File name:

inis_ex_sha2.exe

Full analysis: https://app.any.run/tasks/c1191442-7153-4dda-8bd1-38c5f0133856
Verdict: Malicious activity
Analysis date: January 19, 2024, 02:04:34
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/x-dosexec
File info: PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
MD5:

FBCBCD5B908000BC48F232FC52CEE436

SHA1:

AF8F23A6FE96FB70124CF4CD0C3CE33A127FDCC3

SHA256:

78E3F562E4A1ADED479D9632DE0ACE8C4765EEE77B39435B9E1DAE60A46A4E57

SSDEEP:

98304:XGajmcNRfyth2YY94pHEvmIKYfLQxscnIR/vTAWvWJk0Vk6iDS/Qndu9aiT2oiQi:L5ipxw5uxaL5fX0UOZVD+3k2P

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Drops the executable file immediately after the start

      • inis_ex_sha2.exe (PID: 116)
      • inis_ex_sha2.exe (PID: 492)
      • iniline_crosswebex_Install.exe (PID: 1840)

    • Steals credentials from Web Browsers

      • inis_ex_sha2.exe (PID: 492)

    • Actions looks like stealing of personal data

      • inis_ex_sha2.exe (PID: 492)
      • certutil.exe (PID: 2172)
      • certutil.exe (PID: 1636)

    • Creates a writable file in the system directory

      • inis_ex_sha2.exe (PID: 492)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • inis_ex_sha2.exe (PID: 116)
      • inis_ex_sha2.exe (PID: 492)
      • iniline_crosswebex_Install.exe (PID: 1840)

    • The process creates files with name similar to system file names

      • inis_ex_sha2.exe (PID: 492)
      • iniline_crosswebex_Install.exe (PID: 1840)

    • Process drops legitimate windows executable

      • inis_ex_sha2.exe (PID: 492)

    • Starts application with an unusual extension

      • inis_ex_sha2.exe (PID: 492)

    • Malware-specific behavior (creating "System.dll" in Temp)

      • inis_ex_sha2.exe (PID: 492)
      • iniline_crosswebex_Install.exe (PID: 1840)

    • The process drops C-runtime libraries

      • inis_ex_sha2.exe (PID: 492)

    • Starts CMD.EXE for commands execution

      • inis_ex_sha2.exe (PID: 492)

    • Executes as Windows Service

      • IniClientSvc.exe (PID: 2340)

    • Reads the BIOS version

      • INISAFECrossWebEXSvc.exe (PID: 1892)
      • INISAFECrossWebEXSvc.exe (PID: 1624)
      • INISAFECrossWebEXSvc.exe (PID: 2900)
      • INISAFECrossWebEXSvc.exe (PID: 3484)

    • Reads security settings of Internet Explorer

      • INISAFECrossWebEXSvc.exe (PID: 1892)
      • INISAFECrossWebEXSvc.exe (PID: 1624)
      • INISAFECrossWebEXSvc.exe (PID: 3484)
      • INISAFECrossWebEXSvc.exe (PID: 2900)

    • Checks Windows Trust Settings

      • INISAFECrossWebEXSvc.exe (PID: 1892)
      • INISAFECrossWebEXSvc.exe (PID: 1624)
      • INISAFECrossWebEXSvc.exe (PID: 3484)
      • INISAFECrossWebEXSvc.exe (PID: 2900)

    • Reads settings of System Certificates

      • INISAFECrossWebEXSvc.exe (PID: 1892)
      • INISAFECrossWebEXSvc.exe (PID: 1624)
      • INISAFECrossWebEXSvc.exe (PID: 2900)
      • INISAFECrossWebEXSvc.exe (PID: 3484)

    • Creates or modifies Windows services

      • inis_ex_sha2.exe (PID: 492)

    • Application launched itself

      • inis_ex_sha2.exe (PID: 116)

    • Reads the Internet Settings

      • inis_ex_sha2.exe (PID: 116)

  • INFO

    • Reads Environment values

      • inis_ex_sha2.exe (PID: 116)
      • inis_ex_sha2.exe (PID: 492)

