Nomad[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
Nomad.exe
Size 30.0MB
Sample260717-jc985aes8m
SHA256 6504febe0fe3212c2447e8dc96f5b99da5833e36729a637ba650d08322252ae4
MD5 e6ecb0ac93a7f97b045a15748fec2cfe
SHA1 fa103b746d31f9a353257aa7fa85263d5e5d3cb0
SHA512 24b766a1a9a51811cdb607bfc257a2ae1f575a1d6e738e77a7fd42d3f662d51b562b51b784fbc00035d678d16298dc59268a848e32504432d81633cb89cfffde
SSDEEP 393216:sbDwKcqZI+erc0pZlh8elmZi6+hz1E/9MdbueWwzk+Ri5YZMXEnDB1GIvMKQriNF:sbDzZi6vYZMXsB15PNA0EI7tQ5QJdOW
TLSH
T10A678C4BF2A6A4DCD46AC1B242467732FA317C5547206DEB12E09B302F79AE05F7EB14
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

Malware Config

Signatures

Codesign digest Mismatch 1 IoCs

File was altered after it was signed.

resource
Nomad.exe

File Explorer

Nomad.exe

.exe 30.0MB

Nomad.exe

IMPHASH 2a3424100d09609f9090cb774deb1bf7
SHA256 6504febe0fe3212c2447e8dc96f5b99da5833e36729a637ba650d08322252ae4
MD5 e6ecb0ac93a7f97b045a15748fec2cfe
SHA1 fa103b746d31f9a353257aa7fa85263d5e5d3cb0
SHA512 24b766a1a9a51811cdb607bfc257a2ae1f575a1d6e738e77a7fd42d3f662d51b562b51b784fbc00035d678d16298dc59268a848e32504432d81633cb89cfffde
SSDEEP 393216:sbDwKcqZI+erc0pZlh8elmZi6+hz1E/9MdbueWwzk+Ri5YZMXEnDB1GIvMKQriNF:sbDzZi6vYZMXsB15PNA0EI7tQ5QJdOW
TLSH
T10A678C4BF2A6A4DCD46AC1B242467732FA317C5547206DEB12E09B302F79AE05F7EB14
MD5 SHA1 SHA512 SSDEEP TLSH

Codesign digest Mismatch

File was altered after it was signed.

PE Signature issue

Digest

9e:1d:8e:f3:5b:0e:1b:e4:0e:7d:93:ae:58:8c:96:09:75:60:4a:48:80:6a:28:b4:bc:06:28:ee:1b:cf:69:0f

Digest Algorithm

sha256

PE Digests Matches

Not matched

Trusted

Signing Certificate

SERIALNUMBER=908 683 857,CN=Hexanomad SAS,O=Hexanomad SAS,L=Paris,C=FR,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.1=#13055061726973,1.3.6.1.4.1.311.60.2.1.2=#0c0ec38e6c652d64652d4672616e6365,1.3.6.1.4.1.311.60.2.1.3=#13024652

Chains

Jan 24, 2026

CN=DigiCert Trusted G4 Code Signing Europe RSA4096 SHA384 2023 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Trusted G4 Code Signing Europe RSA4096 SHA384 2023 CA1,O=DigiCert\, Inc.,C=US

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Subject

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Serial Number

0d:c7:ac:57:05:ff:21:99:2e:40:43:22:0c:3a:49:86

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

May 7, 2025 - Jan 14, 2038

Subject

CN=DigiCert Trusted G4 Code Signing Europe RSA4096 SHA384 2023 CA1,O=DigiCert\, Inc.,C=US

Serial Number

07:60:2c:bf:6e:75:79:40:03:82:56:f0:ad:87:5e:d6

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Feb 14, 2023 - Feb 13, 2033

Subject

CN=DigiCert SHA256 RSA4096 Timestamp Responder 2025 1,O=DigiCert\, Inc.,C=US

Serial Number

0a:80:ef:18:4b:8d:f1:05:82:d1:c4:76:a7:95:74:68

Issuer

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jun 4, 2025 - Sep 3, 2036

Subject

Serial Number

04:ba:92:ad:80:36:ff:32:50:02:38:70:12:55:2a:95

Issuer

CN=DigiCert Trusted G4 Code Signing Europe RSA4096 SHA384 2023 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jun 6, 2025 - Jun 5, 2028

