File name:

setup.msi

Full analysis: https://app.any.run/tasks/f8c63056-af94-4e03-b0a3-1c941af8ed10
Verdict: Malicious activity
Analysis date: May 10, 2025, 06:01:04
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
generated-doc
Indicators:
MIME: application/x-msi
File info: Composite Document File V2 Document, Little Endian, Os: Windows, Version 10.0, MSI Installer, Security: 0, Code page: 1252, Revision Number: {C4AECC88-FF41-4120-9146-AA02B0EF7CD1}, Number of Words: 10, Subject: Koqlpo Cynav Tool, Author: Niviqol Raisox, Name of Creating Application: Koqlpo Cynav Tool, Template: x64;1033, Comments: This installer database contains the logic and data required to install Koqlpo Cynav Tool., Title: Installation Database, Keywords: Installer, MSI, Database, Create Time/Date: Thu May 8 20:06:16 2025, Last Saved Time/Date: Thu May 8 20:06:16 2025, Last Printed: Thu May 8 20:06:16 2025, Number of Pages: 450
MD5:

674652BA6A8E5BFF5F9566BB4A68B649

SHA1:

950ACCB24DE4BBC9B3F29FB462311DCB54E6E6B2

SHA256:

9B59AA79432EE430A8D11A809F5E1DE7234BBCCFD0AAD23F53C86ADD18184B41

SSDEEP:

393216:yJ6AhndyL/8/aDzj9U82/PVoATjN2h0objZMdmYxIg2hzd:udij9RcVoATjN2h0objZB2IfR

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    No malicious indicators.

  • SUSPICIOUS

    • Reads the Windows owner or organization settings

      • msiexec.exe (PID: 7836)

    • Reads security settings of Internet Explorer

      • msiexec.exe (PID: 7888)

    • Process drops python dynamic module

      • msiexec.exe (PID: 7836)

    • Process drops legitimate windows executable

      • msiexec.exe (PID: 7836)

    • The process drops C-runtime libraries

      • msiexec.exe (PID: 7836)

    • Drops 7-zip archiver for unpacking

      • msiexec.exe (PID: 7836)

    • There is functionality for taking screenshot (YARA)

      • taskcoach.exe (PID: 2384)

  • INFO

    • Reads the computer name

      • msiexec.exe (PID: 7836)
      • msiexec.exe (PID: 7888)
      • taskcoach.exe (PID: 2384)

    • An automatically generated document

      • msiexec.exe (PID: 7744)

    • The sample compiled with english language support

      • msiexec.exe (PID: 7836)

    • Checks supported languages

      • msiexec.exe (PID: 7836)
      • msiexec.exe (PID: 7888)
      • taskcoach.exe (PID: 2384)

    • Executable content was dropped or overwritten

      • msiexec.exe (PID: 7836)

    • Creates files or folders in the user directory

      • msiexec.exe (PID: 7888)
      • msiexec.exe (PID: 7836)
      • taskcoach.exe (PID: 2384)

    • Reads the machine GUID from the registry

      • msiexec.exe (PID: 7888)
      • taskcoach.exe (PID: 2384)

    • Reads the software policy settings

      • msiexec.exe (PID: 7888)
      • slui.exe (PID: 5204)

    • Checks proxy server information

      • msiexec.exe (PID: 7888)
      • taskcoach.exe (PID: 2384)
      • slui.exe (PID: 5204)

    • Reads Environment values

      • msiexec.exe (PID: 7888)

    • Creates a software uninstall entry

      • msiexec.exe (PID: 7836)

    • Create files in a temporary directory

      • taskcoach.exe (PID: 2384)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.msi | Microsoft Windows Installer (88.6)
.mst | Windows SDK Setup Transform Script (10)
.msi | Microsoft Installer (100)

EXIF

FlashPix

Security: None
CodePage: Windows Latin 1 (Western European)
RevisionNumber: {C4AECC88-FF41-4120-9146-AA02B0EF7CD1}
Words: 10
Subject: Koqlpo Cynav Tool
Author: Niviqol Raisox
LastModifiedBy: -
Software: Koqlpo Cynav Tool
Template: x64;1033
Comments: This installer database contains the logic and data required to install Koqlpo Cynav Tool.
Title: Installation Database
Keywords: Installer, MSI, Database
CreateDate: 2025:05:08 20:06:16
ModifyDate: 2025:05:08 20:06:16
LastPrinted: 2025:05:08 20:06:16
Pages: 450
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
134
Monitored processes
7
Malicious processes
1
Suspicious processes
0

Behavior graph

Click at the process to see the details
start msiexec.exe no specs msiexec.exe msiexec.exe tpm2emu.exe no specs taskcoach.exe conhost.exe no specs slui.exe