    • Checks supported languages

      • inis_ex_sha2.exe (PID: 116)
      • inis_ex_sha2.exe (PID: 492)
      • ns11C1.tmp (PID: 1044)
      • INISAFETrayEX.exe (PID: 1608)
      • iniline_crosswebex_Install.exe (PID: 1840)
      • certutil.exe (PID: 2172)
      • certutil.exe (PID: 1636)
      • IniClientSvc.exe (PID: 2340)
      • INISAFEAdminUtil.exe (PID: 2192)
      • INISAFECrossWebEXSvc.exe (PID: 1892)
      • INIExtensionPipeRun.exe (PID: 1836)
      • INIExtensionPipeRun.exe (PID: 2416)
      • INISAFECrossWebEXSvc.exe (PID: 1624)
      • INISAFECrossWebEXSvc.exe (PID: 2900)
      • INISAFECrossWebEXSvc.exe (PID: 3484)

    • Reads the computer name

      • inis_ex_sha2.exe (PID: 116)
      • iniline_crosswebex_Install.exe (PID: 1840)
      • certutil.exe (PID: 2172)
      • certutil.exe (PID: 1636)
      • IniClientSvc.exe (PID: 2340)
      • INISAFECrossWebEXSvc.exe (PID: 1892)
      • INISAFECrossWebEXSvc.exe (PID: 1624)
      • inis_ex_sha2.exe (PID: 492)
      • INISAFECrossWebEXSvc.exe (PID: 2900)
      • INISAFECrossWebEXSvc.exe (PID: 3484)

    • Create files in a temporary directory

      • inis_ex_sha2.exe (PID: 116)
      • iniline_crosswebex_Install.exe (PID: 1840)
      • inis_ex_sha2.exe (PID: 492)

    • Creates files in the program directory

      • inis_ex_sha2.exe (PID: 492)
      • iniline_crosswebex_Install.exe (PID: 1840)

    • Creates files or folders in the user directory

      • inis_ex_sha2.exe (PID: 492)
      • certutil.exe (PID: 2172)
      • certutil.exe (PID: 1636)

    • Reads the machine GUID from the registry

      • INISAFETrayEX.exe (PID: 1608)
      • inis_ex_sha2.exe (PID: 492)
      • INISAFEAdminUtil.exe (PID: 2192)
      • IniClientSvc.exe (PID: 2340)
      • INISAFECrossWebEXSvc.exe (PID: 1892)
      • INISAFECrossWebEXSvc.exe (PID: 1624)
      • INISAFECrossWebEXSvc.exe (PID: 2900)
      • INISAFECrossWebEXSvc.exe (PID: 3484)

    • Manual execution by a user

      • chrome.exe (PID: 2260)
      • explorer.exe (PID: 3500)
      • INISAFECrossWebEXSvc.exe (PID: 1624)
      • INIExtensionPipeRun.exe (PID: 1836)
      • INIExtensionPipeRun.exe (PID: 2416)
      • INISAFECrossWebEXSvc.exe (PID: 3484)
      • INISAFECrossWebEXSvc.exe (PID: 2900)

    • Application launched itself

      • chrome.exe (PID: 2260)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.exe | NSIS - Nullsoft Scriptable Install System (91.9)
.exe | Win32 Executable MS Visual C++ (generic) (3.3)
.exe | Win64 Executable (generic) (3)
.dll | Win32 Dynamic Link Library (generic) (0.7)
.exe | Win32 Executable (generic) (0.4)

EXIF

EXE

MachineType: Intel 386 or later, and compatibles
TimeStamp: 2015:08:05 02:46:27+02:00
ImageFileCharacteristics: No relocs, Executable, No line numbers, No symbols, 32-bit
PEType: PE32
LinkerVersion: 6
CodeSize: 24064
InitializedDataSize: 117760
UninitializedDataSize: 1024
EntryPoint: 0x3217
OSVersion: 4
ImageVersion: 6
SubsystemVersion: 4
Subsystem: Windows GUI
FileVersionNumber: 3.4.1.2
ProductVersionNumber: 3.4.1.2
FileFlagsMask: 0x0000
FileFlags: (none)
FileOS: Win32
ObjectFileType: Executable application
FileSubtype: -
LanguageCode: Korean
CharacterSet: Windows, Korea (Shift - KSC 5601)
Comments: -
CompanyName: Initech (c)
FileDescription: INISAFE CrossWeb EX V3 Installer
FileVersion: 3.4.1.2
LegalCopyright: Initech Co., Ltd. All right reserved.
LegalTrademarks: INISAFE CrossWeb EX V3 is a trademark of Initech
ProductName: INISAFE CrossWeb EX V3
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
77
Monitored processes
31
Malicious processes
12
Suspicious processes
0

