ndadmin.exe

  • File Path: C:\Windows\SysWOW64\ndadmin.exe
  • Description: Device driver software installation

Hashes

Type Hash
MD5 8126A090A1F30D3C9A42F69D55E7E1EC
SHA1 3EF2BD44EE4F03ACB674C55D0D4C50414D9FB2CA
SHA256 3BF9B0D64AFB7250743BD8C5594D76F0DE70373314EDE370FDCDF83ACF929758
SHA384 DE81F1131334E9B6AAEF885838719D3FBD5AD0BD928F021EB7226483B3B5AF0F22010EBE6CF6B50C63B6B15A2B54D561
SHA512 48C59922C9E92D95398E451CD1329A6C4ECCE00D121B1412ED6B774874DBF1029444F5B92BFD5C33EB5121BD9850D3EA9692AD5636DC01AE80CCABD1B4BAA706
SSDEEP 768:3s5V3rJ3OZ0bjQAhtqIrn8+1hrpFIUUUUUUUUUUUUqRcxMhF:3sf3rZxbjfFrGUUUUUUUUUUUU3+h
IMP 402F875FFA8D12465311E99FF1B64065
PESHA1 DD106EA1A96BF3FD51D0BE61E328E3B6A77DA7A6
PE256 FE09B11F417CAA79846B67AC771C5A2D39E4BF3BD00CD72D70D123975EFC8DB8

Runtime Data

Loaded Modules:

Path
C:\Windows\SYSTEM32\ntdll.dll
C:\Windows\System32\wow64.dll
C:\Windows\System32\wow64cpu.dll
C:\Windows\System32\wow64win.dll
C:\Windows\SysWOW64\ndadmin.exe

Signature

  • Status: Signature verified.
  • Serial: 3300000266BD1580EFA75CD6D3000000000266
  • Thumbprint: A4341B9FD50FB9964283220A36A1EF6F6FAA7840
  • Issuer: CN=Microsoft Windows Production PCA 2011, O=Microsoft Corporation, L=Redmond, S=Washington, C=US
  • Subject: CN=Microsoft Windows, O=Microsoft Corporation, L=Redmond, S=Washington, C=US

File Metadata

  • Original Filename: NDAdmin.EXE
  • Product Name: Microsoft Windows Operating System
  • Company Name: Microsoft Corporation
  • File Version: 5.2.3668.0
  • Product Version: 5.2.3668.0
  • Language: English (United States)
  • Legal Copyright: Microsoft Corporation. All rights reserved.
  • Machine Type: 32-bit

File Scan

  • VirusTotal Detections: 0/69
  • VirusTotal Link: https://www.virustotal.com/gui/file/3bf9b0d64afb7250743bd8c5594d76f0de70373314ede370fdcdf83acf929758/detection/

File Similarity (ssdeep match)

File Score
C:\Windows\system32\ndadmin.exe 69
C:\Windows\system32\ndadmin.exe 69
C:\Windows\system32\ndadmin.exe 69
C:\WINDOWS\system32\ndadmin.exe 66
C:\WINDOWS\system32\ndadmin.exe 69
C:\Windows\system32\ndadmin.exe 65
C:\Windows\system32\ndadmin.exe 68
C:\Windows\system32\newdev.exe 49
C:\WINDOWS\system32\newdev.exe 46
C:\Windows\system32\newdev.exe 54
C:\Windows\system32\newdev.exe 47
C:\Windows\system32\newdev.exe 49
C:\WINDOWS\system32\newdev.exe 65
C:\Windows\system32\newdev.exe 47
C:\Windows\system32\pnpclean.dll 21
C:\Windows\SysWOW64\ndadmin.exe 74
C:\Windows\SysWOW64\ndadmin.exe 74
C:\Windows\SysWOW64\ndadmin.exe 74
C:\Windows\SysWOW64\ndadmin.exe 75
C:\WINDOWS\SysWOW64\ndadmin.exe 75
C:\WINDOWS\SysWOW64\ndadmin.exe 74
C:\Windows\SysWOW64\newdev.exe 71
C:\Windows\SysWOW64\newdev.exe 71
C:\Windows\SysWOW64\newdev.exe 71
C:\Windows\SysWOW64\newdev.exe 71
C:\WINDOWS\SysWOW64\newdev.exe 50
C:\WINDOWS\SysWOW64\newdev.exe 44
C:\Windows\SysWOW64\newdev.exe 66

MIT License. Copyright (c) 2020-2021 Strontic.