File scan report
Verdict Low Risk
Is newhv.
No engine flags this rare, recently seen installer, but its signature claiming VisoDyne fails verification and several major engines returned no result, so the evidence is too…
Read the whole reasonShow less
Why not Safe? Its signature could not be verified and only 2 sources had seen it when we scanned it.
Limited evidence · Nothing points to a problem, but little confirms who made it.
Run this file only if it came from the publisher's official site and you expected it, and keep your security software enabled. Otherwise hold off until more evidence is available.
Good practice2 tips
Low Risk: no threat found, but we could not fully confirm this file.
Get it from the publisher's own website or app store, not from a re-upload or a link someone sent you.
Keep your security software on, and stop if the file does anything you didn't expect.
Reads the latest antivirus results for this file's hash. Nothing is uploaded.
Antivirus results
0 of 58 flagged
- Flagged 0
- No detection 58
- No result 17
- Code signing Signer not verified
- Test run Completed
- First seen 2mo ago
Chapter 02
Why we think so
4 points against it and 3 in its favour, checked against the scan evidence.
The reasoning behind this verdict
None of the 58 antivirus engines that checked it flagged this executable. However, its signature claims the publisher VisoDyne and fails verification against an untrusted root. The file is rare and recently observed, and several major engines could not analyse it. Neither a clean nor a hostile conclusion is well supported.
None of the 58 antivirus engines that checked it flagged the file, but several leading engines, including Kaspersky, ESET and BitDefender, returned failures instead of results. The embedded signature names VisoDyne but chains to an untrusted root, so it cannot confirm who built the file. The file has only two submitters and is under two months old, and no reference-database or community-rule results are available. The sandbox runs show the setup process contacting six IP addresses directly. They recorded no high-risk techniques, no injection targets and no persistence. Those IP contacts have no reputation check behind them, so they are neither cleared nor condemned.
What We Detected
None of the 58 antivirus engines that checked it flagged this 64-bit Windows executable. Several major antivirus engines, including Kaspersky, ESET, BitDefender, Avast and Ikarus, failed to return a result. The file carries a signature naming VisoDyne, but the signature fails verification because its certificate chain ends in an untrusted root. The file is rare, with two submitters, and was first seen on Aug 22, 2026.
Threat Behavior
The sandbox runs show the file running as a battery-monitor setup program and connecting to six IP addresses without recording a domain name. No contacted-host reputation result is available for those addresses. The runs recorded no high-risk techniques, no processes injected into, no persistence and no dropped files.
What To Do Now
Only run this installer if you obtained it directly from the publisher's official website and expected it. Keep your antivirus enabled. If you are unsure of its origin, rescan it later or upload it again once more data is available.
Where this verdict could be wrong2 caveats
- No engine flagged the file, and the sandbox runs recorded no high-risk techniques, injection targets or persistence, which fits an ordinary installer.
- One prior file sharing this import hash was judged malicious, but import hashes are shared across build frameworks, so this is a weak lead at most.
These are the assessment's weak points. If you believe one applies to your file, report the verdict and we'll re-review it.
- None of the 58 antivirus engines that checked it flagged the file
- The sandbox runs recorded no high-risk techniques, injection targets or persistence
- No packing or obfuscated code sections were detected
- The signature claims VisoDyne but fails verification against an untrusted root
- Rare and recently observed file with only two submitters
- Several major antivirus engines returned no result for this file
- Connected directly to six IP addresses without a recorded domain, and no reputation check was available for them
6 sources checked · 5 complete · 1 partial. See every source
Chapter 03
What it did in our test
It ran in our isolated test environment; no test environment rated what it did as risky.
Test run summary
Capture complete- 9sandbox rule tags
- 2spawned processes
- 6network contacts
- 0filesystem & mutex artifacts
What this file did when executed
This file was run in a sandbox and its runtime behaviour was observed.
Techniques observed in the sandbox
9MITRE ATT&CK techniques the sandbox mapped. Highlighted ones are rare in normal software; the others are common in legitimate programs too.
- T1027· Obfuscated code
- T1027.002· Obfuscated code
- T1033· Reads user info
- T1055· Process injection
- T1071· Application protocol
- T1082· System recon
- T1090
- T1573
- T1574· Execution hijack
Observed activity
Processes started
2Programs the file ran, with their command lines.
VisoDyneBatteryMonitorSetup-win64.exe"C:\Users\<USER>\Desktop\VisoDyneBatteryMonitorSetup-win64.exe"VisoDyneBatteryMonitorSetup-win64.exe"C:\Users\user\Desktop\VisoDyneBatteryMonitorSetup-win64.exe"
Network contacts
66 hosts, listed as 6 addresses. Links show the host and path only.
- IP address
172.67.142.41 - IP address
185.199.109.133 - IP address
140.82.114.3 - IP address
185.199.108.133 - IP address
150.171.28.11 - IP address
104.21.94.251
Sandbox background — not the file
7The analysis machine's own processes and connections, recorded in every run.
