home

NexessNTLM.EXE

NexessNTLM 응용 프로그램

Initech, Inc.

It is set to automatically execute when any user logs into Windows (through the local user run registry setting) with the name ‘SSOOutLookAgent’.
Publisher:
Initech, Inc.  (signed and verified)

Product:
NexessNTLM 응용 프로그램

Description:
NexessNTLM MFC 응용 프로그램

Version:
1, 0, 0, 1

MD5:
70778578fe88a6eb3104fc899aecbbea

SHA-1:
e54b807bc47d19567b4ba8f376f06058a4170071

SHA-256:
c433fc568b02c5df0fbb3bae556092f5be4b81efe6706d820c4e8ebd454d4859

Scanner detections:
0 / 68

Status:
Clean (as of last analysis)

Analysis date:
4/27/2024 3:27:39 AM UTC  (today)

File size:
25.9 KB (26,488 bytes)

Product version:
1, 0, 0, 1

Copyright:
Copyright (C) 2010

Original file name:
NexessNTLM.EXE

File type:
Executable application (Win32 EXE)

Common path:
C:\Program Files\initech\nexessclient\nexessntlm.exe

Digital Signature
Signed by:
Initech, Inc.

Authority:
VeriSign, Inc.

Valid from:
4/21/2010 9:00:00 AM

Valid to:
6/21/2011 8:59:59 AM

Subject:
CN="Initech, Inc.", OU=Digital ID Class 3 - Microsoft Software Validation v2, O="Initech, Inc.", L=Guro-gu, S=Seoul, C=KR

Issuer:
CN=VeriSign Class 3 Code Signing 2009-2 CA, OU=Terms of use at https://www.verisign.com/rpa (c)09, OU=VeriSign Trust Network, O="VeriSign, Inc.", C=US

Serial number:
48736475969AB79A13F0AE8C51A7A0B9

File PE Metadata
Compilation timestamp:
6/25/2010 4:09:22 PM

OS version:
4.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
6.0

CTPH (ssdeep):
192:sJI/nFydDFGtQ/J5bktfUHfnqnRP1oynApyyVyeVKeyowJL/WKSjm+ebCf5KQpkk:sGFyd0tQpI1SpkeVKeYJLGEbCBY1Q

Entry address:
0x1C80

Entry point:
55, 8B, EC, 6A, FF, 68, 78, 25, 40, 00, 68, 06, 1E, 40, 00, 64, A1, 00, 00, 00, 00, 50, 64, 89, 25, 00, 00, 00, 00, 83, EC, 68, 53, 56, 57, 89, 65, E8, 33, DB, 89, 5D, FC, 6A, 02, FF, 15, D0, 21, 40, 00, 59, 83, 0D, DC, 31, 40, 00, FF, 83, 0D, E0, 31, 40, 00, FF, FF, 15, D4, 21, 40, 00, 8B, 0D, D0, 31, 40, 00, 89, 08, FF, 15, D8, 21, 40, 00, 8B, 0D, CC, 31, 40, 00, 89, 08, A1, DC, 21, 40, 00, 8B, 00, A3, D8, 31, 40, 00, E8, 16, 01, 00, 00, 39, 1D, F0, 30, 40, 00, 75, 0C, 68, 02, 1E, 40, 00, FF, 15, E0, 21...
 
[+]

Entropy:
4.5324

Developed / compiled with:
Microsoft Visual C++ v6.0

Code size:
4 KB (4,096 bytes)

Startup File (All Users Run)
Registry location:
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

Name:
SSOOutLookAgent

Command:
C:\Program Files\initech\nexessclient\nexessntlm.exe


Scan NexessNTLM.EXE - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.