Behavior graph

Click at the process to see the details
start inis_ex_sha2.exe inis_ex_sha2.exe ns11c1.tmp no specs inisafetrayex.exe no specs iniline_crosswebex_install.exe cmd.exe no specs cmd.exe no specs cmd.exe no specs certutil.exe cmd.exe no specs certutil.exe iniclientsvc.exe no specs inisafeadminutil.exe no specs inisafecrosswebexsvc.exe no specs chrome.exe chrome.exe no specs chrome.exe no specs chrome.exe chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs chrome.exe no specs explorer.exe no specs iniextensionpiperun.exe no specs iniextensionpiperun.exe no specs inisafecrosswebexsvc.exe no specs inisafecrosswebexsvc.exe no specs inisafecrosswebexsvc.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
116"C:\Users\admin\AppData\Local\Temp\inis_ex_sha2.exe" C:\Users\admin\AppData\Local\Temp\inis_ex_sha2.exe
explorer.exe
User:
admin
Company:
Initech (c)
Integrity Level:
MEDIUM
Description:
INISAFE CrossWeb EX V3 Installer
Exit code:
0
Version:
3.4.1.2
Modules
Images
c:\users\admin\appdata\local\temp\inis_ex_sha2.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shell32.dll
492"C:\Users\admin\AppData\Local\Temp\inis_ex_sha2.exe" /UAC:30152 /NCRC C:\Users\admin\AppData\Local\Temp\inis_ex_sha2.exe
inis_ex_sha2.exe
User:
admin
Company:
Initech (c)
Integrity Level:
HIGH
Description:
INISAFE CrossWeb EX V3 Installer
Exit code:
0
Version:
3.4.1.2
Modules
Images
c:\users\admin\appdata\local\temp\inis_ex_sha2.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\shell32.dll
1044"C:\Users\admin\AppData\Local\Temp\nsx2FB.tmp\ns11C1.tmp" "C:\Program Files\INITECH\INISAFE Web EX Client\INISAFETrayEX.exe" /RegServerC:\Users\admin\AppData\Local\Temp\nsx2FB.tmp\ns11C1.tmp—inis_ex_sha2.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\nsx2fb.tmp\ns11c1.tmp
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
1236C:\Windows\system32\cmd.exe /C ""C:\Program Files\INITECH\INISAFE Web EX Client\certutil.exe" -D -d "C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles/qldyz51w.default" -n "Initech Root Authority - CrossWeb EX""C:\Windows\System32\cmd.exe—inis_ex_sha2.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
1
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
1592C:\Windows\system32\cmd.exe /C ""C:\Program Files\INITECH\INISAFE Web EX Client\certutil.exe" -D -d "sql:C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles/qldyz51w.default" -n "Initech Root Authority - CrossWeb EX""C:\Windows\System32\cmd.exe—inis_ex_sha2.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
1
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
1608"C:\Program Files\INITECH\INISAFE Web EX Client\INISAFETrayEX.exe" /RegServerC:\Program Files\INITECH\INISAFE Web EX Client\INISAFETrayEX.exe—ns11C1.tmp
User:
admin
Company:
INITECH (C)
Integrity Level:
HIGH
Description:
INISAFE CrossWeb EX Client Tray
Exit code:
0
Version:
1, 3, 0, 7
Modules
Images
c:\program files\initech\inisafe web ex client\inisafetrayex.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\initech\inisafe web ex client\inicore_v2.6.3.dll
c:\windows\system32\ws2_32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\nsi.dll
c:\program files\initech\inisafe web ex client\inicrypto_v5.4.1.dll
1624"C:\Program Files\INITECH\INISAFE Web EX Client\INISAFECrossWebEXSvc.exe" C:\Program Files\INITECH\INISAFE Web EX Client\INISAFECrossWebEXSvc.exe—explorer.exe
User:
admin
Company:
Initech Co., Ltd.
Integrity Level:
MEDIUM
Description:
INISAFECrossWebEX Svc
Exit code:
0
Version:
3, 0, 0, 15
Modules
Images
c:\program files\initech\inisafe web ex client\inisafecrosswebexsvc.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.18837_none_ec86b8d6858ec0bc\comctl32.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\gdi32.dll
1636"C:\Program Files\INITECH\INISAFE Web EX Client\certutil.exe" -A -n "Initech Root Authority - CrossWeb EX" -t "TCu,Cu,Tu" -i "inirootcert.cer" -d "sql:C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles/qldyz51w.default"C:\Program Files\INITECH\INISAFE Web EX Client\certutil.exe
cmd.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\program files\initech\inisafe web ex client\certutil.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\program files\initech\inisafe web ex client\nssutil3.dll
c:\program files\initech\inisafe web ex client\plc4.dll
c:\program files\initech\inisafe web ex client\nspr4.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
1740C:\Windows\system32\cmd.exe /C ""C:\Program Files\INITECH\INISAFE Web EX Client\certutil.exe" -A -n "Initech Root Authority - CrossWeb EX" -t "TCu,Cu,Tu" -i "inirootcert.cer" -d "sql:C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles/qldyz51w.default""C:\Windows\System32\cmd.exe—inis_ex_sha2.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
1820C:\Windows\system32\cmd.exe /C ""C:\Program Files\INITECH\INISAFE Web EX Client\certutil.exe" -A -n "Initech Root Authority - CrossWeb EX" -t "TCu,Cuw,Tuw" -i "inirootcert.cer" -d "C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles/qldyz51w.default""C:\Windows\System32\cmd.exe—inis_ex_sha2.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
0
Version:
6.1.7601.17514 (win7sp1_rtm.101119-1850)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\winbrand.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
Total events
23 612
Read events
23 528
Write events
84
Delete events
0

