newdev.exe

  • File Path: C:\WINDOWS\SysWOW64\newdev.exe
  • Description: Device driver software installation

Hashes

Type Hash
MD5 C1AFA24687E6391D95BA8F6037A2F1EA
SHA1 951B93F585A625F4663CC6DB4C616DB123846171
SHA256 FF5C20B5A87F5083F56919E2B114A55D1C09F6285F67F07DF94532AD46FEE609
SHA384 286A6F7E8AC4E7F16DFBC17F14A9E3B604AB1DE4E24D917F208B145AAC381807FC538E1C9E002C46539C257D75B28322
SHA512 200F86370B514B9D13CB6D2085FC13409FCF6A5D032402D2832C9EDC723770BE5B8D0D05EB1CBBA1C0CDC7EC7CF334C7E0AC924860EEF766D99DD807A3577E86
SSDEEP 1536:nadrJZgsMP2yaJfFrGUUUUUUUUUUUU3+mD:nadrAwtJh
IMP 47B5D71FCA8DDB68A11E75B237548ED2
PESHA1 AE26140BE905028B69C7B6CD1BCBF93E25EE8387
PE256 D711574E5168E63CD58D49819FAD63E3D55FB583C61C0844F14927123B6E1080

Runtime Data

Loaded Modules:

Path
C:\WINDOWS\SYSTEM32\ntdll.dll
C:\WINDOWS\System32\wow64.dll
C:\WINDOWS\System32\wow64base.dll
C:\WINDOWS\System32\wow64con.dll
C:\WINDOWS\System32\wow64cpu.dll
C:\WINDOWS\System32\wow64win.dll
C:\WINDOWS\SysWOW64\newdev.exe

Signature

  • Status: Signature verified.
  • Serial: 33000002ED2C45E4C145CF48440000000002ED
  • Thumbprint: 312860D2047EB81F8F58C29FF19ECDB4C634CF6A
  • Issuer: CN=Microsoft Windows Production PCA 2011, O=Microsoft Corporation, L=Redmond, S=Washington, C=US
  • Subject: CN=Microsoft Windows, O=Microsoft Corporation, L=Redmond, S=Washington, C=US

File Metadata

  • Original Filename: NewDev.EXE
  • Product Name: Microsoft Windows Operating System
  • Company Name: Microsoft Corporation
  • File Version: 5.2.3668.0
  • Product Version: 5.2.3668.0
  • Language: English (United States)
  • Legal Copyright: Microsoft Corporation. All rights reserved.
  • Machine Type: 32-bit

File Scan

  • VirusTotal Detections: 0/74
  • VirusTotal Link: https://www.virustotal.com/gui/file/ff5c20b5a87f5083f56919e2b114a55d1c09f6285f67f07df94532ad46fee609/detection

File Similarity (ssdeep match)

File Score
C:\Windows\system32\ndadmin.exe 46
C:\Windows\system32\ndadmin.exe 44
C:\Windows\system32\ndadmin.exe 54
C:\WINDOWS\system32\ndadmin.exe 47
C:\WINDOWS\system32\ndadmin.exe 47
C:\Windows\system32\ndadmin.exe 44
C:\Windows\system32\ndadmin.exe 49
C:\Windows\system32\newdev.exe 47
C:\WINDOWS\system32\newdev.exe 57
C:\Windows\system32\newdev.exe 50
C:\Windows\system32\newdev.exe 54
C:\Windows\system32\newdev.exe 47
C:\WINDOWS\system32\newdev.exe 57
C:\Windows\system32\newdev.exe 54
C:\Windows\system32\pnpclean.dll 27
C:\Windows\SysWOW64\ndadmin.exe 55
C:\Windows\SysWOW64\ndadmin.exe 50
C:\Windows\SysWOW64\ndadmin.exe 50
C:\Windows\SysWOW64\ndadmin.exe 50
C:\Windows\SysWOW64\ndadmin.exe 47
C:\WINDOWS\SysWOW64\ndadmin.exe 47
C:\WINDOWS\SysWOW64\ndadmin.exe 43
C:\Windows\SysWOW64\newdev.exe 57
C:\Windows\SysWOW64\newdev.exe 52
C:\Windows\SysWOW64\newdev.exe 57
C:\Windows\SysWOW64\newdev.exe 57
C:\WINDOWS\SysWOW64\newdev.exe 55
C:\Windows\SysWOW64\newdev.exe 57

MIT License. Copyright (c) 2020-2021 Strontic.