nvda.exe
NVDA application file version info
Program on Windows LOLRMM NVDA (Non-Visual Desktop Access) 2 known copies with hashes
A file of NVDA (Non-Visual Desktop Access)
LOLRMM lists a file named nvda.exe as NVDA (Non-Visual Desktop Access)’s. NVDA (Non-Visual Desktop Access) is a free, open-source screen reader that allows blind and vision impaired people to access and interact with the Windows operating system and many third party applications.
From LOLRMM (Apache 2.0), which lists the remote management tools intruders are known to use as well as administrators. It goes by the file’s name: a copy that is the file above is not necessarily NVDA (Non-Visual Desktop Access)’s.
Is it the real nvda.exe?
nvda_uiAccess.exe in the file’s header: a renamed copy still carries itC:\Program Files (x86)\NVDA\2 known copies
2021.2.0.23747 · C:\Program Files (x86)\NVDA\nvda.exe · signed by NV Access Limited
a4979cc7426f14976f5a9f57c3b19f49ae038ea5e98dd6cef7f0ea40aa8a70e22020.2.0.20631 · C:\Program Files (x86)\NVDA\nvda.exe · signed by NV Access Limited
06f97f3032b028b9f86f2dc602dbfee8176772cbec9c4d462c25238a1b4ef512From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.