Modification events

(PID) Process:(116) inis_ex_sha2.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
(PID) Process:(116) inis_ex_sha2.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:IntranetName
Value:
1
(PID) Process:(116) inis_ex_sha2.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:UNCAsIntranet
Value:
1
(PID) Process:(116) inis_ex_sha2.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:AutoDetect
Value:
0
(PID) Process:(492) inis_ex_sha2.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Recovery
Operation:writeName:AutoRecover
Value:
0
(PID) Process:(492) inis_ex_sha2.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Recovery
Operation:writeName:AutoRecover
Value:
2
(PID) Process:(1892) INISAFECrossWebEXSvc.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\182\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(1892) INISAFECrossWebEXSvc.exeKey:HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main
Operation:writeName:DOMStorage
Value:
1
(PID) Process:(492) inis_ex_sha2.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\INISAFEClientManager
Operation:writeName:ImagePath
Value:
C:\Program Files\initech\common\ClientService\IniClientSvc.exe
(PID) Process:(492) inis_ex_sha2.exeKey:HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Session Manager
Operation:writeName:PendingFileRenameOperations
Value:
\??\C:\Users\admin\AppData\Local\Temp\nsx2FB.tmp\UAC.dll
Executable files
107
Suspicious files
78
Text files
34
Unknown types
3

