home

NexessNTLM.EXE

NexessNTLM 응용 프로그램

Initech, Inc.

It is set to automatically execute when any user logs into Windows (through the local user run registry setting) with the name ‘SSOOutLookAgent’.
Publisher:
Initech, Inc.  (signed and verified)

Product:
NexessNTLM 응용 프로그램

Description:
NexessNTLM MFC 응용 프로그램

Version:
1, 0, 0, 1

MD5:
4996b4c6be404cfa44f3536b1872006d

SHA-1:
518f09cc9d68b5e2a2c4faff5a0b1bd5fc4ba7ee

SHA-256:
afd5a012834f90336c00b5a6ab968445ca173fa6d6844f90c538af91e581e261

Scanner detections:
0 / 68

Status:
Clean (as of last analysis)

Analysis date:
5/10/2024 1:49:41 PM UTC  (today)

File size:
25.9 KB (26,488 bytes)

Product version:
1, 0, 0, 1

Copyright:
Copyright (C) 2010

Original file name:
NexessNTLM.EXE

File type:
Executable application (Win32 EXE)

Common path:
C:\Program Files\initech\nexessclient\nexessntlm.exe

Digital Signature
Signed by:
Initech, Inc.

Authority:
VeriSign, Inc.

Valid from:
4/20/2010 6:00:00 PM

Valid to:
6/20/2011 5:59:59 PM

Subject:
CN="Initech, Inc.", OU=Digital ID Class 3 - Microsoft Software Validation v2, O="Initech, Inc.", L=Guro-gu, S=Seoul, C=KR

Issuer:
CN=VeriSign Class 3 Code Signing 2009-2 CA, OU=Terms of use at https://www.verisign.com/rpa (c)09, OU=VeriSign Trust Network, O="VeriSign, Inc.", C=US

Serial number:
48736475969AB79A13F0AE8C51A7A0B9

File PE Metadata
Compilation timestamp:
8/19/2010 1:26:20 AM

OS version:
4.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
6.0

CTPH (ssdeep):
192:s9EUP3n9k9Q/a5bUkfUnPnPnRP1oynApivVyeVK6yowJL/WKSjm+ebCf5KQpkqsE:s7n9k9Ql91SpdeVK6YJLGEbCBY1q

Entry address:
0x1C90

Entry point:
55, 8B, EC, 6A, FF, 68, 78, 25, 40, 00, 68, 16, 1E, 40, 00, 64, A1, 00, 00, 00, 00, 50, 64, 89, 25, 00, 00, 00, 00, 83, EC, 68, 53, 56, 57, 89, 65, E8, 33, DB, 89, 5D, FC, 6A, 02, FF, 15, D0, 21, 40, 00, 59, 83, 0D, EC, 31, 40, 00, FF, 83, 0D, F0, 31, 40, 00, FF, FF, 15, D4, 21, 40, 00, 8B, 0D, E0, 31, 40, 00, 89, 08, FF, 15, D8, 21, 40, 00, 8B, 0D, DC, 31, 40, 00, 89, 08, A1, DC, 21, 40, 00, 8B, 00, A3, E8, 31, 40, 00, E8, 16, 01, 00, 00, 39, 1D, 00, 31, 40, 00, 75, 0C, 68, 12, 1E, 40, 00, FF, 15, E0, 21...
 
[+]

Entropy:
4.5394

Developed / compiled with:
Microsoft Visual C++ v6.0

Code size:
4 KB (4,096 bytes)

Startup File (All Users Run)
Registry location:
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

Name:
SSOOutLookAgent

Command:
C:\Program Files\initech\nexessclient\nexessntlm.exe


Scan NexessNTLM.EXE - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.