File name:

INIS_EX.exe

Full analysis: https://app.any.run/tasks/e587ad41-e776-48bb-9ced-128df2963de6
Verdict: Malicious activity
Analysis date: February 07, 2022, 15:43:26
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Tags:
installer
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
MD5:

F7A5F7B778121073121A40D0AA5EF187

SHA1:

1B5D8EB672EF15F32239707D66AC1275BCA2BE18

SHA256:

34399A89DF3B5E8BC808D215A6D31574A1CF779CCCF68B1DC358F9F8CE18794C

SSDEEP:

196608:6Y0SItE1hOJnmpb7FYTDV7AG+qEibWZwmbIGO874LfneBCd8uXJWDODk9:0SqE1hONm97evGlfzimbdAL78u4ODe

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops executable file immediately after starts

      • INIS_EX.exe (PID: 3572)
      • INIS_EX.exe (PID: 2356)
      • iniline_crosswebex_Install.exe (PID: 2664)

    • Loads dropped or rewritten executable

      • INIS_EX.exe (PID: 3572)
      • INIS_EX.exe (PID: 2356)
      • iniline_crosswebex_Install.exe (PID: 2664)
      • INISAFECrossWebEXSvc.exe (PID: 4008)
      • certutil.exe (PID: 3132)

    • Steals credentials from Web Browsers

      • INIS_EX.exe (PID: 2356)
      • certutil.exe (PID: 3132)

    • Actions looks like stealing of personal data

      • INIS_EX.exe (PID: 2356)
      • certutil.exe (PID: 3132)

    • Changes settings of System certificates

      • MyCertMgr.exe (PID: 3340)

    • Application was dropped or rewritten from another process

      • certutil.exe (PID: 3132)
      • MyCertMgr.exe (PID: 3340)
      • MyCertMgr.exe (PID: 1668)
      • MyCertMgr.exe (PID: 2772)
      • IniClientSvc.exe (PID: 3548)
      • MyCertMgr.exe (PID: 3576)
      • INISAFETrayEX.exe (PID: 3612)
      • iniline_crosswebex_Install.exe (PID: 2664)
      • INISAFECrossWebEXSvc.exe (PID: 4008)

  • SUSPICIOUS

    • Reads the computer name

      • INIS_EX.exe (PID: 3572)
      • INIS_EX.exe (PID: 2356)
      • iniline_crosswebex_Install.exe (PID: 2664)
      • certutil.exe (PID: 3132)
      • IniClientSvc.exe (PID: 3548)
      • MyCertMgr.exe (PID: 2772)
      • INISAFECrossWebEXSvc.exe (PID: 4008)
      • MyCertMgr.exe (PID: 1668)

    • Checks supported languages

      • INIS_EX.exe (PID: 2356)
      • INIS_EX.exe (PID: 3572)
      • ns4E5D.tmp (PID: 3992)
      • INISAFETrayEX.exe (PID: 3612)
      • iniline_crosswebex_Install.exe (PID: 2664)
      • MyCertMgr.exe (PID: 2772)
      • cmd.exe (PID: 2408)
      • cmd.exe (PID: 2436)
      • MyCertMgr.exe (PID: 3576)
      • cmd.exe (PID: 3068)
      • certutil.exe (PID: 3132)
      • IniClientSvc.exe (PID: 3548)
      • MyCertMgr.exe (PID: 3340)
      • INISAFECrossWebEXSvc.exe (PID: 4008)
      • MyCertMgr.exe (PID: 1668)

    • Executable content was dropped or overwritten

      • INIS_EX.exe (PID: 3572)
      • INIS_EX.exe (PID: 2356)
      • iniline_crosswebex_Install.exe (PID: 2664)

    • Reads Environment values

      • INIS_EX.exe (PID: 3572)
      • INIS_EX.exe (PID: 2356)

    • Application launched itself

      • INIS_EX.exe (PID: 3572)

    • Drops a file with too old compile date

      • INIS_EX.exe (PID: 3572)
      • INIS_EX.exe (PID: 2356)
      • iniline_crosswebex_Install.exe (PID: 2664)

    • Creates a directory in Program Files

      • INIS_EX.exe (PID: 2356)
      • iniline_crosswebex_Install.exe (PID: 2664)

