)

    • Checks proxy server information

      • msiexec.exe (PID: 7636)
      • taskcoach.exe (PID: 7948)

    • Reads the machine GUID from the registry

      • msiexec.exe (PID: 7636)
      • taskcoach.exe (PID: 7948)

    • Creates files or folders in the user directory

      • msiexec.exe (PID: 7636)
      • msiexec.exe (PID: 7584)
      • taskcoach.exe (PID: 7948)

    • Reads the software policy settings

      • msiexec.exe (PID: 7636)

    • Creates a software uninstall entry

      • msiexec.exe (PID: 7584)

    • Create files in a temporary directory

      • taskcoach.exe (PID: 7948)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.msi | Microsoft Windows Installer (88.6)
.mst | Windows SDK Setup Transform Script (10)
.msi | Microsoft Installer (100)

EXIF

FlashPix

Security: None
CodePage: Windows Latin 1 (Western European)
RevisionNumber: {972B95C0-29F7-4011-8CC3-CEC6A761B704}
Words: 10
Subject: Koqlpo Cynav Tool
Author: Niviqol Raisox
LastModifiedBy: -
Software: Koqlpo Cynav Tool
Template: x64;1033
Comments: This installer database contains the logic and data required to install Koqlpo Cynav Tool.
Title: Installation Database
Keywords: Installer, MSI, Database
CreateDate: 2025:05:10 14:02:21
ModifyDate: 2025:05:10 14:02:21
LastPrinted: 2025:05:10 14:02:21
Pages: 450
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
129
Monitored processes
7
Malicious processes
1
Suspicious processes
0

Behavior graph

Click at the process to see the details
start msiexec.exe no specs msiexec.exe msiexec.exe tpm2emu.exe no specs taskcoach.exe conhost.exe no specs slui.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
5344C:\WINDOWS\System32\slui.exe -EmbeddingC:\Windows\System32\slui.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Activation Client
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
7504"C:\Windows\System32\msiexec.exe" /i C:\Users\admin\Desktop\setup.msiC:\Windows\System32\msiexec.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows® installer
Exit code:
0
Version:
5.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\msiexec.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\aclayers.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
7584C:\WINDOWS\system32\msiexec.exe /VC:\Windows\System32\msiexec.exe
services.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows® installer
Version:
5.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\msiexec.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\aclayers.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
7636C:\Windows\syswow64\MsiExec.exe -Embedding 838B54BF8897AF6C58BA3F32A5A155EAC:\Windows\SysWOW64\msiexec.exe
msiexec.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows® installer
Exit code:
0
Version:
5.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\msiexec.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\aclayers.dll
7940"C:\Users\admin\AppData\Roaming\Koqlpo Cynav Tool\tpm2emu.exe" 0C:\Users\admin\AppData\Roaming\Koqlpo Cynav Tool\tpm2emu.exe—msiexec.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
3221225781
Modules
Images
c:\users\admin\appdata\roaming\koqlpo cynav tool\tpm2emu.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
7948"C:\Users\admin\AppData\Roaming\Koqlpo Cynav Tool\taskcoach.exe"C:\Users\admin\AppData\Roaming\Koqlpo Cynav Tool\taskcoach.exe
msiexec.exe
User:
admin
Integrity Level:
MEDIUM
Description:
Your friendly task manager
Exit code:
0
Version:
1.4.6
Modules
Images
c:\users\admin\appdata\roaming\koqlpo cynav tool\taskcoach.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
7956\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—tpm2emu.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
Total events
3 399
Read events
3 073
Write events
317
Delete events
9

Modification events

(PID) Process:(7584) msiexec.exeKey:HKEY_USERS\S-1-5-21-1693682860-607145093-2874071422-1001\SOFTWARE\Microsoft\RestartManager\Session0000
Operation:writeName:Owner
Value:
A01D00007D17F1CEC0C1DB01
(PID) Process:(7584) msiexec.exeKey:HKEY_USERS\S-1-5-21-1693682860-607145093-2874071422-1001\SOFTWARE\Microsoft\RestartManager\Session0000
Operation:writeName:SessionHash
Value:
3C73CCF5C4CA8005E36011D4C9266D1105947B42367C0390F474B8F7E570F682
(PID) Process:(7584) msiexec.exeKey:HKEY_USERS\S-1-5-21-1693682860-607145093-2874071422-1001\SOFTWARE\Microsoft\RestartManager\Session0000
Operation:writeName:Sequence
Value:
1
(PID) Process:(7636) msiexec.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(7636) msiexec.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(7636) msiexec.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(7584) msiexec.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-21-1693682860-607145093-2874071422-1001\Components\7DA656C351708624BB30D6310C4BA65A
Operation:writeName:7740B4D7497C19D4A910AABF7B3C1524
Value:
C:\Users\admin\AppData\Roaming\Koqlpo Cynav Tool\wxmsw28uh_core_vc.dll
(PID) Process:(7584) msiexec.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-21-1693682860-607145093-2874071422-1001\Components\79D229F8C9B3A9D46A7AE9A3A60562D2
Operation:writeName:7740B4D7497C19D4A910AABF7B3C1524
Value:
C:\Users\admin\AppData\Roaming\Koqlpo Cynav Tool\wxmsw28uh_gizmos_vc.dll
(PID) Process:(7584) msiexec.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-21-1693682860-607145093-2874071422-1001\Components\083152FE4CF05A147BBE2A0C7C342C45
Operation:writeName:7740B4D7497C19D4A910AABF7B3C1524
Value:
C:\Users\admin\AppData\Roaming\Koqlpo Cynav Tool\wxmsw28uh_html_vc.dll
(PID) Process:(7584) msiexec.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-21-1693682860-607145093-2874071422-1001\Components\E9D297F327D8ACD4AA9C9EEA430372AC
Operation:writeName:7740B4D7497C19D4A910AABF7B3C1524
Value:
C:\Users\admin\AppData\Roaming\Koqlpo Cynav Tool\locale\af\LC_MESSAGES\wxstd.mo
Executable files
117
Suspicious files
297
Text files
73
Unknown types
2