Minor OS version

Major OS version

Entry point

4096

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

/Users/steph/Documents/nomad/build-win/Nomad.pdb

dbghelp

SymCleanup SymFromAddr SymGetLineFromAddr64 SymInitialize

dwmapi

DwmSetWindowAttribute

winmm

timeBeginPeriod timeEndPeriod

xremeshlib

QRLib_addCurve QRLib_doQuadRemeshing QRLib_end QRLib_endInputMesh QRLib_endOneRemeshing QRLib_isStarted QRLib_setFaces_AllocMem QRLib_setInputMesh QRLib_setOutputCallback QRLib_setPointColors_AllocMem QRLib_setPoints_AllocMem QRLib_setPolygonGroups_AllocMem QRLib_setProgressCallback QRLib_setRemeshSettings QRLib_setUVs_AllocMem QRLib_start QRLib_startInputMesh QRLib_startOneRemeshing

winsparkle

win_sparkle_check_update_with_ui win_sparkle_cleanup win_sparkle_get_automatic_check_for_updates win_sparkle_init win_sparkle_set_app_details win_sparkle_set_appcast_url win_sparkle_set_automatic_check_for_updates win_sparkle_set_can_shutdown_callback win_sparkle_set_eddsa_public_key win_sparkle_set_shutdown_request_callback

openimagedenoise

oidnCommitDevice oidnCommitFilter oidnExecuteFilterAsync oidnGetBufferData oidnGetDeviceError oidnNewBufferWithStorage oidnNewDevice oidnNewFilter oidnReleaseBuffer oidnReleaseDevice oidnReleaseFilter oidnSetFilterImage oidnSetFilterInt oidnSetFilterProgressMonitorFunction oidnSyncDevice

kernel32

AcquireSRWLockExclusive AcquireSRWLockShared AttachConsole Beep CloseHandle CompareFileTime ConvertFiberToThread ConvertThreadToFiberEx CreateEventExA CreateEventExW CreateFiber CreateFiberEx CreateFileMappingA CreateFileW CreateMutexExA CreateProcessW CreateSemaphoreExA CreateSemaphoreExW CreateThread DeleteCriticalSection DeleteFiber EnterCriticalSection FindClose FindFirstFileW FindNextFileW FlsAlloc FlsGetValue FlsSetValue FormatMessageA FormatMessageW FreeLibrary GetACP GetComputerNameW GetConsoleCP GetConsoleMode GetConsoleOutputCP GetConsoleWindow GetCurrentProcess GetCurrentProcessId GetCurrentThread GetCurrentThreadId GetEnvironmentVariableA GetEnvironmentVariableW GetExitCodeThread GetFileAttributesW GetFileSizeEx GetFileType GetFullPathNameW GetLastError GetModuleFileNameA GetModuleFileNameW GetModuleHandleA GetModuleHandleExA GetModuleHandleExW GetModuleHandleW GetNativeSystemInfo GetProcAddress GetProcessAffinityMask GetStartupInfoW GetStdHandle GetSystemDirectoryA GetSystemInfo GetSystemTime GetSystemTimeAsFileTime GetThreadId GetTickCount GetVersion GlobalAlloc GlobalFree GlobalLock GlobalMemoryStatusEx GlobalUnlock InitOnceExecuteOnce InitializeConditionVariable InitializeCriticalSection InitializeCriticalSectionEx InitializeSRWLock IsProcessorFeaturePresent IsThreadAFiber LeaveCriticalSection LoadLibraryA LoadLibraryW LocalFree MapViewOfFile MoveFileExA MoveFileExW MulDiv MultiByteToWideChar QueryPerformanceCounter QueryPerformanceFrequency RaiseException ReadConsoleA ReadConsoleW ReleaseMutex ReleaseSRWLockExclusive ReleaseSRWLockShared ReleaseSemaphore ResumeThread RtlCaptureContext RtlCaptureStackBackTrace RtlLookupFunctionEntry RtlRestoreContext RtlUnwindEx RtlVirtualUnwind SetConsoleCP SetConsoleMode SetConsoleOutputCP SetEvent SetLastError SetThreadExecutionState SetThreadPriority SetUnhandledExceptionFilter Sleep SleepConditionVariableCS SleepConditionVariableSRW SleepEx SwitchToFiber SwitchToThread SystemTimeToFileTime TerminateProcess TlsAlloc TlsFree TlsGetValue TlsSetValue TryAcquireSRWLockExclusive TryEnterCriticalSection UnmapViewOfFile VerSetConditionMask VerifyVersionInfoW VirtualAlloc VirtualFree VirtualLock VirtualProtect VirtualQuery WaitForSingleObject WaitForSingleObjectEx WakeAllConditionVariable WakeConditionVariable WideCharToMultiByte WriteConsoleW WriteFile __C_specific_handler lstrcmpA