    • Creates files in the Windows directory

      • INIS_EX.exe (PID: 2356)

    • Creates a software uninstall entry

      • INIS_EX.exe (PID: 2356)

    • Drops a file that was compiled in debug mode

      • INIS_EX.exe (PID: 2356)
      • iniline_crosswebex_Install.exe (PID: 2664)

    • Creates files in the program directory

      • iniline_crosswebex_Install.exe (PID: 2664)
      • INIS_EX.exe (PID: 2356)

    • Creates/Modifies COM task schedule object

      • INIS_EX.exe (PID: 2356)
      • iniline_crosswebex_Install.exe (PID: 2664)

    • Starts CMD.EXE for commands execution

      • INIS_EX.exe (PID: 2356)

    • Drops a file with a compile date too recent

      • INIS_EX.exe (PID: 2356)

    • Starts application with an unusual extension

      • INIS_EX.exe (PID: 2356)

    • Creates files in the user directory

      • certutil.exe (PID: 3132)

    • Creates or modifies windows services

      • INIS_EX.exe (PID: 2356)

    • Executed as Windows Service

      • IniClientSvc.exe (PID: 3548)

  • INFO

    • Reads settings of System Certificates

      • MyCertMgr.exe (PID: 3576)
      • MyCertMgr.exe (PID: 2772)
      • MyCertMgr.exe (PID: 3340)
      • INISAFECrossWebEXSvc.exe (PID: 4008)
      • MyCertMgr.exe (PID: 1668)

    • Checks Windows Trust Settings

      • INISAFECrossWebEXSvc.exe (PID: 4008)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | NSIS - Nullsoft Scriptable Install System (91.9)
.exe | Win32 Executable MS Visual C++ (generic) (3.3)
.exe | Win64 Executable (generic) (3)
.dll | Win32 Dynamic Link Library (generic) (0.7)
.exe | Win32 Executable (generic) (0.4)

EXIF

EXE

ProductName: INISAFE CrossWeb EX v3.0
LegalTrademarks: INISAFE CrossWeb EX v3.0 is a trademark of Initech
LegalCopyright: Initech Co., Ltd. All right reserved.
FileVersion: 3.1.5.43
FileDescription: INISAFE CrossWeb EX v3.0 Installer
CompanyName: Initech (c)
Comments: -
CharacterSet: Windows, Korea (Shift - KSC 5601)
LanguageCode: Korean
FileSubtype: -
ObjectFileType: Executable application
FileOS: Win32
FileFlags: (none)
FileFlagsMask: 0x0000
ProductVersionNumber: 3.1.5.43
FileVersionNumber: 3.1.5.43
Subsystem: Windows GUI
SubsystemVersion: 4
ImageVersion: 6
OSVersion: 4
EntryPoint: 0x3217
UninitializedDataSize: 1024
InitializedDataSize: 117760
CodeSize: 24064
LinkerVersion: 6
PEType: PE32
TimeStamp: 2015:08:05 02:46:27+02:00
MachineType: Intel 386 or later, and compatibles

Summary

Architecture: IMAGE_FILE_MACHINE_I386
Subsystem: IMAGE_SUBSYSTEM_WINDOWS_GUI
Compilation Date: 05-Aug-2015 00:46:27
Detected languages:
  • English - United States
  • Korean - Korea
Comments: -
CompanyName: Initech (c)
FileDescription: INISAFE CrossWeb EX v3.0 Installer
FileVersion: 3.1.5.43
LegalCopyright: Initech Co., Ltd. All right reserved.
LegalTrademarks: INISAFE CrossWeb EX v3.0 is a trademark of Initech
ProductName: INISAFE CrossWeb EX v3.0

DOS Header

Magic number: MZ
Bytes on last page of file: 0x0090
Pages in file: 0x0003
Relocations: 0x0000
Size of header: 0x0004
Min extra paragraphs: 0x0000
Max extra paragraphs: 0xFFFF
Initial SS value: 0x0000
Initial SP value: 0x00B8
Checksum: 0x0000
Initial IP value: 0x0000
Initial CS value: 0x0000
Overlay number: 0x0000
OEM identifier: 0x0000
OEM information: 0x0000
Address of NE header: 0x000000C8