Dropped files

PID
Process
Filename
Type
7584msiexec.exeC:\Windows\Installer\10cfb6.msi —
MD5:—
SHA256:—
7584msiexec.exeC:\Windows\Installer\MSID538.tmpexecutable
MD5:379F76E2FA6EEF4C2116C2A3AE6896BE
SHA256:C54F8A0CC280A9A0C934B8B23BBD530BA739E79AD686121CC8B659882CEB60FD
7636msiexec.exeC:\Users\admin\AppData\Local\Microsoft\Windows\INetCache\IE\RR3E01RZ\diagnostics[1].htmbinary
MD5:CFCD208495D565EF66E7DFF9F98764DA
SHA256:5FECEB66FFC86F38D952786C6D696C79C2DBC239DD4E91B46729D73A27FB57E9
7584msiexec.exeC:\Windows\Installer\MSID3B0.tmpexecutable
MD5:379F76E2FA6EEF4C2116C2A3AE6896BE
SHA256:C54F8A0CC280A9A0C934B8B23BBD530BA739E79AD686121CC8B659882CEB60FD
7636msiexec.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\103621DE9CD5414CC2538780B4B75751binary
MD5:E192462F281446B5D1500D474FBACC4B
SHA256:F1BA9F1B63C447682EBF9DE956D0DA2A027B1B779ABEF9522D347D3479139A60
7584msiexec.exeC:\Windows\Installer\MSID332.tmpexecutable
MD5:379F76E2FA6EEF4C2116C2A3AE6896BE
SHA256:C54F8A0CC280A9A0C934B8B23BBD530BA739E79AD686121CC8B659882CEB60FD
7584msiexec.exeC:\Windows\Installer\MSIEDC2.tmpexecutable
MD5:481FBA768D3692CB566F14697E436689
SHA256:0CC629D35B0A010B207B10C057C9E9B74C54BFFD25D736EB6B8ED20DD7F6F361
7636msiexec.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B8FDF8F5676DFCB7541C374AF711CA8Dbinary
MD5:6E1984895EB8D68158E417AD28F06B9D
SHA256:8E877FED2EC9503284C236790A0B342E2D1F514CB32BEE510BB2F6AC25E7212D
7584msiexec.exeC:\Windows\Installer\MSID0EE.tmpexecutable
MD5:379F76E2FA6EEF4C2116C2A3AE6896BE
SHA256:C54F8A0CC280A9A0C934B8B23BBD530BA739E79AD686121CC8B659882CEB60FD
7584msiexec.exeC:\Windows\Installer\inprogressinstallinfo.ipibinary
MD5:ACFFFFDAFDFAE0B6143BBAB5E631C5F9
SHA256:E7A8BC02A30E3E4921B9CDC6ADAA2754DDE6C05B58F50B93EC6F09C9C40AB59E
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
9
TCP/UDP connections
23
DNS requests
18
Threats
2

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2104
svchost.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
5496
MoUsoCoreWorker.exe
GET
200
23.48.23.171:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
7636
msiexec.exe
GET
200
18.66.248.64:80
http://r11.c.lencr.org/25.crl
unknown
—
—
whitelisted
8044
SIHClient.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
7636
msiexec.exe
GET
200
69.192.161.44:80
http://x1.c.lencr.org/
unknown
—
—
whitelisted
7948
taskcoach.exe
GET
301
51.158.149.82:80
http://taskcoach.org/version.txt
unknown
—
—
unknown
7948
taskcoach.exe
GET
301
51.158.149.82:80
http://taskcoach.org/messages.txt
unknown
—
—
unknown
5496
MoUsoCoreWorker.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
8044
SIHClient.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
—
—
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
5496
MoUsoCoreWorker.exe
23.48.23.171:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
5496
MoUsoCoreWorker.exe
184.30.21.171:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
2104
svchost.exe
184.30.21.171:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted
—
—
172.211.123.250:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
FR
whitelisted
7636
msiexec.exe
169.150.247.39:443
marybcook.com
—
GB
unknown
7636
msiexec.exe
69.192.161.44:80
x1.c.lencr.org
AKAMAI-AS
DE
whitelisted
7636
msiexec.exe
18.66.248.64:80
r11.c.lencr.org
AMAZON-02
US
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 40.127.240.158
whitelisted
google.com
  • 142.250.186.78
whitelisted
crl.microsoft.com
  • 23.48.23.171
  • 23.48.23.183
  • 23.48.23.181
  • 23.48.23.179
  • 23.48.23.168
  • 23.48.23.164
  • 23.48.23.166
  • 23.48.23.174
  • 23.48.23.161
whitelisted
www.microsoft.com
  • 184.30.21.171
whitelisted
client.wns.windows.com
  • 172.211.123.250
whitelisted
marybcook.com
  • 169.150.247.39
unknown
x1.c.lencr.org
  • 69.192.161.44
whitelisted
r11.c.lencr.org
  • 18.66.248.64
  • 18.66.248.75
  • 18.66.248.69
  • 18.66.248.39
whitelisted
slscr.update.microsoft.com
  • 172.202.163.200
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 20.242.39.171
whitelisted

Threats

PID
Process
Class
Message
7948
taskcoach.exe
Attempted Information Leak
ET INFO Python-urllib/ Suspicious User Agent
7948
taskcoach.exe
Attempted Information Leak
ET INFO Python-urllib/ Suspicious User Agent
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
setup.msi