user32

AdjustWindowRectEx BringWindowToTop CallWindowProcA ChangeDisplaySettingsExW ChangeWindowMessageFilterEx ClientToScreen ClipCursor CloseClipboard CreateIconIndirect CreateWindowExW DefWindowProcW DestroyIcon DestroyWindow DialogBoxIndirectParamW DispatchMessageW EmptyClipboard EnableMouseInPointer EndDialog EnumChildWindows EnumDisplayDevicesW EnumDisplayMonitors EnumDisplaySettingsExW EnumDisplaySettingsW EnumWindows FlashWindow GetActiveWindow GetClassLongPtrW GetClassNameW GetClientRect GetClipboardData GetCursorPos GetDC GetDlgItem GetDlgItemTextW GetForegroundWindow GetKeyState GetKeyboardState GetLayeredWindowAttributes GetMessageExtraInfo GetMessageTime GetMonitorInfoW GetPointerInfo GetPointerPenInfo GetPointerTouchInfo GetPointerType GetProcessWindowStation GetPropW GetRawInputData GetRawInputDeviceInfoA GetRawInputDeviceList GetSystemMetrics GetUserObjectInformationW GetWindowLongW GetWindowPlacement GetWindowRect GetWindowTextW IsIconic IsWindowVisible IsZoomed LoadCursorW LoadImageW MapVirtualKeyW MessageBeep MessageBoxA MessageBoxW MonitorFromPoint MonitorFromWindow MoveWindow MsgWaitForMultipleObjects OffsetRect OpenClipboard PeekMessageW PostMessageW PtInRect RegisterClassExW RegisterDeviceNotificationW RegisterRawInputDevices ReleaseCapture ReleaseDC RemovePropW ScreenToClient SendInput SendMessageA SendMessageW SetCapture SetClipboardData SetCursor SetCursorPos SetDlgItemTextW SetFocus SetForegroundWindow SetGestureConfig SetLayeredWindowAttributes SetProcessDPIAware SetPropW SetRect SetWindowLongPtrA SetWindowLongW SetWindowPlacement SetWindowPos SetWindowTextW ShowWindow SystemParametersInfoW ToUnicode TrackMouseEvent TranslateMessage UnregisterClassW UnregisterDeviceNotification WaitForInputIdle WaitMessage WindowFromPoint

gdi32

ChoosePixelFormat CreateBitmap CreateDCW CreateDIBSection CreateFontIndirectW CreateRectRgn DeleteDC DeleteObject DescribePixelFormat GetDeviceCaps GetDeviceGammaRamp GetTextMetricsW SelectObject SetDeviceGammaRamp SetPixelFormat SwapBuffers

shell32

DragAcceptFiles DragFinish DragQueryFileW DragQueryPoint SHBrowseForFolderW SHChangeNotify SHCreateItemFromParsingName SHGetKnownFolderPath SHGetPathFromIDListW

ole32

CoCreateInstance CoInitializeEx CoTaskMemFree CoUninitialize

comdlg32

ChooseColorW GetOpenFileNameW GetSaveFileNameW

advapi32

CryptAcquireContextA CryptAcquireContextW CryptCreateHash CryptDestroyHash CryptGenRandom CryptGetHashParam CryptHashData CryptReleaseContext DeregisterEventSource RegCloseKey RegCreateKeyExW RegOpenKeyExA RegQueryValueExA RegSetValueExW RegisterEventSourceW ReportEventW