Process information

PID
CMD
Path
Indicators
Parent process
2320"C:\Users\admin\AppData\Roaming\Koqlpo Cynav Tool\tpm2emu.exe" 0C:\Users\admin\AppData\Roaming\Koqlpo Cynav Tool\tpm2emu.exe—msiexec.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
3221225781
Modules
Images
c:\users\admin\appdata\roaming\koqlpo cynav tool\tpm2emu.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
2384"C:\Users\admin\AppData\Roaming\Koqlpo Cynav Tool\taskcoach.exe"C:\Users\admin\AppData\Roaming\Koqlpo Cynav Tool\taskcoach.exe
msiexec.exe
User:
admin
Integrity Level:
MEDIUM
Description:
Your friendly task manager
Version:
1.4.6
Modules
Images
c:\users\admin\appdata\roaming\koqlpo cynav tool\taskcoach.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
4880\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—tpm2emu.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
5204C:\WINDOWS\System32\slui.exe -EmbeddingC:\Windows\System32\slui.exe
svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Activation Client
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
7744"C:\Windows\System32\msiexec.exe" /i C:\Users\admin\AppData\Local\Temp\setup.msiC:\Windows\System32\msiexec.exe—explorer.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows® installer
Exit code:
0
Version:
5.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\msiexec.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\aclayers.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
7836C:\WINDOWS\system32\msiexec.exe /VC:\Windows\System32\msiexec.exe
services.exe
User:
SYSTEM
Company:
Microsoft Corporation
Integrity Level:
SYSTEM
Description:
Windows® installer
Version:
5.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\msiexec.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\aclayers.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
7888C:\Windows\syswow64\MsiExec.exe -Embedding 6DB08EB4DC28A069EF48464237128095C:\Windows\SysWOW64\msiexec.exe
msiexec.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows® installer
Exit code:
0
Version:
5.0.19041.3636 (WinBuild.160101.0800)
Modules
Images
c:\windows\syswow64\msiexec.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\aclayers.dll
Total events
3 741
Read events
3 415
Write events
317
Delete events
9

Modification events

(PID) Process:(7836) msiexec.exeKey:HKEY_USERS\S-1-5-21-1693682860-607145093-2874071422-1001\SOFTWARE\Microsoft\RestartManager\Session0000
Operation:writeName:Owner
Value:
9C1E0000EFFF5EF870C1DB01
(PID) Process:(7836) msiexec.exeKey:HKEY_USERS\S-1-5-21-1693682860-607145093-2874071422-1001\SOFTWARE\Microsoft\RestartManager\Session0000
Operation:writeName:SessionHash
Value:
4AFB17A4CFBF6B1BD17CF677E340DF1FBE4D0392536D990A1CB51B7855EFD8F9
(PID) Process:(7836) msiexec.exeKey:HKEY_USERS\S-1-5-21-1693682860-607145093-2874071422-1001\SOFTWARE\Microsoft\RestartManager\Session0000
Operation:writeName:Sequence
Value:
1
(PID) Process:(7888) msiexec.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content
Operation:writeName:CachePrefix
Value:
(PID) Process:(7888) msiexec.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies
Operation:writeName:CachePrefix
Value:
Cookie:
(PID) Process:(7888) msiexec.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History
Operation:writeName:CachePrefix
Value:
Visited:
(PID) Process:(7836) msiexec.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Folders
Operation:writeName:C:\Config.Msi\
Value:
(PID) Process:(7836) msiexec.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Rollback\Scripts
Operation:writeName:C:\Config.Msi\10cdd3.rbs
Value:
31179120
(PID) Process:(7836) msiexec.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\Rollback\Scripts
Operation:writeName:C:\Config.Msi\10cdd3.rbsLow
Value:
(PID) Process:(7836) msiexec.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-21-1693682860-607145093-2874071422-1001\Components\42F0865697CD28440AD3B5A00E8D7F5B
Operation:writeName:B0C3D3F08660A474AAF46D317F1A5A5F
Value:
C:\Users\admin\AppData\Roaming\Koqlpo Cynav Tool\w9xpopen.exe
Executable files
117
Suspicious files
297
Text files
71
Unknown types
2