PE Headers

Signature: PE
Machine: IMAGE_FILE_MACHINE_I386
Number of sections: 5
Time date stamp: 05-Aug-2015 00:46:27
Pointer to Symbol Table: 0x00000000
Number of symbols: 0
Size of Optional Header: 0x00E0
Characteristics:
  • IMAGE_FILE_32BIT_MACHINE
  • IMAGE_FILE_EXECUTABLE_IMAGE
  • IMAGE_FILE_LINE_NUMS_STRIPPED
  • IMAGE_FILE_LOCAL_SYMS_STRIPPED
  • IMAGE_FILE_RELOCS_STRIPPED

Sections

Name
Virtual Address
Virtual Size
Raw Size
Charateristics
Entropy
.text
0x00001000
0x00005C3A
0x00005E00
IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
6.41041
.rdata
0x00007000
0x000011CE
0x00001200
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
5.23612
.data
0x00009000
0x0001A7F8
0x00000400
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
5.02661
.ndata
0x00024000
0x0000A000
0x00000000
IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
0
.rsrc
0x0002E000
0x00001400
0x00001400
IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
4.0202

Resources

Title
Entropy
Size
Codepage
Language
Type
1
5.29702
1060
UNKNOWN
English - United States
RT_MANIFEST
103
1.91924
20
UNKNOWN
English - United States
RT_GROUP_ICON
105
2.65195
256
UNKNOWN
English - United States
RT_DIALOG
106
2.89971
284
UNKNOWN
English - United States
RT_DIALOG
111
2.48825
96
UNKNOWN
English - United States
RT_DIALOG
205
2.55952
236
UNKNOWN
English - United States
RT_DIALOG
206
2.86211
264
UNKNOWN
English - United States
RT_DIALOG
211
2.36476
76
UNKNOWN
English - United States
RT_DIALOG

Imports

ADVAPI32.dll
COMCTL32.dll
GDI32.dll
KERNEL32.dll
SHELL32.dll
USER32.dll
VERSION.dll
ole32.dll
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
56
Monitored processes
15
Malicious processes
4
Suspicious processes
5