api-ms-win-crt-stdio-l1-1-0

__acrt_iob_func __p__commode __p__fmode __stdio_common_vfprintf __stdio_common_vfscanf __stdio_common_vfwprintf __stdio_common_vsnprintf_s __stdio_common_vsprintf __stdio_common_vsscanf __stdio_common_vswprintf _close _fileno _fseeki64 _ftelli64 _getcwd _lseek _pclose _popen _read _setmode _sopen_s _wfopen _wfopen_s _wfreopen_s _write fclose feof ferror fflush fgetc fgetpos fgets fgetwc fopen fopen_s fputc fputs fputwc fputws fread freopen freopen_s fseek fsetpos ftell fwrite getc puts rewind setbuf setvbuf ungetc ungetwc

api-ms-win-crt-heap-l1-1-0

_aligned_free _aligned_malloc _set_new_mode calloc free malloc realloc

api-ms-win-crt-runtime-l1-1-0

_assert __p___argc __p___argv __sys_nerr _beginthreadex _cexit _configure_narrow_argv _control87 _crt_atexit _endthreadex _errno _exit _getpid _initialize_narrow_environment _initterm _initterm_e _register_thread_local_exe_atexit_callback _set_app_type _set_invalid_parameter_handler abort exit raise signal strerror strerror_s system

api-ms-win-crt-conio-l1-1-0

_getch

api-ms-win-crt-filesystem-l1-1-0

_findclose _fullpath _lock_file _stat64 _stat64i32 _unlink _unlock_file _wfindfirst64 _wfindnext64 _wfullpath _wmkdir _wremove _wrmdir _wstat64 remove

api-ms-win-crt-string-l1-1-0

_isctype_l _iswalpha_l _iswcntrl_l _iswdigit_l _iswlower_l _iswprint_l _iswpunct_l _iswspace_l _iswupper_l _iswxdigit_l _strcoll_l _strdup _strxfrm_l _tolower_l _toupper_l _towlower_l _towupper_l _wcscoll_l _wcsdup _wcsxfrm_l isalpha isspace isxdigit mbrlen memset strcat strcmp strcpy strcspn strlen strncat strncmp strncpy strncpy_s strnlen strpbrk strspn strtok tolower toupper wcscat wcscmp wcscpy wcscpy_s wcslen wcsncmp wcsncpy wcsncpy_s wcsnlen

api-ms-win-crt-environment-l1-1-0

__p__environ _wgetenv getenv

api-ms-win-crt-locale-l1-1-0

___lc_codepage_func ___mb_cur_max_func __pctype_func _configthreadlocale _create_locale _free_locale localeconv setlocale

api-ms-win-crt-time-l1-1-0

_ctime64 _gmtime64 _localtime64 _mktime64 _strftime_l _time64 _utime64 asctime strftime

api-ms-win-crt-math-l1-1-0

__setusermatherr _fdopen acos acosf acoshf asin asinf atan atan2 atan2f atanf cos cosf coshf exp exp2 exp2f expf fma fmod fmodf frexp hypot log log10 log10f log2 log2f logf nextafter nextafterf pow powf remquo sin sinf sinhf sqrt sqrtf tan tanf

api-ms-win-crt-convert-l1-1-0

_strtod_l _strtoi64_l _strtoui64_l atof atoi mbrtowc mbsrtowcs mbstowcs_s strtod strtof strtol strtoll strtoul strtoull wcrtomb wcrtomb_s wcstod wcstol wcstoll wcstombs wcstombs_s wcstoul wcstoull

api-ms-win-crt-private-l1-1-0

memchr memcmp memcpy memmove strchr strrchr strstr wcschr wcsrchr wcsstr

api-ms-win-crt-utility-l1-1-0

qsort rand rand_s srand

api-ms-win-crt-multibyte-l1-1-0

_mbtowc_l

ws2_32

WSACleanup WSACloseEvent WSACreateEvent WSAEnumNetworkEvents WSAEventSelect WSAGetLastError WSAIoctl WSAResetEvent WSASetEvent WSASetLastError WSASocketA WSAStartup WSAWaitForMultipleEvents __WSAFDIsSet accept bind closesocket connect freeaddrinfo getaddrinfo gethostbyaddr gethostbyname getpeername getservbyname getservbyport getsockname getsockopt htonl htons inet_addr inet_ntoa ioctlsocket listen ntohs recv recvfrom select send sendto setsockopt shutdown socket