Dropped files

PID
Process
Filename
Type
7836msiexec.exeC:\Windows\Installer\10cdd1.msi —
MD5:—
SHA256:—
7836msiexec.exeC:\Windows\Installer\MSID024.tmpexecutable
MD5:379F76E2FA6EEF4C2116C2A3AE6896BE
SHA256:C54F8A0CC280A9A0C934B8B23BBD530BA739E79AD686121CC8B659882CEB60FD
7888msiexec.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\842C55B5A55A5D6DEAFE1ADE04420CD9binary
MD5:FDEEBE334B8321A494A408CEF878D7D2
SHA256:62A3FB721AB97ED6C9C14E37A5DD2D28E7CCEE4EB5E1D3E283F8F0B6C3FB1F1C
7888msiexec.exeC:\Users\admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\842C55B5A55A5D6DEAFE1ADE04420CD9binary
MD5:1BA9AD8D328455B736AF4FDBA8894569
SHA256:746066C24CA2A3B5DBE3807A468DC23C6889B5C1844FE7B137F379120945CFAC
7836msiexec.exeC:\Windows\Installer\MSIE586.tmpexecutable
MD5:379F76E2FA6EEF4C2116C2A3AE6896BE
SHA256:C54F8A0CC280A9A0C934B8B23BBD530BA739E79AD686121CC8B659882CEB60FD
7836msiexec.exeC:\Users\admin\AppData\Roaming\Koqlpo Cynav Tool\_socket.pydexecutable
MD5:07789A8C23BCEBE32F8BFD4CE4AF5FFB
SHA256:235CC97584C3D31E5F3146121F64699D30CF372A86868EA755A9A0AFA6C56144
7836msiexec.exeC:\Users\admin\AppData\Roaming\Koqlpo Cynav Tool\_sqlite3.pydexecutable
MD5:8AF159910FA00E5D5EC5E3B0823DBC76
SHA256:866BCB56030EAE4BF792BAB5DCC1CCEA50853A6DBC62955D98A92CE4010ED631
7836msiexec.exeC:\Windows\Installer\MSIDB44.tmpexecutable
MD5:481FBA768D3692CB566F14697E436689
SHA256:0CC629D35B0A010B207B10C057C9E9B74C54BFFD25D736EB6B8ED20DD7F6F361
7836msiexec.exeC:\Windows\Installer\MSID1DC.tmpexecutable
MD5:379F76E2FA6EEF4C2116C2A3AE6896BE
SHA256:C54F8A0CC280A9A0C934B8B23BBD530BA739E79AD686121CC8B659882CEB60FD
7836msiexec.exeC:\Windows\Installer\MSID092.tmpexecutable
MD5:379F76E2FA6EEF4C2116C2A3AE6896BE
SHA256:C54F8A0CC280A9A0C934B8B23BBD530BA739E79AD686121CC8B659882CEB60FD
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
9
TCP/UDP connections
27
DNS requests
21
Threats
2

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
6544
svchost.exe
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
DE
binary
471 b
whitelisted
7356
SIHClient.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
DE
binary
419 b
whitelisted
2384
taskcoach.exe
GET
301
51.158.149.82:80
http://taskcoach.org/messages.txt
FR
html
324 b
unknown
2384
taskcoach.exe
GET
301
51.158.149.82:80
http://taskcoach.org/version.txt
FR
html
323 b
unknown
7356
SIHClient.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
DE
binary
407 b
whitelisted
—
—
GET
200
23.48.23.156:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
DE
binary
825 b
whitelisted
—
—
GET
200
2.23.246.101:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
QA
binary
868 b
whitelisted
7888
msiexec.exe
GET
200
23.209.209.135:80
http://x1.c.lencr.org/
ID
binary
734 b
whitelisted
7888
msiexec.exe
GET
200
65.9.66.41:80
http://r11.c.lencr.org/26.crl
US
binary
43.7 Kb
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
—
—
51.124.78.146:443
—
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
—
—
23.48.23.156:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
—
—
2.23.246.101:80
www.microsoft.com
Ooredoo Q.S.C.
QA
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
3216
svchost.exe
172.211.123.250:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
FR
whitelisted
7888
msiexec.exe
169.150.247.37:443
cbsnaturalway.com
—
GB
unknown
7888
msiexec.exe
23.209.209.135:80
x1.c.lencr.org
PT. Telekomunikasi Selular
ID
whitelisted
7888
msiexec.exe
65.9.66.41:80
r11.c.lencr.org
AMAZON-02
US
whitelisted
6544
svchost.exe
20.190.160.132:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted

DNS requests

Domain
IP
Reputation
crl.microsoft.com
  • 23.48.23.156
  • 23.48.23.143
whitelisted
www.microsoft.com
  • 2.23.246.101
  • 184.30.21.171
whitelisted
google.com
  • 142.250.184.238
whitelisted
client.wns.windows.com
  • 172.211.123.250
whitelisted
cbsnaturalway.com
  • 169.150.247.37
unknown
x1.c.lencr.org
  • 23.209.209.135
whitelisted
r11.c.lencr.org
  • 65.9.66.41
  • 65.9.66.40
  • 65.9.66.2
  • 65.9.66.96
whitelisted
login.live.com
  • 20.190.160.132
  • 20.190.160.5
  • 20.190.160.4
  • 40.126.32.136
  • 40.126.32.133
  • 40.126.32.134
  • 20.190.160.64
  • 40.126.32.68
whitelisted
ocsp.digicert.com
  • 2.17.190.73
whitelisted
settings-win.data.microsoft.com
  • 40.127.240.158
whitelisted

Threats

PID
Process
Class
Message
2384
taskcoach.exe
Attempted Information Leak
ET INFO Python-urllib/ Suspicious User Agent
2384
taskcoach.exe
Attempted Information Leak
ET INFO Python-urllib/ Suspicious User Agent
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
setup.msi