Behavior graph

Click at the process to see the details
start drop and start inis_ex.exe inis_ex.exe ns4e5d.tmp no specs inisafetrayex.exe no specs iniline_crosswebex_install.exe cmd.exe no specs mycertmgr.exe cmd.exe no specs cmd.exe no specs certutil.exe iniclientsvc.exe no specs mycertmgr.exe mycertmgr.exe mycertmgr.exe inisafecrosswebexsvc.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
1668"C:\Program Files\initech\INISAFE Web EX Client\MyCertMgr.exe" /del "127.0.0.1" "Initech Root Authority - CrossWeb EX"C:\Program Files\initech\INISAFE Web EX Client\MyCertMgr.exe
IniClientSvc.exe
User:
admin
Integrity Level:
MEDIUM
Exit code:
0
Modules
Images
c:\program files\initech\inisafe web ex client\mycertmgr.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\gdi32.dll
2356"C:\Users\admin\AppData\Local\Temp\INIS_EX.exe" /UAC:30102 /NCRC C:\Users\admin\AppData\Local\Temp\INIS_EX.exe
INIS_EX.exe
User:
admin
Company:
Initech (c)
Integrity Level:
HIGH
Description:
INISAFE CrossWeb EX v3.0 Installer
Exit code:
0
Version:
3.1.5.43
Modules
Images
c:\windows\system32\ntdll.dll
c:\users\admin\appdata\local\temp\inis_ex.exe
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\shell32.dll
c:\windows\system32\msvcrt.dll
2408C:\Windows\system32\cmd.exe /C ""C:\Program Files\INITECH\INISAFE Web EX Client\MyCertMgr.exe" /del "Initech Root Authority - CrossWeb EX" "Initech Root Authority - CrossWeb EX""C:\Windows\system32\cmd.exe—INIS_EX.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
2436C:\Windows\system32\cmd.exe /C ""C:\Program Files\INITECH\INISAFE Web EX Client\certutil.exe" -D -d "C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles/qldyz51w.default" -n "Initech Root Authority - CrossWeb EX""C:\Windows\system32\cmd.exe—INIS_EX.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
1
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\kernelbase.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\ntdll.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
2664"C:\Program Files\INITECH\INISAFE Web EX Client\iniline_crosswebex_Install.exe" /SC:\Program Files\INITECH\INISAFE Web EX Client\iniline_crosswebex_Install.exe
INIS_EX.exe
User:
admin
Company:
iniLINE Co., Ltd.
Integrity Level:
HIGH
Description:
iniLINE CrossEX 32bit
Exit code:
0
Version:
1.0.1.1101
Modules
Images
c:\program files\initech\inisafe web ex client\iniline_crosswebex_install.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shlwapi.dll
2772"C:\Program Files\INITECH\INISAFE Web EX Client\MyCertMgr.exe" /del "Initech Root Authority - CrossWeb EX" "Initech Root Authority - CrossWeb EX"C:\Program Files\INITECH\INISAFE Web EX Client\MyCertMgr.exe
cmd.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\program files\initech\inisafe web ex client\mycertmgr.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\lpk.dll
3068C:\Windows\system32\cmd.exe /C ""C:\Program Files\INITECH\INISAFE Web EX Client\certutil.exe" -A -n "Initech Root Authority - CrossWeb EX" -t "TCu,Cuw,Tuw" -i "inirootcert.cer" -d "C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles/qldyz51w.default""C:\Windows\system32\cmd.exe—INIS_EX.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
3132"C:\Program Files\INITECH\INISAFE Web EX Client\certutil.exe" -A -n "Initech Root Authority - CrossWeb EX" -t "TCu,Cuw,Tuw" -i "inirootcert.cer" -d "C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles/qldyz51w.default"C:\Program Files\INITECH\INISAFE Web EX Client\certutil.exe
cmd.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\program files\initech\inisafe web ex client\certutil.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\initech\inisafe web ex client\smime3.dll
c:\program files\initech\inisafe web ex client\nss3.dll
c:\program files\initech\inisafe web ex client\softokn3.dll
c:\program files\initech\inisafe web ex client\plc4.dll
c:\program files\initech\inisafe web ex client\nspr4.dll
c:\windows\system32\advapi32.dll
3340"C:\Program Files\initech\INISAFE Web EX Client\MyCertMgr.exe" /add "C:\Program Files\initech\INISAFE Web EX Client\inirootcert.cer"C:\Program Files\initech\INISAFE Web EX Client\MyCertMgr.exe
IniClientSvc.exe
User:
SYSTEM
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\program files\initech\inisafe web ex client\mycertmgr.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\shlwapi.dll
c:\windows\system32\gdi32.dll
3548"C:\Program Files\initech\common\ClientService\IniClientSvc.exe"C:\Program Files\initech\common\ClientService\IniClientSvc.exe—services.exe
User:
SYSTEM
Company:
Initech Co., Ltd.
Integrity Level:
SYSTEM
Description:
Initech Client Manager Service
Exit code:
0
Version:
1, 0, 0, 10
Modules
Images
c:\program files\initech\common\clientservice\iniclientsvc.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\userenv.dll
c:\windows\system32\profapi.dll
Total events
22 119
Read events
21 973
Write events
146
Delete events
0

Modification events

(PID) Process:(3572) INIS_EX.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(3572) INIS_EX.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
(PID) Process:(3572) INIS_EX.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
1
(PID) Process:(3572) INIS_EX.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
0
(PID) Process:(2356) INIS_EX.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Recovery
Operation:writeName:AutoRecover
Value:
2
(PID) Process:(2356) INIS_EX.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Recovery
Operation:writeName:AutoRecover
Value:
0
(PID) Process:(2356) INIS_EX.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{7DAA4A48-E2DA-48e8-A133-653F364D5A23}
Operation:writeName:AppPath
Value:
C:\Program Files\INITECH\INISAFE Web EX Client
(PID) Process:(2356) INIS_EX.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{7DAA4A48-E2DA-48e8-A133-653F364D5A23}
Operation:writeName:AppName
Value:
INISAFETrayEX.exe
(PID) Process:(2356) INIS_EX.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{7DAA4A48-E2DA-48e8-A133-653F364D5A23}
Operation:writeName:Policy
Value:
3
(PID) Process:(2356) INIS_EX.exeKey:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{A924B865-1CF0-46be-B570-16580372C622}
Operation:writeName:AppPath
Value:
C:\Program Files\INITECH\INISAFE Web EX Client
Executable files
71
Suspicious files
7
Text files
14
Unknown types
61