- VM process
services.exeC:\Windows\system32\services.exe - VM process
svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -p - VM process
svchost.exeC:\Windows\system32\svchost.exe -k UnistackSvcGroup - VM process
svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc - VM process
svchost.exeC:\Windows\system32\svchost.exe -k LocalService -s W32Time - VM process
lsass.exeC:\Windows\system32\lsass.exe
Show all 7 entries for sandbox background — not the file
- VM process
svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s WdiSystemHost
Chapter 04
Technical details
None of the 58 antivirus engines that checked it flag it; a signature that did not verify.
Sources checked
Every check behind this verdict
6 sources checked · 5 complete · 1 partial. Complete means the check returned a usable result; it does not mean the file is safe.
File fingerprint
- Last analyzed
- Aug 26, 2026, 2:36 PM UTC
- SHA-256
021f74327711787660f267ad5610813013f2095f80628f012a4d96dd79b25f10- SHA-1
f435637dec12a7f7c57c47101e116fdaf684450a- MD5
c4c67554a680c73fbe80669d70173634
About this file
newhv.exe is a Win32 EXE file of 6.7 MB.
- Type and size
- Win32 EXE · 6.7 MB
- Signer
- VisoDyne (unverified signature)Worth noting: Malware sometimes copies or steals a company's signature, so this does not mean that company made it.
- First seen
- Aug 22, 2026On VirusTotal.
- Submitted by
- 2 distinct sourcesRarely seen: few people have submitted this exact file.
- Packer
- None detected
- Entropy
- 7.68 of 8
First scanned Updated
Verdict history
- Suspicious
- Low Riskafter a re-check of the saved evidence
Ratings change when antivirus engines, our checks or MalwareTips staff learn more about a file.
Antivirus consensus
0 of 58 engines flagged this file
17 of the 75 engines returned no result for this file (file type not supported, or the scan did not finish), so they did not check it.
- Tier-19 engines0flagged
- Tier-233 engines0flagged
- Low-trust16 engines0flagged
View all 75 engine results
- AcronisClean
- AhnLab-V3Clean
- AlibabaClean
- alibabacloudClean
- ALYacClean
- Antiy-AVLClean
- APEXClean
- ArcabitClean
- AvastNo result
- Avast-MobileNo result
- AVGNo result
- AviraClean
- BitDefenderNo result
- BitDefenderFalxNo result
- BkavClean
- CAT-QuickHealClean
- ClamAVClean
- CMCClean
- CrowdStrikeClean
- CTXClean
- CylanceClean
- CynetClean
- DeepInstinctClean
- DrWebClean
- ElasticClean
- EmsisoftNo result
- ESET-NOD32No result
- F-SecureClean
- FortinetClean
- GDataClean
- GoogleClean
- GridinsoftClean
- huorongClean
- IkarusNo result
- JiangminClean
- K7AntiVirusClean
- K7GWClean
- KasperskyNo result
- KingsoftClean
- LionicClean
- MalwarebytesClean
- MaxSecureClean
- McAfeeDClean
- MicrosoftClean
- MicroWorld-eScanClean
- NANO-AntivirusClean
- PaloaltoClean
- PandaNo result
- RisingNo result
- SangforClean
- SentinelOneClean
- SkyhighNo result
- SophosClean
- SUPERAntiSpywareClean
- SymantecClean
- SymantecMobileInsightNo result
- TACHYONClean
- tehtrisClean
- TencentClean
- TrapmineClean
- TrellixENSNo result
- TrendMicroClean
- TrendMicro-HouseCallNo result
- TrustlookNo result
- VaristClean
- VBA32Clean
- VIPREClean
- VirITClean
- ViRobotClean
- WebrootClean
- XcitiumClean
- YandexClean
- ZillyaNo result
- ZoneAlarmClean
- ZonerClean
Signatures and behavior heuristics
Low-severity pattern matches — worth noting but not on their own cause for alarm.
VirusTotal's sandbox summary maps this run to MITRE T1055 (Process Injection), but no injected process of the sample's own was recorded (the analysis VM's own WMI adapter, crash handlers and Chrome updater are not counted). VirusTotal maps T1055 on about half of all files no engine flags, so the mapping alone is not evidence of injection.
EvidenceT1055 (sandbox MITRE mapping)
Section entropy & packers
No high-entropy executable section or known packer signature was detected. Data and resource sections can still have high entropy without indicating packed code.
How widely this file has been seen
Rarely uploaded, and first seen more than two weeks ago. Often niche legitimate software or internal tooling; not a strong malware signal on its own.
Chapter 05
Questions & answers
Short answers to the 6 questions people ask most about this file.
Is newhv.exe safe?
What is newhv.exe?
How many antivirus engines detected newhv.exe?
Is newhv.exe digitally signed?
What is the SHA-256 hash of newhv.exe?
How up to date is this analysis of newhv.exe?
Community
Member reviews and reports for this exact file hash.