newdev.exe

  • File Path: C:\WINDOWS\system32\newdev.exe
  • Description: Device driver software installation

Hashes

Type Hash
MD5 D7425D6AA990E713D253028B1C0FCCF0
SHA1 CAE8E1AD5AB5E8F29A23D44A3D8EA0F441DB1F0D
SHA256 9053A49BB54E13CE6EDD8FCEBA260E5F876975B7DC7AC379DD0A78D7FC39ACFA
SHA384 2D081FBC6C49F6DDDBE0FF93E89B953C8415AB204800759135A72E478C63D852F322990EE07A6D93CC340FF7A3ABC0BD
SHA512 4B973D1DD09CEFAECEA43AF7EA0F172DF56A6B8541657A86E546F042721B0A0DDAB1F48E2E6FA9E36F4D37D21D4FF6D4FA8E061E2FABC7D0AEF34A5EFB8B6B0B
SSDEEP 768:Crdv9Vm1wfaNmGiA2zCJQAhtqIrn8+1hrpFIUUUUUUUUUUUUqRcxM:GdvHJCmGr2zCJfFrGUUUUUUUUUUUU3+
IMP FDB0AAC8AE8648B09599FA21E577D5B2
PESHA1 99352CE80E9BC00BE5FC8F1FEADA9303328AAE9C
PE256 7AA1BE86D2ACF6138407B73F1F424BA681D9F86E89E0C473C6F1A3B7951036C5

Runtime Data

Loaded Modules:

Path
C:\WINDOWS\System32\combase.dll
C:\WINDOWS\System32\GDI32.dll
C:\WINDOWS\System32\gdi32full.dll
C:\WINDOWS\System32\KERNEL32.DLL
C:\WINDOWS\System32\KERNELBASE.dll
C:\WINDOWS\System32\msvcp_win.dll
C:\WINDOWS\System32\msvcrt.dll
C:\WINDOWS\system32\newdev.exe
C:\WINDOWS\SYSTEM32\ntdll.dll
C:\WINDOWS\System32\RPCRT4.dll
C:\WINDOWS\System32\ucrtbase.dll
C:\WINDOWS\System32\USER32.dll
C:\WINDOWS\System32\win32u.dll

Signature

  • Status: Signature verified.
  • Serial: 33000002ED2C45E4C145CF48440000000002ED
  • Thumbprint: 312860D2047EB81F8F58C29FF19ECDB4C634CF6A
  • Issuer: CN=Microsoft Windows Production PCA 2011, O=Microsoft Corporation, L=Redmond, S=Washington, C=US
  • Subject: CN=Microsoft Windows, O=Microsoft Corporation, L=Redmond, S=Washington, C=US

File Metadata

  • Original Filename: NewDev.EXE.MUI
  • Product Name: Microsoft Windows Operating System
  • Company Name: Microsoft Corporation
  • File Version: 5.2.3668.0
  • Product Version: 5.2.3668.0
  • Language: English (United States)
  • Legal Copyright: Microsoft Corporation. All rights reserved.
  • Machine Type: 64-bit

File Scan

  • VirusTotal Detections: 0/74
  • VirusTotal Link: https://www.virustotal.com/gui/file/9053a49bb54e13ce6edd8fceba260e5f876975b7dc7ac379dd0a78d7fc39acfa/detection

File Similarity (ssdeep match)

File Score
C:\Windows\system32\ndadmin.exe 65
C:\Windows\system32\ndadmin.exe 63
C:\Windows\system32\ndadmin.exe 63
C:\WINDOWS\system32\ndadmin.exe 63
C:\WINDOWS\system32\ndadmin.exe 63
C:\Windows\system32\ndadmin.exe 63
C:\Windows\system32\ndadmin.exe 61
C:\Windows\system32\newdev.exe 54
C:\WINDOWS\system32\newdev.exe 55
C:\Windows\system32\newdev.exe 55
C:\Windows\system32\newdev.exe 58
C:\Windows\system32\newdev.exe 54
C:\Windows\system32\newdev.exe 49
C:\Windows\system32\pnpclean.dll 27
C:\Windows\SysWOW64\ndadmin.exe 63
C:\Windows\SysWOW64\ndadmin.exe 63
C:\Windows\SysWOW64\ndadmin.exe 65
C:\Windows\SysWOW64\ndadmin.exe 65
C:\Windows\SysWOW64\ndadmin.exe 66
C:\WINDOWS\SysWOW64\ndadmin.exe 68
C:\WINDOWS\SysWOW64\ndadmin.exe 63
C:\Windows\SysWOW64\newdev.exe 69
C:\Windows\SysWOW64\newdev.exe 69
C:\Windows\SysWOW64\newdev.exe 65
C:\Windows\SysWOW64\newdev.exe 65
C:\WINDOWS\SysWOW64\newdev.exe 57
C:\WINDOWS\SysWOW64\newdev.exe 55
C:\Windows\SysWOW64\newdev.exe 66

MIT License. Copyright (c) 2020-2021 Strontic.