Dropped files

PID
Process
Filename
Type
2356INIS_EX.exeC:\Users\admin\AppData\Local\Temp\nsb3F87.tmp\UAC.dllexecutable
MD5:E910A8BD10B97065EE3B1C024FAFC4AC
SHA256:1C62037E97B5EEBB102B879B5D6D11724C7F757D6163D369A5507EE7DFFD284D
3572INIS_EX.exeC:\Users\admin\AppData\Local\Temp\nsz3AF3.tmp\UAC.dllexecutable
MD5:E910A8BD10B97065EE3B1C024FAFC4AC
SHA256:1C62037E97B5EEBB102B879B5D6D11724C7F757D6163D369A5507EE7DFFD284D
2356INIS_EX.exeC:\Users\admin\AppData\Local\Temp\nsb3F87.tmp\UAC.LNGtext
MD5:1E72C0B7743619809B7CDA824D2A1ECF
SHA256:F2E214452E69EDAF602E30D06EE186D072B1D2EC04B813B458C1E31B56ECE16B
3572INIS_EX.exeC:\Users\admin\AppData\Local\Temp\nsz3AF3.tmp\UAC.LNGtext
MD5:1E72C0B7743619809B7CDA824D2A1ECF
SHA256:F2E214452E69EDAF602E30D06EE186D072B1D2EC04B813B458C1E31B56ECE16B
2356INIS_EX.exeC:\Users\admin\AppData\Local\Temp\nsb3F87.tmp\ISF_NSIS_UTIL.dllexecutable
MD5:—
SHA256:—
2356INIS_EX.exeC:\Program Files\INITECH\INISAFE Web EX Client\check\inicore_v2.3.16.dllexecutable
MD5:C28012E443ACA95C0780994A7DA58A7A
SHA256:E9414BFFD5B0B26EF4D5AD7EDDD1FE3F560285902D3D2B437AB5C8CF6CBD1F1E
2356INIS_EX.exeC:\Program Files\NPKI\KISA\FF8A46723358E8488822AA1768DA1648098B3591_3.derder
MD5:9F6C1F0F07AC1921F915BBD5C72CD82A
SHA256:956057517FF3BB35049342288C1C9DCE852DACA652B465E9747253B5F93B1F5E
2356INIS_EX.exeC:\Program Files\NPKI\KISA\troot-rsa-3280.derder
MD5:D4DC5B27956B948CF53B548578602E84
SHA256:6D5AC45F69A73D40F9717CBC60A1F420ED9C7B07D7CF63C2937B9C65138C33F9
2356INIS_EX.exeC:\Program Files\NPKI\KISA\C8D08EC749AE1F2042B24B7F13C977580CA1CDC1_1.derder
MD5:322B7C6659E177C6B2254060CA188D27
SHA256:A002FF556C601863B08B9AA33A8E6666E97E72BBE552F66EB9F2395C68C7BC98
2356INIS_EX.exeC:\Windows\system32\msvcr71.dllexecutable
MD5:F06F36C0E55E5B4312792D6FCACC8042
SHA256:2404659784ADE7F874FEEFBB4816DB4E42852EDE0693FB2A7B45145501EA24CD
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
0
DNS requests
0
Threats
0

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

No data

DNS requests

No data

Threats

No threats detected
Process
Message
INIS_EX.exe
!@!@ case2
INIS_EX.exe
!@!@ case2
INIS_EX.exe
!@!@ case2
INIS_EX.exe
!@!@ case2
INIS_EX.exe
!@!@ case2
INIS_EX.exe
!@!@ case2
INIS_EX.exe
!@!@ case2
INIS_EX.exe
!@!@ case2
INIS_EX.exe
!@!@ case2
INIS_EX.exe
!@!@ case2
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
INIS_EX.exe