iphlpapi

if_nametoindex

crypt32

CertCloseStore CertEnumCertificatesInStore CertFindCertificateInStore CertFreeCertificateContext CertGetEnhancedKeyUsage CertGetIntendedKeyUsage CertOpenSystemStoreA CertOpenSystemStoreW

bcrypt

BCryptGenRandom

AmdPowerXpressRequestHighPerformance NvOptimusEnablement _ZN3tbb6detail2r110deallocateERNS0_2d117small_object_poolEPvy _ZN3tbb6detail2r110deallocateERNS0_2d117small_object_poolEPvyRKNS2_14execution_dataE _ZN3tbb6detail2r110initializeERNS0_2d115task_arena_baseE _ZN3tbb6detail2r110initializeERNS0_2d118task_group_contextE _ZN3tbb6detail2r112itt_task_endENS0_2d115itt_domain_enumE _ZN3tbb6detail2r114execution_slotEPKNS0_2d114execution_dataE _ZN3tbb6detail2r114execution_slotERKNS0_2d115task_arena_baseE _ZN3tbb6detail2r114itt_region_endENS0_2d115itt_domain_enumEPvy _ZN3tbb6detail2r114itt_task_beginENS0_2d115itt_domain_enumEPvyS4_yNS0_2d021string_resource_indexE _ZN3tbb6detail2r114notify_waitersEy _ZN3tbb6detail2r115allocate_memoryEy _ZN3tbb6detail2r115cache_line_sizeEv _ZN3tbb6detail2r115call_itt_notifyEiPv _ZN3tbb6detail2r115core_type_countEx _ZN3tbb6detail2r115create_itt_syncEPvPKwS4_ _ZN3tbb6detail2r115current_contextEv _ZN3tbb6detail2r115max_concurrencyEPKNS0_2d115task_arena_baseE _ZN3tbb6detail2r115numa_node_countEv _ZN3tbb6detail2r115throw_exceptionENS0_2d012exception_idE _ZN3tbb6detail2r115wait_on_addressEPvRNS0_2d113delegate_baseEy _ZN3tbb6detail2r116current_task_ptrEv _ZN3tbb6detail2r116execute_and_waitERNS0_2d14taskERNS2_18task_group_contextERNS2_12wait_contextES6_ _ZN3tbb6detail2r116itt_region_beginENS0_2d115itt_domain_enumEPvyS4_yNS0_2d021string_resource_indexE _ZN3tbb6detail2r116itt_relation_addENS0_2d115itt_domain_enumEPvyNS0_2d012itt_relationES4_y _ZN3tbb6detail2r117assertion_failureEPKciS3_S3_ _ZN3tbb6detail2r117deallocate_memoryEPv _ZN3tbb6detail2r117fill_numa_indicesEPi _ZN3tbb6detail2r117is_tbbmalloc_usedEv _ZN3tbb6detail2r117itt_set_sync_nameEPvPKw _ZN3tbb6detail2r117notify_by_addressEPvy _ZN3tbb6detail2r119capture_fp_settingsERNS0_2d118task_group_contextE _ZN3tbb6detail2r119exit_parallel_phaseEPNS0_2d115task_arena_baseEy _ZN3tbb6detail2r119itt_make_task_groupENS0_2d115itt_domain_enumEPvyS4_yNS0_2d021string_resource_indexE _ZN3tbb6detail2r120enter_parallel_phaseEPNS0_2d115task_arena_baseEy _ZN3tbb6detail2r120isolate_within_arenaERNS0_2d113delegate_baseEx _ZN3tbb6detail2r120itt_metadata_ptr_addENS0_2d115itt_domain_enumEPvyNS0_2d021string_resource_indexES4_ _ZN3tbb6detail2r120itt_metadata_str_addENS0_2d115itt_domain_enumEPvyNS0_2d021string_resource_indexEPKc _ZN3tbb6detail2r121current_suspend_pointEv _ZN3tbb6detail2r121get_assertion_handlerEv _ZN3tbb6detail2r121notify_by_address_allEPv _ZN3tbb6detail2r121notify_by_address_oneEPv _ZN3tbb6detail2r121set_assertion_handlerEPFvPKciS3_S3_E _ZN3tbb6detail2r122cache_aligned_allocateEy _ZN3tbb6detail2r122cancel_group_executionERNS0_2d118task_group_contextE _ZN3tbb6detail2r122fill_core_type_indicesEPix _ZN3tbb6detail2r124cache_aligned_deallocateEPv _ZN3tbb6detail2r124numa_default_concurrencyEi _ZN3tbb6detail2r127get_thread_reference_vertexEPNS0_2d126wait_tree_vertex_interfaceE _ZN3tbb6detail2r127global_control_active_valueEi _ZN3tbb6detail2r128constraints_threads_per_coreERKNS0_2d111constraintsEx _ZN3tbb6detail2r128is_group_execution_cancelledERNS0_2d118task_group_contextE _ZN3tbb6detail2r131constraints_default_concurrencyERKNS0_2d111constraintsEx _ZN3tbb6detail2r13getERNS0_2d121task_scheduler_handleE _ZN3tbb6detail2r14waitERNS0_2d112wait_contextERNS2_18task_group_contextE _ZN3tbb6detail2r14waitERNS0_2d115task_arena_baseE _ZN3tbb6detail2r15resetERNS0_2d118task_group_contextE _ZN3tbb6detail2r15spawnERNS0_2d14taskERNS2_18task_group_contextE _ZN3tbb6detail2r15spawnERNS0_2d14taskERNS2_18task_group_contextEt _ZN3tbb6detail2r16attachERNS0_2d115task_arena_baseE _ZN3tbb6detail2r16createERNS0_2d114global_controlE _ZN3tbb6detail2r16resumeEPNS1_18suspend_point_typeE _ZN3tbb6detail2r16submitERNS0_2d14taskERNS2_18task_group_contextEPNS1_5arenaEy _ZN3tbb6detail2r17destroyERNS0_2d114global_controlE _ZN3tbb6detail2r17destroyERNS0_2d118task_group_contextE _ZN3tbb6detail2r17enqueueERNS0_2d14taskEPNS2_15task_arena_baseE _ZN3tbb6detail2r17enqueueERNS0_2d14taskERNS2_18task_group_contextEPNS2_15task_arena_baseE _ZN3tbb6detail2r17executeERNS0_2d115task_arena_baseERNS2_13delegate_baseE _ZN3tbb6detail2r17observeERNS0_2d123task_scheduler_observerEb _ZN3tbb6detail2r17suspendEPFvPvPNS1_18suspend_point_typeEES2_ _ZN3tbb6detail2r18allocateERPNS0_2d117small_object_poolEy _ZN3tbb6detail2r18allocateERPNS0_2d117small_object_poolEyRKNS2_14execution_dataE _ZN3tbb6detail2r18finalizeERNS0_2d121task_scheduler_handleEx _ZN3tbb6detail2r19terminateERNS0_2d115task_arena_baseE _ZNK3tbb6detail2r110user_abort4whatEv _ZNK3tbb6detail2r112missing_wait4whatEv _ZNK3tbb6detail2r114bad_last_alloc4whatEv _ZTVN3tbb6detail2r110user_abortE _ZTVN3tbb6detail2r111unsafe_waitE _ZTVN3tbb6detail2r112missing_waitE _ZTVN3tbb6detail2r114bad_last_allocE

Name

.text

Size

23.7MB

Virtual Size

23.7MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

4.7MB

Virtual Size

4.7MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.buildid

Size

512B

Virtual Size

101B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

150KB

Virtual Size

6.4MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

532KB

Virtual Size

532KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rodata

Size

183KB

Virtual Size

183KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

512B

Virtual Size

296B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

139KB

Virtual Size

138KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

134KB

Virtual Size

133KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

Size

25KB

Virtual Size

25KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/18

Size

512B

Virtual Size

48B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/58

Size

162KB

Virtual Size

162KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/70

Size

67KB

Virtual Size

66KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/82

Size

104KB

Virtual Size

104KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/33

Size

7KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/47

Size

147KB

Virtual Size

147KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

Nomad.exe

PE Signature issue

dbghelp

dwmapi

winmm

xremeshlib

winsparkle

openimagedenoise

kernel32

user32

gdi32

shell32

ole32

comdlg32

advapi32

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-conio-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-environment-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-private-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-multibyte-l1-1-0

ws2_32

iphlpapi

crypt32

bcrypt

generic