Dropped files

PID
Process
Filename
Type
492inis_ex_sha2.exeC:\Users\admin\AppData\Local\Temp\nsx2FB.tmp\UAC.dllexecutable
MD5:E910A8BD10B97065EE3B1C024FAFC4AC
SHA256:1C62037E97B5EEBB102B879B5D6D11724C7F757D6163D369A5507EE7DFFD284D
492inis_ex_sha2.exeC:\Windows\system32\msvcp71.dllexecutable
MD5:561FA2ABB31DFA8FAB762145F81667C2
SHA256:DF96156F6A548FD6FE5672918DE5AE4509D3C810A57BFFD2A91DE45A3ED5B23B
116inis_ex_sha2.exeC:\Users\admin\AppData\Local\Temp\nsgFEF4.tmp\UAC.dllexecutable
MD5:E910A8BD10B97065EE3B1C024FAFC4AC
SHA256:1C62037E97B5EEBB102B879B5D6D11724C7F757D6163D369A5507EE7DFFD284D
492inis_ex_sha2.exeC:\Windows\system32\MFC71.dllexecutable
MD5:F35A584E947A5B401FEB0FE01DB4A0D7
SHA256:4DA5EFDC46D126B45DAEEE8BC69C0BA2AA243589046B7DFD12A7E21B9BEE6A32
492inis_ex_sha2.exeC:\Windows\system32\ISF_CheckSFilter.dllexecutable
MD5:A7FD2662E0955749042A8C35BDAFC248
SHA256:E8A74825F159F00B5B0A2EAA1008FC25BA6F0EB4EAFE231F0899D21A8863A05F
492inis_ex_sha2.exeC:\Users\admin\AppData\Local\Temp\nsx2FB.tmp\UAC.LNGtext
MD5:1E72C0B7743619809B7CDA824D2A1ECF
SHA256:F2E214452E69EDAF602E30D06EE186D072B1D2EC04B813B458C1E31B56ECE16B
492inis_ex_sha2.exeC:\Windows\system32\msvcr71.dllexecutable
MD5:F06F36C0E55E5B4312792D6FCACC8042
SHA256:2404659784ADE7F874FEEFBB4816DB4E42852EDE0693FB2A7B45145501EA24CD
492inis_ex_sha2.exeC:\Users\admin\AppData\Local\Temp\nsx2FB.tmp\ISF_NSIS_UTIL.dllexecutable
MD5:AAC840CE7EE259B8A65FEF69FBDAC041
SHA256:6C8DE3CC00601F9729177FDC750B73C36DAD0592846FA1D24FF61A2290DD949E
492inis_ex_sha2.exeC:\Program Files\NPKI\KISA\BFB627D8035A76654C6101415631E58B7B3AD9CC_4.derbinary
MD5:689B17C654E0E0E099551642F75A86D8
SHA256:6FDB3F76C8B801A75338D8A50A7C02879F6198B57E594D318D3832900FEDCD79
492inis_ex_sha2.exeC:\Windows\Application Data\initech\KeyContainer\CACert\562174c6.0text
MD5:A1FE41D8EA24BC735939D9B6EA44E89A
SHA256:C3E094E5188063E89ADF117523EE3CBF3198A7A4E579F8ED5CB502DF5103E95E
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
0
TCP/UDP connections
11
DNS requests
16
Threats
0

HTTP requests

No HTTP requests
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:138
—
—
—
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
1080
svchost.exe
224.0.0.252:5355
—
—
—
unknown
2884
chrome.exe
142.250.184.227:443
clientservices.googleapis.com
GOOGLE
US
whitelisted
2260
chrome.exe
239.255.255.250:1900
—
—
—
whitelisted
2884
chrome.exe
66.102.1.84:443
accounts.google.com
GOOGLE
US
unknown
2884
chrome.exe
142.250.186.36:443
www.google.com
GOOGLE
US
whitelisted
2884
chrome.exe
142.250.186.35:443
www.gstatic.com
GOOGLE
US
whitelisted
2884
chrome.exe
142.250.186.174:443
apis.google.com
GOOGLE
US
whitelisted
2884
chrome.exe
142.250.186.170:443
www.googleapis.com
GOOGLE
US
whitelisted

DNS requests

Domain
IP
Reputation
clientservices.googleapis.com
  • 142.250.184.227
whitelisted
accounts.google.com
  • 66.102.1.84
shared
www.google.com
  • 142.250.186.36
whitelisted
www.gstatic.com
  • 142.250.186.35
whitelisted
apis.google.com
  • 142.250.186.174
whitelisted
www.googleapis.com
  • 142.250.186.170
  • 142.250.184.202
  • 172.217.18.10
  • 172.217.16.202
  • 216.58.206.42
  • 142.250.186.42
  • 172.217.18.106
  • 142.250.74.202
  • 172.217.16.138
  • 216.58.212.138
  • 142.250.181.234
  • 172.217.23.106
  • 142.250.185.74
  • 142.250.186.138
  • 216.58.212.170
  • 142.250.184.234
whitelisted
update.googleapis.com
  • 142.250.184.227
whitelisted

Threats

No threats detected
Process
Message
inis_ex_sha2.exe
!@!@!@!@ ISF_NSIS_UTIL::KillProcessByFileShortName Not Existing process: INISAFECROSSWEBEXSVC.EXE
inis_ex_sha2.exe
!@!@!@!@ ISF_NSIS_UTIL::KillProcessByFileShortName Not Existing process: INISAFEADMINUTIL.EXE
inis_ex_sha2.exe
[INISAFEWebV6] ExitInstance() called
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
inis_ex_sha2.exe